Slashdot Mirror

← Back to Stories (view on slashdot.org)

Attackers Can Track Kids' Locations Via Connected Watches

Posted by BeauHD on from the kids-safety dept.

secwatcher shares a report from Threatpost: A gamut of kids' GPS-tracking watches are exposing sensitive data involving 35,000 children -- including their location, in real time. Researchers from Pen Test Partners specifically took a look at the Gator portfolio of watches from TechSixtyFour. The Gator line had been in the spotlight in 2017 for having a raft of vulnerabilities, called out by the Norwegian Consumers Council in its WatchOut research. "A year on, we decided to have a look at the Gator watch again to see how their security had improved," said Vangelis Stykas, in a Tuesday posting. "Guess what: a train wreck. Anyone could access the entire database, including real-time child location, name, parents' details etc. Not just Gator watches either -- the same back end covered multiple brands and tens of thousands of watches." "At issue was an easy-to-exploit, severe privilege-escalation vulnerability: The system failed to validate that the user had the appropriate permission to take admin control," reports Threatpost. "An attacker with access to the watch's credentials simply needed to change the user level parameter in the backend to an admin designation, which would provide access to all account information and all watch information."

33 comments

  1. Re: Pedo delight by Anonymous Coward · · Score: 0

    It got AOC hot she likes trafficking.

  2. Is that a crime? by Anonymous Coward · · Score: 0

    Really? What statute?

    1. Re:Is that a crime? by fermion · · Score: 1

      No crime, just lawsuits. one kid get nabbed and the company issued to oblivion.

      --
      "She's a scientist and a lesbian. She's not going to let it slide." Orphan Black
    2. Re:Is that a crime? by Anonymous Coward · · Score: 0

      All it takes, is someone who is both a competent hacker and a pedo. Or at least a hacker who works for such people.

    3. Re:Is that a crime? by Opportunist · · Score: 2

      Or someone pissed enough of the whole IoT makers flaunting their disregard for the privacy of their users who doesn't give a shit about kids who makes a webpage that tracks every kid and puts their whereabouts and how to pretend you're daddy when luring them somewhere...

      Hold my beer.

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
  3. The good news is by Anonymous Coward · · Score: 1

    you always know where your kid is. The bad news is, so does everyone else.

  4. Gator watch by Anonymous Coward · · Score: 0

    Shane does not let Chipmunk use Gator watches

  5. Oh god by Anonymous Coward · · Score: 0

    They can also track kids using THEIR EYES

  6. Link goes to by Anonymous Coward · · Score: 0

    "A Randomized Trial of E-Cigarettes versus Nicotine-Replacement Therapy"

  7. Why would you by Anonymous Coward · · Score: 0

    Want to track your kid like that? In the grand scheme of things a single person is extremely unimportant

    1. Re:Why would you by Anonymous Coward · · Score: 1

      Probably the same selfish animal instincts that got them the kid in the first place.

    2. Re:Why would you by dwillden · · Score: 1

      We have a similar device, the location feature is just an extra. I've used it more to figure out where the kid left the watch when he's taken it off. (ex. At the pool during swimming lessons, it fell underneath the bench where he and his brothers' towels were so didn't get picked up and put back on after the lesson ended.)

      We've also sent the then 11 y/o across town on the commuter rail system and I use it to ensure he gets off at the right stop to be met by his mother.

      It's a slow process, it takes about a minute to poll the device and update the location every time you check it. But if in doubt I can get a general idea of where he is.

      Also a local news story covered an attempted kidnapping, thwarted in part due to one of these watches a couple years ago. https://www.ksl.com/article/41008494

      --
      I'm too lazy to compose a creative sig.
    3. Re: Why would you by Anonymous Coward · · Score: 0

      No wonder. That took place in Uthardistan. Why anyone would want to live there is beyond me. I had to spend a year there due to a job, and had I known what I was getting into I would have gone to Eastern Europe instead. Most everyone I met there and wanted to be friends with left the place within that year. Most of those who remained are planning to leave too.
      My female colleagues were afraid to take public transit or walk out on the parking lot at dark. Homeless drug users and crazy people everywhere. Seen people do heroin in school yards and sidewalks. Had a knife pulled on us - we were a group of 60 people - by a homeless crazy person. A 4000 bed "shelter" in the middle of the city, what's supposed to be prime real estate. A lot of inbred people, lacking high school education. The nature is miserable - smog all winter, radon pollution, brown from October to May, green for a month, yellow and withered between mid June and October ... the best quality food at a local restaurant I could get was at Panda Express which was also the local police gathering spot. No bars, no actual restaurants, just fast food eateries.

  8. No shit, Sherlock by DogDude · · Score: 1

    I'd guess that 90% of things connected to the Internet today shouldn't be. But, people are lazy. So, nothing will change.

