BreakMi: Reversing, Exploiting and Fixing Xiaomi Fitness Tracking Ecosystem
Xiaomi is the leading company in the fitness tracking industry. Successful attacks on its fitness tracking ecosystem would result in severe consequences, including the loss of sensitive health and personal data. Despite these relevant risks, we know very little about the security mechanisms adopted...
| Main Authors: | , , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
Ruhr-Universität Bochum
2022-06-01
|
| Series: | Transactions on Cryptographic Hardware and Embedded Systems |
| Subjects: | |
| Online Access: | https://tches.iacr.org/index.php/TCHES/article/view/9704 |
| _version_ | 1818207128591007744 |
|---|---|
| author | Marco Casagrande Eleonora Losiouk Mauro Conti Mathias Payer Daniele Antonioli |
| author_facet | Marco Casagrande Eleonora Losiouk Mauro Conti Mathias Payer Daniele Antonioli |
| author_sort | Marco Casagrande |
| collection | DOAJ |
| description |
Xiaomi is the leading company in the fitness tracking industry. Successful attacks on its fitness tracking ecosystem would result in severe consequences, including the loss of sensitive health and personal data. Despite these relevant risks, we know very little about the security mechanisms adopted by Xiaomi. In this work, we uncover them and show that they are insecure. In particular, Xiaomi protects its fitness tracking ecosystem with custom application-layer protocols spoken over insecure Bluetooth Low-Energy (BLE) connections (ignoring standard BLE security mechanisms already supported by their devices) and TLS connections. We identify severe vulnerabilities affecting such proprietary protocols, including unilateral and replayable authentication. Those issues are critical as they affect all Xiaomi trackers released since 2016 and up-to-date Xiaomi companion apps for Android and iOS. We show in practice how to exploit the identified vulnerabilities by presenting six impactful attacks. Four attacks enable to wirelessly impersonate any Xiaomi fitness tracker and companion app, man-in-the-middle (MitM) them, and eavesdrop on their communication. The other two attacks leverage a malicious Android application to remotely eavesdrop on data from a tracker and impersonate a Xiaomi fitness app. Overall, the attacks have a high impact as they can be used to exfiltrate and inject sensitive data from any Xiaomi tracker and compatible app. We propose five practical and low-overhead countermeasures to mitigate the presented vulnerabilities. Moreover, we present breakmi, a modular toolkit that we developed to automate our reverse-engineering process and attacks. breakmi understands Xiaomi application-layer proprietary protocols, reimplements Xiaomi security mechanisms, and automatically performs our attacks. We demonstrate that our toolkit can be generalized by extending it to be compatible with the Fitbit ecosystem. We will open-source breakmi.
|
| first_indexed | 2024-12-12T04:24:00Z |
| format | Article |
| id | doaj.art-c8d3963d02d24842b6a3792af2d1deeb |
| institution | Directory Open Access Journal |
| issn | 2569-2925 |
| language | English |
| last_indexed | 2024-12-12T04:24:00Z |
| publishDate | 2022-06-01 |
| publisher | Ruhr-Universität Bochum |
| record_format | Article |
| series | Transactions on Cryptographic Hardware and Embedded Systems |
| spelling | doaj.art-c8d3963d02d24842b6a3792af2d1deeb2022-12-22T00:38:15ZengRuhr-Universität BochumTransactions on Cryptographic Hardware and Embedded Systems2569-29252022-06-012022310.46586/tches.v2022.i3.330-366BreakMi: Reversing, Exploiting and Fixing Xiaomi Fitness Tracking EcosystemMarco Casagrande0Eleonora Losiouk1Mauro Conti2Mathias Payer3Daniele Antonioli4EURECOM, Sophia Antipolis, FranceUniversity of Padua, Padua, ItalyUniversity of Padua, Padua, ItalyEPFL, Lausanne, SwitzerlandEURECOM, Sophia Antipolis, France Xiaomi is the leading company in the fitness tracking industry. Successful attacks on its fitness tracking ecosystem would result in severe consequences, including the loss of sensitive health and personal data. Despite these relevant risks, we know very little about the security mechanisms adopted by Xiaomi. In this work, we uncover them and show that they are insecure. In particular, Xiaomi protects its fitness tracking ecosystem with custom application-layer protocols spoken over insecure Bluetooth Low-Energy (BLE) connections (ignoring standard BLE security mechanisms already supported by their devices) and TLS connections. We identify severe vulnerabilities affecting such proprietary protocols, including unilateral and replayable authentication. Those issues are critical as they affect all Xiaomi trackers released since 2016 and up-to-date Xiaomi companion apps for Android and iOS. We show in practice how to exploit the identified vulnerabilities by presenting six impactful attacks. Four attacks enable to wirelessly impersonate any Xiaomi fitness tracker and companion app, man-in-the-middle (MitM) them, and eavesdrop on their communication. The other two attacks leverage a malicious Android application to remotely eavesdrop on data from a tracker and impersonate a Xiaomi fitness app. Overall, the attacks have a high impact as they can be used to exfiltrate and inject sensitive data from any Xiaomi tracker and compatible app. We propose five practical and low-overhead countermeasures to mitigate the presented vulnerabilities. Moreover, we present breakmi, a modular toolkit that we developed to automate our reverse-engineering process and attacks. breakmi understands Xiaomi application-layer proprietary protocols, reimplements Xiaomi security mechanisms, and automatically performs our attacks. We demonstrate that our toolkit can be generalized by extending it to be compatible with the Fitbit ecosystem. We will open-source breakmi. https://tches.iacr.org/index.php/TCHES/article/view/9704IoTReverse EngineeringBluetooth Low EnergyFitness Tracker |
| spellingShingle | Marco Casagrande Eleonora Losiouk Mauro Conti Mathias Payer Daniele Antonioli BreakMi: Reversing, Exploiting and Fixing Xiaomi Fitness Tracking Ecosystem Transactions on Cryptographic Hardware and Embedded Systems IoT Reverse Engineering Bluetooth Low Energy Fitness Tracker |
| title | BreakMi: Reversing, Exploiting and Fixing Xiaomi Fitness Tracking Ecosystem |
| title_full | BreakMi: Reversing, Exploiting and Fixing Xiaomi Fitness Tracking Ecosystem |
| title_fullStr | BreakMi: Reversing, Exploiting and Fixing Xiaomi Fitness Tracking Ecosystem |
| title_full_unstemmed | BreakMi: Reversing, Exploiting and Fixing Xiaomi Fitness Tracking Ecosystem |
| title_short | BreakMi: Reversing, Exploiting and Fixing Xiaomi Fitness Tracking Ecosystem |
| title_sort | breakmi reversing exploiting and fixing xiaomi fitness tracking ecosystem |
| topic | IoT Reverse Engineering Bluetooth Low Energy Fitness Tracker |
| url | https://tches.iacr.org/index.php/TCHES/article/view/9704 |
| work_keys_str_mv | AT marcocasagrande breakmireversingexploitingandfixingxiaomifitnesstrackingecosystem AT eleonoralosiouk breakmireversingexploitingandfixingxiaomifitnesstrackingecosystem AT mauroconti breakmireversingexploitingandfixingxiaomifitnesstrackingecosystem AT mathiaspayer breakmireversingexploitingandfixingxiaomifitnesstrackingecosystem AT danieleantonioli breakmireversingexploitingandfixingxiaomifitnesstrackingecosystem |