Fitbit Aria Wi-Fi Smart Scale: Unterschied zwischen den Versionen

Version vom 29. November 2012, 20:22 Uhr

Fitbit Aria Wi-Fi Smart Scale Status: beta

Beschreibung	Reverse engineering the fitbit aria wlan scale protocol
Autor:	architekt, krisha

PayPal

description

the scale

The scale offered by fitbit.com measures weight and body fat. The data is then submitted to their website and can be further analysed. It is possible to use one scale for multiple users including different accounts on fitbit.com website. The scale identifies the users by their weight and maybe by their body fat.

the master plan

We want to create an own service to analyse the data in our own way. With that we're able to bypass limits and to extend the functionality. We are maybe able to allow more users and to identify the users in a better way. Additionally the data is not transmitted any more unencrypted to a public website. One main interest is also the reversing of the protocol and maybe more...

analysis

request

The data is transmitted with HTTP POST to http://www.fitbit.com/scale/upload
It usually consists of 62 bytes of binary data in little endian format
- In case there is no connection, the data is stored inside the scale and transmitted later

0                   4                   8                   C
+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+
|      Ident 1      |       Battery     |     MAC Address of scale    | Firmware>
|     fixed (2)     |     in percent    | 00   1D   C9   XX   XX   XX |  e.g.   >
+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+
> version |      unknown      |     Timestamp     | Number of measure-| Ident   >
>   28    |     fixed (33)    |     Sync; Unix    |   ments (here 1)  | fixed   >
+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+
>         |  Elec. impedance  |   Weight in g     |  Timestamp Meas-  |   User  >
>  (2)    |   0 for guests    |                   |   urement; Unix   |  0 for  >
+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+
>  ID     |  Displayed body   |    Covariance     |    Body fat 2     |
> guests  |   fat, per mil    |     as float      |                   |
+----+----+----+----+----+----+----+----+----+----+----+----+----+----+

explanation

For guests "users id", "displayed body fat", "covariance" and "body fat 2" are set to 0.
The covariance is also displayed inside the HTML code if you login to your account.

response

header

0                   4                   8
+----+----+----+----+----+----+----+----+----+----+
|     Timestamp     |Unit|??? |  Number of users  |
|                   |    |(0) |                   |
+----+----+----+----+----+----+----+----+----+----+

user data

0                   4                   8                   C
+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+
|      User ID      |                     Always zero                           > 
|                   |                  (maybe reserved)                         >
+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+
>                   |          Name of user, only first three bytes used, rest  >
>                   |                                                           >
+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+
>   is filled with spaces               |    Tolerance min  |   Tolerance max   |
>                                       |                   |                   |
+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+
|   Age in years    |Gen |     Height in     |    Some weight    |    Body Fat  >
|                   |der |    millimeters    |       or 0        |              >
+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+
>    |   Covariance (?)  |     Some other    |     Timestamp     |
>    |  1040128544 or 0  |       weight      |                   |
+----+----+----+----+----+----+----+----+----+----+----+----+----+

padding

0                   4                   8
+----+----+----+----+----+----+----+----+
|         Padding, always zero          |
|                                       |
+----+----+----+----+----+----+----+----+

explanation

Unit : 00: Pfund, 01: Stone, 02: Kilo
(0) : seems to be always 32
Tolerance max/min: last weight +/- 4kg (in our tests); used by scale to recognize users
Gender : 02: male, 00: female

