Pith. sign in

REVIEW 2 major objections 4 minor 103 references

WatchWitch: Interoperability, Privacy, and Autonomy for the Apple Watch

T0 review · 2 major / 4 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read The Apple Watch can be used with Android phones, a new open-source app shows.

desk verdict First real documentation of the Apple Watch's wireless stack plus a working Android reimplementation; the core holds up, but the health-data forgery claim needs a tighter threat model and an end-to-end demonstration. read the letter →

arxiv 2507.07210 v1 pith:5OCKZCRM submitted 2025-07-09 cs.CR

Nils Rollshausen , Alexander Heinrich , Matthias Hollick , Jiska Classen This is my paper · ORCID
classification cs.CR
keywords AppleWatchwirelessprotocolreverseengineeringAndroidinteroperabilityAlloymessagingNanoSynchealthsynchronizationdataprivacyIKEv2customnotifypayloadsA-over-Cencryptionmalleability
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper sets out to show that the Apple Watch's wireless protocol stack can be reverse-engineered and reimplemented on a third-party phone, directly contradicting Apple's claim that Android interoperability is infeasible. It presents WatchWitch, an Android app that reproduces several core watch features—push notifications with reply actions, Internet sharing, and health-data synchronization—while keeping cryptographic keys in hardware-backed storage and the user's health database encrypted on-device. In the process, the paper documents previously unpublished protocols and reports security weaknesses: custom IKEv2 messages can be forged to redirect traffic, and the extra encryption layer that protects health data is malleable, allowing an attacker with ciphertext access to alter the type of a health sample and insert forged values into the health database. If these claims hold, users would have a practical path out of Apple's ecosystem lock-in, and Apple's security justifications for the walled garden would be weakened.

What carries the argument

The load-bearing mechanism is the layered protocol stack that carries every watch-phone message, with the A-over-C encryption layer as the specific hinge for the security claims. A-over-C wraps class-A health data by encrypting the payload with AES-CBC under a fresh key, encapsulates that key in a message-protection envelope using RSA-OAEP, AES-CTR, and an ECDSA signature, and sends the result over the class-C IPSec tunnel. Because the CBC payload is not authenticated, an attacker who knows some plaintext can flip ciphertext bits so that the corrupted block decrypts to a random-looking but valid 16-byte UUID while the bit flips carry into the following block and alter the sample type byte; the attack exploits the alignment of these 16-byte UUIDs with cipher blocks. The same stack, on the constructive side, is what WatchWitch reimplements: the IKEv2 handshake with custom Link Director Messages, Alloy messaging, Shoes proxying, and NanoSync database synchronization.

What would settle it

Capture a real health-synchronization message from a current-generation Apple Watch, recover the A-over-C ciphertext, flip the bits that correspond to the type byte of a known sample, and deliver the modified message to a paired phone; if the phone's health database does not record a sample of the changed type, or rejects the message as unauthenticated, the forgery claim is falsified. Similarly, if a current watch no longer answers the documented IKEv2 custom notify payloads with the expected Link Director Messages, the interoperability claim is falsified.

Watch

Extended reading notes

Core claim

The central discovery is that the Apple Watch's proprietary communication stack is learnable and replicable. The paper reconstructs the chain from Bluetooth and Wi-Fi transport through an IKEv2/IPSec tunnel, the Alloy messaging bus, the Shoes Internet-sharing proxy, and the NanoSync health-synchronization format, then reimplements enough of it on Android to deliver notifications, reply actions, Internet sharing, and health-data synchronization to a real watch. Alongside this constructive result, the security analysis finds that Apple's deviations from standard protocols introduce weaknesses: custom IKEv2 notify payloads carrying Link Director Messages are accepted in unauthenticated contexts, enabling traffic redirection, and the A-over-C encryption used for class-A health data encrypts the payload with unauthenticated AES-CBC, so flipping bits in one ciphertext block can change the type byte of a health sample in the next block and inject forged readings into the health database. The paper also documents that deleted health samples retain their type and deletion timestamp, which it argues can harm users.

Load-bearing premise

The argument rests on the assumption that how the tested watches and phones behaved is how Apple's current and future devices behave; for the newest models the paper could not observe the encryption algorithms, so a change in the protocol stack would break both the interoperability demo and the attacks.

Editorial extensions

If this is right

  • Android interoperability is practically feasible: a proof-of-concept app reimplements push notification forwarding with replies, Internet sharing, and health-data sync, so Apple's infeasibility claim is contradicted.
  • The A-over-C layer should be fixed with authenticated encryption; the paper notes Apple could encrypt the entire message with the message-protection mechanism or use an authenticated algorithm.
  • Custom IKEv2 extensions should be accepted only in encrypted and authenticated contexts; otherwise any in-range packet injector can forge Wi-Fi address updates or redirect Shoes proxy traffic.
  • Users can gain privacy controls not available on iOS: an on-device firewall, full health-database access, and regional feature unlocking such as ECG, all without cloud involvement.
  • Interoperability need not mean downgraded security; keys can stay in hardware-backed storage and health data can remain encrypted on the device.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the protocol stack is representative beyond the tested devices, the same reverse-engineering route likely opens up other Apple peripherals that reuse the same lower-level transports, such as Magnet or CLink.
  • A natural next experiment is to implement the Bluetooth path over raw L2CAP sockets; the paper identifies this as missing work, and success would remove the current need for a modified iPhone in the setup.
  • Regulators weighing interoperability mandates may treat a working third-party implementation as evidence that technical infeasibility claims deserve closer scrutiny.
  • The A-over-C result suggests that any vendor that layers unauthenticated encryption under a secure tunnel should re-examine the inner layer, since an attacker who obtains one layer's keys can still break the next layer.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

