Can your smartwatch get hacked? Study shows what information is at risk

Smartwatches might be good for tracking steps and heart rates, but they can also offer hackers a wealth of personal information to exploit, according to a new Charles Darwin University (CDU) study.

The paper, "Vulnerability Analysis and Exploitation Attacks on Smart Wearable Devices" was published as part of the 2024 2nd International Conference on Advancement in Computation & Computer Technologies (InCACCT).

Researchers in the study hacked into a variety of smart wearable devices, valued between $25 and $150, to understand the vulnerabilities of this technology and what information can be accessed and exploited.

These devices allow people to track their health, monitor their fitness, conduct medical tests and more, but often use Bluetooth Low Energy (BLE) technology, which sacrifices security for low energy consumption.

Study supervisor Dr. Bharanidharan Shanmugan, who is a Lecturer in Information Technology at CDU's Faculty of Science and Technology, said researchers were able to connect to the devices and gain access to data and had the ability to manipulate it.

"We could bring a pulse down or up, we could see where a person has gone, where they've spent time and other medical readings like heartbeat, blood pressure and ECG readings," Dr. Shanmugan said.

"This data can be pushed to medical companies, used for targeted marketing, or can be used to develop a profile on a user."

Dr. Shanmugan said given the rising popularity of smart wearable BLE devices, manufacturers needed to make it a priority to implement robust security mechanisms.

"The assertion that smartwatch makers are not taking security seriously is a significant concern," Dr. Shanmugan said.

"If this trend persists, it could lead to a cascade of negative consequences for both individuals and society. Potential consequences are increased identity theft and financial loss, as any breach could expose personally identifiable information to cybercriminals, leading to identity theft, financial fraud and unauthorized access.

"There's health data violation. If the data fall into wrong hands, it could be used for blackmail or even physical harm, especially for elders, and there's corporate espionage. Compromised devices can allow competitors or cybercriminals to steal valuable intellectual property. A massive volume of lawsuits stemming from these incidents could potentially bankrupt the company."

The study was conducted with Christ Academy Institute for Advanced Studies in Bengaluru, India.