Apple’s smartwatch has full access to an iPhone: The Apple Watch shares almost everything with the phone, from communication (Messages app, telephony) and credit cards (Wallet app, though these must be added individually) to health data or iPhone camera control (remote triggering on the watch). Therefore, it is important that only an authorized Apple smartwatch connects to the iPhone. Apple has implemented a series of protocols and measures for this. However, at least the principle behind it is now public: Nils Rollshausen, a researcher specializing in wearable security, has successfully reverse-engineered the Apple Watch at the Seemoo lab of TU Darmstadt.<\/p>\n
Fake Apple Watch says Hello<\/p>\n
The hardware and software combination developed by Rollshausen, which was presented last year<\/a> and has since been refined, goes through the security steps intended by Apple for the connection between the fake Apple Watch and the iPhone. However, the user must approve the connection, so an attacker would need access to the iPhone. Rollshausen did not find any specific device attestation or other function that would truly only allow genuine Apple watches to connect. \u201cI was waiting for this wall the whole time, but it never came.\u201d However, a specific attack was necessary, for which a paper is currently being worked on. <\/p>\n The findings from the reverse engineering of the Apple smartwatch<\/a> are already available. In addition, Rollshausen has developed an app called WatchWitch<\/a>, with which one can communicate with an Apple Watch from an Android device and request various data. This includes recorded health information, open apps, or alarms. WatchWitch can also be used to send notifications, forward notifications, and create and download screenshots. Apple is currently only preparing such interoperability measures towards third-party devices from the iPhone<\/a>.<\/p>\n Replicated Watches as a Security Problem<\/p>\n With the successful reverse engineering of the watch protocols, the abundant Apple Watch fakes available in China and elsewhere pose a practical security problem for the iPhone.<\/p>\n The devices often look very similar to the original and could be used by malicious sellers to read sensitive iPhone data \u2013 because the user believes it to be a genuine Apple product and pairs it with their iPhone. However, corresponding incidents have not yet become publicly known. The technical possibility is now proven thanks to Rollshausen.<\/p>\n Empfohlener redaktioneller Inhalt<\/p>\n \n Mit Ihrer Zustimmung wird hier ein externer Preisvergleich (heise Preisvergleich) geladen.\n <\/p>\n Preisvergleich jetzt laden\n <\/p>\n (bsc<\/a>)<\/p>\n \n Don’t miss any news \u2013 follow us on \n This article was originally published in<\/p>\n
\n Facebook<\/a>,
\n LinkedIn<\/a> or
\n Mastodon<\/a>.\n <\/p>\n