The security of seven popular fitness trackers and the Apple Watch was tested. Some trackers had issues with Bluetooth visibility, authentication, and data tampering. Pebble Time, Microsoft Band 2, and Basis Peak were among the most secure, while Striiv Fusion, Xiaomi MiBand, and Runtastic Moment Elite had the most security risks due to inconsistencies with authentication, tampering protection, and encrypted data transmission. The Apple Watch was also found to be highly secure, though some encrypted data could be accessed with additional steps.

1. created by Markus Selinger18th July 2016
Seven Fitness Wristbands and the Apple Watch in
a Security Check 2016
Fitness wristbands and smart watches are extremely popular, not only with sports fans. Health insurance companies
are now even subsidizing the purchase of a tracker or rewarding their use, as fit people cost the insurance companies
less. That is why the experts from AV-TEST examined 7 of the latest fitness wristbands under Android and the Apple
Watch in terms of their security. The result: some manufacturers are continuing to make disappointing errors.
Smart watches and fitness wristbands or trackers are popular and are even being at least recommended by health insurers
worldwide. In Europe, the legal playing field only allows the health insurance companies to subsidize the wearables. In the United
States, there are already offers of premium rebates, as long as the policyholder is able to demonstrate his or her efforts per
fitness tracker. The New York startup, Oscar Health, for example, pays policyholders one dollar per day if they reach the daily
fitness goal.
At first glance, the current and forecast sales figures for fitness trackers mostly elicit an initial "Wow!". According to IDC, in 2014
over 26 million wearables were already sold, in 2015 already more than 75 million, and in 2016 the number is expected to exceed
100 million.
Persistent high risks with fitness trackers
This test evaluated the latest and best-selling fitness wristbands, along with the Apple Watch. All wristbands operate with a
corresponding app on an Android smartphone. That is why the findings are summarized in the test for trackers and apps. The
laboratory is also making a very detailed test report available as a PDF.
The Apple Watch represents a special case: some test methods cannot be directly applied from Android to the iOS. That is why
the evaluation of the Apple Watch is found separately at the end of the article. The following products were tested:
- Basis Peak
- Microsoft Band 2
- Mobile Action Q-Band
- Pebble Time
- Runtastic Moment Elite
- Striiv Fusion
- Xiaomi MiBand
- Apple Watch (see end of article)
The experts focused on two special issues:
1. From the perspective of the private user, is the data recorded in the tracker or app secure against spying or hacking by third
parties?
2. From the perspective of health insurers or other companies, is the data in the tracker or app secure against tampering?
The first issue involves the consideration that attackers may use the data or exploit it to the user's disadvantage. It involves
private data that rightly needs to be protected. The second issue concerns health insurance companies that reward their
policyholders for reaching a fitness goal. If a fitness tracker or app can be manipulated, however, it is inevitable that this
approach will be exploited eventually.
Three test steps to risk assessment

