Today I'm going to talk about some sportish and healthish applications.
But I will talk from a forensic viewpoint.
Many times I perform security research, I have a question, how is it secure?
How is it secure if, for example, we can fully turn off our mobile device and even if we detach any hardware parts, if it's secure, and if in this case our risk level is zero.
In fact, if you have online services we use in mobile applications, we still have a risk application every time.
And this presentation was done and supported by several forensic teams who prefer to be unknown unless you guess out by some screenshots.
Nowadays security teams focus not only device, mobile device, I mean, or IoT device, or medical devices, in extracting your data.
It's also focused on some kind of certified clouds, for example, Dropbox, OneDrive, any kind of cloud services in obtaining your data, or maybe obtaining any kind of data related to your information, to your profile, maybe credentials, depending on the application and how leaky this application would be.
But the trend is about accessing your data from network services, developer, web services, you may know, like, Apple Cloud, I mean, Apple Health Cloud, also iCloud, Google Fit, it's a quite popular application, and unified storage of your personal data,
personal health data.
But the first time when I tried to check my mobile device and my credential storage on mobile device by forensic tools, I found I can get access to 49 applications, and most of them it's only backup data.
And in fact, I have more than 300 applications installed and filled by any kind of data, by summer sports application, gym, workouts, winter sports, just general application about your health tracking, sleep tracking.
This is how many applications I have, and you just can simply compare how advertisement and marketing make you scary people and fear forensic teams.
In fact, many features claimed in marketing release notes or any spreadsheets, it's a kind of marketing bullshit.
That's a real story, but before we talk about some healthy sports application, we'll focus on a case, for example, when your credentials, it depends, passwords or maybe token or any other kind of credentials to access your data from web services, maybe obtained by forensic teams,
by criminals, by even you if you're going to test it, how many times you have to prevent your data downloading from web services.
In fact, everything you'll get from some kind of simple forensic research, it's just email notification about you perform one more login in your services.
And if you stick to iPhone, for example, you maybe didn't pay enough attention because if you reproduce the network stack and access your data and grab the ID of application from iPhone, it's the same.
It's like application just re-identificates and you didn't pay enough attention.
But in other site, if you never use iPhone and we'll see, you maybe pay just a little attention because many services allow to download your data quite quickly.
For example, Foursquare, Swarm or Uber.
Unless I found that Instagram just stop you every five megabytes of data, you'll have to wait five minutes to download again.
Unless it's continue, you'll be finished as a transaction operation.
But even if you noticed some unusual activity and trying to stop this activity, for example, what can you do?
You may change your password at the same time you found and even you have, for example, even one hour in case of Instagram before all data will be downloaded by forensic tools.
It doesn't mean changing your password will revoke all authentication tokens by other application.
So in this case, you can rely on just changing your password.
You need feature in application by revocation all authentication tokens.
But many times you'll find you have some feature.
When I continue my research and confrontation with forensic tools, I still found several sportish application like Strava and some more that provide you information downloaded from web services.
It's an example what we can acquire by forensic tools.
It's only stick to images.
General information about account and reality.
We can download even credentials, use sport gear if you use in gym some kind of gear and bind your iPhone, for example, with this gear.
Talking about Strava, it's quite good application from security viewpoint and forensic viewpoint because it's mainly store your data on our own services.
They don't reuse Amazon clouds or any kind of public clouds.
But they still like kind of way of optimization.
When you use media files and easily can find all your data about photos you've done on CloudFront services without any kind of authentication, you just need to do a little research and reverse this application to understand how you should pick up parts of URL to download all your photos and not only your photos but any kind of user photos from CloudFront.
It also gives you information about some kind of georoutes with background of your map.
Sometimes we have some issues when you start to use forensic tools and you start reversing of forensic tools.
You may find that if you access to any kind of device, iPhone, iPad, any kind of Android devices, you will get all files from this device.
But I name this developing in Apple style because when you acquire all files without folder structure, you will never reassemble these files in case of use some kind of encryption.
When you use encryption like TrueCrypt or Veracrypt, you have one solid file which stored on the device or cloud accounts.
