Breaking Fitness Records Without Moving: Reverse Engineering and Spoofing Fitbit

Conference paper
Part of the Lecture Notes in Computer Science book series (LNCS, volume 10453)


Tens of millions of wearable fitness trackers are shipped yearly to consumers who routinely collect information about their exercising patterns. Smartphones push this health-related data to vendors’ cloud platforms, enabling users to analyze summary statistics on-line and adjust their habits. Third-parties including health insurance providers now offer discounts and financial rewards in exchange for such private information and evidence of healthy lifestyles. Given the associated monetary value, the authenticity and correctness of the activity data collected becomes imperative. In this paper, we provide an in-depth security analysis of the operation of fitness trackers commercialized by Fitbit, the wearables market leader. We reveal an intricate security through obscurity approach implemented by the user activity synchronization protocol running on the devices we analyze. Although non-trivial to interpret, we reverse engineer the message semantics, demonstrate how falsified user activity reports can be injected, and argue that based on our discoveries, such attacks can be performed at scale to obtain financial gains. We further document a hardware attack vector that enables circumvention of the end-to-end protocol encryption present in the latest Fitbit firmware, leading to the spoofing of valid encrypted fitness data. Finally, we give guidelines for avoiding similar vulnerabilities in future system designs.


Fitness trackers Reverse engineering Spoofing Fitbit 



Hossein Fereidooni is supported by the Deutsche Akademische Austauschdienst (DAAD). Mauro Conti is supported by the EU TagItSmart! Project (agreement H2020-ICT30-2015-688061) and IT-CNR/Taiwan-MOST 2016-17 “Verifiable Data Structure Streaming”. This work has been co-funded by the DFG as part of projects S1 and S2 within the CRC 1119 CROSSING, and by the BMBF within CRISP. Paul Patras has been partially supported by the Scottish Informatics and Computer Science Alliance (SICSA) through a PECE grant.

We thank the Fitbit Security Team for their professional collaboration with us, and their availability to discuss our findings and address the vulnerabilities we identified.

Supplementary material

440190_1_En_3_MOESM1_ESM.txt (1 kb)
Supplementary material 1 (txt 1 KB)


  1. 1.
    Forbes. Wearable tech market to be worth $34 billion by 2020, February 2016.
  2. 2.
    International Data Corporation. Worldwide quarterly wearable device tracker, March 2017.
  3. 3.
    Mashable. Husband learns wife is pregnant from her Fitbit data, February 2016.
  4. 4.
    The Wall Street Journal. Prosecutors say Fitbit device exposed fibbing in rape case, April 2016.
  5. 5.
    The Guardian. Court sets legal precedent with evidence from Fitbit health tracker, November 2014.
  6. 6.
  7. 7.
  8. 8.
  9. 9.
    Rahman, M., Carbunar, B., Banik, M.: Fit and vulnerable: attacks and defenses for a health monitoring device. In: Proceedings of the Privacy Enhancing Technologies Symposium (PETS), Bloomington, IN, USA (2013)Google Scholar
  10. 10.
    Cyr, B., Horn, W., Miao, D., Specter, M.: Security Analysis of Wearable Fitness Devices (Fitbit) (2014).
  11. 11.
    Clausing, E., Schiefer, M., Morgenstern, M.: AV TEST Analysis of Fitbit Vulnerabilities (2016).
  12. 12.
    Schellevis, M., Jacobs, B., Meijer, C.: Security/privacy of wearable fitness tracking IoT devices. Radboud niversity. Bachelor thesis: Getting access to your own Fitbit data, August 2016Google Scholar
  13. 13.
    Accenture. Digital trust in the IoT era (2015)Google Scholar
  14. 14.
  15. 15.
    Fereidooni, H., Frassetto, T., Miettinen, M., Sadeghi, A.-R., Conti, M.: Fitness Trackers: Fit for health but unfit for security and privacy. In: Proceedings of the IEEE International Workshop on Safe, Energy-Aware, & Reliable Connected Health (CHASE workshop: SEARCH 2017), in press, Philadelphia, Pennsylvania, USA, July 17–19 (2017)Google Scholar
  16. 16.
  17. 17.
    Wireshark network protocol analyzer.
  18. 18.
    Hilts, A., Parsons, C., Knockel, J.: Every Step You Fake: A Comparative Analysis of Fitness Tracker Privacy and Security. Open Effect Report (2016).
  19. 19.
    Clausing, E., Schiefer, M., Morgenstern, M.: Internet of Things: Security Evaluation of nine Fitness Trackers. AV TEST, The Independent IT-Security institute, Magdeburg, Germany (2015)Google Scholar
  20. 20.
    Zhou, W., Piramuthu, S.: Security/privacy of wearable fitness tracking IoT devices. In: IEEE Iberian Conference on Information Systems and Technologies (2014)Google Scholar
  21. 21.
    Rahman, M., Carbunar, B., Topkara, U.: Secure management of low power fitness trackers. Published IEEE Trans. Mob. Comput. 15(2), 447–459 (2016)CrossRefGoogle Scholar

Copyright information

© Springer International Publishing AG 2017

Authors and Affiliations

  1. 1.University of PaduaPaduaItaly
  2. 2.Technische Universität DarmstadtDarmstadtGermany
  3. 3.University of EdinburghEdinburghUK

Personalised recommendations