Popular Home ECG Monitors Leak Heart Data Over Unencrypted Bluetooth, Study Finds

Portable electrocardiogram monitors have become one of the quiet success stories of modern healthcare. Since the COVID-19 pandemic accelerated the shift toward remote patient monitoring, pocket-sized devices that can record a clinical-grade heart rhythm in thirty seconds have moved from cardiology wards into millions of homes. But a new systematic security analysis suggests that the wireless plumbing connecting these devices to our smartphones is far weaker than the medical data flowing through it deserves. Researchers at Manchester Metropolitan University in the United Kingdom have uncovered multiple vulnerabilities in three widely used consumer ECG monitors, including one device that transmits blood pressure readings and heart rhythms over Bluetooth in completely unencrypted plaintext.

The study, published in Frontiers in the Internet of Things, examined the Beurer BM 95 upper arm blood pressure monitor with ECG function, the AliveCor KardiaMobile 6L six-lead ECG monitor, and the OMRON Complete blood pressure and ECG monitor. All three devices pair with companion Android apps over Bluetooth Low Energy, the power-sipping variant of Bluetooth that has become the default radio for wearable and portable health technology. Led by Alex Akinbi and Preethi Paul Raj from the university’s Department of Computing and Mathematics, the team built its investigation around a deliberately proactive philosophy: rather than waiting for a breach and reconstructing what happened, they modeled the threats first, then attacked the devices in a controlled laboratory setting to see which of those threats were real.

That modeling work began with a systematic literature review following established software engineering guidelines. The researchers searched five major digital libraries, including IEEE Xplore, ScienceDirect, the ACM Digital Library, Google Scholar and SpringerLink, for peer-reviewed studies published between January 2020 and January 2025 that addressed security threats and threat modeling for medical Internet of Things systems. The initial search returned 574 publications, which the team whittled down through successive rounds of inclusion and exclusion filtering to 34 relevant papers. From those, they extracted a catalogue of 48 distinct threats spanning device sensors, network communication, cloud storage and companion smartphones, which they consolidated into 36 threats specific to portable ECG ecosystems, organized into five attack categories: companion device attacks, wireless network attacks, cloud and server-side attacks, software and firmware exploitation, and side-channel attacks.

To turn that catalogue into an actionable test plan, the researchers combined two complementary threat modeling techniques. STRIDE, a framework originally developed at Microsoft, was used to understand the security boundaries of each component in the ECG ecosystem, from the sensor electrodes to the smartphone app to the cloud backend. Attack trees, a technique dating back to security pioneer Bruce Schneier, were then used to map out the concrete paths an attacker could take toward a specific goal, with each branch of the tree representing a sub-goal or attack method. Some branches required multiple weaknesses to be chained together before a breach occurred; others could cause a breach on their own. This dual approach, the authors argue, addresses a gap in prior work, which often tested medical devices without a reproducible, systematic methodology that other security analysts could follow.

The experimental setup was deliberately grounded in realistic adversarial capabilities. A Google Pixel 8a running Android 14 served as the companion smartphone, paired with each ECG device in turn. The phone was rooted using Magisk, a widely available rooting tool, with the Shamiko module deployed to hide the rooted status from apps that attempt to detect and block compromised devices. BLE traffic was captured with an nRF52840 dongle acting as a hardware sniffer, alongside Wireshark for protocol analysis and the Android Bluetooth HCI snoop log retrieved through the Android Debug Bridge. Forensic imaging and app data analysis were performed with Magnet Axiom Process and Autopsy. The study received ethical approval from Manchester Metropolitan University’s Research Ethics Committee, and all ECG recordings collected from volunteers were anonymized before analysis.

The most striking finding concerns the Beurer BM 95. Traffic analysis revealed that the device uses the BLE ‘Just Works’ association model at Security Mode 1, Level 1, which provides no encryption and no authentication whatsoever. In packet captures, the team could read blood pressure measurements, heart rate values, status information and even a user identifier flowing between the device and the smartphone in plaintext, visible to anyone within radio range with an inexpensive sniffer. Because no secure pairing is implemented, the researchers note that more sophisticated man-in-the-middle attacks and secure simple pairing attacks become possible in specific scenarios, including the injection of malicious readings into the data stream. The device runs Bluetooth 4.0, and the analysis linked it to two known vulnerabilities, CVE-2023-24023 and CVE-2019-9506, carrying medium and high severity scores respectively.

The KardiaMobile 6L and OMRON Complete fared somewhat better, but not well enough to be reassuring. Both devices implement Security Mode 1, Level 2, which pairs through Just Works but at least encrypts the connection using a Long Term Key negotiated during pairing. Packet captures showed the LE Start Encryption command sequence, with the LTK, encrypted diversifier and random number exchanged to generate the session key. However, Just Works pairing offers no protection against man-in-the-middle attacks, because there is no mechanism for the user to verify that they are pairing with the legitimate device rather than an impostor. Both devices also run legacy Bluetooth versions, 4.2 and 4.1 respectively, which expose them to the KNOB attack, a downgrade technique that manipulates the encryption key negotiation to force keys with as little as one byte of entropy, rendering them trivially brute-forceable. Offline brute-force attacks on legacy pairing and BlueMirror attacks, which mirror legitimate device responses to trick systems into accepting unauthorized commands, round out the threat picture.

The team also probed the firmware itself. On both the Beurer BM 95 and the OMRON Complete, they identified the memory chip as an SST26VF032B, a 32-megabit serial flash memory, and used a CH341A programmer to extract the stored firmware. The recovered data turned out to be encrypted with OpenPGP, and without the encryption key the researchers could not decrypt it, a defensive measure that at least raises the bar for firmware tampering. The smartphone app analysis proved more revealing. On a rooted device, the Kardia app refused to run until the Shamiko module concealed the root status, and its SQLite database stored ECG results, timestamps, heart rates in beats per minute, device serial numbers and paired device records, alongside proprietary .atc files that can be parsed to visualize full six-lead ECG waveforms. The Omron Connect and Beurer HealthManager Pro apps ran on the rooted phone without any restriction, storing ECG waveform images and Realm database files named with hex-encoded user identifiers, all recoverable by an attacker who gains root access through malware.

The researchers were careful to acknowledge the limits of their work. Side-channel attacks, which leak cryptographic keys through power consumption or electromagnetic emanations, and cloud and server-side attacks were excluded from testing due to tooling limitations and ethical concerns about handling sensitive data on third-party infrastructure. That omission, they write, constrains the generalizability of the findings, particularly since real-world deployments increasingly connect such devices to hospital networks and analytics services. Still, the comparative verdict was unambiguous: while all three devices showed weaknesses, the Beurer BM 95 presents a significantly higher risk than the KardiaMobile 6L or the OMRON Complete, primarily because it transmits user data without any encryption and carries two known CVEs where the others carry one each.

The countermeasures the study proposes are technically straightforward but practically difficult. The gold standard is BLE Security Mode 1, Level 4, which uses LE Secure Connections with Elliptic Curve Diffie-Hellman key exchange and pairing models such as Numeric Comparison, Passkey Entry or out-of-band pairing, all of which resist man-in-the-middle and eavesdropping attacks. Replay attacks can be defeated with nonces and timestamps, and KNOB attacks by enforcing minimum key lengths during negotiation. The catch is that Bluetooth version support is baked into the radio adapter on the device’s motherboard, so firmware updates cannot upgrade a Bluetooth 4.0 chip to modern security. On the app side, the authors recommend multi-layered root detection and encrypting all health data with robust algorithms such as AES, with keys secured in the Android Keystore. As connected healthcare continues to expand, the study’s central message is that security must be designed into these ecosystems from the start, because the data at stake, the intimate electrical signature of a human heartbeat, is exactly the kind of information patients cannot afford to broadcast in the clear.

Subject of Research: Cybersecurity vulnerabilities in portable ECG medical IoT devices and their Bluetooth ecosystems

Article Title: A systematic security analysis of medical internet of things (MIoT) ecosystems in threat modeling scenarios

Article References: A systematic security analysis of medical internet of things (MIoT) ecosystems in threat modeling scenarios. (n.d.). https://doi.org/10.3389/friot.2025.1712430

Image Credits: AI Generated

DOI: 10.3389/friot.2025.1712430

Keywords: medical IoT, ECG monitors, Bluetooth Low Energy, threat modeling, penetration testing, cybersecurity, vulnerability analysis, STRIDE, attack trees, patient data privacy, firmware extraction, Android apps