{"id":6685,"date":"2016-01-26T07:37:12","date_gmt":"2016-01-26T12:37:12","guid":{"rendered":"https:\/\/kasperskydaily.com\/uk\/?p=6685"},"modified":"2019-11-22T10:11:41","modified_gmt":"2019-11-22T10:11:41","slug":"smart-watch-nightmare","status":"publish","type":"post","link":"https:\/\/www.kaspersky.co.uk\/blog\/smart-watch-nightmare\/6685\/","title":{"rendered":"When smart watches become a living nightmare"},"content":{"rendered":"<p>Nowadays, it seems like every company is producing their own smartwatch. They can do everything from tracking your heart rate to making phone calls and *shock* tell you the\u00a0time. But did you know that they can also be used to recognize what you are typing?<\/p>\n<p><i>Ok, that\u2019s new.<\/i><\/p>\n<p>Wearable devices like fitness trackers and smartwatches have <a href=\"https:\/\/www.kaspersky.com\/blog\/fitness-trackers-privacy\/6480\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">raised security concerns<\/a> from their inception. This is primarily due to the data that they collected and transfer to the cloud could end up in the wrong hands or sold to the highest bidder.<\/p>\n<p>Fitness tracker vendors are trying their best to convince users that their <a href=\"https:\/\/www.fitbit.com\/privacy\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">data is secure<\/a>, but at the same time they <a href=\"http:\/\/www.cio.com\/article\/2377723\/it-strategy\/pros-and-cons-of-using-fitness-trackers-for-employee-wellness.html\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">sell smart bracelets en-masse to corporate clients<\/a>. But how can corporations use fitness trackers? A good example is they can use these wearables to track their employees\u2019 health, which is definitely not the way the private data should be treated. It turns out that this issue probably in not the worst part of the fitness trackers and smartwatches question.<\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">Your fitness is their business. Nothing personal \u2013  <a href=\"https:\/\/t.co\/82w3NuTWxl\" target=\"_blank\" rel=\"noopener nofollow\">https:\/\/t.co\/82w3NuTWxl<\/a> via <a href=\"https:\/\/twitter.com\/kaspersky?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">@kaspersky<\/a> <a href=\"https:\/\/twitter.com\/hashtag\/security?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#security<\/a><\/p>\n<p>\u2014 Kaspersky (@kaspersky) <a href=\"https:\/\/twitter.com\/kaspersky\/status\/527931777881751552?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">October 30, 2014<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>When Roman Unuchek at Kaspersky Lab found out that it\u2019s very <a href=\"https:\/\/securelist.com\/blog\/research\/69369\/how-i-hacked-my-smart-bracelet\/\" target=\"_blank\" rel=\"noopener noreferrer\">easy to connect a smartphone to practically any fitness tracker<\/a>, which is already connected to another device, he concluded his research with a relatively positive note:<\/p>\n<p><em>\u201cBy hacking the bracelet I have, the fraudster cannot get access to all user data as this is not stored on the wristband or in the phone \u2014 the official application regularly transfers information from the wristband to the cloud.\u201d<\/em><\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">Kaspersky Lab Expert: How I Hacked my Smart Bracelet <a href=\"http:\/\/t.co\/0DNsNeLKRP\" target=\"_blank\" rel=\"noopener nofollow\">http:\/\/t.co\/0DNsNeLKRP<\/a> via <a href=\"https:\/\/twitter.com\/Securelist?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">@Securelist<\/a>  <a href=\"https:\/\/twitter.com\/hashtag\/wearables?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#wearables<\/a> <a href=\"https:\/\/twitter.com\/hashtag\/security?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#security<\/a> <a href=\"http:\/\/t.co\/DCcZHtFqPO\" target=\"_blank\" rel=\"noopener nofollow\">pic.twitter.com\/DCcZHtFqPO<\/a><\/p>\n<p>\u2014 Kaspersky (@kaspersky) <a href=\"https:\/\/twitter.com\/kaspersky\/status\/581108650745454592?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">March 26, 2015<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>Later Tony Beltramelli, a student at IT University of Copenhagen, <a href=\"http:\/\/gizmodo.com\/your-smartwatchs-motion-sensors-can-reveal-everything-y-1750442236\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">has shown<\/a> that the fraudster does not need this data to harm the wearable device\u2019s owner. In his <a href=\"http:\/\/arxiv.org\/abs\/1512.05616\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">master\u2019s thesis project<\/a>, he demonstrated that after obtaining access to a smartwatch, one can track it\u2019s owner\u2019s gestures and reverse-engineer them into symbols they type on a numeric keypad.