2 major / 4 minor

Summary. The paper presents WatchWitch, an open-source Android reimplementation of parts of the Apple Watch-to-iPhone protocol stack, based on extensive reverse engineering of the proprietary wireless protocols (NRLP, Magnet, IKEv2/LDM, Alloy, A-over-C, NanoSync, and Shoes). The authors document these protocols, provide tooling, and demonstrate several smartwatch features on Android: notification forwarding and reply, Internet sharing with a user-controlled firewall, and health-data synchronization. The paper also reports security findings: unauthenticated IKEv2 Link Director Messages enable packet injection and traffic redirection; the A-over-C health-protection layer is malleable because the payload is encrypted with unauthenticated AES-CBC; and cycle-tracking deletions leave metadata behind. The central claims are that third-party Android interoperability is technically feasible despite Apple's stated position, and that the extra health-protection layer can be bypassed to forge health samples.

Significance. If the central claims survive scrutiny, this is a substantial contribution. It is the first public documentation of the Apple Watch's wireless protocol stack, it directly challenges Apple's claimed infeasibility of Android interoperability, and it identifies concrete security weaknesses in a widely deployed health-data protection mechanism. The work is unusually concrete: the source code and tooling are published, the protocol descriptions are specific enough to be independently checked, the app is demonstrated on real devices, and the security findings were responsibly disclosed to Apple. The main caveat is that the headline health-forgery claim is not fully established under the paper's own threat model, and the 'practical interoperability' characterization is heavily qualified by Section 5.4. Overall, this is a strong systems-security contribution that merits publication after the load-bearing claims are tightened and supported.

major comments (2)
  1. [6.3 / 6.1] Section 6.3, Figure 13: the claimed health-data forgery goes beyond the stated threat model. Section 6.1 defines Attacker 2 as having access to IPSec key material (e.g., after brief physical access to a locked phone), which lets the attacker read A-over-C ciphertexts but not A-over-C plaintexts. The attack, however, requires knowledge of the exact byte offset at which the 16-byte sample UUID begins relative to CBC block boundaries, and of the current type byte (e.g., 0x0a) so that the XOR mask can be constructed. The paper's own wording conditions the attack on 'partial knowledge of their plaintext content,' but this capability is not derived from the assets listed in Section 6.1; it is an additional assumption that must be stated and justified in the threat model. Moreover, the paper does not show how Attacker 2 obtains this plaintext knowledge in practice, and the demonstration in Figure 13 is not reported as a blind attack performed under the threat model. Finally, the paper does not show that the modified sample is accepted by the health daemon (for example, that a forged row appears in healthdb_secure.sqlite); the evidence presented is the CBC malleability property, not an end-to-end exploit. Because Apple's non-fix decision was based on 'cannot be exploited,' this end-to-end step is load-bearing. Please either extend the threat model and present a blind end-to-end demonstration, or downgrade the claim to a conditional malleability property that requires an additional plaintext-knowledge assumption.
  2. [Abstract / Section 5.4 / Section 9] The abstract and conclusion describe the result as 'practical interoperability' and 'true interoperability,' but Section 5.4 states that the current setup requires a rooted Android phone, a jailbroken iPhone on the same Wi-Fi network to bootstrap the connection, does not support a Bluetooth link, and sometimes relies on 'stealing' a protocol session from the previously connected iPhone. These limitations do not invalidate the technical feasibility result, which is valuable, but the wording overstates what was demonstrated. Please align the abstract and conclusion with the limitations in Section 5.4 by referring to a technical proof of concept, or by presenting a concrete user-facing scenario that is actually supported by the prototype.
minor comments (4)
  1. [5.3.2] There is a typo in the phrase 'maintain the the app's functionality'; it should read 'maintain the app's functionality.'
  2. [References] Reference [13] is titled 'Track your sleep with Apple Watch,' but the URL and surrounding context indicate that it should instead be the Apple WatchOS feature-availability page; please correct the citation.
  3. [Figure 13] The hex dump in Figure 13 is difficult to follow without explicit row and column annotations; adding byte offsets and a parsed structure showing where the 16-byte UUID and the type byte reside would make the attack description much easier to verify.
  4. [6.4] Section 6.4 is presented as a security finding, but it is essentially a data-retention observation about local database contents. It would be clearer to state the relevant attacker model (for example, device seizure) and to distinguish this issue from the over-the-air vulnerabilities in Sections 6.2 and 6.3.

