Fitbit Aria Wi-Fi Smart Scale: Unterschied zwischen den Versionen

Aktuelle Version vom 15. März 2014, 02:55 Uhr

Fitbit Aria Wi-Fi Scale Status: beta

Beschreibung	Reverse engineering the Fitbit Aria WLAN scale protocol
Autor:	architekt, krisha

PayPal

Description

The Scale

The scale offered by Fitbit measures weight and body fat. The data is then submitted to their website and can be further analysed. It is possible to use one scale for multiple users including different accounts on Fitbit's website. The scale identifies the users by their weight and maybe their body fat.

The Master Plan

We want to create our own service to analyse the data ourselves. With that we're able to bypass existing limits and to extend the functionality. We may be able to allow more users and to identify the users in a better way. Additionally the data is not send to a public website vie unencrypted transmission anymore. One main interest is also the reverse-engineering of the protocol and maybe more...

Analysis

Request

The data is transmitted with HTTP POST to http://www.fitbit.com/scale/upload.
It usually consists of 62 bytes of binary data in little endian format.
- In case there is no connection, the data is stored inside the scale and transmitted later.

0                   4                   8                   C
+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+
|      Ident 1      |       Battery     |     MAC Address of scale    | Firmware>
|     fixed (2)     |     in percent    | 00   1D   C9   XX   XX   XX |  e.g.   >
+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+
> version |      unknown      |     Timestamp     | Number of measure-| Ident   >
>   28    |     fixed (33)    |     Sync; Unix    |   ments (here 1)  | fixed   >
+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+
>         |  Elec. impedance  |   Weight in g     |  Timestamp Meas-  |   User  >
>  (2)    |   0 for guests    |                   |   urement; Unix   |  0 for  >
+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+
>  ID     |  Displayed body   |    Covariance     |    Body fat 2     |
> guests  |   fat, per mil    |     as float      |                   |
+----+----+----+----+----+----+----+----+----+----+----+----+----+----+

For guests users id, displayed body fat, covariance and body fat 2 are set to 0.
The covariance is also displayed inside the HTML code if you login to your account.

Response

Header

0                   4                   8                                                    
+----+----+----+----+----+----+----+----+----+----+                                          
|     Timestamp     |Unit|Stat|  Number of users  |                                          
|                   |    | us |                   |                                          
+----+----+----+----+----+----+----+----+----+----+

User Data

0                   4                   8                   C
+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+
|      User ID      |                     Always zero                           > 
|                   |                  (maybe reserved)                         >
+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+
>                   |          Name of user, only first three bytes used, rest  >
>                   |                                                           >
+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+
>   is filled with spaces               |    Tolerance min  |   Tolerance max   |
>                                       |                   |                   |
+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+
|   Age in years    |Gen |     Height in     |    Some weight    |    Body Fat  >
|                   |der |    millimeters    |       or 0        |              >
+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+
>    |   Covariance (?)  |     Some other    |     Timestamp     |
>    |  1040128544 or 0  |       weight      |                   |
+----+----+----+----+----+----+----+----+----+----+----+----+----+

Padding

0                   4                   8
+----+----+----+----+----+----+----+----+
|         Padding, always zero          |
|                                       |
+----+----+----+----+----+----+----+----+

Explanation

Unit: 00 Pound, 01 Stone, 02 Kilo
Status: 0x32 configured, 0x64 unconfigured, no users (yet)
Tolerance max/min: last weight +/- 4kg (in our tests); used by scale to recognize users
Gender: 02 male, 00 female

Own tools

/* to be crafted */

attacks

During our analysis we found some vulnerabilities. We contacted fitbit via mail, twitter and phone, but we never got an acknowledgement nor an answer - even after calling the german represantive of fitbit, who forwarded our research to the management. Since some time past since that and hopefully they fixed the issues here are our theoretical attacks.

fatify local target

It's quite easy to change the values of a local user. If you have access to the local network you can sniff the packets send to the fitbit servers (tcpdump, ethereal). As soon as you have the sniffed data, you can just resent the packet with custom weight and fat measurements. It might be that fitibit limits the number of measures and that the weight of a target needs to be within some limits/average values (e.g. no one will increase weight by 5kg in some hours only).

