Slashdot Mirror
U8 Smartwatch Engages In Covert Traffic With Chinese IP Behind Your Back (softpedia.com)
An anonymous reader writes: In a presentation at the BSides security conferences in San Francisco, Michael Raggo from MobileIron, has revealed that he discovered a cheap smartwatch engaging in covert communications behind the users' back. The watch in question is the U8 Nucleus, a cheap smartwatch that's made in China, sold for around $17 (€15.6), which also runs its own operating system, also known as Nucleus. When the user would install the iOS/Android app that allows the owners to manage the smartwatch via their phones, the app would start an encrypted communications channel with an IP address in China. This could be telemetry or analytics data, but nothing in the U8 smartwatch manual or website even mentioned something like this was happening in the first place.
The Chinese want to know what time it is in America! The bastards!
Geez, I am so tired of these lame presentations and announcements. A n00b could figure this out, how is it relevant to real security research, much less worth a presentation at B-Sides?
Z-z-z-z-z-z-z....
Did you ever wake up in the morning, with a Zombie Woof behind your eyes? -- FZ
Intercept the packets, change a few bytes here and there, and send them on their way.
Therefore, we must end smart phone encryption to prevent things like this from happening. Think of the children!
there has been several of these kind of stories here about chinese devices secretly phoning home to an ip addresses (easily found to be chinese) .
but doesn't lot of other devices do that, regardless of origin of company that makes, designs, or markets, them ( esp device that are much hyped and costs lot more than this)?
so why select obscure presentations targeting chinese ones?
btw what are the past accomplishments of michael raggo and mobileIron in this field?
... would never dream of doing such a thing?
I actually found one of these watches behind my house. It is complete garbage. Never use software from China.
I'd be more worried about having its cheap Chinese batteries explode and burn my wrist.
Wow, these guys come off as idiots.
>claims it connects to random IP but they can't find it or determine what it is.
Too stupid to check APNIC?
> claims watch runs a weird OS "Nucleus"
Apparently they're too stupid to google it and found out its a rtos for embedded systems that other smart watch makers in China are using
https://www.mentor.com/embedded-software/industries/wearable-devices
> apparently never contacted company to ask about connection
Honestly, which slightly advanced OS and/or platforn does not call home? Maybe some not so good variants of Linux. This post so bad to be a piece of FUD, but close enough... Chinese and cheap, huh. They already are a superpower, your are late by 15-20 years, depending on the industry.
China, USA..... honestly is there any difference these days ?
So it's a continued race to the bottom?
Why is it always that security researchers find this crap in Chinese companies. Have you ever heard of a security researcher saying I found this EU or US app secretly sending traffic from my device behind my back? And why in the hell aren't US lawmakers enforcing the same privacy laws on Chinese companies they enforce on US ones. Do you know how hard is it to handle US user data, but these crappy products never get tested... and then slashdotters comment "why are you picking on the chinese for?"
Yikes, that's slightly terrifying.
Somewhere, something incredible is waiting to be known. -Carl Sagan
I, for one, welcome our new Chinese spyware overlords!
No wait, telemetry is the word I was looking for. Excusable mistake. Considering that Microsoft and everybody else fucks us over, telemetry is a bit of misnomer.
If somebody manages to reverse engineer it, it could be pretty useful.
Another fine product from the Nucleus family. Fsckin' Gavin Belson.
The packets go through the NSA routers before it can reach China.
Authority questions you. Return the favor. -- d474
I dunno bout you but I prefer Eastasia to Oceania, just saying; girls are prettier in Eastasia
If something is going out to someone else, I'm glad it is encrypted. Makes it harder for an attacker to learn stuff about what your phone is doing.
look, i get that you like cool devices that are capable of neat things but if history has proven anything, it's that these "smartthings" are are a bad investment and a security nightmare. we have smartTVs that spy on you and inject even more advertisements, we have watches that die faster than winding watches and are less accurate than some of the original mechanical clocks if they don't sync and finally we have cellphones that need daily charging and give your information to just about anyone.
your "smartthings" are dumb.
Anons need not reply. Questions end with a question mark.
This article has enough completely-wrong aspects that exempts it from the concept of "not even wrong" I suppose.
1) The watch does not engage in covert traffic. It's the pairing app for the watch that a user installs on a phone that does the communication.
2) What on earth does the redundant phrase "covert communications behind the users' back" even mean? Have you looked at network traffic when *any* application has been launched? If you think that any app talking on the internet without explicitly asking the user first counts as "covert communications", then I think you can label just about all of the software out there (esp. in the mobile space) as engaging in "covert communications."
3) The phrase "random IP address" used by the speaker is slang meant to convey that he didn't know what it is. In this case, it's a system referred to by its IP rather than its DNS name. So rather than looking up who owns the IP address, he says it's "random" and shrugs.
4) To give up and say that it's "very difficult to determine" what is being sent over the network because it's over an encrypted channel is ridiculous. For all we know, it's just talking to the software vendor via HTTPS. In which case it would be trivial to inspect by using MITM.
I'm not saying that there's nothing sketchy going on here. But to provide zero evidence of what's actually happening and just speculate and spread FUD is irresponsible.
Guys/gals, yes we kniw Chinese firmware has really been found to be spying in certain cases, but this may just be a STUN(?) or reverse connection mechanism in order to allow talking between the phone and the watch across/through NAT. Think about it. Two devices that may be in different, privately-networked locations need a third-party server to set up the connection.
I suspect some of the recent IPcam stories are a case of the same requirement. Of course they could ALSO benspyong with it, but NAT traversal is a legit reason to makeba connection to a specific third-party server.
Is it that strange to phone home?
...smart watches you!
Uh -- hmm.
If you aren't already familiar with them, it would be prudent to learn how to utilize a packet sniffer to watch what your shiny new devices are doing once connected to a network. You may think twice about blindly connecting it to the same network your other systems reside upon.
China has health care