Circularity Check

0 steps flagged · score 1.0 of 10

No material circularity: the paper's claims rest on observed protocol traces, a working reimplementation, and standard AES-CBC malleability, not on fitted inputs or a self-citation chain.

full rationale

WatchWitch's central claims (protocol documentation, Android interoperability, and the A-over-C health-value forgery) are empirical and constructive rather than derived from their own outputs. The protocol stack is reverse-engineered from live traffic, system logs, and static binaries (Section 3), and the Android app is an independent reimplementation that communicates with real Apple Watches and was tested over extended periods (Section 5.4), so the demonstration is externally falsifiable and not fitted to a target result. The security finding in Section 6.3 is grounded in standard AES-CBC malleability and a documented plaintext layout (Figure 13), and the iMessage-style encapsulation is explicitly attributed to Garman et al. [44], an external reference. The paper's self-citations (Heinze et al. [48] for Magnet, Classen et al. [26] for Fitbit, Stute et al. [84] for CLink) provide contextual prior art for lower-layer protocols and are not load-bearing premises for the new contributions. No equation is defined in terms of its own output, no fitted parameter is relabeled as a prediction, and no uniqueness theorem from the authors' prior work is invoked to force a choice. The noted caveats (untested newer firmware, root/jailbreak requirements, and absence of an end-to-end demonstration that the health daemon accepts the forged sample) are completeness or threat-model limitations, not circular reasoning.

Assumptions & free parameters 0 free parameters · 4 assumptions · 0 invented entities

This is an empirical reverse-engineering paper; there are no fitted parameters, invented entities, or circular derivations. The explicit assumptions are the attacker models and the representativeness of the tested firmware versions.

assumptions (4)
  • domain assumption IPSec in well-known standard form is secure and the cryptographic primitives used are secure.
    Invoked in Section 6.1 to isolate Apple-specific deviations; the attacks are scoped to what Apple added on top. This assumption is standard cryptographic practice, not specific to this paper.
  • domain assumption Dolev-Yao attacker with radio range of both devices and membership in the same wireless network.
    Section 6.1 assumes attackers 'within radio range of both devices and members of the same wireless network,' which underlies both the IKEv2 LDM forgery and the CBC malleability analysis.
  • domain assumption Attacker 2 can extract class C/D IPSec key material from a locked iPhone via commercial tools such as Cellebrite or GrayKey.
    Section 6.1 justifies this with commercial offerings [30, 63]; the health-forgery attack depends on this premise. It is plausible but stronger than the ubiquitous-network-attacker setting.
  • ad hoc to paper Protocol behavior observed on iOS 14.8, watchOS 7.3.3, and watchOS 10.0.2 is representative of current Apple devices.
    Appendix A.4.1 states newer-models' ESP ciphers could not be observed because no jailbreak exists for iOS 17/watchOS 10, yet conclusions about the protocol stack and vulnerabilities are stated generally. Partially mitigated by the A-over-C comparison across iOS 14.8 and 17.5.1 in Section 6.3.

how reviews work

0 comments
Cite this review

Pith. "Pith review of WatchWitch: Interoperability, Privacy, and Autonomy for the Apple Watch." pith.science (2026). https://pith.science/paper/5OCKZCRM

@misc{pith2026250707210,
  author       = {Pith},
  title        = {Pith review of: WatchWitch: Interoperability, Privacy, and Autonomy for the Apple Watch},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/5OCKZCRM}},
  note         = {Machine review of arXiv:2507.07210}
}
read the original abstract

Smartwatches such as the Apple Watch collect vast amounts of intimate health and fitness data as we wear them. Users have little choice regarding how this data is processed: The Apple Watch can only be used with Apple's iPhones, using their software and their cloud services. We are the first to publicly reverse-engineer the watch's wireless protocols, which led to discovering multiple security issues in Apple's proprietary implementation. With WatchWitch, our custom Android reimplementation, we break out of Apple's walled garden -- demonstrating practical interoperability with enhanced privacy controls and data autonomy. We thus pave the way for more consumer choice in the smartwatch ecosystem, offering users more control over their devices.

Figures

Figures reproduced from arXiv: 2507.07210 by the authors.

Figure 1
Figure 1. Watch message handling logic on iOS. Darker cells [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 2
Figure 2. Protocol stack for Bluetooth and Wi-Fi connections. Cells with a lighter background are standardized open proto￾cols/formats; darker cells are proprietary and largely undoc￾umented. PB is ProtoBuf. Icons represent health data (heart), Internet access (clouds), and local messages (arrows). 4 [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 4
Figure 4. A-over-C layer with surrounding encryption layers. [PITH_FULL_IMAGE:figures/full_fig_p006_4.png] view at source ↗
Figures from the paper (10 more)
Figure 3
Figure 3. Figure 3: Common byte structure of Alloy application data [PITH_FULL_IMAGE:figures/full_fig_p006_3.png]
Figure 6
Figure 6. Figure 6: A generic Shoes request. Destination data is depen [PITH_FULL_IMAGE:figures/full_fig_p007_6.png]
Figure 5
Figure 5. Figure 5: A simplified illustration of a NanoSync message [PITH_FULL_IMAGE:figures/full_fig_p007_5.png]
Figure 8
Figure 8. Figure 8: The WatchWitch app in context, showing the Apple [PITH_FULL_IMAGE:figures/full_fig_p008_8.png]
Figure 10
Figure 10. Figure 10: WatchWitch’s health log and firewall views. [PITH_FULL_IMAGE:figures/full_fig_p009_10.png]
Figure 11
Figure 11. Figure 11: A Signal message sent to the Android phone is [PITH_FULL_IMAGE:figures/full_fig_p009_11.png]
Figure 12
Figure 12. Figure 12: Attacking the Apple Watch by replacing an IKEv2 [PITH_FULL_IMAGE:figures/full_fig_p012_12.png]
Figure 13
Figure 13. Figure 13: Anatomy of a vulnerable A-over-C message in [PITH_FULL_IMAGE:figures/full_fig_p012_13.png]
Figure 14
Figure 14. Figure 14: Local-first (top) versus cloud-first (bottom) smart [PITH_FULL_IMAGE:figures/full_fig_p013_14.png]
Figure 15
Figure 15. Figure 15: NRLP message byte format. The calculation of the checksum present at the end of each NRLP packet (see [PITH_FULL_IMAGE:figures/full_fig_p016_15.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