own tools

/* to be crafted */

@@ Zeile 11: / Zeile 11: @@
 [[Category:Software]]
-== description==
+== description ==
 === the scale ===
 The scale offered by fitbit.com measures weight and body fat. The data is then submitted to their website and can be further analysed. It is possible to use one scale for multiple users including different accounts on fitbit.com website. The scale identifies the users by their weight and maybe by their body fat.
-===the master plan===
+=== the master plan ===
-We want to create an own service to analyse the data in our own way. With that we're able to bypass limits and to extend the functionality. We are maybe able to allow more users and are able to identify the users in a better way. Additionally the data is not transmitted any more unencrypted to a public website (fitbit.com is password protected). One main interest is also the reversing of the protocol and maybe more...
+We want to create an own service to analyse the data in our own way. With that we're able to bypass limits and to extend the functionality. We are maybe able to allow more users and to identify the users in a better way. Additionally the data is not transmitted any more unencrypted to a public website. One main interest is also the reversing of the protocol and maybe more...
 == analysis ==
 === request ===
 * The data is transmitted with HTTP POST to http://www.fitbit.com/scale/upload
-* Usually it consists of 62 bytes of binary data in little endian format
+* It usually consists of 62 bytes of binary data in little endian format
-** In case there is no connection, the data is stored inside the scale and transmitted in a bulk when it is used next time
+** In case there is no connection, the data is stored inside the scale and transmitted later
-              4                   8              0xC
+                  4                   8                   C
-  +---+---+---+---+---+---+---+---+   +---+---+---+---+---+---+---+---+
+  +----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+
-  |    Ident 1    |    ??? (1)    |   |          MAC          |  ???  >
+  |      Ident 1      |       Battery     |     MAC Address of scale    | Firmware>
-  | 02  00  00  00| 5C  00  00  00|   | 00  1D  C9  XX  XX  XX| 1C  00>
+  |     fixed (2)     |     in percent    | 00   1D   C9   XX   XX   XX |  e.g.   >
-  +---+---+---+---+---+---+---+---+   +---+---+---+---+---+---+---+---+
+  +----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+
-  >  (2)  |    ??? (3)    |    Timestamp 2    |   ??? (4)     | Ident >
+  > version |      unknown      |     Timestamp     | Number of measure-| Ident   >
-  > 00  00| 21  00  00  00| 30  4D      90  50| 01  00  00  00| 02  00>
+  >   28    |     fixed (33)    |     Sync; Unix    |   ments (here 1)  | fixed   >
-  +---+---+---+---+---+---+---+---+   +---+---+---+---+---+---+---+---+
+  +----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+
-  >  2    |    ??? (5)    |    Weight in g    |  Timestamp 1  | User  >
+  >         |  Elec. impedance  |   Weight in g     |  Timestamp Meas-  |   User  >
-  > 00  00| 00  00  00  00| 06  FE      00  00| 1C  4D  90  50| 00  00>
+  >  (2)    |   0 for guests    |                   |   urement; Unix   |  0 for  >
-  +---+---+---+---+---+---+---+---+   +---+---+---+---+---+---+---+---+
+  +----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+
-  >  ID   |  Body fat 1   |    Body fat 2     |  Body fat 3   |
+  >  ID     |  Displayed body   |    Covariance     |    Body fat 2     |
-  > 00  00| 00  00  00  00| 00  00      00  00| 00  00  00  00|
+  > guests  |   fat, per mil    |     as float      |                   |
-  +---+---+---+---+---+---+---+---+   +---+---+---+---+---+---+
+  +----+----+----+----+----+----+----+----+----+----+----+----+----+----+
 ==== explanation ====
-* Ident 1: Seems to be always 2
+* For guests "users id", "displayed body fat", "covariance" and "body fat 2" are set to 0.
-* (1): Values: 0x5C, 0x5B, 0x4F, might be indication for errornous syncs
+* The covariance is also displayed inside the HTML code if you login to your account.
-* (2): Values: 0x1C, 0x1D
-* (3): Unknown, might saw 0x11 and 0x21
-* Timestamp 2: Measurement end in unix time
-* (4): Unknown (fixed?)
-* Ident 2: Unknown (fixed?)
-* (5): Values 0x00, 0x66
-* Weight in g: self-explanatory
-* Timestamp 1: Measurement start in unix time
-* User ID: 0x00 for guest, values for registered users: 0x0011yyyy
-* Body fat 1: Displayed body fat in per mil
-* Body fat 2: Maybe physical measurement value (resistance, electrical impedance). For registered users this has always a value.  For guests this is 0x0.
-* Body fat 3: Value similiar to Body fat 1
 === response ===
 ==== header ====
-              4                   8
-  +---+---+---+---+---+---+---+---+   +---+---+
+                  4                   8
-  |  Timestamp    |  ???  |  Number of users  |
+  +----+----+----+----+----+----+----+----+----+----+
-  |               |       |                   |