<\/p>\n<p>What the researcher is actually relying on is the fact that every user has their own unique style of typing. Researchers had once suggested that this fact can be used to enhance security: in order to get access to something you need not only to type in the password, but to do it the certain manner \u2014 with the pattern of keystrokes the owner of the device is used to.<\/p>\n<p>In his experiment Beltramelli used an Android Wear-based Sony Smartwatch 3, a handmade numeral pad and a piece of code with some limited artificial intelligence capabilities. His software was aware of his own unique typing pattern and thus, using the data from the motion sensors built-in to the smartwatch, was able to convert these data into the digits he actually typed, hitting over 60% accuracy.<\/p>\n<p><span class=\"embed-youtube\" style=\"text-align:center; display: block;\"><iframe class=\"youtube-player\" type=\"text\/html\" width=\"640\" height=\"390\" src=\"https:\/\/www.youtube.com\/embed\/ZBwSfvnoq5U?version=3&amp;rel=1&amp;fs=1&amp;showsearch=0&amp;showinfo=1&amp;iv_load_policy=1&amp;wmode=transparent\" frameborder=\"0\" allowfullscreen=\"true\"><\/iframe><\/span><\/p>\n<p>Ok, someone can use a hacked smartwatch to learn what we type on a numpad. Now what?<\/p>\n<p>Technically\u2026 <i>A lot of bad things could happen.<\/i><\/p>\n<p>This numpad could have been a PIN-pad on an ATM or in the card reader device in a shop, and now the adversary knows the PIN code of your credit card. Or the numpad could have been your phone\u2019s lock screen \u2014 once the malefactor gets his hands on your phone, he can easily get all the information including your contacts, messages, banking account data and so on, because now he knows your PIN-code.<\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\"><a href=\"https:\/\/twitter.com\/hashtag\/Google?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#Google<\/a> Patches Latest <a href=\"https:\/\/twitter.com\/hashtag\/Android?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#Android<\/a> Lockscreen Bypass via <a href=\"https:\/\/twitter.com\/threatpost?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">@threatpost<\/a> <a href=\"https:\/\/t.co\/XqLsWIWRXd\" target=\"_blank\" rel=\"noopener nofollow\">https:\/\/t.co\/XqLsWIWRXd<\/a> <a href=\"https:\/\/twitter.com\/hashtag\/mobile?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#mobile<\/a> <a href=\"http:\/\/t.co\/7ioP8J3Rdz\" target=\"_blank\" rel=\"noopener nofollow\">pic.twitter.com\/7ioP8J3Rdz<\/a><\/p>\n<p>\u2014 Kaspersky (@kaspersky) <a href=\"https:\/\/twitter.com\/kaspersky\/status\/644214636997406720?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">September 16, 2015<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>Moreover, if someone can make the software to recognize the digits on the numpad, they can probably improve it and make it to distinguish the letters on a common computer keyboard. If that happens, the adversary could be able to track whatever you type, making all of your correspondence insecure. Well, since you have only one smartwatch, only one of your hands can be traced, but half of the letters you typed in could be enough to comprehend what exactly you were typing.<\/p>\n<p>We don\u2019t have any proof that threats like this may be already in the wild, but believe us, you surely wouldn\u2019t like to encounter one of them if or when it turns out that they actually exist \u2013 in this case there is only one way to protect yourself. You have to be sure that no malware is installed on your smartwatch.<\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">Kaspersky Lab, <a href=\"https:\/\/twitter.com\/WISeKey?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">@WISeKey<\/a> partner to increase <a href=\"https:\/\/twitter.com\/hashtag\/security?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#security<\/a> for connected wearables <a href=\"https:\/\/twitter.com\/hashtag\/IoT?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#IoT<\/a> <a href=\"https:\/\/twitter.com\/hashtag\/infosec?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#infosec<\/a> <a href=\"https:\/\/t.co\/ECsrrkS1pA\" target=\"_blank\" rel=\"noopener nofollow\">https:\/\/t.co\/ECsrrkS1pA<\/a> <a href=\"https:\/\/t.co\/KsMRplc0GV\" target=\"_blank\" rel=\"noopener nofollow\">pic.twitter.com\/KsMRplc0GV<\/a><\/p>\n<p>\u2014 Kaspersky (@kaspersky) <a href=\"https:\/\/twitter.com\/kaspersky\/status\/687669691687563265?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">January 14, 2016<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>There are two things you can do to increase your wearable\u2019s security.