It looks like the unchallenged dominant position and popularity of the Fitbit company on the market might be jeopardized as major and justified concerns arise regarding their product.

I’m talking about the (supposed) Fitbit tracker 10 second hack that took place at the Hacktivity Conference in Budapest on 9-10 October this year.

That’s right, Fitbit’s fitness tracker was apparently hacked in just 10 seconds. But “fortunately” for the company, this hack was publicly announced  and performed in a well intentioned manner by a security researcher working at Fortinet, named Axelle Apvrille, who did this specifically to warn the company (and especially its users).

She used the fitness tracker’s open Bluetooth connection to send data packets to the tracker, which could then be transmitted to the computer that the user had connected the tracker to, as the day’s activities are synced.

Though she didn’t infect the device she demonstrated on with an actual, real piece of malware or virus, she claimed that the payload she could send was sufficiently large to do so (17 bytes), despite being quite small compared to today’s data storage and transfer capabilities.

So, in short, she had the freedom to send whatever she wanted to the tracker and then to the computer with no obstacle whatsoever in her way, except for the before-mentioned (sufficient) size limit.

Guillaume Lovet, a senior manager at FortiGuard, part of Fortinet, also confirmed the hack, telling CBS News that Apvrille had managed to show “that the Fitbit firmware has vulnerabilities that allowed her to plant arbitrary bytes into the Fitbit, those bytes then being, ‘reflected’ to a computer talking to a Fitbit.”

Now imagine how much more shocking it would have been to users if these vulnerabilities giving unstoppable access to strangers were announced via actual malicious hacks, as opposed to Apvrille’s gracious intervention.

Especially since, probably the most intriguing point she made, due to its security risks deriving from the Bluetooth connection and a hack taking such a small amount of time, it means that your Fitbit could be easily hacked by anyone in your vicinity, say someone who knows where you stop for a drink of water when you go out to run, or just a good-reflexes, speedy hacker that notices your Fitbit while sitting on a bench near you when you take a brief rest.

Another fun part? Apvrille said that she can also manipulate the data on the Fitbit itself (like your distance covered or number of steps taken). So if you get a hacker troll, he might mess with this data to ruin your feel-good vibe just for fun.

Axelle Apvrille will present Fitbit findings again this Thursday at the Hack.lu event in Luxembourg.

However, Fitbit disputes Apvrille’s claims.

Image source: 1.