Fitbit Aria Wi-Fi Smart Scale - Versionsgeschichte

Krisha am 15. März 2014 um 01:55 Uhr

2014-03-15T01:55:53Z

← Nächstältere Version		Version vom 15. März 2014, 01:55 Uhr
Zeile 85:		Zeile 85:
	== Own tools ==		== Own tools ==
	/* to be crafted */		/* to be crafted */

			== attacks ==
			During our analysis we found some vulnerabilities. We contacted fitbit via mail, twitter and phone, but we never got an acknowledgement nor an answer - even after calling the german represantive of fitbit, who forwarded our research to the management. Since some time past since that and hopefully they fixed the issues here are our theoretical attacks.

			=== fatify local target ===

			It's quite easy to change the values of a local user. If you have access to the local network you can sniff the packets send to the fitbit servers (tcpdump, ethereal). As soon as you have the sniffed data, you can just resent the packet with custom weight and fat measurements. It might be that fitibit limits the number of measures and that the weight of a target needs to be within some limits/average values (e.g. no one will increase weight by 5kg in some hours only).

			=== fatify the world ===

			We did not test it, but probably it's possible to increase the weight for all fitbit users worldwide. The scale authenticates with the server using the MAC (which just increments). Additionally there is a user ID with some bits. These can be tested by bruteforce but might take some time. The fitbit server also replies to guests (value 0) and gives out the complete userlist with the user ID in response. If you now take the user ID and create custom requests you should be able to submit new weights for all fitbit users - worldwide :)

Advi am 27. Mai 2013 um 19:35 Uhr

2013-05-27T19:35:53Z

← Nächstältere Version		Version vom 27. Mai 2013, 19:35 Uhr
Zeile 4:		Zeile 4:
	\|status = beta		\|status = beta
	\|autor = [[Benutzer:architekt\|architekt]], [[Benutzer:krisha\|krisha]]		\|autor = [[Benutzer:architekt\|architekt]], [[Benutzer:krisha\|krisha]]
	\|beschreibung = Reverse engineering the ~~fitbit aria wlan~~ scale protocol		\|beschreibung = Reverse engineering the Fitbit Aria WLAN scale protocol
	\|image = Fitbit cat img.jpg		\|image = Fitbit cat img.jpg
	\|imagesize = 280		\|imagesize = 280

Advi: Sprachlich aufgeräumt, Überschriften kapitalisiert

2013-05-27T19:32:33Z

Sprachlich aufgeräumt, Überschriften kapitalisiert

← Nächstältere Version		Version vom 27. Mai 2013, 19:32 Uhr
Zeile 11:		Zeile 11:
	[[Category:Software]]		[[Category:Software]]

	== ~~description~~ ==		== Description ==
	=== ~~the scale~~ ===		=== The Scale ===
	The scale offered by [http://fitbit.com Fitbit] measures weight and body fat. The data is then submitted to their website and can be further analysed. It is possible to use one scale for multiple users including different accounts on Fitbit website. The scale identifies the users by their weight and maybe by their body fat.		The scale offered by [http://fitbit.com Fitbit] measures weight and body fat. The data is then submitted to their website and can be further analysed. It is possible to use one scale for multiple users including different accounts on Fitbit's website. The scale identifies the users by their weight and maybe their body fat.

	=== ~~the master plan~~ ===		=== The Master Plan ===
	We want to create an own service to analyse the data ~~in our own way~~. With that we're able to bypass limits and to extend the functionality. We ~~are maybe~~ able to allow more users and to identify the users in a better way. Additionally the data is not ~~transmitted any more unencrypted~~ to a public website. One main interest is also the ~~reversing~~ of the protocol and maybe more...		We want to create our own service to analyse the data ourselves. With that we're able to bypass existing limits and to extend the functionality. We may be able to allow more users and to identify the users in a better way. Additionally the data is not send to a public website vie unencrypted transmission anymore. One main interest is also the reverse-engineering of the protocol and maybe more...

