Hacktivity_2019_Conference_Chemerkin_Yury.pdf

Presentation by Yury Chemerkin on hacking health, wearable and smart apps to prevent data leakage. Covers forensics capabilities, data extraction from various fitness and health apps, and security issues with mobile and IoT devices.

1. BREAKINGSMART.
H
ACKINGHEALTH, WEARABLEAND SMART
APPSTOPREVENTLEAKING
YURY CHEMERKIN
MULTI-SKILLED SECURITY EXPERT
CJSC ADVANCED MONITORING

2. YURY CHEMERKIN
I have 10+ years of experience in information
security. I‘m amulti-skilled security expert on
security & compliance and mainly focused on
privacy and leakage showdown. Key activity
fields are EMM and Mobile &, Cloud
Computing, IAM, Forensics & Compliance.
Ipublished many papers on mobile and cloud
security, regularly appears at conferences such
as CyberCrimeForum, HackerHalted, DefCamp,
NullCon, OWASP, CONFidence, Hacktivity,
Hackfest, DeepSec Intelligence, HackMiami,
NotaCon, BalcCon, Intelligence- Sec, InfoSec
NetSysAdmins, etc.
LINKEDIN:
HTTPS://WWW.LINKEDIN.COM/IN/YURYCHEMERKIN
TWITTER: @YURYCHEMERKIN
EMAIL: [email protected]

3. SMART ISSUES
FORENSICS
CAPABILITIES
SPORT &
HEALTH
SECURITY &
TIPS

4. SECURITY NOWADAYS. FORENSICS
DIRECTION
APP SERVERS HEALTH
VENDOR
CLOUD
CDN 3
RD
PARTY
CLOUD
BACKUP OF
DEVICE
MOBILE DEVICE 2FA LEAKED
DATABASE

5. FORENSICS TOOLS. ADVERTISEMENT IS
NOT SCARIEST THING IN THE WORLD 

8. FORENSICS. UNSTOPPABLE ACCESS

9. STRAVA
GOOGLE,
CRASHLYTICS,
FACEBOOK,
ZENDESK,
IO.BRANCH
NETWORK
DATA IS
PROTECTED
FROM MITM
CREDENTIALS,
PROFILE AND
MEASURES
SPORT GEAR
MEASURES IF IT
EXISTS
MAINLY KEEP
ON STRAVA
SERVERS
GEO DATA IN
BACKUPS
ZENDESK
USERID&
TOKEN
+ BASIC
PROFILE
PHOTOS
TAKEN BY
USERS ON
CLOUDFRONT

10. FORENSICS. DEVELOPED IN A MAC
STYLE 

11. CLOUDY DATA. EXTRACTION

12. RUNGAPAPP.
AN EXCHANGE INTERFACE FOR DATA
DROPBOX
SUPPORTS
SPORT
ACTIVITIES
HEALTH DATA BODY
MEASURES
ZIPPED FILES
ROUTES MAPS

13. ALTERNATIVE SOURCES ARE NOT
SUPPORTED

14. ALTERNATIVE SOURCES ARE NOT
SUPPORTED. ~50 APPS W/O 2FA
•GeneralSport:Strava,RunGap,Pacer,NikeRUNClub&Training,
MyFitnesspal
•Gym:Smartgym,Gymaholic,GYM&Freelitcs,Flexi,Hussle,Strong
•Health&Sleep:Pillow,HeartWatch,SleepWatch,Welltory
•SummerSports:RunKeeper,Road&MountainBike,iSkate,Bike
Tracks,SpeedTracker,CycleMeter,FitMeterBike,Crono,Altimeter
•WinterSports:Ullr&UllrMaps,Squawalpine,Snowforecast,
SnocRu,Slopes,Skitude,SkiTracks,SkiAR,JollyTurns,Riders,Fatmap,
Avalanche
•Workouts:Workouts++,Running,Gymatic,Gymnotize,Muscle
Booster,Fitnessbuddy,Centr,Bodyweight,AsanRebel,Training
(Adidas,Runtastic)

15. DOWNLOADS W/O RESTRICTIONS.
PUBLIC DATA, BACKUP ACROSS CLOUDS
SLEEPWATCH:
SLEEP & HEART
DATA
ROADBIKE,
MOUNTAIN BIKE:
IMAGES ON CDN
PACER:
WORKOUTS,
HEATH & GPS
SKITUDE: RIDER LIST
AND THEIR TRACKS

16. SHARING YOUR DATA. LEAKING OUT
OF HEALTH APP
INTER-ACCESS:
GYMAHOLIC,
WELLTORY,
FATMAP,
CYCLEMETER
DISCOVERING IDS:
MUSCLE BOOSTER
TRANSFERRING:
WELLTORY
NOT CLEANING:
GYMNOTIZE

17. SECURE APPS. NO DATA, NO ISSUES
•No backup data, no network data
•Speed tracker, Altimeter
•Workouts++, Gymatic, Flexi, Hussle, & Smart gym, BodyWeight
•Squaw alpine, JollyTurns, Avalance
•No network data
•Pillow, SleepWatch
•Cyclemeter, FitmeterBike, Crono
•Muscle Booster
•No backup data
•Pacer, GYM & Freelitcs, Gymnotize, Centr
•Ullr & Maps, Snow Forecast, Slopes

18. OVERLOADED APPS
ROAD BIKE, MOUNTAIN
BIKE, ISKATE, BIKE
TRACKS, CYCLEMETER,
FITMETERBIKE, FATMAP,
RUNNING, WELLTORY,
RUNKEEPER
ULLR & MAPS, SNOW
FORECAST, SLOPES,
SKITUDE, SKITRACKS,
RIDERS, FATMAP, FITNESS
BUDDY, CENTR,
WELLTORT
ISKATE, SKITRACKS,
FITNESS BUDDY, CENTR,
RUNKEEPER

19. MOBILE, Io T, CLOUDS…
IT’S TIME TO HIRE A RISK MANAGER!
HOW TO CONTACT ME ?
ADD ME IN LINKEDIN:
HTTPS://WWW.LINKEDIN.COM/IN/YURYCHEMERKIN
YURY CHEMERKIN
SEND A MAIL TO:[email protected]