Ethical hacking of Garmin’s sports watch

Detta är en Master-uppsats från KTH/Skolan för elektroteknik och datavetenskap (EECS)

Sammanfattning: IoT devices within the technical market are rapidly growing in popularity. However, they are still young and due to the rapid growth and demand of the market, they are also known to be more vulnerable to attacks compared to other applications. The smartwatch is an IoT device that collects a large amount of personal data and monitors a consumer continuously, therefore it also comes with a great privacy risk if there are vulnerabilities in the device.  The objective of this thesis was to assess the security of Garmin’s smartwatch Venu and to demonstrate whether the smartwatch is secure or not. The task of fully validating the security of an application or device is nontrivial and cannot be perfectly achieved. However, this thesis uses a systematic approach using state of the art approaches to attempt to assess security.  The methodology PTES was applied which includes threat modelling. Threat modelling was used to list the possible vulnerabilities existing on the smartwatch. The tested vulnerabilities were selected based on the delimitations as well as their placing on an applied risk matrix. The vulnerabilities were then tested based on OWASP:s testing guide and ASVS.  It was found that Garmin Venu was generally secure with a few minor security flaws. The Swedish law limited the possible security tests, as this thesis was done without collaboration with Garmin. However, the thesis does provide pointers of needed further investigation for vulnerabilities as well as conclusions that suggest that the smartwatch is secure. The threat model in this thesis provides identified threats that were not analysed due to time constraints. The conclusion of this thesis encourages further analysis of the operating system Garmin runs on, as it opens up more potential threats to be penetration tested. 

  HÄR KAN DU HÄMTA UPPSATSEN I FULLTEXT. (följ länken till nästa sida)