  Tens of millions of wearable fitness trackers are shipped yearly to consumers
who routinely collect information about their exercising patterns. Smartphones
push this health-related data to vendors' cloud platforms, enabling users to
analyze summary statistics on-line and adjust their habits. Third-parties
including health insurance providers now offer discounts and financial rewards
in exchange for such private information and evidence of healthy lifestyles.
Given the associated monetary value, the authenticity and correctness of the
activity data collected becomes imperative. In this paper, we provide an
in-depth security analysis of the operation of fitness trackers commercialized
by Fitbit, the wearables market leader. We reveal an intricate security through
obscurity approach implemented by the user activity synchronization protocol
running on the devices we analyze. Although non-trivial to interpret, we
reverse engineer the message semantics, demonstrate how falsified user activity
reports can be injected, and argue that based on our discoveries, such attacks
can be performed at scale to obtain financial gains. We further document a
hardware attack vector that enables circumvention of the end-to-end protocol
encryption present in the latest Fitbit firmware, leading to the spoofing of
valid encrypted fitness data. Finally, we give guidelines for avoiding similar
vulnerabilities in future system designs.
