Anatomy of a vulnerable fitness tracking system: dissecting the fitbit cloud, app, and firmware

Jiska Classen, Daniel Wegemer, Paul Patras, Tom Spink, Matthias Hollick

Research output: Contribution to journalArticlepeer-review


Fitbit fitness trackers record sensitive personal information, including daily step counts, heart rate profiles, and locations visited. By design, these devices gather and upload activity data to a cloud service, which provides aggregate statistics to mobile app users. The same principles govern numerous other Internet-of-Things (IoT) services that target different applications. As a market leader, Fitbit has developed perhaps the most secure wearables architecture that guards communication with end-to-end encryption. In this paper, we analyze the complete Fitbit ecosystem and, despite the brand's continuous efforts to harden its products, we demonstrate a series of vulnerabilities with potentially severe implications to user privacy and device security. We employ a repertoire of techniques encompassing protocol analysis, software decompiling, and both static and dynamic embedded code analysis, to reverse engineer previously undocumented communication semantics, the official smartphone app, and the tracker firmware. Through this interplay and in-depth analysis, we reveal how attackers can exploit the Fitbit protocol to extract private information from victims without leaving a trace, and wirelessly flash malware without user consent. We demonstrate that users can tamper with both the app and firmware to selfishly manipulate records or circumvent Fitbit's walled garden business model, making the case for an independent, user-controlled, and more secure ecosystem. Finally, based on the insights gained, we make specific design recommendations that not only can mitigate the identified vulnerabilities, but are also broadly applicable to securing future wearable system architectures.
Original languageEnglish
Article number5
Number of pages24
JournalProceedings of the ACM on Interactive, Mobile, Wearable and Ubiquitous Technologies
Issue number1
Publication statusPublished - 26 Mar 2018


  • Networking
  • Privacy
  • Security
  • Wearable Computing


Dive into the research topics of 'Anatomy of a vulnerable fitness tracking system: dissecting the fitbit cloud, app, and firmware'. Together they form a unique fingerprint.

Cite this