Hackers Stalked Me by Hijacking a Smartwatch for Youngsters

Sinotrack and the NewGPS2012 platform didn’t reply to WIRED’s requests for remark, and the researchers say their hacking methods towards these programs nonetheless seem to work.

For greater than a decade, cybersecurity specialists and privateness advocates have warned that low cost, GPS-enabled youngsters’s smartwatches and aftermarket car equipment are riddled with safety vulnerabilities that depart children and drivers prone to hacking and monitoring. But the sheer variety of totally different manufacturers and fashions of these gadgets has typically made figuring out the actually insecure devices really feel almost not possible for customers.

More than any particular vulnerability, Solferini and Stykas say, they needed to focus on that a lot of that daunting range amongst GPS gadgets—together with customers’ sense of selection amongst them—is actually an phantasm.

“A parent in Sweden buying a ‘SafeKid’ watch and a parent in Spain buying a ‘SaveFamily’ watch are both sending their child’s location data to the same vulnerable myaqsh.com backend on Alibaba Cloud in mainland China, without knowing it,” they write in a whitepaper shared with WIRED forward of their Black Hat presentation, referring to the net companies of YiQingTeng. “The white-label model means a vulnerability in one backend affects dozens of consumer brands at the same time, and consumers have no way to tell which backend their product uses.”

The smartwatch WIRED examined was made by Shenzhen-based YiQingTeng Electronics and runs on the SETracker platform utilized by dozens of manufacturers and hundreds of thousands of gadgets.

Courtesy of Jobanny Cabrera

Solferini and Stykas aren’t revealing the total particulars of the vulnerabilities they found within the three main platforms, partly as a result of not all of them have been mounted regardless of sharing their findings with the businesses for months. In the case of YiQingTeng, the producer of the watch WIRED examined, nonetheless, they are saying an authentication safety flaw would have allowed anybody to ship instructions to any SETracker-based machine. That would let hackers exploit and take over gadgets at random or to focus on particular watches if they will decide an identifier for them, such because the guardian’s e mail deal with the machine is registered to. (To hack the smartwatch worn by a WIRED reporter, as an illustration, the reporter gave Stykas his e mail deal with however no different details about the machine. Stykas says he may have simply focused gadgets in different methods, equivalent to hacking quite a few watches and looking by way of them to search out the closest weak gadgets or one related to a goal’s figuring out info.)

In the case of SinoTrack, the researchers say they discovered that an account supposed for demonstration functions may very well be used to ship instructions to any of the platform’s hundreds of thousands of gadgets. They additionally discovered a SQL injection vulnerability—a flaw that primarily permits anybody to ship instructions disguised as knowledge which can be then executed by the SinoTrack server—that gave them entry to tens of hundreds of gadgets’ areas, passwords, and car data.

Finally, for NewGPS2012 gadgets, the researchers say they discovered related SQL injection vulnerabilities and had been capable of run their very own code on the corporate’s servers. They additionally say they discovered proof of a earlier compromise of the corporate’s programs, suggesting different unauthorized customers or hackers might have had entry to it for an unknown time frame.

Dozens of Devices, Years of Warnings

Given the sheer variety of totally different manufacturers and resellers of these Shenzhen-manufactured devices, the researchers didn’t verify the vulnerability of all the individually branded gadgets they discovered to make use of YiQingTeng’s SETracker platform or the NewGPS2012 platform. WIRED couldn’t independently verify every machine’s vulnerability both. But the desk beneath lists manufacturers whose merchandise had been based mostly at the least partly on these platforms, in addition to the corporate’s response when WIRED reached out for touch upon the researchers’ findings.

Stykas and Solferini’s Black Hat speak is much from the primary warning concerning the risks of low cost GPS gadgets—even from these researchers themselves. Stykas and one other researcher, Michael Gruhn, revealed a broad assortment of vulnerabilities in GPS-enabled gadgets in 2018, which they referred to as Trackmageddon. GPS-enabled automotive gadgets plugged into the OBDII port on vehicles’ dashboards have confirmed many times to be weak to hacking and monitoring.

Children’s GPS-enabled watches have additionally been proven to be particularly liable to vital privateness and safety vulnerabilities: Pen Test Partners and the Norwegian government issued warnings about sure hackable youngsters’s watches in 2017 and 2018, and one other examine by the Münster University of Applied Sciences in 2020 examined six youngsters’s smartwatches and located severe vulnerabilities in 5. “It was loopy,” Sebastian Schinzel, one of the Münster researchers, told WIRED at the time. “Everything was principally damaged.”