<\/p>\n<p>1. Download your apps only from official stores like Apple App Store, Google Play or Amazon Appstore. Apps from these markets are not 100 % fail-safe, but at least they get checked by shop representatives and there is some filtration system \u2014 not every app can get into these stores.<\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">Allegedly 40 apps on App Store are infected <a href=\"https:\/\/t.co\/UTSGwvWccj\" target=\"_blank\" rel=\"noopener nofollow\">https:\/\/t.co\/UTSGwvWccj<\/a> <a href=\"https:\/\/twitter.com\/hashtag\/apple?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#apple<\/a> <a href=\"http:\/\/t.co\/moLosQwB9V\" target=\"_blank\" rel=\"noopener nofollow\">pic.twitter.com\/moLosQwB9V<\/a><\/p>\n<p>\u2014 Kaspersky (@kaspersky) <a href=\"https:\/\/twitter.com\/kaspersky\/status\/646689631333949440?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">September 23, 2015<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>2. Use a proper security solution. Since all the apps that get to your watch are first downloaded to your phone, they are automatically checked if you have <a href=\"http:\/\/app.appsflyer.com\/com.kms.free?pid=smm&amp;c=kd-com\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">Kaspersky Internet Security for Android<\/a> Premium installed.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Researcher shows that using data from motion sensors built into a smartwatch one can recognize numbers you press on a numerical pad. How can that affect your security?<\/p>\n","protected":false},"author":696,"featured_media":6686,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[2026],"tags":[105,1207,1276,770,3840,1277,187,877,709,97,1275,1274],"class_list":{"0":"post-6685","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-threats","8":"tag-android","9":"tag-communications","10":"tag-fitness-bands","11":"tag-iot","12":"tag-kaspersky-for-android","13":"tag-keyloggers","14":"tag-passwords","15":"tag-private-data","16":"tag-research","17":"tag-security-2","18":"tag-smartwatches","19":"tag-wearables"},"hreflang":[{"hreflang":"en-gb","url":"https:\/\/www.kaspersky.co.uk\/blog\/smart-watch-nightmare\/6685\/"},{"hreflang":"en-ae","url":"https:\/\/me-en.kaspersky.com\/blog\/smart-watch-nightmare\/5300\/"},{"hreflang":"ar","url":"https:\/\/me.kaspersky.com\/blog\/smart-watch-nightmare\/3687\/"},{"hreflang":"en-us","url":"https:\/\/usa.kaspersky.com\/blog\/smart-watch-nightmare\/6593\/"},{"hreflang":"es-mx","url":"https:\/\/latam.kaspersky.com\/blog\/smart-watch-nightmare\/6566\/"},{"hreflang":"es","url":"https:\/\/www.kaspersky.es\/blog\/smart-watch-nightmare\/7575\/"},{"hreflang":"it","url":"https:\/\/www.kaspersky.it\/blog\/smart-watch-nightmare\/7319\/"},{"hreflang":"ru","url":"https:\/\/www.kaspersky.ru\/blog\/smart-watch-nightmare\/10620\/"},{"hreflang":"x-default","url":"https:\/\/www.kaspersky.com\/blog\/smart-watch-nightmare\/11144\/"},{"hreflang":"pt-br","url":"https:\/\/www.kaspersky.com.br\/blog\/smart-watch-nightmare\/6038\/"},{"hreflang":"de","url":"https:\/\/www.kaspersky.de\/blog\/smart-watch-nightmare\/6817\/"},{"hreflang":"ja","url":"https:\/\/blog.kaspersky.co.jp\/smart-watch-nightmare\/10185\/"},{"hreflang":"ru-kz","url":"https:\/\/blog.kaspersky.kz\/smart-watch-nightmare\/10620\/"},{"hreflang":"en-au","url":"https:\/\/www.kaspersky.com.au\/blog\/smart-watch-nightmare\/11144\/"},{"hreflang":"en-za","url":"https:\/\/www.kaspersky.co.za\/blog\/smart-watch-nightmare\/11144\/"}],"acf":[],"banners":"","maintag":{"url":"https:\/\/www.kaspersky.co.uk\/blog\/tag\/android\/","name":"Android"},"_links":{"self":[{"href":"https:\/\/www.kaspersky.co.uk\/blog\/wp-json\/wp\/v2\/posts\/6685","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.kaspersky.co.uk\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.kaspersky.co.uk\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.kaspersky.co.uk\/blog\/wp-json\/wp\/v2\/users\/696"}],"replies":[{"embeddable":true,"href":"https:\/\/www.kaspersky.co.uk\/blog\/wp-json\/wp\/v2\/comments?post=6685"}],"version-history":[{"count":2,"href":"https:\/\/www.kaspersky.co.uk\/blog\/wp-json\/wp\/v2\/posts\/6685\/revisions"}],"predecessor-version":[{"id":17804,"href":"https:\/\/www.kaspersky.co.uk\/blog\/wp-json\/wp\/v2\/posts\/6685\/revisions\/17804"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.kaspersky.co.uk\/blog\/wp-json\/wp\/v2\/media\/6686"}],"wp:attachment":[{"href":"https:\/\/www.kaspersky.co.uk\/blog\/wp-json\/wp\/v2\/media?parent=6685"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.kaspersky.co.uk\/blog\/wp-json\/wp\/v2\/categories?post=6685"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.kaspersky.co.uk\/blog\/wp-json\/wp\/v2\/tags?post=6685"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}