103 extracted references · 72 canonical work pages

  1. [1]

    Android Open Source Project. 2023. Android Keystore system. Retrieved March 27, 2024 from https://developer.android.com/privacy-and-security/keystore

    2023

  2. [2]

    Android Open Source Project. 2023. IpSecManager. Retrieved May 13, 2024 from https://developer.android.com/reference/android/net/IpSecManager

    2023

  3. [3]

    2024.NotificationListenerService

    Android Open Source Project. 2024.NotificationListenerService. Retrieved May 13, 2024 from https://developer.android.com/reference/android/service/notification/ NotificationListenerService

    2024

  4. [4]

    Apple Inc. 2021. Data Protection classes . Retrieved April 10, 2024 from https: //support.apple.com/guide/security/data-protection-classes-secb010e978a/web

    2021

  5. [5]

    Apple Inc. 2021. Keychain Data Protection . Retrieved March 27, 2024 from https://support.apple.com/guide/security/secb0694df1a

    2021

  6. [6]

    Apple Inc. 2023. Apple Watch Ultra 2 . Retrieved April 2, 2024 from https: //www.apple.com/apple-watch-ultra-2/

    2023

  7. [7]

    Apple Inc. 2023. Health Privacy Overview. https://www.apple.com/ios/health/ pdf/Health_Privacy_White_Paper_May_2023.pdf

    2023

  8. [8]

    Apple Inc. 2024. About the security content of watchOS 10.3 . Retrieved May 15, 2024 from https://support.apple.com/en-us/HT214060

    2024

Show all 103 references
  1. [9]

    Apple Inc. 2024. Bluetooth. Retrieved May 22, 2024 from https://developer.apple. com/bluetooth/

    2024

  2. [10]

    Apple Inc. 2024. Hand off tasks from Apple Watch . Retrieved May 15, 2024 from https://support.apple.com/guide/watch/hand-off-tasks-from-apple-watch- apdc40081790/watchos

    2024

  3. [11]

    Apple Inc. 2024. iMessage with PQ3: The new state of the art in quantum-secure messaging at scale. Retrieved May 23, 2024 from https://security.apple.com/blog/ imessage-pq3/

    2024

  4. [12]

    Apple Inc. 2024. Track your sleep with Apple Watch . Retrieved May 21, 2024 from https://support.apple.com/guide/watch/track-your-sleep-apd830528336/ 10.0/watchos/10.0

    2024

  5. [13]

    Apple Inc. 2024. Track your sleep with Apple Watch. Retrieved May 23, 2024 from https://www.apple.com/watchos/feature-availability/

    2024

  6. [14]

    Apple Inc. 2024. Use Camera Remote and timer on Apple Watch. Retrieved May 15, 2024 from https://support.apple.com/guide/watch/camera-remote-apda6e61c287/ watchos

    2024

  7. [15]

    The AsteroidOS Project. 2024. Free your wrist - AsteroidOS . Retrieved April 2, 2024 from https://asteroidos.org/

    2024

  8. [16]

    Baggili, Jeff Oduro, Kyle Anthony, Frank Breitinger, and Glenn McGee

    Ibrahim M. Baggili, Jeff Oduro, Kyle Anthony, Frank Breitinger, and Glenn McGee

  9. [17]

    Elaine Barker and Quynh Dang. 2015. Recommendation for Key Management - Application-Specific Key Management Guidance . Technical Report NIST Spe- cial Publication (SP) 800-57 Part 3, Rev. 1. National Institute of Standards and Technology, Gaithersburg, MD. https://doi.org/10.6...

    2015 doi

  10. [18]

    Reuben Binns, Ulrik Lyngs, Max Van Kleek, Jun Zhao, Timothy Libert, and Nigel Shadbolt. 2018. Third Party Tracking in the Mobile Ecosystem. In Proceedings of the 10th ACM Conference on Web Science (Amsterdam, Netherlands) (WebSci ’18). Association for Computing Machinery, New ...

