34C3: Fitbit Sniffing and Firmware Hacking

If you walked into a gym and asked to sniff exercise equipment you would get some mighty strange looks. If you tell hackers you’ve sniffed a Fitbit, you might be asked to give a presentation. [Jiska] and [DanielAW] were not only able to sniff Bluetooth data from a run-of-the-mill Fitbit fitness tracker, they were also able to connect to the hardware with data lines using test points etched right on the board. Their Fitbit sniffing talk at 34C3 can be seen after the break. We appreciate their warning that opening a Fitbit will undoubtedly void your warranty since Fitbits don’t fare so well after the sealed case is cracked. It’s all in the name of science.

There’s some interesting background on how Fitbit generally work. For instance, the Fitbit pairs with your phone which needs to be validated with the cloud server. But once the cloud server sends back authentication credentials they will never change because they’re bound to to the device ID of the Fitbit. This process is vulnerable to replay attacks.

Data begin sent between the Fitbit and the phone can be encrypted, but there is a live mode that sends the data as plain text. The implementation seemed to be security by obscurity as a new Bluetooth handle is used for this mode. This technique prevents the need to send every encrypted packet to the server for decryption (which would be for every heartbeat packet). So far the fix for this has been the ability to disable live mode. If you have your own Fitbit to play with, sniffing live mode would be a fun place to start.

The hardware side of this hack begins by completely removing the PCB from the rubber case. The board is running an STM32 and the team wanted to get deep access by enabling GDB. Unfortunately, the debug pins were only enabled during reset and the stock firmware disables them at startup (as it should). The workaround was to rewrite the firmware so that the necessary GPIO remain active and there’s an interesting approach here. You may remember [Daniel Wegemer] from the Nexmon project that reverse engineered the Nexus 5 WiFi. He leveraged the binary patching he used on Nexmon to patch the Fitbit firmware to enable debugging support. Sneaky!

For more about 34C3 we have a cheatsheet of the first day and for more about Fitbit security, check out this WAV file.

Continue reading “34C3: Fitbit Sniffing and Firmware Hacking”

Gamify Your Workout with this Wearable Console Controller

‘Tis soon to be the season when resolutions falter and exercise equipment purchased with the best of intentions is cast aside in frustration. But with a little motivation, like making your exercise machine a game console controller, you can maximize your exercise gear investment and get in some guilt-free gaming to boot.

Honestly, there is no better motivation for keeping up with exercise than taking classes, but not many people have the discipline — or the pocketbook — to keep going to the gym for the long haul. With this in mind, [Jason] looked for a way to control PS4  games like Mario Karts or TrackMania with his recumbent bike. In an attempt to avoid modifying the bike, [Jason] decided on a wearable motion sensor for his ankle. Consisting of an Uno, an MPU9250 accelerometer, and a transmitter for the 433-MHz ISM band, the wearable sends signals to a receiver whenever the feet are moving. This simulates pressing the up arrow controller key to set the game into action. Steering and other game actions are handled by a regular controller; we’d love to see this expanded to include strain gauges on the recumbent bike’s handles to allow left-right control by shifting weight in the seat. Talk about immersive gameplay!

While we like the simplicity of [Jason]’s build and the positive reinforcement it provides, it’s far from the first exercise machine hack we’ve seen. From making Google Street View bike-controlled to automatically logging workouts, exercise machines are ripe for the hacking.

Continue reading “Gamify Your Workout with this Wearable Console Controller”

Fitness Tracker Teardown is a Lesson In Design for Manufacture

If the trends are anything to go on, after the success of Fitbit we are nearing a sort of fitness tracker singularity. Soon there will be more fitness trackers on wrists and ankles then there will be stars in the sky. We will have entire generations who will grow up not knowing what life is like without the ever-present hug of a heart monitor strapped across their chest. Until then though, we can learn a bit of design for manufacture from this excellent teardown of a watch shaped fitness tracker.

This tracker has a nice round e-paper screen, which could be a welcome part in a project if they start washing up on the shores of eBay. The rest of the watch is a basic Bluetooth low energy module and the accessory electronics wrapped in a squishy plastic casing.

