Hacking a Chinese Medical Device via Bluetooth

Hacking a Chinese Medical Device via Bluetooth - iHealth Nexus Pro Scale

Рет қаралды 19,227

Matt Brown

Күн бұрын

Пікірлер

@PunkrockNoir-ss2pq 3 ай бұрын

I have the Wyze version

@mattbrwn 3 ай бұрын

HOLY CRAP. just decompiled the wyze android app. There are references to ihealth and I found that same R1, R2 encryption/authentication thing. I think they are LITERALLY the same device under the hood.

@ytadmin 3 ай бұрын

@@mattbrwn Get that wyze bug bounty money!

@mattbrwn 3 ай бұрын

@@ytadmin LOL you got me excited for a second. Unfortunately, they only have one device in scope for their BB program and its not their scale. Just ordered the Wyze scale and will do a video on it 😁

@exshenanigan2333 3 ай бұрын

@@mattbrwn we have a brand called etekcity, I wouldn't be surprised if they're ALL exactly the same. I remember we used to buy LiPo chargers from China, the same exact charger, but probably I had 20 different brands. At this point, they're out of naming ideas so Amazon is full of brands like XUIKLUIFII, FAKFAKLING, BALPOVER, etc. 🤓

@gametec_live 3 ай бұрын

"do they respond to my emails about security vulnerabilities in their products, ofcourse they dont" every IOT company ever 😂

@SanityIT 3 ай бұрын

Matt Brown. 28 years in look, 48 years of experience.

@mattbrwn 3 ай бұрын

LOL I might have lied on some of that data... I also might not be 7 foot tall

@SanityIT 3 ай бұрын

@@mattbrwn Just exceptional work Matt. Very few even with 20 years of experience in engineering can explain things as you do. Just love it.

@muratkabilov 3 ай бұрын

"S" in IoT stands for Security

@MrMegaventilator 3 ай бұрын

AmoguS

@geoffwallick 3 ай бұрын

It stands for SHiot

@ColinMcCormack 3 ай бұрын

Nice one, mate. Not only did you hack it, but you opened it up so people with that device can use it without the android app. That is genuinely useful and beneficial

@voidpale 3 ай бұрын

You make such good videos, this is one of my new favorite channels. You look so genuinely stoked to be explaining what you've found and unraveled and it's definitely contagious. I get the same giddy feeling any time my digging unearths something interesting. That feeling of looking inside the black box and poking around is super unique and you capture it in all your vids. Appreciate you sharing, take care Matt

@HandFromCoffin 3 ай бұрын

IoT thing has bad security = who could have know Chinese medical health IoT thing has bad security = who could have known They should have their license reviewed/revoked for not responding the security issues. :) Love your stuff!

@pwrdwnsys 3 ай бұрын

The "S" in IoT stands for security. Great work, really interesting video.

@SlinkyD 3 ай бұрын

To get BLE logs without the errors: `logcat -d | awk '{ if ($5!="E") print }' | grep -i ble` Just the errors: `logcat -d | awk '{ if ($5=="E") print }' | grep -i ble`

@SlinkyD 3 ай бұрын

@@vextech I saw a few comments that looked like they supported it. Must be their "special" format I have no interest of researching or learning. We got standards for a reason but they wanna be a difficult kind of special cuz "bunch'o overpriced paper professionals work here & we makin $£€₿¥, so we right no matter how stupid it is".

@SlinkyD 3 ай бұрын

@@vextech The amount of paid professional programmers I know that can't make their way thru a 400 line project on git is too damn high. One got me into crypto because he was having problems compiling & configuring his mining rig. He majored in Computer Science with a minor in Mathematics. He stuck on a paycheck when he could code up one of his ideas and make a few $milli. I saw a few of his ideas done by someone else and they ran the money up like their name was Bigboy Baggit.

@I_hu85ghjo 3 ай бұрын

this man explains it so well. Learned so much in the past 3 months

@skywalker781 3 ай бұрын

Man very inspiring. But i noticed that is a bug in you decrypt script because at min 39:29 we can see body_bulding is 0.😊 Nice you are inspiring people and this kind of work is pushing companies to make better products and consumers to choose better products. Keep going.

@mattbrwn 3 ай бұрын

body_bulding = 0 yeah clearly a flawed device.