    2018

  11. [19]

    Braden, D

    R. Braden, D. Borman, and C. Partridge. 1988. Computing the Internet checksum. RFC 1071. https://doi.org/10.17487/RFC1071

    1988 doi

  12. [20]

    CardboardFace. 2022. WatchMuteMirror. https://havoc.app/package/ watchmutemirror

    2022

  13. [21]

    CARROT. 2024. CARROT Weather for Apple Watch. Retrieved May 23, 2024 from https://www.meetcarrot.com/weather/applewatch.html

    2024

  14. [22]

    Marco Casagrande, Eleonora Losiouk, Mauro Conti, Mathias Payer, and Daniele Antonioli. 2022. BreakMi: Reversing, Exploiting and Fixing Xiaomi Fitness Tracking Ecosystem. IACR Trans. Cryptogr. Hardw. Embed. Syst. 2022, 3 (2022), 330–366. https://doi.org/10.46586/TCHES.V2022.I3.330-366

    2022 doi

  15. [23]

    Julian Chokkattu. 2022. Google’s Long-A waited Pixel Watch Is Finally Here. https: //www.wired.com/story/google-pixel-watch-features-release-date-price/

    2022

  16. [24]

    Jiska Classen. 2024. Frida Scripts for iOS . Retrieved May 22, 2024 from https: //github.com/seemoo-lab/frida-scripts

    2024

  17. [25]

    Jiska Classen, Alexander Heinrich, Robert Reith, and Matthias Hollick. 2022. Evil Never Sleeps: When Wireless Malware Stays On after Turning Off iPhones. InPro- ceedings of the 15th ACM Conference on Security and Privacy in Wireless and Mobile Networks (San Antonio, TX, USA) (...

    2022

  18. [26]

    Jiska Classen, Daniel Wegemer, Paul Patras, Tom Spink, and Matthias Hollick

  19. [27]

    2024.Apple Watch Pulse Oximetry Can Be Reactivated Through Software in 2028 or With Successful Appeal

    Juli Clover. 2024.Apple Watch Pulse Oximetry Can Be Reactivated Through Software in 2028 or With Successful Appeal . Retrieved May 23, 2024 from https://www. macrumors.com/2024/03/12/apple-watch-blood-oxygen-sensor-software/

    2024

  20. [28]

    Tim Cooijmans, Joeri de Ruiter, and Erik Poll. 2014. Analysis of Secure Key Storage Solutions on Android. InProceedings of the 4th ACM Workshop on Security and Privacy in Smartphones & Mobile Devices (Scottsdale, Arizona, USA) (SPSM ’14). Association for Computing Machinery, N...

    2014

  21. [29]

    Counterpoint. 2023. Global Smartwatch Market Rebounds; Huawei and Fire-Boltt Hit New Peaks. https://counterpointresearch.com/insights/global-smartwatch- market-rebounds-huawei-and-fire-boltt-hit-new-peaks/

    2023

  22. [30]

    Joseph Cox. 2024. Leaked Docs Show What Phones Cellebrite Can (and Can’t) Unlock. Retrieved August 14, 2024 from https://www.404media.co/leaked-docs- show-what-phones-cellebrite-can-and-cant-unlock/

    2024

  23. [31]

    Cross Forward Consulting LLC. 2024. Pedometer++. Retrieved May 23, 2024 from https://pedometer.app/

    2024

  24. [32]

    Crunchy Bagel Pty Ltd. 2018. outcast - The podcast player for Apple Watch . Retrieved May 23, 2024 from https://outcastapp.com/

    2018

  25. [33]

    Phoebe Davis. 2023. British police testing women for abortion drugs . https://www.tortoisemedia.com/2023/10/30/british-police-testing-women-for- abortion-drugs/

    2023

  26. [34]

    Paterson

    Jean Paul Degabriele, Jérôme Govinden, Felix Günther, and Kenneth G. Paterson

  27. [35]

    Peter Deutsch

    L. Peter Deutsch. 1996. GZIP file format specification version 4.3. RFC 1952. https://doi.org/10.17487/RFC1952

    1996 doi

  28. [36]

    Quang Do, Ben Martini, and Kim-Kwang Raymond Choo. 2017. Is the data on your wearable device secure? An Android Wear smartwatch case study. Softw. Pract. Exp. 47, 3 (2017), 391–403. https://doi.org/10.1002/SPE.2414

    2017 doi

  29. [37]

    Danny Dolev and Andrew Chi-Chih Yao. 1983. On the security of public key protocols. IEEE Trans. Inf. Theory 29, 2 (1983), 198–207. https://doi.org/10.1109/ TIT.1983.1056650

    1983

  30. [38]

    European Parliament. 2022. Deal on Digital Markets Act: EU rules to ensure fair competition and more choice for users . Retrieved May 23, 2024 from https://www.europarl.europa.eu/news/en/press-room/20220315IPR25504/deal- on-digital-markets-act-ensuring-fair-competition-and-mor...

    2022

  31. [39]

    Matt Evans. 2023. Where is all your health data going? The Google and Fitbit scandal explained. Retrieved March 28, 2024 from https://www.techradar.com/ health-fitness/fitness-trackers/google-and-fitbit-scandal-explained

    2023

  32. [40]

    Hossein Fereidooni, Jiska Classen, Tom Spink, Paul Patras, Markus Miettinen, Ahmad-Reza Sadeghi, Matthias Hollick, and Mauro Conti. 2017. Breaking Fitness Records Without Moving: Reverse Engineering and Spoofing Fitbit. In Research in Attacks, Intrusions, and Defenses - 20th I...

