Flaws in a popular GPS tracker leak real-time locations and can remotely activate its microphone

guest · May 12, 2019

Flaws in a popular GPS tracker leak real-time locations and can remotely activate its microphone
Simple hack turns them into super secret spying tool
May 11, 2019
https://www.theregister.co.uk/2019/05/11/panic_alarms_hackable/

A GPS tracker used by elderly people and young kids has a security hole that could allow others to track and secretly record their wearers.
The white-label product is manufactured in China and then rebadged and rebranded by a range of companies in the UK, US, Australia and elsewhere including Pebbell 2, OwnFone and SureSafeGo. Over 10,000 people in the UK use the devices.

But researchers at Fidus Information Security discovered, and revealed on Friday, that the system has a dangerous flaw: you can send a text message to the SIM and force it to reset. From there, a remote attacker can cause the device to reveal its location, in real time, as well as secretly turn on the microphone.

The problem arises from the fact that the Chinese manufacturer built in a PIN to the device so it would be locked to the telephone number programmed into the device. Which is fine, except the PIN was disabled by default [...] And so it is possible to send a reset command to the device – if you know its SIM telephone number – and restore it to factory settings.
Click to expand...

In short, poor design and the lack of a decent security audit prior to putting the updated product on the market has turned what is supposed to provide peace of mind into a potential stalking and listening nightmare.
Click to expand...

guest · Sep 5, 2019

Buggy GPS Trackers Expose Childrens’ Real-Time Location
September 5, 2019
https://www.bleepingcomputer.com/ne...trackers-expose-childrens-real-time-location/

Several vulnerabilities impacting twenty-nine models of GPS trackers designed to monitor the location of children, pets, and valuable possessions expose real-time location data as Avast Threat Labs researchers found.

The security flaws were found in GPS location trackers manufactured by the Shenzhen i365 Tech, with over 600,000 users from countries all over the world and resold under multiple brands on various e-commerce platforms like Amazon or eBay.
While these trackers are being marketed to keep one's kids or pets safe, the flaws they come with are exposing all the data they collect and send to the cloud.

All the communication with the trackers' online portal is unencrypted, with the data being sent in plain text over HTTP and exposing it to interception attacks.

"Further security issues involved user account information, which comes with an assigned ID number and default password of 123456," Avast found.
To make things even worse, "Design flaws in the trackers can also enable third-parties to “spoof” (or fake) the user’s location, or access the microphone for eavesdropping."
Click to expand...

Avast: Avast discovers widespread security flaws in GPS child trackers

Log in or Sign up

Flaws in a popular GPS tracker leak real-time locations and can remotely activate its microphone

guest Guest

guest Guest

Log in or Sign up

Flaws in a popular GPS tracker leak real-time locations and can remotely activate its microphone

guest Guest

guest Guest

Useful Searches