Your Smart Scale is Leaking More than Your Weight

### Biometric Privacy in Everyday Consumer IoT At 00:00, Erez Yalon (Checkmarx) examines the security posture of smart personal health devices, exploring how connected bathroom scales expose sensitive user biometrics and home network telemetry.

### The Proliferation of Insecure Bluetooth Appliances At 06:00, Yalon surveys the consumer IoT market, noting that manufacturers have embedded Bluetooth Low Energy (BLE) transceivers into personal devices—including smart toothbrushes, baby pacifiers, and bathroom scales—often without implementing baseline encryption.

### Reverse Engineering Smart Scale Communications At 12:01, the presenter details reverse-engineering a commercial smart scale and its mobile companion application. The analysis reveals that the device broadcasts unencrypted telemetry payloads over standard BLE advertising packets.

### Long-Range BLE Interception and Physical Sniffing At 18:00, Yalon demonstrates real-world sniffing tests. Utilizing standard software-defined radios and directional antennas, researchers captured unencrypted biometric data—including user weight, body fat percentages, and device identifiers—from over 100 meters away through interior building walls.

### Cloud API Vulnerabilities and Data Harvesting Concluding between 24:00 and 30:03, Yalon highlights serious vulnerabilities in cloud backends. Companion mobile APIs frequently suffer from Insecure Direct Object References (IDOR) and misconfigured cloud buckets, allowing attackers to enumerate historical user health profiles across thousands of accounts.

(AI summary — Gemini Flash)