Fitbit Firmware Hacking The Current State of the Heart

Daniel Wegemer presents a detailed hardware and firmware reverse engineering analysis of the Fitbit ecosystem, tracing the architectural evolution from early activity trackers (Fitbit Flex and Charge HR) to the Fitbit Ionic smartwatch. Wegemer breaks down the hardware components of each generation, contrasting the simpler Cortex-M3 ARM microcontroller and Nordic nRF BLE chip of the Flex with the multi-chip architecture of the Ionic, which incorporates a Cypress Bluetooth controller, a Broadcom processor, Wi-Fi, and NFC capabilities.

[07:26] Wegemer details the physical teardown process and hardware modification methodologies, including soldering 39 copper jumper wires onto test points of the Ionic's main PCB to monitor internal buses and tap debug interfaces. He explores firmware extraction, dumping EEPROM contents, and reverse engineering update protocols. For earlier devices like the Flex, he demonstrates remapping GPIO ports over Bluetooth commands to inject custom code and extract firmware images.

[27:38] The presentation turns to the wireless attack surface, investigating the Bluetooth Low Energy (BLE) implementation on the Fitbit Ionic. Wegemer highlights legacy diagnostic interfaces carried over from older generations and uncovers security flaws in the Ionic's Bluetooth pairing routines. Specifically, despite running Bluetooth 4.2, the Ionic enforces "Just Works" pairing without user authentication, allowing nearby attackers to sniff communications, manipulate device state, access unencrypted crash dumps, and perform sustained battery drain attacks.

(AI summary — Gemini Flash)