    2017

  33. [41]

    Marc Fischlin and Olga Sanina. 2021. Cryptographic Analysis of the Bluetooth Secure Connection Protocol Suite. In Advances in Cryptology - ASIACRYPT 2021 - 27th International Conference on the Theory and Application of Cryptology and Information Security, Singapore, December 6...

    2021 doi

  34. [42]

    Lars Fröder, kok3shidoll, and Évelyne. 2023. Dopamine Jailbreak. Retrieved May 21, 2024 from https://ellekit.space/dopamine/

    2023

  35. [43]

    Fu and Jerome Solinas

    David E. Fu and Jerome Solinas. 2007. ECP Groups For IKE and IKEv2 . Request for Comments RFC 4753. Internet Engineering Task Force. https://doi.org/10. 17487/RFC4753

    2007

  36. [44]

    Christina Garman, Matthew Green, Gabriel Kaptchuk, Ian Miers, and Michael Rushanan. 2016. Dancing on the Lip of the Volcano: Chosen Ciphertext Attacks on Apple iMessage. In 25th USENIX Security Symposium, USENIX Security 16, Austin, TX, USA, August 10-12, 2016 , Thorsten Holz ...

    2016

  37. [45]

    Google LLC. 2024. Protocol Buffers. Retrieved May 5, 2024 from https://protobuf. dev/ 14 WatchWitch ()

    2024

  38. [46]

    Scharon Harding. 2024. Apple Watch no longer sold with blood oxy- gen monitoring after patent battle loss . Retrieved April 2, 2024 from https://arstechnica.com/gadgets/2024/01/apple-watch-no-longer-sold-with- blood-oxygen-monitoring-after-patent-battle-loss/

    2024

  39. [47]

    HASHBANG Productions. 2021. Cephei Reference. Retrieved April 23, 2024 from https://hbang.github.io/libcephei/

    2021

  40. [48]

    Dennis Heinze, Jiska Classen, and Matthias Hollick. 2020. ToothPicker: Apple Picking in the iOS Bluetooth Stack. In 14th USENIX Workshop on Offensive Tech- nologies, WOOT 2020, August 11, 2020 , Yuval Yarom and Sarah Zennou (Eds.). USENIX Association. https://www.usenix.org/co...

    2020

  41. [49]

    Dennis Heinze, Jiska Classen, and Felix Rohrbach. 2020. MagicPairing: Apple’s take on securing Bluetooth peripherals. InProceedings of the 13th ACM Conference on Security and Privacy in Wireless and Mobile Networks (Linz, Austria) (WiSec ’20). Association for Computing Machine...

    2020

  42. [50]

    IANA. 2023. Internet Key Exchange Version 2 (IKEv2) Parameters . Retrieved August 14, 2024 from https://www.iana.org/assignments/ikev2-parameters/ikev2- parameters.xhtml

    2023

  43. [51]

    JJTech. 2023. iMessage, explained. Retrieved May 24, 2024 from https://jjtech. dev/reverse-engineering/imessage-explained/

    2023

  44. [52]

    Daniel Jost. 2014. A constructive analysis of IPsec . Master’s thesis. ETH-Zürich

    2014

  45. [53]

    Hoffman, Yoav Nir, Pasi Eronen, and Tero Kivinen

    Charlie Kaufman, Paul E. Hoffman, Yoav Nir, Pasi Eronen, and Tero Kivinen

  46. [54]

    Stephen Kent. 2005. IP Encapsulating Security Payload (ESP). RFC 4303. https: //doi.org/10.17487/RFC4303

    2005 doi

  47. [55]

    Mika Kojo and Tero Kivinen. 2003. More Modular Exponential (MODP) Diffie- Hellman Groups for Internet Key Exchange (IKE) . Request for Comments RFC

    2003

  48. [56]

    Jakob Krantz. 2024. ZSWatch. Retrieved March 27, 2024 from https://github.com/ jakkra/ZSWatch

    2024

  49. [57]

    Tobias Kröll, Stephan Kleber, Frank Kargl, Matthias Hollick, and Jiska Classen

  50. [58]

    2016.Elliptic Curves for Security

    Adam Langley, Mike Hamburg, and Sean Turner. 2016.Elliptic Curves for Security. Request for Comments RFC 7748. Internet Engineering Task Force. https://doi. org/10.17487/RFC7748

    2016 doi

  51. [59]

    Leech, M

    M. Leech, M. Ganis, Y. Lee, R. Kuris, D. Koblas, and L. Jones. 1996.SOCKS Protocol Version 5. Request for Comments RFC 1928. Internet Engineering Task Force. https://doi.org/10.17487/RFC1928

    1996 doi

  52. [60]

    lunotech11. 2022. Legizmo ’Jupiter’ (watchOS 6-8) . https://chariz.com/buy/ legizmo-jupiter

    2022

  53. [61]

    lunotech11. 2023. Legizmo. https://legizmo.app

    2023

  54. [62]

    Áine MacDermott, Stephen Lea, Farkhund Iqbal, Ibrahim Idowu, and Babar Shah

  55. [63]

    InComputer Security – ESORICS 2021, Elisa Bertino, Haya Shulman, and Michael Waidner (Eds.)

