The growing number of smart devices that interoperates with smartphones could leave text messages, calendar entries, biometric data, and other sensitive user information wide open to hackers, security researchers warn.
That’s because most smart watches rely on a six-digit PIN to secure information traveling to and from connected Android smartphones. With only one million possible keys securing the Bluetooth connection between the handset and the smart device, the PINs are susceptible to brute-force attacks, in which a nearby hacker attempts every possible combination until finding the right one.
Researchers from security firm Bitdefender mounted a proof-of-concept hack against a Samsung Gear Live smartwatch that was paired with a Google Nexus 4 running Android L Preview. Using readily available hacking tools, they found that the PIN obfuscating the Bluetooth connection between the two devices was easily brute forced. From that point on, they were able to monitor the information passing between the watch and the phone.
The findings aren’t particularly surprising. Six-digit PINs have always contained one million possible combinations. Security engineers have long known that’s hardly enough entropy to prevent a determined hacker from arriving at the right sequence of numbers. Still, the research is important because it comes at an important time. With the explosion of relatively new smartwatches and other wearable smart devices, the data traveling over Bluetooth connections is growing ever more sensitive. Smart device manufacturers would do well to create more secure communications channels now, before the devices become ubiquitous.
Unfortunately, some of the most obvious fixes may come at the cost of user convenience, making them a bitter pill for manufacturers to swallow. The most obvious remedy, for instance, would be to require a password be entered into a smart device before it is paired, something that users almost certainly would resent, given the limited keyboards most devices offer. Another potential remedy would be to rely on NFC to transmit a PIN code to a smartwatch during pairing, but that would likely raise the price and complexity of the devices. A third option is to augment Bluetooth encryption with a second layer of encryption that’s implemented by the app running on the phone and watch. There are almost certainly other potential fixes. Here’s hoping engineers get cracking.