There’s a lot of nice engineering inside the watch. As far as the electronics go, it’s very low power. On top of that is plenty of clever cost optimization; from a swath of test points to reduce quality issues in the hands of consumers to the clever stamped and formed battery tabs which touch the CR2032 that powers it.

The teardown covers more details: the switch, what may be hiding behind the epoxy globs, the plastics, and more. One thing that may be of interest to those that have been following Jenny’s excellent series is the BOM cost of the device. All in all a very educational read.

All-terrain Hoverboard Junk Pile Build

If you’re anything like us, chances are pretty good you’ve got at least one underused piece of fitness gear cluttering up your place. Rather than admit defeat on that New Year’s Resolution purchase, why not harvest the guts and build an all-terrain hoverboard for a little outdoor fun?

The fitness machine in question for [MakeItExtreme]’s build was a discarded Crazy Fit vibration platform. We’re not sure we see the fitness benefits of the original machine, but there’s no doubt it yielded plenty of goodies. The motor and drive belt look stout, and the control board eventually made it into the hoverboard too. The custom steel frame was fabricated using some of [MakeItExtreme]’s DIY tools, which is what we’re used to seeing them build — check out their sand blaster and spot welder for examples. A couple of knobby tires in the center of the board let the rider balance (there’s no gyro in this version) and power is provided by a couple of 12 volt AGM batteries. Sadly, the motor was a line voltage unit, so an inverter was needed. But it was the only part that had to be purchased, making this a pretty complete junk pile build.

See the video after the break for build details and a few test rides. Looks like it can do 20 mph or so – pretty impressive.

Continue reading “All-terrain Hoverboard Junk Pile Build”

Smart Sweatbands

If you’ve ever known anyone who has to monitor their blood glucose level, you know it is annoying to have to prick your finger with a lancet to draw blood for each measurement. A new sweatband that incorporates flexible electronics can measure glucose–as well as sodium, potassium, and lactate–from your sweat, without a painful pin prick.

Continue reading “Smart Sweatbands”

Physical Fitness for the Truly Lazy

We’re going to get in shape around here, starting today. Well… in the United States, it is almost Thanksgiving, so we might as well wait until… but then it is going to be the end of the year and between Christmas, Hanukkah,  and New Year’s, we should put it off until then.

OK, we get it. There’s always some excuse. We know we should go on and do some push ups today. Of course, we are a lazy bunch, so not everyone’s going to do a full push up. Then we’ll all argue how many we actually did. If this sounds like you, maybe you need an Arduino-based project that counts proper push ups.

Continue reading “Physical Fitness for the Truly Lazy”

DIY Electrical Body Fat Analyzer

Whether you are trying to drop some fat or build some muscle, it’s important to track progress. It’s easy enough to track your weight, but weight doesn’t tell the whole story. You might be burning fat but also building muscle, which can make it appear as though you aren’t losing weight at all. A more useful number is body fat percentage. Students from Cornell have developed their own version of an electrical body fat analyzer to help track body fat percentage.

Fat free body mass contains mostly water, whereas fat contains very little water. This means that if you were to pass an electrical current through a body, the overall bioelectrical impedance will vary depending on how much fat or water there is. This isn’t a perfect system, but it can give a rough approximation in a relatively easy way.

The students’ system places an electrode on one hand and another on the opposite foot. This provides the longest electrical path possible in the human body to allow for the most accurate measurement possible. An ATMega1284P is used to generate a 50kHz square wave signal. This signal is opto-isolated for user safety. Another stage of the circuit then uses this source signal to generate a 10ua current source at 50kHz. This is passed through a human body and fed back to the microcontroller for analysis.

The voltage reading is sent to a MATLAB script via serial. The user must also enter in their weight and age. The MATLAB script uses these numbers combined with the voltage reading to estimate the body fat percentage. In order to calibrate the system, the students measured the body fat of 12 of their peers using body fat calipers. They admit that their sample size is too small. All of the sample subjects are about 21 years old and have a similar body fat percentage. This means that their system is currently very accurate for people in this range, but likely less accurate for anyone else. Continue reading “DIY Electrical Body Fat Analyzer”