Sometimes, cybersecurity isn’t about passwords or computer chips or networks. Instead, it may be about what’s on your wrist.
New research led by WPI faculty members and students shows that electromagnetic signals from smartwatches that connect to cellular networks can be collected and used to make inferences about a wearer’s behavior, activities, and even health.
The research is in its early stages, and the team noted that a system they developed to collect signals worked accurately only when smartwatches were within about 5 inches of collection devices. Yet the demonstration revealed a potential security vulnerability that has received little attention, says Xiaoyan (Sherry) Sun, associate professor in the Department of Computer Science and an author of the research.
“People use smartwatches to monitor their heart rates, send text messages and emails, stream music, and so much more,” Sun says. “It is possible to track that activity to build a profile of a wearer, perhaps for targeted advertising or even criminal activities.”
The researchers reported that they developed a system, called MagWatch, to probe smartwatches for “side-channel” weaknesses. Side-channel analysis involves collecting information, such as power use, that is inadvertently leaked by a computer system to gain access to secrets.
MagWatch includes a small sensor device to capture and process electromagnetic signals from smartwatch hardware, an algorithm to enhance the signals, and artificial intelligence tools to analyze the data. The research did not include Bluetooth-only smartwatches, which emit less electromagnetic information than smartwatches that are continuously connected to cellular networks.