2. The testers subjected each fitness wristband to a total of 10 testing criteria, divided up into three areas: tracker, application and
online communication. The graph on risk assessment shows the areas in which test candidates have problems and whether the
testers classify the particular criterion as a risk. The terms "fault" or "security gap" were explicitly not chosen, as there is only a
heightened or high risk of penetration in the areas evaluated, but not explicitly an open door. Nor did the testers make any further
attempt to "hack" a risk area. They simply analyzed what an attacker could do in that area and what the consequences would
be.
Tracker – connection, authentication, tampering
Visibility: All fitness trackers use Bluetooth to connect with the smartphone. Here the traditional problems were examined first.
One security aspect is invisibility for other Bluetooth devices. You can't connect to or track something that's not there. Only
during pairing should the devices be visible for a certain time. This security is only offered by the wristbands from Microsoft and
Pebble. Mobile Action claims the capability, but it is still visible.
BLE privacy: The second Bluetooth safety aspect is the function of BLE privacy, which has been a feature since Android 5.0.
With this feature, the device repeatedly generates a new MAC address for a Bluetooth connection. The actual address is never
disclosed and therefore not trackable. This technology is only used by Microsoft Band 2. None of the others know the
technology.
Ability to be found: Once a device is to be connected, technically speaking there are several options. A very secure solution is
exclusive Bluetooth pairing (i.e. the tracker only allows a connection to one known smartphone), which in the test, however, is
only used by Basis Peak and Microsoft Band 2. Pebble Time allows connections with several devices, but the user is required to
manually confirm each one; that is also secure. The Xiaomi MiBand uses a simple, yet safe method: after a successful pairing, it
is simply no longer visible and allows no more connections. Only the wristbands from Striiv, Runtastic and Mobile Action fail to
use reliable technology to also prevent connections with unknown devices.
Authentication: If a third-party smartphone successfully paired up with a tracker, on some products there is an additional safety
feature: authentication. Only three out of seven products use this secondary security threshold consistently: Basis Peak,
Microsoft Band 2, and Pebble Time. While Xiaomi does also use the technology, it is quite simple to circumvent and therefore
useless under certain circumstances. The other three products either do not offer this additional security or they implement it
inadequately.
Tamper protection: This item is just as interesting for users as it is presumably for health insurance companies or courts who
rely on the authenticity of data. That is why it was tested whether there is an integrity safeguard or access protection for the
data stored in the tracker. The protection must be configured so that it prevents access from third parties, and eliminates
tampering of data by the smartphone owner. Only the products from Basis, Microsoft, Pebble and Xiaomi offer basic protection in
this area. However the device from Xiaomi can also be fooled by weak authentication. It is possible for a third-party to make the
wristband vibrate, for example, to change alarm times, or even completely reset the tracker to factory settings.
The fitness trackers from Striiv and Mobile Action do not use any adequate and functioning authentication or any other safety
mechanisms, and are therefore vulnerable to tampering. On the Striiv Fusion, the values for body measurements of the user
could be changed to superhuman parameters. These were then used as inputs for the calculation of distance traveled and calorie
burn. On the tracker from Mobile Action, it was also possible to modify the stored user information on weight, height, step length,
etc. during the test. These values were also used directly for the calculation of calorie burn and distance traveled.
The App – safeguarding and code check
Local storage: Even if the technology of the tracker is secure, the corresponding app on the smartphone can be the weakest
link. That is why testing was conducted as to whether the apps save data accessible to other apps on the smartphone. The
security functions for non-rooted Android devices actually prevent this access. But if data is saved in the wrong place, it is
accessible to everyone. Xiaomi MiBand was the only one committing this error. It stores an extensive log file on app activity in a
completely open area. This log contains all the transmitted data, as well as user information, alias, body measurements, and
much more, which is also used for the authentication process.
Code obfuscation: During the second test, the object is to identify sloppy programming of the apps. It was checked whether
the apps use code obfuscation. This technology prevents reverse engineering and hides useful information from attackers. The
apps from Mobile Action, Pebble and Xiaomi use the technology entirely. The apps from Basis and Runtastic raised flags in this
category. They do not consistently use obfuscation – this can enable attackers. The products from Microsoft and Striiv do not
use obfuscation at all. Which means that specialists could perform an app analysis.

