Attackers can surveil, disrupt vehicles outfitted with popular GPS tracker, CISA warns

guest · Jul 19, 2022

July 19, 2022

Six vulnerabilities in a popular GPS tracking device could allow malicious hackers to secretly track, disrupt or even remotely shut off vehicles, federal cybersecurity officials warned Tuesday.

“Successful exploitation of these vulnerabilities could allow an attacker control over any MV720 GPS tracker, granting access to location, routes, fuel cutoff commands and the disarming of various features (e.g., alarms),” according to a Cybersecurity and Infrastructure Security Agency.
Click to expand...

The Chinese-made tracker in question is known as the MiCODUS MV720 GPS tracker. It’s used across the globe by consumers and businesses alike seeking theft protection and location management, according to the cybersecurity company BitSight, which discovered the problem earlier this year and notified CISA. BitSight and CISA collaborated on the vulnerability alert.

Experts say the vulnerabilities in easily available GPS trackers are not that surprising because many inexpensive, internet-connected devices are built on insecure code and outdated software.
Click to expand...

“With the fast growth in adoption of mobile devices and the desire for our society to be more connected, it is easy to overlook the fact that GPS tracking devices such as these can greatly increase cyber risk if they are not built with security in mind.”
Click to expand...

ICS Advisory (ICSA-22-200-01) - MiCODUS MV720 GPS tracker

The API server has an authentication mechanism that allows devices to use a hard-coded master password. This may allow an attacker to send SMS commands directly to the GPS tracker as if they were coming from the GPS owner’s mobile number.
CVE-2022-2107 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been calculated

SMS-based GPS commands can be executed without authentication.
CVE-2022-2141 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been calculated

The main web server has a reflected cross-site scripting vulnerability that could allow an attacker to gain control by tricking a user into making a request.
CVE-2022-2199 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated

Click to expand...

The main web server has an authenticated insecure direct object reference vulnerability on endpoint and parameter device IDs, which accept arbitrary device IDs without further verification.
CVE-2022-34150 has been assigned to this vulnerability. A CVSS v3 base score of 7.1 has been calculated

The main web server has an authenticated insecure direct object references vulnerability on endpoint and POST parameter “Device ID,” which accepts arbitrary device IDs.
CVE-2022-33944 has been assigned to this vulnerability. A CVSS v3 base score of 6.5 has been calculated

Click to expand...

guest · Jul 19, 2022

CISA released Security Advisory on MiCODUS MV720 Global Positioning System (GPS) Tracker
July 19, 2022

CISA has released an Industrial Controls Systems Advisory (ICSA) detailing six vulnerabilities that were discovered in MiCODUS MV720 Global Positioning System Tracker. Successful exploitation of these vulnerabilities may allow a remote actor to exploit access and gain control the global positioning system tracker. These vulnerabilities could impact access to a vehicle fuel supply, vehicle control, or allow locational surveillance of vehicles in which the device is installed.

CISA encourages users and technicians to review ICS Advisory ICSA-22-200-01: MiCODUS MV720 GPS Tracker for technical details and mitigations and the Bitsight Report: Critical Vulnerabilities in Widely Used Vehicle GPS Tracker for additional information.
Click to expand...

Bitsight: BitSight Discovers Critical Vulnerabilities in Widely Used Vehicle GPS Tracker

BitSight announced today the discovery of six severe vulnerabilities in the MiCODUS MV720 GPS Tracker, a popular vehicle GPS tracker made in China and used worldwide by consumers for theft protection and location management, and by organizations for vehicle fleet management. If exploited in an attack, threat actors could not only access and control the tracker – they could potentially cut off fuel, physically stop vehicles, or surveil movement of vehicles in which the device is installed.
Click to expand...

Log in or Sign up

Attackers can surveil, disrupt vehicles outfitted with popular GPS tracker, CISA warns

guest Guest

guest Guest

Log in or Sign up

Attackers can surveil, disrupt vehicles outfitted with popular GPS tracker, CISA warns

guest Guest

guest Guest

Useful Searches