@wasabinow 2 ай бұрын

Matt, thank you for being our eyes going through the Java packets to figure out the complete protocol paths. I am now on the edge of removing SmartTrack app that connects to my BT scale! Looking forward to the next episode after the IHealth binge! 😅🎉

@frollard 3 ай бұрын

I was just at my hackerspace yesterday where our primary volunteer dev was poking through our code and noticed that a path that really doesn't matter - the edge rfid controller telling the server 'hey I saw xyz card uuid' - was unauthenticated. In theory, someone could via wifi tell the server that a card was seen. It wouldn't unlock the door, it would only log that that card's user was seen recently. ...and it was immediately patched. (the doors were one of the first things built, and by someone else...so there is some sloppy security there. the rest is encrypted.

@ApolloPwnsYou 3 ай бұрын

This is amazing Matt! I love watching your videos :)

@Vincent-db2ug 2 ай бұрын

I've been watching your video's non-stop since I discovered your channel. Very inspirational! I'm looking forward to future content. If I may ask: is there a device you'd recommend for a total beginner to get started with? I've even tried looking for purpose-built boards, but that doesn't really seem to be a thing.

@TheDanielsherer 3 ай бұрын

Incredible! Thanks, both for the video and the large amount of work that it took to reverse engineer this. Well Done!

@ConnorDuPlooy 3 ай бұрын

Super cool video! Will be sharing it with my colleagues 🎉 Ive often found that you can copy paste the jadx decompiled output to build your own client/server if for whatever reason rebuilding it in a different language would take too long.

@BobertV702 3 ай бұрын

Your videos are really interesting and informative and teach a lot about hardware hacking. The hardcoded credentials even in 2024 are a real problem... they could simply generate a hash from the name that the user creates, and then encrypt the traffic to send with the hash. By the way the 'double way' authentication is called mTLS, but I knew that it was used mainly in microservice architectures with kubernetes for example. Also, you are getting me more and more interested in actually giving a chance to Python. I really prefer to write in C, but when sending data over the network, python is less lines of code to write, and less time used overall.

@actuator 2 ай бұрын

This is a excellent video on reversing non-BT protocol level crypto via the mobile app. I was looking at a smart Bluetooth scale last year & found out it wasn't encrypting anything and sent stuff like Age, Gender, Height data in cleartext over the air

@4megii 3 ай бұрын

I don't think IoT and Health belong in the same sentence.

@TankR 2 ай бұрын

Hilariously thats what PANs are for. Personal Area Network. Literally expressly meant to centralize your 'medical' and 'personal accessories' like year buds under one relatively secure roof. Of course, even though its based on a bluetooth layer for communication, none of the companies have figured out a way to trick people into a faux walled garden of proprietary sounding software, so they just copy paste the same old BT libraries and its off to the races.... The protocols exist, they're just either bastardized or ignored because they cant squeeze a profit channel from it....

@derrekvanee4567 3 ай бұрын

Comments about Wyze, woozy, and low Energy rainbow tables have become my favorite way to wake up Mondays. *That said nearly everything just edits a git repo and book diggity Shenjhau express* 🚂 SL SL SL

@MichaelGrigoriev 2 ай бұрын

Learning a lot from these videos! They are probably using ”stroke” as a misnomer for "prime". As in R1' = enc(R1)

@asassdsdd 3 ай бұрын

Man! This is really good video!

@Marco_Ris 3 ай бұрын

Hey Matt. thank you for your effort and videos. i really like to watch them and maybe also do a little bit of iot hacking when i have some time left. when you find some vulnerabilities are they new CVEs? i mean do you then register the CVEs in your name or is that not a topic of your hacking?

@mattbrwn 3 ай бұрын

I don't think its bad for researchers to register CVEs but I personally think that system is largely broken.

@minirop 3 ай бұрын

@@mattbrwn and it's getting worse with all those script kiddies finding non-issues (like CVE-2023-34585) or those now using AI that hallucinate things.

@hedgehogform 3 ай бұрын

Keep it up!!! Love all these vids recently!!!

@DaveThompson1 3 ай бұрын

Great vid, did I spot a reference to the 1990s film Sneakers in the background on the phone at one point?

@DaKink 3 ай бұрын

Masterbuilt? I just built mine! can't wait to see that video :D

@mattbrwn 3 ай бұрын

Solid smoker, but I'm guessing the tech might have some vulns...

@zoes17 3 ай бұрын

R1_stroke likely refers to a way of writing that it's after the "encryption" round and is likely writen that way to write the " R1ʼ " or the R1 with a bar over both the R and 1 ways of writing the same thing. This is a common practice in the math/programming world for cryptography functions. The R1_stroke would then likely be named something closer to R1_prime but maybe there was a translation thing happening there or perhaps they didn't want to confuse themselves with the way a public key algorithm like RSA uses primes. Interesting video and the above are just my thoughts on something trivial in the video that ultimately doesn't matter for the reversing or security points made here.