But if you use application like Cryptometer, each file in your folder will be encrypted.
And this is how it looks when in encryption.
You should have all information about folders, files, which files are related to parent folder.
Also, besides you need to decrypt this information or obtain the password, you also need information about metadata.
And this is how it will look like.
I just found without any search or information about structure folder, about only master crypt key, but it's nothing without your password.
And if you will try to find and collect, reassemble all encrypted files, you will never be successful.
Another story when we access to third-party clouds.
For example, Dropbox or Amazon.
It's a funny question, but how many times you check your Dropbox account just to be sure you have all up-to-date files.
When I have looked to my Dropbox account, I found that many folders made by applications.
It's really outdated, but keep a lot of information in my cloud services.
In this case, many forensic tools may be useful to access your data.
If we speak in general, but if we going to be some specific, we have one Sportage application known as RunGap application.
It supports 25 or 30 applications.
It's some kind of interconnected interface between several applications.
If you have Strava, you can just use RunGap to copy your data from Strava account and put it to MyFitnessPal or Placer or any other kind of information.
In this case, this application relies on Dropbox activities.
Of course, without any kind of encryption or any other kind of protection.
Everything stored in files.
It's just easily how it looks like.
So, all information with metadata and related information to your original account, which account used to transfer this information, any folders, any structures.
But just
a little stack.
This is some kind of RunGap activities.
We can found... I can say it's not really useful information, but it depends on where we can access this information.
If we access directly from device, it's not really useful.
Just background, your routes.
When we talk about popular applications that supported by many forensic tools, we have some issues, because supporting Apple Health application or Google Fit application, you just care about accessing for your health data.
But in fact, we have many alternative applications that fill your health data.
This is a copy of my health application.
But in fact, we have 50 sources applications that originally fill Apple Health and Google Fit application.
This is how many applications I've checked.
Nothing of all these applications really supported by forensic tools.
I can say this application is really secure, because it doesn't have any kind of encryption, any kind of protection or multifunctional authentication.
But all these applications have some kind of specific activities.
If we talk, for example, about some winter sports application, like
some winter sports application, for example, SkiTube.
It's a great application for anyone who prefers ski or snowboards.
But this application relies on CDN every time, and provides all information about pictures of your tracks, pictures of any kind of photos taken by any users.
And it's freely available for anyone on CDN and CloudFront.
Many applications, it's like about just questionnaire about your daily activity.
For example, if you talk about food applications, it's an application asking you every time about information, just to provide you white information, height, blood pressure, any other kind of information.
It never gives you a valuable report on measuring your data.
But in fact, just stealing your data from any application, it's possible to get out and keep this information on our own services.
For example, if you talk about some kind of application, like Gymaholic, Valtteri, Fatmap, CycleMeter, this application is really interconnected.
In some cases, it may collect your credentials from other applications, but we keep it in plain text, just allowing anyone, like a criminal or forensic team, access to your data from other applications.
It's simple.
Besides, it has a lot of data.
Valtteri, it's just an application that every day and every hour performs one simple activity.
Besides, it's a questionnaire and asking how you feel today, and reassembling information about places you visited by Foursquare or Swarm, just to give you a little feedback on how you're in the mood today.
For example, this application just does it every time, picking up all information from all possible applications, and retransfers it to their own services.
And maybe selling for anyone.
Many applications are just a muscle buster, looking for any kind of identification of social networks, text identification, maybe phone numbers.
It's just kind of, not really a spy application, but only focused on identification of you in other networks, unless you, of course, provide this access with a credential.
And this application can re-download this information.
Sometimes applications like Gematis doesn't perform any cleaning.
They store all information on the device, and iCloud backups about what they backup.
So it's reduplication information every time.
It's not cleaning, and everything is stored in a solid file, and easy to analyze.
Despite this application doesn't provide any kind of encryption or protection.
This slide is kind of my best one, because if it doesn't have real protection, we have another way to protect information.
If we have no data, we have no issues in this case.
And the less data items and information your application stores on the website, or even in a backup like iCloud, it's kind of feeling comfortable, because you may feel secure for a while.