    ARIstoteles – Dissecting Apple’s Baseband Interface. InComputer Security – ESORICS 2021, Elisa Bertino, Haya Shulman, and Michael Waidner (Eds.). Springer International Publishing, Cham, 133–151

    2021

  56. [64]

    René Mayrhofer, Jeffrey Vander Stoep, Chad Brubaker, and Nick Kralevich. 2021. The Android Platform Security Model. ACM Trans. Priv. Secur. 24, 3, Article 19 (apr 2021), 35 pages. https://doi.org/10.1145/3448609

    2021 doi

  57. [65]

    James McGee. 2023. Enriching Investigations with Apple Watch Data Through the healthdb_secure.sqlite Database. DFIR Review (2023). https://dfir.pubpub. org/pub/xqvcn3hj

    2023

  58. [66]

    Axel Metz. 2023. Exclusive: Samsung explains why it dropped iOS support on the Galaxy Watch . https://www.techradar.com/health- fitness/smartwatches/exclusive-samsung-explains-why-it-dropped-ios- support-on-the-galaxy-watch

    2023

  59. [67]

    Chance Miller. 2024. Apple says it spent three years trying to bring Apple Watch to Android. Retrieved March 27, 2024 from https://9to5mac.com/2024/03/21/ apple-watch-android-apple-work/

    2024

  60. [68]

    Yoav Nir and Simon Josefsson. 2016. Curve25519 and Curve448 for the Internet Key Exchange Protocol Version 2 (IKEv2) Key Agreement . Request for Comments RFC 8031. Internet Engineering Task Force. https://doi.org/10.17487/RFC8031

    2016 doi

  61. [69]

    Yuichi Niwa, Keisuke Ohashi, Kazuhiko Minematsu, and Tetsu Iwata. 2015. GCM Security Bounds Reconsidered. In Fast Software Encryption, Gregor Leander (Ed.). Springer, Berlin, Heidelberg, 385–407. https://doi.org/10.1007/978-3-662-48116- 5_19

    2015 doi

  62. [70]

    Magnet Forensics. 2024. Magnet Graykey. https://www.magnetforensics.com/ products/magnet-graykey/

    2024

  63. [71]

    palera1n team. 2024. palera1n - Jailbreak for A8 through A11 devices, on iOS 15.0 and higher. Retrieved May 21, 2024 from https://palera.in/

    2024

  64. [72]

    Ayden Panhuyzen. 2020. WinterMode. https://github.com/aydenp/WinterMode

    2020

  65. [73]

    Paige Papandrea. 2019. Addressing the HIPAA-potamus sized gap in wearable technology regulation. Minn. L. Rev. 104 (2019), 1095

    2019

  66. [74]

    PINE64. 2024. PineTime. https://pine64.org/devices/pinetime/

    2024

  67. [75]

    Ole André V. Ravnås. 2017. Frida • A world-class dynamic instrumentation toolkit . Retrieved May 22, 2024 from https://frida.re/

    2017

  68. [76]

    Thomas Roth, Fabian Freyer, Matthias Hollick, and Jiska Classen. 2022. AirTag of the Clones: Shenanigans with Liberated Item Finders. In 2022 IEEE Security and Privacy Workshops (SPW). 301–311. https://doi.org/10.1109/SPW54247.2022. 9833881

    2022

  69. [77]

    Charlie Osborne. 2021. Over 60 million wearable, fitness tracking records exposed via unsecured database. Retrieved April 2, 2024 from https://www.zdnet.com/article/over-60-million-records-exposed-in-wearable- fitness-tracking-data-breach-via-unsecured-database/

    2021

  70. [78]

    Samsung Inc. 2023. Galaxy Watch6. Retrieved April 2, 2024 from https://www. samsung.com/us/watches/galaxy-watch6/#desc-section

    2023

  71. [79]

    SEEMOO Lab. 2019. Fitbit Open Source Android App. https://github.com/seemoo- lab/fitness-app

    2019

  72. [80]

    Signal. 2024. Database Secret Provider . Retrieved May 22, 2024 from https://github.com/signalapp/Signal-Android/blob/main/app/src/main/java/ org/thoughtcrime/securesms/crypto/DatabaseSecretProvider.java

    2024

  73. [81]

    Alejandra Guadalupe Silva-Trujillo, Mauricio Jacobo González González, Luis Pablo Rocha Pérez, and Luis Javier García Villalba. 2023. Cybersecurity Analysis of Wearable Devices: Smartwatches Passive Attack.Sensors 23, 12 (2023). https://doi.org/10.3390/s23125438

    2023 doi

  74. [82]

    SmartGym. 2023. SmartGym - Apple Watch App. Retrieved May 23, 2024 from https://smartgymapp.com/watch

    2023

  75. [83]

    Paul Smith. 2024. Open-SmartWatch. Retrieved March 27, 2024 from https: //open-smartwatch.github.io/

    2024

  76. [84]

    Jan Ruge, Jiska Classen, Francesco Gringoli, and Matthias Hollick. 2020. Franken- stein: Advanced Wireless Fuzzing to Exploit New Bluetooth Escalation Targets. In 29th USENIX Security Symposium (USENIX Security 20) . USENIX Association, 19–36. https://www.usenix.org/conference...

    2020

  77. [85]

    Milan Stute, David Kreitschmann, and Matthias Hollick. 2018. One Billion Apples’ Secret Sauce: Recipe for the Apple Wireless Direct Link Ad hoc Protocol. In Proceedings of the 24th Annual International Conference on Mobile Computing and Networking, MobiCom 2018, New Delhi, Ind...

