对健身追踪器的攻击再访：不合适固件安全性的案例研究
Attacks on Fitness Trackers Revisited: A Case-Study of Unfit Firmware Security
摘要：
健身追踪器-可持续记录穿戴者步数和相关活动数据的可穿戴设备-正在迅速流行。除了对寻求更健康生活方式的个人有用外，他们的数据也被用于法庭和保险公司调整保费。对于这些用例，确保数据的真实性和完整性至关重要。在这里，我们展示了Withings' Activité固件验证方式的缺陷，允许对手破坏跟踪器本身。到目前为止，这种类型的攻击还没有应用于健身追踪器。供应商已经开始减轻以前的攻击，这些攻击通过干扰无线信道或通过物理移动跟踪器来欺骗传感器来操纵数据。不同跟踪器之间的硬件相似性表明，发现也可以转移到其他跟踪器。
英文摘要：
Fitness trackers - wearables that continuously record a wearer's step count and related activity data - are quickly gaining in popularity. Apart from being useful for individuals seeking a more healthy lifestyle, their data is also being used in court and by insurance companies to adjust premiums. For these use cases, it is essential to ensure authenticity and integrity of data. Here we demonstrate a flaw in the way firmware for Withings' Activité is verified, allowing an adversary to compromise the tracker itself. This type of attack has so far not been applied to fitness trackers. Vendors have started mitigating previous attacks, which manipulated data by interfering with wireless channels, or by physically moving the tracker to fool sensors. Hardware similarities amongst different trackers suggest findings can be transferred to other tracker as well.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