fatify the world

We did not test it, but probably it's possible to increase the weight for all fitbit users worldwide. The scale authenticates with the server using the MAC (which just increments). Additionally there is a user ID with some bits. These can be tested by bruteforce but might take some time. The fitbit server also replies to guests (value 0) and gives out the complete userlist with the user ID in response. If you now take the user ID and create custom requests you should be able to submit new weights for all fitbit users - worldwide :)

@@ Zeile 1: / Zeile 1: @@
 {{Infobox Projekt
-|name            = fitbit WLAN Waage
+|name            = Fitbit Aria Wi-Fi Scale
 |kategorie       =
 |status          = beta
 |autor           = [[Benutzer:architekt|architekt]], [[Benutzer:krisha|krisha]]
-|beschreibung    = fitbit WLAN Waage Reverse Engineering
+|beschreibung    = Reverse engineering the Fitbit Aria WLAN scale protocol
 |image           = Fitbit cat img.jpg
 |imagesize       = 280
@@ Zeile 11: / Zeile 11: @@
 [[Category:Software]]
-== Beschreibung ==
+== Description ==
-=== Waage ===
+=== The Scale ===
-Die WLAN Waage von fitbit.com misst Gewicht und Körperfett. Es können Accounts angelegt werden und die Daten über deren Webseite abgerufen werden. Die Daten werden nach jeder Messung über WLAN zu fitbit.com gesendet. Die Nutzer werden anhand von Gewicht und eventuell Körperfett identifiziert.
+The scale offered by [http://fitbit.com Fitbit] measures weight and body fat. The data is then submitted to their website and can be further analysed. It is possible to use one scale for multiple users including different accounts on Fitbit's website. The scale identifies the users by their weight and maybe their body fat.
-===Der Plan===
+=== The Master Plan ===
-Wir wollen einen eigenen Server für die Waage bereit stellen, um so die Daten nach belieben auszuwerten und eventuelle Beschränkungen der Waage zu umgehen und zu erweitern. So können wir mehrere Benutzer erlauben und die Daten z.B. über eine eigenes Webinterface korrigieren (Nutzer-Zuordnung). Außerdem werden dann die persönlichen Daten nicht mehr ins Internet geschickt. Interesse bestand weiterhin an dem Analysieren der gesendeten Daten... :)
+We want to create our own service to analyse the data ourselves. With that we're able to bypass existing limits and to extend the functionality. We may be able to allow more users and to identify the users in a better way. Additionally the data is not send to a public website vie unencrypted transmission anymore. One main interest is also the reverse-engineering of the protocol and maybe more...
-== Analyse ==
+== Analysis ==
-=== Schritte ===
+=== Request ===
-/* TODO */
+* The data is transmitted with HTTP POST to http://www.fitbit.com/scale/upload.
-=== Dumps ===
+* It usually consists of 62 bytes of binary data in little endian format.
-/* TODO */
+** In case there is no connection, the data is stored inside the scale and transmitted later.
-=== Ergebnisse ===
+                   4                   8                   C
-/* TODO */
+ +----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+
+ |      Ident 1      |       Battery     |     MAC Address of scale    | Firmware>
+ |     fixed (2)     |     in percent    | 00   1D   C9   XX   XX   XX |  e.g.   >
+ +----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+
+ > version |      unknown      |     Timestamp     | Number of measure-| Ident   >
+ >   28    |     fixed (33)    |     Sync; Unix    |   ments (here 1)  | fixed   >
+ +----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+
+ >         |  Elec. impedance  |   Weight in g     |  Timestamp Meas-  |   User  >
+ >  (2)    |   0 for guests    |                   |   urement; Unix   |  0 for  >
+ +----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+
+ >  ID     |  Displayed body   |    Covariance     |    Body fat 2     |
+ > guests  |   fat, per mil    |     as float      |                   |
+ +----+----+----+----+----+----+----+----+----+----+----+----+----+----+
+* For guests ''users id'', ''displayed body fat'', ''covariance'' and ''body fat 2'' are set to 0.
+* The covariance is also displayed inside the HTML code if you login to your account.
+=== Response ===
+==== Header ====
+                   4                   8
+ +----+----+----+----+----+----+----+----+----+----+
+ |     Timestamp     |Unit|Stat|  Number of users  |
+ |                   |    | us |                   |