    2018

  78. [86]

    The Tcpdump Group. 2024. Tcpdump & Libpcap. Retrieved May 22, 2024 from https://www.tcpdump.org/

    2024

  79. [87]

    Theos Community. 2021. Documentation Home. Retrieved April 23, 2024 from https://theos.dev/docs/

    2021

  80. [88]

    tihmstar. 2018. jelbrekTime. Retrieved April 04, 2024 from https://github.com/ tihmstar/jelbrekTime

    2018

  81. [89]

    udevsharold. 2021. NanoFi. https://github.com/udevsharold/nanofi

    2021

  82. [90]

    Apple Inc., No

    United States of America et al v. Apple Inc., No. 2:24-cv-04055. 2024. Complaint. (D.N.J. Mar. 21, 2024). Retrieved March 27, 2024 from https://www.justice.gov/ opa/media/1344546/dl

    2024

  83. [91]

    Milan Stute, Alexander Heinrich, Jannik Lorenz, and Matthias Hollick. 2021. Disrupting Continuity of Apple’s Wireless Ecosystem Security: New Tracking, DoS, and MitM Attacks on iOS and macOS Through Bluetooth Low Energy, AWDL, and Wi-Fi. In 30th USENIX Security Symposium, USEN...

    2021

  84. [92]

    Mathy Vanhoef and Frank Piessens. 2017. Key Reinstallation Attacks: Forcing Nonce Reuse in WPA2. In Proceedings of the 24th ACM Conference on Computer and Communications Security (CCS) . ACM

    2017

  85. [93]

    Mathy Vanhoef and Eyal Ronen. 2020. Dragonblood: Analyzing the Dragonfly Handshake of WPA3 and EAP-pwd. In 2020 IEEE Symposium on Security and Privacy, SP 2020, San Francisco, CA, USA, May 18-21, 2020 . IEEE, 517–533. https: //doi.org/10.1109/SP40000.2020.00031

    2020

  86. [94]

    Serge Vaudenay. 2002. Security Flaws Induced by CBC Padding - Applica- tions to SSL, IPSEC, WTLS .... In Advances in Cryptology - EUROCRYPT 2002, International Conference on the Theory and Applications of Cryptographic Tech- niques, Amsterdam, The Netherlands, April 28 - May 2...

    2002 doi

  87. [95]

    Yu Wang. 2022. Dive into Apple IO80211FamilyV2 Vol. II. Retrieved August 21, 2024 from https://i.blackhat.com/USA-22/Wednesday/US-22-Wang-Dive-into- Apple-IO80211Family-Vol-II.pdf

    2022

  88. [96]

    Received %d remote services from the remote master %p !

    Zetetic LLC. 2024. SQLCipher - Full Database Encryption for SQLite . Retrieved April 22, 2024 from https://www.zetetic.net/sqlcipher/ 15 () Nils Rollshausen, Alexander Heinrich, Matthias Hollick, and Jiska Classen A Appendix A.1 Magnet The basic packet structure of Magnet has ...

  89. [98]

    Department of Health and Human Services

    U.S. Department of Health and Human Services. 2022. Summary of the HIPAA Privacy Rule . Retrieved May 21, 2024 from https://www.hhs.gov/hipaa/for- professionals/privacy/laws-regulations/index.html

    2022

  90. [2014]

    RFC 7296

    Internet Key Exchange Protocol Version 2 (IKEv2). RFC 7296. https: //doi.org/10.17487/RFC7296

    doi

  91. [2015]

    In 10th International Conference on A vailability, Reliability and Security, ARES 2015, Toulouse, France, August 24-27, 2015

    Watch What You Wear: Preliminary Forensic Analysis of Smart Watches. In 10th International Conference on A vailability, Reliability and Security, ARES 2015, Toulouse, France, August 24-27, 2015 . IEEE Computer Society, 303–311. https: //doi.org/10.1109/ARES.2015.39

    2015 doi

  92. [2018]

    Anatomy of a Vulnerable Fitness Tracking System: Dissecting the Fitbit Cloud, App, and Firmware. Proc. ACM Interact. Mob. Wearable Ubiquitous Technol. 2, 1 (2018), 5:1–5:24. https://doi.org/10.1145/3191737

    2018 doi

  93. [2019]

    In 2019 10th IFIP International Conference on New Technologies, Mobility and Security (NTMS)

    Forensic Analysis of Wearable Devices: Fitbit, Garmin and HETP Watches. In 2019 10th IFIP International Conference on New Technologies, Mobility and Security (NTMS). 1–6. https://doi.org/10.1109/NTMS.2019.8763834

    2019

  94. [2021]

    In Pro- ceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security (CCS ’21)

    The Security of ChaCha20-Poly1305 in the Multi-User Setting. In Pro- ceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security (CCS ’21) . Association for Computing Machinery, New York, NY, USA, 1981–2003. https://doi.org/10.1145/3460120.3484814

    2021

  95. [3526]

    https://doi.org/10.17487/RFC3526

    Internet Engineering Task Force. https://doi.org/10.17487/RFC3526

    doi

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.