introduction & soa

Reverse engineering of biomedical elaborated signal

Laura Barilli laura.barilli@mail.polimi.it

Luisa Cucugliato luisa.cucugliato@mail.polimi.it

Friday, April 29, 2016 B3Lab, Via Ponzio, Building 21

Context

Detection of biomedical signal to monitor health conditions

2

Fitness Trackers

• Continuous e practical monitoring• Limited prices• User comfort• Large diffusion on the market

Increase of 85% in one year

www.statista.com/statistics/413265/health-and-fitness-tracker-worldwide-unit-sales-region/

Western Europe

Asia Pacifi

c

North Americ

a

Central E

uropeChina

South Americ

a

Africa

& M

iddle East0

2

4

6

8

10

12

142015 2014

Units sales in millions

3

Fitness Trackers

Closed

Open

Fitness

Medical

Open

Closed

Xiaomi

Angel sensor

Empatica

FitBit

Nike+Fuel Band

Jawbone

4

Fitness Trackers

Closed

Open

Fitness

Medical

Open

Closed

Xiaomi

Angel sensor

Empatica

FitBit

Nike+Fuel Band

Jawbone

4

Our Work

What we have:

Fitness data step counter

Sleep data light and deep sleep

What we want:

HR signal PPG sensor

www.mi.com

5

Our Work

What we have:

Fitness data step counter

Sleep data light and deep sleep

What we want:

HR signal PPG sensor

?www.mi.com

5

Idea

Reverse Engineering

Open source signalLimited processed data

6

Access of data is facilitated by Bluetooth communication

State of Art

The authentication system, which is based on Bluetooth Low Energy (BLE) trasmission, is vulnerable. Everyone can connect to portable devices

7

State of Art

“During the last two weeks I had fun playing with the BLE protocol of the Nike+ FuelBand SE”

Simone Margaritelli Khyati Jain

www.evilsocket.net/2015/01/29/nike-fuelband-se-ble-protocol-reversed/thehackernews.com/2015/10/hack-fitbit.html

“An attacker can reverse Fitbit protocols and send malware to the wearable fitness tracker nearby at a Bluetooth distance”

8

State of Art

hackaday.io/project/6581/logs

Figure out the protocol for the purposes of:

• Reading the step count• Reading activity data writing the firmware Morgan Gangwere

9

Our Reverse

Peripheral

Characteristic

Service

Characteristic

Service

10

Our Reverse

Peripheral

Characteristic

Service

Characteristic

Service

PROBLEM: Digital signal format

10

Fitness Trackers

Closed

Open

Fitness

Medical

Open

Closed

Xiaomi

Angel sensor

Empatica

FitBit

Nike+Fuel Band

Jawbone

11

Angel Sensor

“Offers a full ownership of data for both developers and consumers”

Detected by PPG sensor

angelsensor.com

12

Fitness Medical

Use data detected from a cheap fitness tracker in order to study medical conditions

Goals

Create an app which allow to detect Heart Rate Variability (HRV) to extract resipiratory rythm

13

Reverse Engineering of Biomedical Elaborated Signal

Laura.barilli@mail.polimi.itLuisa.cucugliato@mail.polimi.it

https://www.facebook.com/reebes.project2016/

Contacts14

Questions?

15