+ +----+----+----+----+----+----+----+----+----+----+
+==== User Data ====
+                   4                   8                   C
+ +----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+
+ |      User ID      |                     Always zero                           >
+ |                   |                  (maybe reserved)                         >
+ +----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+
+ >                   |          Name of user, only first three bytes used, rest  >
+ >                   |                                                           >
+ +----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+
+ >   is filled with spaces               |    Tolerance min  |   Tolerance max   |
+ >                                       |                   |                   |
+ +----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+
+ |   Age in years    |Gen |     Height in     |    Some weight    |    Body Fat  >
+ |                   |der |    millimeters    |       or 0        |              >
+ +----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+
+ >    |   Covariance (?)  |     Some other    |     Timestamp     |
+ >    |  1040128544 or 0  |       weight      |                   |
+ +----+----+----+----+----+----+----+----+----+----+----+----+----+
+==== Padding ====
+                   4                   8
+ +----+----+----+----+----+----+----+----+
+ |         Padding, always zero          |
+ |                                       |
+ +----+----+----+----+----+----+----+----+
+==== Explanation ====
+* Unit: 00 Pound, 01 Stone, 02 Kilo
+* Status: 0x32 configured, 0x64 unconfigured, no users (yet)
+* Tolerance max/min: last weight +/- 4kg (in our tests); used by scale to recognize users
+* Gender: 02 male, 00 female
 == Own tools ==
 /* to be crafted */
-== Attacks ==
+== attacks ==
-===Fatify local target===
+During our analysis we found some vulnerabilities. We contacted fitbit via mail, twitter and phone, but we never got an acknowledgement nor an answer - even after calling the german represantive of fitbit, who forwarded our research to the management. Since some time past since that and hopefully they fixed the issues here are our theoretical attacks.
-Das geht relativ einfach: Mit tcpdump oder Wireshark die Daten eines Ziels nach der Messung mitschneiden. Da meistens WPA im WLAN zum Einsatz kommt, empfiehlt es sich hier am Router oder danach die Daten mitzusniffen. Anschließend einfach den Request klonen und ein eigenes Gewicht oder Körperfett einsetzen. Es kann sein, dass fitbit die Anzahl der Messungen beschränkt und das Gewicht der Person in einem gewissen Limit liegen muss.
-===Fatify the world===
+=== fatify local target ===
-In der Theorie ist es möglich alle fitbit User etwas schwerer zu machen. Die Waage authentifiziert sich mit der MAC Adresse, zusätzlich gibt es eine xx Bit Userkennung. Die MAC Adresse (Herstellerkennung + Wert) kann per Brute-Force testen, die Benutzerkennung macht den Aufwand aufgrund der vielen Bits aber sehr langwierig. Da der fitbit Server allerdings auch auf Gäste antwortet und zwar mit der kompletten Userliste inkl. der Benutzerkennung, kann man einfach einen Request als Gast (Wert 0) absetzen. Als Antwort schickt der Server die Kennungen zurück und man kann sich seine eigenen Request zusammensetzen, für alle fitbit User zusammenstellen ;-)
+It's quite easy to change the values of a local user. If you have access to the local network you can sniff the packets send to the fitbit servers (tcpdump, ethereal). As soon as you have the sniffed data, you can just resent the packet with custom weight and fat measurements. It might be that fitibit limits the number of measures and that the weight of a target needs to be within some limits/average values (e.g. no one will increase weight by 5kg in some hours only).
+=== fatify the world ===
+We did not test it, but probably it's possible to increase the weight for all fitbit users worldwide. The scale authenticates with the server using the MAC (which just increments). Additionally there is a user ID with some bits. These can be tested by bruteforce but might take some time. The fitbit server also replies to guests (value 0) and gives out the complete userlist with the user ID in response. If you now take the user ID and create custom requests you should be able to submit new weights for all fitbit users - worldwide :)