@guusverbeek2853 3 ай бұрын

Thanks Matt, I'm curious to see if someone will create some Home Assistant integration based upon your research.

@RealBrotherGG 3 ай бұрын

LOVE YOUR VIDS MAN, REALLY GREAT STUFF

@daze8410 3 ай бұрын

another great breakdown!

@nkusters Ай бұрын

I just love this stuff. It tickles just the right spot without me having to actually spend the time myself 😅 ❤from The Netherlands.

@d3stinYwOw 3 ай бұрын

You need to buff up :D Seriously tho, great video and as always, I hope everyone learned something :) I want to do something like this myself :P Maybe some series about other side - how to design secure IoT devices?

@Tongchai-Farang 3 ай бұрын

Hi Matt, great video about reverse engineering. I wonder whether it would be possible to do the same for the Piper Security Systems which have been becoming obsolete a couple of months ago after the company decommissioned their service. I guess a lot of people (me included) would be grateful if their would be a way to run those cameras without requiring Piper servers.

@mattbrwn 3 ай бұрын

I actually LOLed at this. Can't help because of reasons... Look me up on LinkedIn and you'll see ;)

@Tongchai-Farang 3 ай бұрын

@@mattbrwn ups, I understand - actually that wouldn't be a reverse engineering as you probably have all the info needed

@threeMetreJim 3 ай бұрын

For now it's a personal data problem. If you can fake the scale, and feed erroneous data back to the app for potential use by a doctor, who then uses it for the prescribing of medication, then you have a more serious and potentially dangerous problem. It may be difficult to keep up consistent bad data for a set of scales, but not impossible. Thankfully it's not a critical to life medical device.

@mikehensley78 3 ай бұрын

Lets hack it to weigh megabytes then show, in weight, your network throughput. :)

@TESTA-CC 3 ай бұрын

Definitely Collecting Data of Average Weight, Height, Age, Ethnicity, Gender of The American Citizen.

@noxos. 3 ай бұрын

Bro, could you please try to hack an Amazon Echo show 5 2 Gen. These devices run on Android and if you could make a video how you find out what the bootloader code is or enable Adb that would be very helpful. The problem is that the Android is very locked down.

@peytonk7367 3 ай бұрын

I'd imagine that you probably didn't just sit down in a single class to learn everything you know, so how did you come to know so much? Are you self-taught or did you take a small class, and it just grew from there over time?

@Zetornator 2 ай бұрын

Did you use Google's android emulator to run the app on your machine?

@mattbrwn 2 ай бұрын

No. I was running that app on a real phone (emulator can't do BLE). Was using a program called scrcpy to view the phone on my computer.

@Zetornator 2 ай бұрын

@@mattbrwn i actually saw it a few minutes in the video when you started using the phone but for sure thank you for sharing the name of the program, you are awesome! 🙌

@Jeff-ss6qt 3 ай бұрын

Is it 'stroke' as an analogue to a line being drawn through the plaintext?

@ZombieLurker 2 ай бұрын

I have a scale that looks exactly the same, but the center piece is round instead of square and the rectangular screen is vertical instead of horizontal. Wonder if this will work on mine too. The brand is Posture.

@TankR 2 ай бұрын

Most of the time its not their product, it just has their branding on it for this market. You gotta find the factory district that made it and try to get ahold of a dev there

@replikvltyoutube3727 3 ай бұрын

Is it possible to do the same thing to a smart bracelet?

@LokiCDK 24 күн бұрын

Is the Shopify website builder the new 5-minute wordpress templates for e-commerce sites? :D Also; you just put your feet on the Internet. So, yeah, that's going to be out there forever now.

@abdulhareez1827 2 ай бұрын

Bro, how long the process of this RND. From start till end, took how many days? I just asking to see the feasible or standard timeline if this translate to the project.

@mattbrwn 2 ай бұрын

Solid 3 days of focused RE.

@philc787 3 ай бұрын

Brilliant well done

@UNcommonSenseAUS 3 ай бұрын

Here we go again !

@rmichaeldeutsch 3 ай бұрын

Is @mattbrown really 7 feet (213cm) tall?! 😲 (see 4:00 and 39:30)

@UnCoolDad 3 ай бұрын

See how the Japanese do it - Omron have app connected medical devices too. I know there are 3rd party apps (such as MedM health) which can interrogate them. But unofficially.