Sniff Bluetooth traffic using Fitness Tracker

Question

I am attempting to sniff the Bluetooth between the fitness tracker(GOJI ACTIVE GFITBK20 Activity Tracker) and the application(Goji Active) installed on the phone but I am unable to see any health information such as heart beat rate, calories, sleep, distance, sleep hours, etc from the Bluetooth traffic generated from the Android Phone using Wireshark.

I enabled the Developer option on the phone and enable "Enable Bluetooth HCI snoop log" to gather Bluetooth logs.

1. I disable Bluetooth and enable Bluetooth from the phone.
2. I run the Fitness Tracker App and run it.
3. I then connect the Android phone to the Laptop and run adb to generate bugreport using the command, adb bugreport bluetooth
4. I use Wireshark to analyze the logs, btsnoop_hci.log.

I have attached the Bluetooth logs via Wireshark and unable to look for information relating to health information transmitted. Is it encrypted or decrypted? How do we determine this?

Please kindly advise and assist.

Answer 1

You have the app, therefore if you want to know the data format of the packets decompile the app. For standard Java/Kotlin apps Jadx-GUI is an easy start. If Xamarin/MAUI is used it is getting more complicated, and even worse if react native is used. You have to see is and which framework is used in your app.

The HCI snoop log is a good start, but personally I prefer a rooted device and some Frida hooks like blemon to capture Bluetooth traffic. In combination with the knowledge from decompiling you can extend the frida script with own hooks to see the data before it is encoded into the BLE packets.