android based smartwatches hacked

[qwertywarrior]

TLDR

basically pairing the watch to ur phone only uses a short 6 digit code which is very easy to bruteforce

a longer key would defeat this

 

http://www.tomsguide.com/us/smartwatch-encryption-cracked,news-19998.html

 

[LukaP]

ok... i guess google will fix this in 5.0.2?

[dragosudeki]

I'm not too sure if increasing the digits would even work that well either. Why not just allow all characters to work? Then the possibilities are even more endless than 10^n.

[LukaP]

I'm not too sure if increasing the digits would even work that well either. Why not just allow all characters to work? Then the possibilities are even more endless than 10^n.

dude, a 64b int is more than enough, or if youre scared get a 128b number and you wont have any computer realistically bruteforce it

[AlexGoesHigh]

ok... i guess google will fix this in 5.0.2?

i think is easier if they just patched the android wear app and the OS in the watch IIRC android wear updates are fully in control of google instead of the manufacture since wear is pretty much the same exact build in different devices no mods by OEM's, is more like windows in that aspect

[LukaP]

i think is easier if they just patched the android wear app and the OS in the watch IIRC android wear updates are fully in control of google instead of the manufacture since wear is pretty much the same exact build in different devices no mods by OEM's, is more like windows in that aspect

aaah i figured it was like android. then yeah, they really should patch this... a 6 digit code isnt really stronh

[dragosudeki]

dude, a 64b int is more than enough, or if youre scared get a 128b number and you wont have any computer realistically bruteforce it

It's not really a 64b integer though. Its an array of numbers from 0-9. Doing what I suggest is 6 characters of upper/lower cased letters plus numbers. Which is actually far less than the max 64b integer... A true 64b integer would only allow 18 digits of 0-9, which is a lot more numbers to press...

[Master Disaster]

Not really hacked though, is it.

I mean bruteforcing a pairing password is pretty pointless if you can't initialise the pairing in the first place.

Its like knowing the code to the secret door without knowing where the door actually is.

[MoonSpot]

http://hakshop.myshopify.com/products/ubertooth-one?variant=82584132

 

Sniff x sniff. + starbucks = profit(jailtime)^bumrape