+  |     Timestamp     |Unit|??? |  Number of users  |
-  +---+---+---+---+---+---+---+---+   +---+---+
+  |                   |    |(0) |                   |
+  +----+----+----+----+----+----+----+----+----+----+
 ==== user data ====
-              4                   8               12
+                  4                   8                   C
-  +---+---+---+---+---+---+---+---+   +---+---+---+---+---+---+---+---+
+  +----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+
-  |    User Id    |                    Always zero                    >
+  |      User ID      |                     Always zero                           >
-  | XX  XX  YY  YY|                                                   >
+  |                   |                  (maybe reserved)                         >
-  +---+---+---+---+---+---+---+---+   +---+---+---+---+---+---+---+---+
+  +----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+
-  >               | Name of user (only first three bytes used, rest   >
+  >                   |          Name of user, only first three bytes used, rest  >
-  >               |                                                   >
+  >                   |                                                           >
-  +---+---+---+---+---+---+---+---+   +---+---+---+---+---+---+---+---+
+  +----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+
-  > is filled with spaces)        |   |      ???      |      ???      |
+  >   is filled with spaces               |    Tolerance min  |   Tolerance max   |
-  >                               |   |    58950      |               |
+  >                                       |                   |                   |
-  +---+---+---+---+---+---+---+---+   +---+---+---+---+---+---+---+---+
+  +----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+
-  | Age in years  |Sex|      Height in -  |  Weight in g  |  Body Fat >
+  |   Age in years    |Gen |     Height in     |    Some weight    |    Body Fat  >
-  |               |   |    millimeters    |               |           >
+  |                   |der |    millimeters    |       or 0        |              >
-  +---+---+---+---+---+---+---+---+   +---+---+---+---+---+---+---+---+
+  +----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+
-  >   |      ???      | ??|  Some weight  |  Timestamp    |
+  >    |   Covariance (?)  |     Some other    |     Timestamp     |
-  >   |1040128544 or 0|   |               |               |
+  >    |  1040128544 or 0  |       weight      |                   |
-  +---+---+---+---+---+---+---+---+   +---+---+---+---+---+
+  +----+----+----+----+----+----+----+----+----+----+----+----+----+
 ==== padding ====
-              4               8
+                  4                   8
-  +---+---+---+---+---+---+---+---+
+  +----+----+----+----+----+----+----+----+
-  |            Padding            |
+  |         Padding, always zero          |
-  |                               |
+  |                                       |
-  +---+---+---+---+---+---+---+---+
+  +----+----+----+----+----+----+----+----+
 ==== explanation ====
+* Unit             : 00: Pfund, 01: Stone, 02: Kilo
+* (0)              : seems to be always 32
+* Tolerance max/min: last weight +/- 4kg (in our tests); used by scale to recognize users
+* Gender           : 02: male, 00: female
 == own tools ==
 /* to be crafted */
-== attacks ==
-===gather information===
-/* MAC - what is it, what's the idea to use it */
-First results showed that... /* continue with dumping DB */. This is a base attack used later again.
-===fatify local target===
-Das geht relativ einfach: Mit tcpdump oder Wireshark die Daten eines Ziels nach der Messung mitschneiden. Da meistens WPA im WLAN zum Einsatz kommt, empfiehlt es sich hier am Router oder danach die Daten mitzusniffen. Anschließend einfach den Request klonen und ein eigenes Gewicht oder Körperfett einsetzen. Es kann sein, dass fitbit die Anzahl der Messungen beschränkt und das Gewicht der Person in einem gewissen Limit (Durschschnitt) liegen muss.
-===fatify the world===
-In der Theorie ist es möglich alle fitbit User etwas schwerer zu machen. Die Waage authentifiziert sich mit der MAC Adresse, zusätzlich gibt es eine xx Bit Userkennung. Die MAC Adresse (Herstellerkennung + Wert) kann man per Brute-Force testen, die Benutzerkennung macht den Aufwand aufgrund der vielen Bits aber sehr langwierig. Da der fitbit Server allerdings auch auf Gäste antwortet und zwar mit der kompletten Userliste inkl. der Benutzerkennung, kann man einfach einen Request als Gast (Wert 0) absetzen. Als Antwort schickt der Server die Kennungen zurück und man kann sich seine eigenen Requests zusammensetzen - für alle fitbit User weltweit ;-)

Fitbit Aria Wi-Fi Smart Scale: Unterschied zwischen den Versionen

Version vom 29. November 2012, 20:22 Uhr

Inhaltsverzeichnis

description

the scale

the master plan

analysis

request

explanation

response

header

user data

padding

explanation

own tools

Social Media

Spenden

Der Verein

Sonstiges

Anschrift