3. Log and debug info: An additional programming error is the output of log and debug information. Sometimes there is so much
important information in these outputs that other security mechanisms are defeated in the process. Only the app from Mobile
Action works cleanly in this category. All the other apps continue to spit out information that attackers would love to get their
hands on.
Secure online communication
The final check involved all connections established by the app. Can the communication be monitored or does it perhaps even
occur unencrypted? And if so, what is being transmitted? The good news: all connections that ought to be encrypted are
encrypted. Intercepted open HTTP connections were worthless – and therefore probably unencrypted.
Furthermore, the lab examined whether the contents of a secure connection were readable after the installation of a root
certificate. This evaluation is important, as it is a possible pathway for users to manipulate transmitted data themselves. The
products from Basis and Pebble show that security is also possible in this area. They are sufficiently protected against unwanted
access. For all other products, it was possible to monitor the secure connections and partly also to successfully tamper with
them. Thus, authentication and synchronization data were readable.
Conclusion: sports, fun – and lack of security
As already witnessed in the initial test of fitness wristbands last year, many manufacturers are also committing similar errors in
the current test. They often don't pay sufficient attention to the aspect of security. The risk assessment indicates that the
trackers from Pebble Time, Basis Peak and Microsoft Band 2 were among the most secure. They show minor errors, but on
aggregate, they offer few opportunities for attackers or tampering. After this test, the manufacturers are certain to also fix a few
of the smaller defects via a firmware update.
The fitness wristband from Mobile Action indicates multiple risk factors. It features a function that claims to the user that it is
invisible for others – but it is not. It also has deficiencies in terms of authentication and tamper protection. In the test, user data
could even be modified through the back door.
The threesome of Runtastic, Striiv and Xiaomi racked up the most risk points: 7 to 8 possible risk points out of 10. These
products can be tracked rather easily, use inconsistent or no authentication or tamper protection, the code of the apps is not
sufficiently obfuscated, and data traffic can be manipulated and monitored with root certificates. Worst of all, Xiaomi even stores
its entire data unencrypted on the smartphone. You can read more about the comprehensive security study developed by the lab
on the testing of fitness trackers in this PDF file.
The Apple Watch Put to a Security Check

4. The Apple Watch as a
fitness tracker (photo: Apple).
The Apple Watch is also used as a fitness tracker in
conjunction with an iPhone. Yet how safely does it
handle the data, or can data even be retrieved?
The test of the Apple Watch is configured essentially the
same way as the test of the Android devices. However, iOS
and Android are so different in some areas that the test of
various risk criteria could not be performed, whereas others
are not relevant for the Apple device. That is why in the
category of trackers, the lab only examined the criteria of
controlled visibility, BLE privacy and controlled connectivity.
In the area of online communication, it was examined whether
the connections are encrypted and whether the results can be
manipulated using root certificates.
Visibility per Bluetooth can be controlled by the user. Thus,
the watch cannot be constantly tracked. An interesting
element was the test for BLE privacy. In this test, the Apple
Watch was supposed to show a different MAC address each
time Bluetooth was newly activated. This makes it almost
impossible to track. In the test, this function worked
repeatedly. If airplane mode is switched on and off, however, the Apple Watch always shows its genuine MAC address to
the Bluetooth components. This should actually not be the case.
In terms of controlled connectivity, Apple uses a special theft prevention technique: If the Watch has been paired with an
account, it can only be released with great effort. A factory reset does not even help here. If a thief then sells the smart
watch, the new user could no longer pair up with his own iPhone.
In terms of connections, the Apple Watch mostly uses encrypted connections that are additionally secured. Updates,
however, only occur unencrypted via HTTP.
In connections that were encrypted, yet not further secured, the testers were able to read some of the information. There
were lines of text, for example, including the geo data of the user with his or her location – right down to the street address!
In a further step, as with Android devices, a root certificate was installed. Afterwards, many connections could be
monitored. In this manner, the user himself has more access to the data and could tamper with it.
All in all, the Apple Watch receives a high security rating. While the testers did identify certain theoretical vulnerabilities, the
time and effort required for attackers to gain access to the watch would be extremely high.

5. Security Check 2016: Seven Fitness Wristbands and the Apple Watch.


6. Fitness wristbands in a security check: Also in this year's test round, some fitness wristbands present a high safety risk. The Apple Watch is missing in the
lineup, as it was evaluated separately due to the test differences compared to Android.
Test environment: The fitness trackers were connected with the smartphone, the manufacturer apps were examined, attempts were made to fool them per test
app, and the connections were monitored with a proxy.



7. Pebble Time: This fitness wristband earned the fewest risk points in the test – which translates to high security (photo: Pebble).
Microsoft Band 2: Although the Band operates in the Android world, Microsoft makes its use quite secure (Photo: Microsoft).



8. Striiv Fusion: With 8 out of 10 risk points, the fitness wristband can be classified as unsafe (photo: Striiv).
Copyright © 2015 by AV-TEST GmbH, Klewitzstr. 7, 39112 Magdeburg, Germany
Phone +49 (0) 391 60754-60, Fax +49 (0) 391 60754-69, www.av-test.org
