Forensics on Pixel Watch and Fitbit

zanea-wemmer

I'm looking at either buying a pixel watch or fitbit in order to get Google Pay, reply to messages on the go, track steps, etc but my threat model involves forensics when my adversary physically has my devices

I was wondering if anyone knew if notifications sent to either/both watches ever gets written to disk or if its RAM only, my threat model means its okayish for the short window between device seized and the pixel auto rebooting but if my entire conversation history can be pulled from the watch that's an issue

I think wearos is open source but I don't know how to read code, I would really appreciate if someone checks for me or if they happen to already know

thmf

zanea-wemmer I think wearos is open source

GrapheneOS account stated multiple times that WearOS is only partially open source, so I guess it wouldn't be possible look at all of the code at least not easily. There should be other avenues how to approach this, for example analyzing all the watch traffic going out, but I'm not aware of such efforts.
Also, WearOS is Android 11, so probably not all security and privacy improvements are there.

grayway2

zanea-wemmer I don't know much about wearOS but if my threat involved forensics, I would not use a smart watch but rather a regular watch. The more devices you have , the more you'll have to be careful about not screwing the security with one of them

DeletedUser622

grayway2 I would not use a smart watch but rather a regular watch

Casio G-Shock is the way.

DeletedUser639

grayway2 The more devices you have , the more you'll have to be careful about not screwing the security with one of them

Exactly,
and on those lines here's a thought Android auto, Google equpped vehicle, embedded sim in the ECU for talking with the factory engineers etc,
Like you say the more devices you have and connect to your phone...

Oh year smart watch, smart is not the word that readily comes to my mind to describe the device.

grayway2

DeletedUser639 Modern cars are constantly transmitting a lot of data to the factory and with Android Auto it's even worse. Now it's not only your location or driving habits but also your SMS, contact list or installed apps.

Forensics are interested by everything, even the TV, the doorbell camera and the XBOX.