Fitbit Spyware Steals Personal Data Via Watch Face
upstart writes in with an IRC submission:
Fitbit Spyware Steals Personal Data via Watch Face:
A wide-open app-building API would allow an attacker to build a malicious application that could access Fitbit user data, and send it to any server.
Kev Breen, director of cyber threat research for Immersive Labs, created a proof-of-concept for just that scenario, after realizing that Fitbit devices are loaded with sensitive personal data.
"Essentially, [the developer API] could send device type, location and user information including gender, age, height, heart rate and weight," Breen explained. "It could also access calendar information. While this doesn't include PII profile data, the calendar invites could expose additional information such as names and locations."
Since all of this information is available via the Fitbit application developer API, it was a simple process to create an application to carry out the attack. Breen's efforts resulted in a malicious watch face, which he was then able to make available through the Fitbit Gallery (where Fitbit showcases various third-party and in-house apps). Thus, the spyware appears legitimate, and increases the likelihood it would be downloaded.
[...] After contacting Fitbit about the issues, Breen said the company was responsive and vowed to make the necessary changes to mitigate future breaches.
"The trust of our customers is paramount, and we are committed to protecting consumer privacy and keeping data safe," Fitbit told Threatpost, in a statement. "We responded immediately when contacted by this researcher and worked quickly and collaboratively to address the concerns they raised. We are not aware of any actual compromise of user data."
Read more of this story at SoylentNews.