Apple Watch tops wearable security review

New research from the University of Toronto and Open Effect, a Canadian privacy non-profit firm, suggests that Apple Smartwatches and their associated IoT software ecosystems are the most well-designed wearables currently available. Of 8 devices tested, Apple's Smartwatch was found to feature the highest levels of Bluetooth privacy protection, thereby decreasing the likelihood that individual users' movements can be tracked when their fitness bands are not actively paired with the device. These findings are important because other companies such as Garmin, Jawbone, Mio, Withings and Xiaomi showed that comparable weaknesses in their tracking security may call into question the integrity of fitness tracker data at a time when its legal status as evidence for court cases is currently being hotly debated.

If you buy through our links, we may get a commission. Read our ethics policy

Article Hero Image

When it comes to the privacy and security of user data, the Apple Watch and its accompanying software ecosystem are the most well-designed products in the wearable marketplace, a new study shows.

Bluetooth privacy protections — or lack thereof — were central the study's findings. Of the eight devices tested, Apple's wearable was the only one which regularly altered the MAC address broadcast by its Bluetooth radio.

Randomization of the MAC address on Bluetooth Low Energy products is accomplished by a BLE feature known as "LE Privacy." This is important, because unpaired Bluetooth products are designed to send "advertising" packets at regular intervals for discovery — that's how your iPhone knows that there's a nearby Apple Watch available for pairing.

Without this feature, researchers at Canadian privacy non-profit Open Effect and the University of Toronto note that it's relatively trivial to track the movements of individual users when their fitness bands are not actively paired with a device.

Fitbit blamed the "fragmented Android ecosystem" for the lack of LE Privacy support.

Contacted by the researchers about the fault, Fitbit noted that compatibility issues within the "fragmented Android ecosystem" prevent them from adding LE Privacy, despite hardware support in their products. Through corporate parent Intel, Basis noted that using the Peak while not paired to a smartphone was an edge case and did not commit to a fix.

None of the other companies in the test — Garmin, Jawbone, Mio, Withings, or Xiaomi — came back with "notable responses."

In addition to the Bluetooth issues, several companion software packages were found to be insecure. The researchers were variously able to intercept and read fitness data or write false data to disk.

The Garmin Connect app does not use HTTPs for connections, allowing a man-in-the-middle attack to read and write data. A similar attack was possible against Withings's Health Mate app on Android, while Jawbone's Up could allow users to send arbitrary fitness data to the cloud, an issue with potentially severe consequences: