That’s because most smart watches rely on a six-digit PIN to secure information traveling to and from connected Android smartphones. With only one million possible keys securing the Bluetooth connection between the handset and the smart device, the PINs are susceptible to brute-force attacks, in which a nearby hacker attempts every possible combination until finding the right one.

Researchers from security firm Bitdefender mounted a proof-of-concept hack against a Samsung Gear Live smartwatch that was paired with a Google Nexus 4 running Android L Preview. Using readily available hacking tools, they found that the PIN obfuscating the Bluetooth connection between the two devices was easily brute forced. From that point on, they were able to monitor the information passing between the watch and the phone.

The findings aren’t particularly surprising. Six-digit PINs have always contained one million possible combinations. Security engineers have long known that’s hardly enough entropy to prevent a determined hacker from arriving at the right sequence of numbers. Still, the research is important because it comes at an important time. With the explosion of relatively new smartwatches and other wearable smart devices, the data traveling over Bluetooth connections is growing ever more sensitive. Smart device manufacturers would do well to create more secure communications channels now, before the devices become ubiquito.

Read full article on Arstechnica