	== ~~analysis~~ ==		== Analysis ==
	=== ~~request~~ ===		=== Request ===
	* The data is transmitted with HTTP POST to http://www.fitbit.com/scale/upload		* The data is transmitted with HTTP POST to http://www.fitbit.com/scale/upload.
	* It usually consists of 62 bytes of binary data in little endian format		* It usually consists of 62 bytes of binary data in little endian format.
	** In case there is no connection, the data is stored inside the scale and transmitted later		** In case there is no connection, the data is stored inside the scale and transmitted later.
	0 4 8 C		0 4 8 C
	+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+		+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+
Zeile 42:		Zeile 42:
	* The covariance is also displayed inside the HTML code if you login to your account.		* The covariance is also displayed inside the HTML code if you login to your account.

	=== ~~response~~ ===		=== Response ===
	==== ~~header~~ ====		==== Header ====

	0 4 8		0 4 8
Zeile 51:		Zeile 51:
	+----+----+----+----+----+----+----+----+----+----+		+----+----+----+----+----+----+----+----+----+----+

	==== ~~user data~~ ====		==== User Data ====
	0 4 8 C		0 4 8 C
	+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+		+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+
Zeile 70:		Zeile 70:
	+----+----+----+----+----+----+----+----+----+----+----+----+----+		+----+----+----+----+----+----+----+----+----+----+----+----+----+

	==== ~~padding~~ ====		==== Padding ====
	0 4 8		0 4 8
	+----+----+----+----+----+----+----+----+		+----+----+----+----+----+----+----+----+
Zeile 77:		Zeile 77:
	+----+----+----+----+----+----+----+----+		+----+----+----+----+----+----+----+----+

	==== ~~explanation~~ ====		==== Explanation ====
	* Unit: 00 ~~Pfund~~, 01 Stone, 02 Kilo		* Unit: 00 Pound, 01 Stone, 02 Kilo
	* Status: 0x32 configured, 0x64 unconfigured, no users (yet)		* Status: 0x32 configured, 0x64 unconfigured, no users (yet)
	* Tolerance max/min: last weight +/- 4kg (in our tests); used by scale to recognize users		* Tolerance max/min: last weight +/- 4kg (in our tests); used by scale to recognize users
	* Gender: 02 male, 00 female		* Gender: 02 male, 00 female

	== ~~own~~ tools ==		== Own tools ==
	/* to be crafted */		/* to be crafted */

Architekt: /* explanation */ explanation for status

2013-04-26T20:18:53Z

explanation: explanation for status

← Nächstältere Version		Version vom 26. April 2013, 20:18 Uhr
Zeile 79:		Zeile 79:
	==== explanation ====		==== explanation ====
	* Unit: 00 Pfund, 01 Stone, 02 Kilo		* Unit: 00 Pfund, 01 Stone, 02 Kilo
	* (0)~~: seems to be always 32~~		* Status: 0x32 configured, 0x64 unconfigured, no users (yet)
	* Tolerance max/min: last weight +/- 4kg (in our tests); used by scale to recognize users		* Tolerance max/min: last weight +/- 4kg (in our tests); used by scale to recognize users
	* Gender: 02 male, 00 female		* Gender: 02 male, 00 female

Architekt: /* header */ unknown byte is status

2013-04-26T20:16:36Z

header: unknown byte is status

← Nächstältere Version		Version vom 26. April 2013, 20:16 Uhr
Zeile 43:		Zeile 43:

	=== response ===		=== response ===
	==== header ====		==== header ====

	0 4 8		0 4 8
	+----+----+----+----+----+----+----+----+----+----+		+----+----+----+----+----+----+----+----+----+----+
	\| Timestamp \|Unit\|~~???~~ \| Number of users \|		\| Timestamp \|Unit\|Stat\| Number of users \|
	\| \| \|~~(0)~~ \| \|		\| \| \| us \| \|
	+----+----+----+----+----+----+----+----+----+----+		+----+----+----+----+----+----+----+----+----+----+

