Hello, I'm Ludovic and today I'm presenting our project "Every Byte Matters: Traffic Analysis of Bluetooth Wearable Devices".
This is joint work with Alexandre, Apostolos and Jean-Pierre, my colleagues from EPFL.
In this project, we consider wearable devices such as smartwatches, fitness trackers , sleep trackers.
Often these devices synchronize with a smartphone over a Bluetooth connection .
The data exchange is personal and sensitive: by design, these devices collect personal information
that can be sensitive in themselves or used to build a user profile.
Due to the current trend in personalized health, I suspect that tomorrow we will have
even more "medical" devices that obviously collect sensitive information.
This is why , to protect against the Bluetooth eavesdropper, the data in transit is often encrypted.
As a side note, eavesdropping on Bluetooth is not easy today, but it is becoming easier and cheaper due to advances in SDR receivers.
This is discussed in the paper.
Thus, the data should be encrypted. Yet, even encrypted data
might reveal information about the contents through a technique called "traffic analysis".
This is an illustration of traffic analysis in the case of VoIP traffic. On the x-axis is the time,
and on the y-axis is the pitch rate of the encrypted traffic which is visible on the network.
In this example, the encrypted bitrate is correlated with the plaintext voice,
and analyzing the times and sizes of packets (the network metadata) allow inferring plain text information.
These techniques have been used in many domains. They started on Tor and have expanded to Web traffic, Skype traffic, VPN traffic, IoT, smartphones, smart homes, etc.
The reason why we look at traffic analysis is that
this is a powerful attack which we should care about,
especially when the data is sensitive, and when it is not so easy to upgrade the devices and the protocol afterwards.
We don't really know what is the state of affairs for wearable devices.
Compared to the ecosystems I just mentioned, these devices often have a simpler firmware
with few capabilities. Perhaps they are easier to model, and hence attack.
But also wearable devices are power constrained and might transmit little data. If there are few
packets there's few metadata and perhaps they are naturally protected [thanks to] this fact.
Finally, most related works, consider IP or TCP packets, but there are a few specifics
to the Bluetooth stack some packets behave like IP packets, some do not.
So this is our contribution. We perform a broad analysis of the communication of wearable devices
under the lens of traffic analysis. Our goal is to understand whether
in general that encrypted traffic of wearable devices leak sensitive
information, and whether we should apply some defenses.
To answer this question we compose a test bed made of popular devices: smartwatches, step counters,
fitness trackers. Then, we collect a dataset by using the devices in the intended way.
We list user actions that can be performed on these devices, we put on the device, and we manually use them [recording Bluetooth traffic].
Then, we have a machine learning part in which we use a standard pipeline:
We extract features and train model. This is finally used to understand for which adversarial tasks
some sensitive data can be inferred. When that's the case, it's also important
to understand what features of the traffic were most important in inferring sensitive information.
Let's have a brief look at what we discover.
First, we show that the times and sizes of packets (network metadata) allow inferring
with high precision and recall the device and the user action performed on it. In this case the eavesdropper
learns that the user is measuring its heart rate on a particular smartwatch despite
the use of encryption. And we show that this holds for all the wearable devices that we studied.
Second, we focus on Wear OS and there we observe that simply opening an application on a smartwatch
triggers some communication with the smartphone. We wonder if this is sufficient to identify *which*
app is being opened and actually it is. Which means that the adversary can recognize *which* application
is being opened. This can be immediately sensitive or used for profiling.
Finally, we also recognize in-application user actions. For instance, in the case of
an application to help diabetics manage their condition, we show that [an adversary] can recognize highly
sensitive actions, such as, recording an insulin injection, which is clearly sensitive information.
Then, we have a second part [in which] we evaluate some standard defenses: padding, delaying, grouping packets.
Long story short, these defenses are expensive and not very effective.
We observe that the features depend on the attack scenario and it's unlikely
that there is a one-size-fits-all defense that would solve this problem as a whole.
To conclude, I think this is a difficult problem which is worthwhile exploring.
We still lack a good defense against traffic analysis. This is also true for other domains in which traffic analysis is applied.
For wearable devices, we highlight other strategies such as: minimizing the data exchange,
doing bulk transfers, or using a certain type of packet that is constant bit rate .
There are interesting challenges such as *where* we would implement a defense:
Within one app, it's easy [to implement] but it's unlikely to protect cross applications;
Or, we could have the OS provide some defense strategies, that apps could subscribe to.
Our hope with this project is to understand and quantify the risks, but more importantly
to better protect the next generation of wearable devices. Thank you for your attention, if you are
interested we have a 20-minute video, or you can check out our website. Thank you !