It's quite important, because all information stored in your backup will be part of iCloud, and if you use a modern iOS operating system, it means you will have nothing in a local backup.
If you perform all iTunes backup activities, everything will be in your iCloud.
Unless you stop your iCloud backup, everything will move to local backup files.
Sometimes many applications are just overloaded with data information.
So , the right application is like road bike, mountain bike, provides you with all details about your roads, geolocation, some kind of general activities, every minute activities, and everything will be easily analyzed.
Some applications just collect your credentials, never protect them, even if originally, for example, if you talk about Strava application, your credentials are encrypted and really protected.
But many applications, when they become interconnected, they keep your Strava credentials in a plain text, just allowing easy access to your account.
The last, but not the least, when we talk about analytics, in general, it's not really useful information about your device, but it depends on what kind of analytics and SDK libraries you use, because sometimes it's information about your activities paired to each type of application.
And this is how analytics from Bandswitch account and total data I spent on my Wi-Fi from the last year was the cloud, the blue one, but its total amount of data was sent by analytics.
For the whole year, it's about 600 gigabits.
Unless I completely moved all analytics to a host file blocked by a firewall, and do it every time, I reduce it only in 10 times.
And it means even if you reduce and stop sending information from analytics or any other kind of information to clouds, to web services, you have some issues because the application is still trying to connect to services.
It breaks by firewalls, of course, but it still produces an amount of network information by each time requesting, and this is why we can reduce it to zero bytes eventually.
And this is just another kind of bars.
How many applications have analytics?
Just some kind of way to save amount of your money if you have a paid network with limited data.
But also if you look again, it's opportunity to reduce only in 10 times unless you fully turn off network activities or completely patch this application to prevent any kind of leakage.
And I thank you for attention.
If you have any questions, I will answer now or maybe later.
If you have any details about applications, about reversing of forensic tools, I can provide you if you drop me a line.
And this will be a full report available by this year, I guess, by the end.
So thank you for your attention.
Thank you, Yuri.
So who raised the hand?
You saw hand, Yuri, where?
There?
Hello, thank you.
You told us that many applications, let's say, monitor and extract some data, but from my opinion, it's not a bad way because you want smart application that helps you in the life.
If we don't leave them to extract data and build metadata, the application could help us so much.
And this is another aspect, like in Android, when you install an application, you see exactly what it requests, like your location, your contact.
It's not a malware.
You can consider them as poor, potential unwanted application.
It's not a bad behavior.
And about the garbage that application leaves on the mobile or computer, there are solutions like optimizer application who scan the system and clean it.
So why do you consider that kind of application like, I don't know, negative, like malware?
Yeah, I got your question.
I didn't consider this malware.
I consider it's not even garbage.
Of course, if you install an application and you really need this application, you will use it.
Sometimes you have opportunity to reduce some garbage from this application, but if you expect some kind of, for example, route information, geolocation information from this application, until you completely research this application, you will never know what kind of geodetails and location details you will find in this application.
Sometimes it's so-called direct data items.
For example, you have location, and sometimes it's indirect data items.
For example, when location is based on your photos, on your metadata, on NXC, of course, or name of place.
Sometimes it's by minute activities.
It depends on which information is valuable to you.
If you need months report about your activity, it's all you need.
You don't need storing all information about your activity.
You need to reassemble this information, recalculate, receive feedback with report.
This difference, when I talk, this application may be bad for someone or good for someone.
If you need completely detailed information, yes, of course, you need all this data.
But I'm not sure you will track your activities by every second, unless you have regular hard activities.
And in this case, you need to go to details.
But these are unusual activities.
And if you have unusual activities, you may have, for example, some special section in report.
So this geolocation plus your regular activities, hard activities, was done in this time frame.
That was what you need, actually.
So that's a difference, from my opinion.
Yeah, I get it.
I would like to just ask, did you actually aggregate the data that you used for the tests and assessments that you presented?
And did you make the assessment and the production of the figures that you presented yourself?
And if yes, what was the hardware that you used, the approximate specifications of the hardware?