Krisha: fit to project page

2012-12-05T11:13:07Z

fit to project page

← Nächstältere Version		Version vom 5. Dezember 2012, 11:13 Uhr
Zeile 1:		Zeile 1:
	{{Infobox Projekt		{{Infobox Projekt
	\|name = Fitbit Aria Wi-Fi ~~Smart~~ Scale		\|name = Fitbit Aria Wi-Fi Scale
	\|kategorie =		\|kategorie =
	\|status = beta		\|status = beta

Krisha: /* explanation */

2012-12-05T08:28:02Z

explanation

← Nächstältere Version		Version vom 5. Dezember 2012, 08:28 Uhr
Zeile 81:		Zeile 81:
	* (0): seems to be always 32		* (0): seems to be always 32
	* Tolerance max/min: last weight +/- 4kg (in our tests); used by scale to recognize users		* Tolerance max/min: last weight +/- 4kg (in our tests); used by scale to recognize users
	* Gender: 02: male, 00: female		* Gender: 02 male, 00 female

	== own tools ==		== own tools ==
	/* to be crafted */		/* to be crafted */

Krisha: /* explanation */ removed some spaces

2012-12-05T08:27:45Z

explanation: removed some spaces

← Nächstältere Version		Version vom 5. Dezember 2012, 08:27 Uhr
Zeile 78:		Zeile 78:

	==== explanation ====		==== explanation ====
	* Unit : 00: Pfund, 01: Stone, 02: Kilo		* Unit: 00 Pfund, 01 Stone, 02 Kilo
	* (0) : seems to be always 32		* (0): seems to be always 32
	* Tolerance max/min: last weight +/- 4kg (in our tests); used by scale to recognize users		* Tolerance max/min: last weight +/- 4kg (in our tests); used by scale to recognize users
	* Gender : 02: male, 00: female		* Gender: 02: male, 00: female

	== own tools ==		== own tools ==
	/* to be crafted */		/* to be crafted */

Architekt: + field names italic in explanation, link to fitbit

2012-11-29T19:34:07Z

+ field names italic in explanation, link to fitbit

← Nächstältere Version		Version vom 29. November 2012, 19:34 Uhr
Zeile 13:		Zeile 13:
	== description ==		== description ==
	=== the scale ===		=== the scale ===
	The scale offered by fitbit.com measures weight and body fat. The data is then submitted to their website and can be further analysed. It is possible to use one scale for multiple users including different accounts on ~~fitbit.com~~ website. The scale identifies the users by their weight and maybe by their body fat.		The scale offered by [http://fitbit.com Fitbit] measures weight and body fat. The data is then submitted to their website and can be further analysed. It is possible to use one scale for multiple users including different accounts on Fitbit website. The scale identifies the users by their weight and maybe by their body fat.

	=== the master plan ===		=== the master plan ===
Zeile 39:		Zeile 39:


	* For guests "users id", "displayed body fat", "covariance" and "body fat 2" are set to 0.		* For guests ''users id'', ''displayed body fat'', ''covariance'' and ''body fat 2'' are set to 0.
	* The covariance is also displayed inside the HTML code if you login to your account.		* The covariance is also displayed inside the HTML code if you login to your account.

Krisha: /* request */ removed small categroy

2012-11-29T19:23:46Z

request: removed small categroy

← Nächstältere Version		Version vom 29. November 2012, 19:23 Uhr
Zeile 38:		Zeile 38:
	+----+----+----+----+----+----+----+----+----+----+----+----+----+----+		+----+----+----+----+----+----+----+----+----+----+----+----+----+----+

	~~==== explanation ====~~
	* For guests "users id", "displayed body fat", "covariance" and "body fat 2" are set to 0.		* For guests "users id", "displayed body fat", "covariance" and "body fat 2" are set to 0.
	* The covariance is also displayed inside the HTML code if you login to your account.		* The covariance is also displayed inside the HTML code if you login to your account.