Slashdot Mirror
U8 Smartwatch Engages In Covert Traffic With Chinese IP Behind Your Back (softpedia.com)
An anonymous reader writes: In a presentation at the BSides security conferences in San Francisco, Michael Raggo from MobileIron, has revealed that he discovered a cheap smartwatch engaging in covert communications behind the users' back. The watch in question is the U8 Nucleus, a cheap smartwatch that's made in China, sold for around $17 (€15.6), which also runs its own operating system, also known as Nucleus. When the user would install the iOS/Android app that allows the owners to manage the smartwatch via their phones, the app would start an encrypted communications channel with an IP address in China. This could be telemetry or analytics data, but nothing in the U8 smartwatch manual or website even mentioned something like this was happening in the first place.
The Chinese want to know what time it is in America! The bastards!
Geez, I am so tired of these lame presentations and announcements. A n00b could figure this out, how is it relevant to real security research, much less worth a presentation at B-Sides?
Z-z-z-z-z-z-z....
Did you ever wake up in the morning, with a Zombie Woof behind your eyes? -- FZ
Intercept the packets, change a few bytes here and there, and send them on their way.
there has been several of these kind of stories here about chinese devices secretly phoning home to an ip addresses (easily found to be chinese) .
but doesn't lot of other devices do that, regardless of origin of company that makes, designs, or markets, them ( esp device that are much hyped and costs lot more than this)?
so why select obscure presentations targeting chinese ones?
btw what are the past accomplishments of michael raggo and mobileIron in this field?
... would never dream of doing such a thing?
I actually found one of these watches behind my house. It is complete garbage. Never use software from China.
Wow, these guys come off as idiots.
>claims it connects to random IP but they can't find it or determine what it is.
Too stupid to check APNIC?
> claims watch runs a weird OS "Nucleus"
Apparently they're too stupid to google it and found out its a rtos for embedded systems that other smart watch makers in China are using
https://www.mentor.com/embedded-software/industries/wearable-devices
> apparently never contacted company to ask about connection
Honestly, which slightly advanced OS and/or platforn does not call home? Maybe some not so good variants of Linux. This post so bad to be a piece of FUD, but close enough... Chinese and cheap, huh. They already are a superpower, your are late by 15-20 years, depending on the industry.
China, USA..... honestly is there any difference these days ?
So it's a continued race to the bottom?
Yikes, that's slightly terrifying.
Somewhere, something incredible is waiting to be known. -Carl Sagan
I, for one, welcome our new Chinese spyware overlords!
I can only assume you have not be taken advantage of by Microsofts windows 10 'upgrade' yet?
And anyway, it is patently obviously not the watch doing this, its the associated smartphone app that does it.
Should it be? Almost certainly not. Is it common as mud? Pretty much.
Another fine product from the Nucleus family. Fsckin' Gavin Belson.
Windows does lots of stuff nobody knows about because it is encrypted. While this is good for security, you now have to take Microsoft's word for it it is all benign.
(-1: Post disagrees with my already-settled worldview) is not a valid mod option.
Repeat after me, telemetry is spying. Telemetry is spying.
Telemetry is spying.
The packets go through the NSA routers before it can reach China.
Authority questions you. Return the favor. -- d474
If something is going out to someone else, I'm glad it is encrypted. Makes it harder for an attacker to learn stuff about what your phone is doing.
look, i get that you like cool devices that are capable of neat things but if history has proven anything, it's that these "smartthings" are are a bad investment and a security nightmare. we have smartTVs that spy on you and inject even more advertisements, we have watches that die faster than winding watches and are less accurate than some of the original mechanical clocks if they don't sync and finally we have cellphones that need daily charging and give your information to just about anyone.
your "smartthings" are dumb.
Anons need not reply. Questions end with a question mark.
This article has enough completely-wrong aspects that exempts it from the concept of "not even wrong" I suppose.
1) The watch does not engage in covert traffic. It's the pairing app for the watch that a user installs on a phone that does the communication.
2) What on earth does the redundant phrase "covert communications behind the users' back" even mean? Have you looked at network traffic when *any* application has been launched? If you think that any app talking on the internet without explicitly asking the user first counts as "covert communications", then I think you can label just about all of the software out there (esp. in the mobile space) as engaging in "covert communications."
3) The phrase "random IP address" used by the speaker is slang meant to convey that he didn't know what it is. In this case, it's a system referred to by its IP rather than its DNS name. So rather than looking up who owns the IP address, he says it's "random" and shrugs.
4) To give up and say that it's "very difficult to determine" what is being sent over the network because it's over an encrypted channel is ridiculous. For all we know, it's just talking to the software vendor via HTTPS. In which case it would be trivial to inspect by using MITM.
I'm not saying that there's nothing sketchy going on here. But to provide zero evidence of what's actually happening and just speculate and spread FUD is irresponsible.
If you aren't already familiar with them, it would be prudent to learn how to utilize a packet sniffer to watch what your shiny new devices are doing once connected to a network. You may think twice about blindly connecting it to the same network your other systems reside upon.