Security Analysis of Wearable Smart Health Devices and Their Companion Apps

Wearable Smart Health Device (WSHD) went from being a fantasy to reality in the past few years with the drastic development in the new smart technology. Just like any other technologically developed devices, along with its positive impact on the society, WSHD comes with its own risks as well. In this paper, we focus on analyzing how WSHD can leak the personal information of end users through identification of vulnerabilities in the devices, their companion apps and their communication channels. Through the static and dynamic analysis of the companion apps, we discovered exposed security keys, authentication tokens and API endpoints that can be used to modify the data sent from the app to the cloud. We were also able to spoof Bluetooth Low Energy data packets to change the attributes on the WSHD. Our study sheds light on how severe these security risks are to the smart health device manufacturer as well as the user. To help mitigate these risks, we have proposed a few recommendations that the manufacturers and developers could follow to address the security threats in their products.