Mainly, I will focus only on network activities, because it's a popular trend for forensic teams.
And I have much more interest in researching these activities.
Also, I perform this research on Android in some cases, when I need to understand the real difference between network stack or interfaces, when we access the web data between iOS application and Android application.
In general, we have no difference.
Of course, sometimes it happens, but it's not really an effect on accessing cloud.
Even if any malicious application or criminal may access to your data.
When you access to local data by device or maybe cloud, like iCloud or Google Backup, you also not really rely on specific hardware, because it's only about tokens, about lockdowns records, and some kind of credentials, and the way how you bypass.
So, in this case, I analyzed only local information from device, just to compare how many information stored on the web services and locally on your device.
And this was iOS 13.1 and Android 9, in case if you're answering the question.
I fully understand now, thanks.
First of all, thank you for the presentation.
I have a question regarding the Google Play Store.
Mainly, if during these years of publishing apps that have interactions between them and share information and are intrusive to the user, has Google, I don't know, made any improvements on their prevention?
Or had they become more aware of these apps?
And did the Google App Store for iOS become more secure for these apps, for securing the information, for letting them get published?
I got a question.
I'm not sure App Store or Google Play team may prevent this situation, because lockdown, in my research, it's only automated from one side by forensic tools, but in general, you cannot optimize fully this process.
And their teams rely on automation tools when they're trying to prevent some kind of scam, malware, or unless some kind of reports will be repeatedly sent by any researchers to their team.
In this case, they may limit it, or maybe fully prevent this application removed from App Store, but the real issue is not about a sportish or healthish application if you use it on Android, because many really good applications paired with your watches,
smartwatches, of course, and a few of them you should pay attention when you use on Android watches.
Many of applications I can only test on iPhone.
iPhone, and I mean Apple Watch.
From another side, it's a kind of application and developer perform fully compliance application from Google requirements.
They provide in general information, or sometimes maybe detailed information, privacy policy about which data they access, but as it was in the first question I answered, it depends for you how detailed information you need.
You may just claim you have access to location data, but in fact you may collect a lot of location information.
In this case, there is no difference from Google viewpoint or Apple viewpoint.
Maybe this kind of detailization may be useful to prevent some kind of supplication from such activities, but I'm not sure it happens in nearest future.
It also depends on a particular person who wants to use this application.
If he satisfies this application, then why not.
It's completely up to him.
Thank you.
Yuri, we have another one here.
Okay.
Can we consider the official applications provided by the different wearable manufacturers more secure than generic ones?
I'm not sure we can provide some kind of distinguish between these applications, because no one provides real encryption, even stores or transfers this data.
Also, many applications store it in plain text on cloud accounts.
In general, talking about Sportage application, there is one way to say it may protect your data, if this application stores less information about you on the clouds or on your device.
In this case, we can say it's generally protected.
It may be a sleep watch application, if you monitor your sleep activities.
Some kind of Winterspot application for skis and snowboards is a really good application, because when developers publish these applications, they focus only on the activity you need.
If you need to build roads, how you ride, how you fall, in this case, it provides only this information without any garbage details.
If you need to post some activities, not many applications provide this feature.
In this case, Winterspot application, in my opinion, from other categories, is the best, because they have not many data items and fully complies from logical viewpoint feature and only activities related to this feature.
Thank you.
I think we can take one more.
It's okay?
Yeah, sure.
Okay.
Hello.
Among all the applications that you've analyzed from a forensics point of view, and I'm not talking only about sports related tracking applications, which ones have you found to be the most insecure and that you wouldn't recommend us to use?
Most insecure application, it's application that looks like your diary, like everyday diary to keep your activities, like food application, which kind of questionary and asking you provide any information about food you eat, how many water you drink, also maybe just
general applications that are not really connected to your smartwatches, but also act like a diary application and asking about you everything.
Well, the application, of course, some kind of garbage, because I didn't find any valuable feedback about my activities, but it's collecting all information about my everyday activities, even places I visited every day.
So, that application you should avoid, from my opinion.
All right.
Thank you so much, Yuri.
Thank you, folks.