4 ms·

Jailbreaking the Microsoft Fitness Band

94 points by moyix 10y ago

snuxoll 10y ago
While the title matches the article, it really isn't descriptive of the content of the article (which is all about modifying and flashing the ROM, there's no 'jailbreak' yet).
- moyix 10y ago
  He achieved full code execution on the device. You can argue that it's not a jailbreak because there wasn't much of a "jail" (checksums, rather than crypto), but I'm not sure what more you would want in terms of capabilities.
- lowtolerance 10y ago
  I disagree. The github repo he links to in this writeup contains everything necessary to install a custom firmware to the Fitness Band. He even includes the binary itself, which is probably not too smart(it would have been better to write a script to download the binary direct from MS's server). What more do you want? Cydia?
tener 10y ago
While he is able to run custom binary on the band, there doesn't seem to be any sort of crypto signatures present securing the firmware. So all you have to do is reverse engineer the binary format, change the code, update the CRCs where needed and hijack the update process. The article is well written and the feat is cool, but the device doesn't seem to be very secure to begin with.
- sliverstorm 10y ago
  It wasn't quite a developer kit, but the Band was expressly "experimental" to begin with, so I'm not surprised! I roughly their marketing pitch was roughly "we're going to put lots of sensors on you and see what happens"
- duaneb 10y ago
  Why on earth does a fitness band need security? What a waste of time and effort for everyone involved.
  - halomru 10y ago
    Not sure if you're serious? The fitness band doesn't store your SSH keys, but with a heartbeat sensor, GPS and an accelerometer it allows unprecedented insights in your daily life (your heartbeat accelerated inside the maternity ward? Just imagine the datamining possibilities). We are dealing with extremely private data here, and a consumer device should be protected accordingly.
    - slavik81 10y ago
      As long as the firmware update requires physical access to the band and the paired computer, then it is secure. If this device is insecure just because its owner can install new software onto it, then all laptops and desktops are also insecure.
      - userbinator 10y ago
        ...and that "insecurity" is a good thing, because it's insecurity that leads to freedom. Nonetheless, there are plenty of groups who want to get rid of that insecurity, which is even scarier. https://www.gnu.org/philosophy/right-to-read.en.html https://www.gnu.org/philosophy/right-to-read.en.html http://boingboing.net/2012/01/10/lockdown.html http://boingboing.net/2012/01/10/lockdown.html http://boingboing.net/2012/08/23/civilwar.html http://boingboing.net/2012/08/23/civilwar.html "Perfect security is a good idea only to those for whom freedom is worth nothing."
        johncolanduoni 10y ago
        How are Cory's predictions going? Apple dropped their TPM (without ever even using it), UEFI Secure Boot still allows you to put your own keys even on the most vertically integrated platforms (like the Surface), you can buy plenty of consumer routers that are already running DD-WRT and can be easily flashed with whatever you fancy, Nexus devices still let you unlock the bootloader, and Apple now lets you compile and run apps for your iPhone without a developer's license. Even consumer GPUs are easily programmable now. In what way have any general purpose computers become less general purpose since the hysteria about the war on general purpose computers started?
m0atz 10y ago
I thought this was an awesome article, the OP is obviously deep in the rabbit hole and his code is well written. Top job. Keep on hacking.
wmccullough 10y ago
Your comment is in line with my thoughts as well. I've come to accept that HN is slowly becoming a pit of contrarian asswipes honestly.
- nameless912 10y ago
  Well, that's kind and encouraging.
- dang 10y ago
  Please don't make this place even worse by posting unsubstantive dismissals of it. More about this here: https://news.ycombinator.com/item?id=12053739 https://news.ycombinator.com/item?id=12053739. We detached this subthread from https://news.ycombinator.com/item?id=12057792 https://news.ycombinator.com/item?id=12057792 and marked it off-topic.
deleted 10y ago
[deleted]
pedalpete 10y ago
I've got two bands (Microsoft shipped me two, charged me twice and refused to take the 2nd back - brutal customer service), I suspect the Band can be looked at as a failed experiment/product. What I'd like to see is Microsoft open-source or somehow support hacking on these devices so they can see what the small community of users does with them when given full access.

94 points by moyix 10y ago

While the title matches the article, it really isn't descriptive of the content of the article (which is all about modifying and flashing the ROM, there's no 'jailbreak' yet).

moyix 10y ago
He achieved full code execution on the device. You can argue that it's not a jailbreak because there wasn't much of a "jail" (checksums, rather than crypto), but I'm not sure what more you would want in terms of capabilities.
lowtolerance 10y ago
I disagree. The github repo he links to in this writeup contains everything necessary to install a custom firmware to the Fitness Band. He even includes the binary itself, which is probably not too smart(it would have been better to write a script to download the binary direct from MS's server). What more do you want? Cydia?

tener 10y ago

While he is able to run custom binary on the band, there doesn't seem to be any sort of crypto signatures present securing the firmware. So all you have to do is reverse engineer the binary format, change the code, update the CRCs where needed and hijack the update process. The article is well written and the feat is cool, but the device doesn't seem to be very secure to begin with.

sliverstorm 10y ago
It wasn't quite a developer kit, but the Band was expressly "experimental" to begin with, so I'm not surprised! I roughly their marketing pitch was roughly "we're going to put lots of sensors on you and see what happens"
duaneb 10y ago
Why on earth does a fitness band need security? What a waste of time and effort for everyone involved.
- halomru 10y ago
  Not sure if you're serious? The fitness band doesn't store your SSH keys, but with a heartbeat sensor, GPS and an accelerometer it allows unprecedented insights in your daily life (your heartbeat accelerated inside the maternity ward? Just imagine the datamining possibilities). We are dealing with extremely private data here, and a consumer device should be protected accordingly.
  - slavik81 10y ago
    As long as the firmware update requires physical access to the band and the paired computer, then it is secure. If this device is insecure just because its owner can install new software onto it, then all laptops and desktops are also insecure.
    - userbinator 10y ago
      ...and that "insecurity" is a good thing, because it's insecurity that leads to freedom. Nonetheless, there are plenty of groups who want to get rid of that insecurity, which is even scarier. https://www.gnu.org/philosophy/right-to-read.en.html https://www.gnu.org/philosophy/right-to-read.en.html http://boingboing.net/2012/01/10/lockdown.html http://boingboing.net/2012/01/10/lockdown.html http://boingboing.net/2012/08/23/civilwar.html http://boingboing.net/2012/08/23/civilwar.html "Perfect security is a good idea only to those for whom freedom is worth nothing."
      - johncolanduoni 10y ago
        How are Cory's predictions going? Apple dropped their TPM (without ever even using it), UEFI Secure Boot still allows you to put your own keys even on the most vertically integrated platforms (like the Surface), you can buy plenty of consumer routers that are already running DD-WRT and can be easily flashed with whatever you fancy, Nexus devices still let you unlock the bootloader, and Apple now lets you compile and run apps for your iPhone without a developer's license. Even consumer GPUs are easily programmable now. In what way have any general purpose computers become less general purpose since the hysteria about the war on general purpose computers started?

m0atz 10y ago

I thought this was an awesome article, the OP is obviously deep in the rabbit hole and his code is well written. Top job. Keep on hacking.

wmccullough 10y ago

Your comment is in line with my thoughts as well. I've come to accept that HN is slowly becoming a pit of contrarian asswipes honestly.

nameless912 10y ago
Well, that's kind and encouraging.
dang 10y ago
Please don't make this place even worse by posting unsubstantive dismissals of it. More about this here: https://news.ycombinator.com/item?id=12053739 https://news.ycombinator.com/item?id=12053739. We detached this subthread from https://news.ycombinator.com/item?id=12057792 https://news.ycombinator.com/item?id=12057792 and marked it off-topic.

deleted 10y ago

[deleted]

pedalpete 10y ago

I've got two bands (Microsoft shipped me two, charged me twice and refused to take the 2nd back - brutal customer service), I suspect the Band can be looked at as a failed experiment/product. What I'd like to see is Microsoft open-source or somehow support hacking on these devices so they can see what the small community of users does with them when given full access.