    --
    I don't respond to AC's.
    1. Re:No shit, Sherlock by Anonymous Coward · · Score: 1

      Who had the weird idea that kid locations should go into a database?

      If I made such a system, I'd make it so the kid location is sent directly to the parent's device (phone or pc). No intermediary. (Other than the network itself, but encryption prevents snooping there.) No cloud. No company server somewhere. So even if hackers overran my company, they couldn't get any locations. It'd be cheaper for my company too - not having to store the location of hundred thousand kids in realtime, and no worrying about lawsuits if a kidnapping ring hacks my company computer.

      What is it with this sickness, that everything has to go through someone's server? Even when said server adds no value to the system? I once had some students make a simple multiplayer phone game - where they played using bluetooth/network without any server inbetween. People who saw it found that aspect so special - for me it was just the natural way of doing it. No server needed, so the game could be played even without a connection to the global Internet. As it should be.

    2. Re:No shit, Sherlock by stealth_finger · · Score: 1

      Who had the weird idea that kid locations should go into a database?

      If I made such a system, I'd make it so the kid location is sent directly to the parent's device (phone or pc). No intermediary. (Other than the network itself, but encryption prevents snooping there.) No cloud. No company server somewhere.

      Yeah, but then how would you sell that data to third parties?

      --
      Wanna buy a shirt?
      https://www.redbubble.com/people/stealthfinger/shop?asc=u
    3. Re:No shit, Sherlock by Opportunist · · Score: 1

      And how do you plan to sell the data that you don't have access to?

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
  9. Researchers from Pen Test Partners by Anonymous Coward · · Score: 0

    Shouldn't that be Watch Test Partners?

  10. Stranger attacks? by dryeo · · Score: 4, Insightful

    How many actual stranger attacks on children are there? Seems like a lot because it sells news, so it is over reported. There was one around here about 30 years back, sad because the kid vanished at a baseball game, but the news still talks about it.
    Most child kidnappings seem to be by their divorced other parent and even most molestation is by relatives, friends and trusted figures like the priest, coach or scout leader.

    --
    https://en.wikipedia.org/wiki/Inverted_totalitarianism
    1. Re:Stranger attacks? by Opportunist · · Score: 2

      While I agree 100%, the thing here is that the exposure to the threat is unnecessary. It is possible to implement this in a secure manner with very little effort. If this was only possible with a lot of expense or at the expense of functionality, I'd be right with you. But what we are dealing here is just lazy engineering, opening a security hole where none needs to exist.

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
    2. Re:Stranger attacks? by mjwx · · Score: 1

      How many actual stranger attacks on children are there? Seems like a lot because it sells news, so it is over reported. There was one around here about 30 years back, sad because the kid vanished at a baseball game, but the news still talks about it.
      Most child kidnappings seem to be by their divorced other parent and even most molestation is by relatives, friends and trusted figures like the priest, coach or scout leader.

      Whilst you're 100% correct that most child disappearances (well, kidnappings and disappearances in general) are done by family or close, trusted people, the reason why we still talk about it 30 years later is because we're genetically programmed to care about children, and not just our own. This genetic programming is often combined with the media's love of hyperbole to get eyeballs to blow stories completely out of proportion (erm... see Madeline McCann).

      However it also should be noted that the last 30 (probably 50) years there's been a huge emphasis on teaching children about the dangers of strangers which has done a lot to cut down on abductions.

      --
      Calling someone a "hater" only means you can not rationally rebut their argument.
    3. Re:Stranger attacks? by CrimsonAvenger · · Score: 1

      However it also should be noted that the last 30 (probably 50) years there's been a huge emphasis on teaching children about the dangers of strangers which has done a lot to cut down on abductions.

      Citation?

      Children kidnapped by strangers happens so infrequently that it's hardly a blip, and pretty much always has been. Runaways are ~1000x more numerous. And "missing children" as a result of miscommunication (Grandma picks up the kids from school because Dad asked her to, and Mom, not knowing this, panics - or switch position of Mom and Dad, same deal) are even more numerous....

      --

      "I do not agree with what you say, but I will defend to the death your right to say it"
  11. Already p0wnd by Anonymous Coward · · Score: 0

    An attacker with access to the watch's credentials

    They're already in the watch, so the user is screwed even without a escalation of privilege attack.

  12. The product plan by Anonymous Coward · · Score: 0

    Guess what: a train wreck.

    The product plan wasn't about keeping children safe: It was about selling crap to helicopter/neurotic/half-arsed parents every month.

  13. Wrong link! by Anonymous Coward · · Score: 0

    The "are exposing sensitive data involving 35,000 children" link takes you to "A Randomized Trial of E-Cigarettes versus Nicotine-Replacement Therapy" study and not to anything related to GPS-watches.

    Some editor should fix it.

      - Peder

  14. Or an attacker could use their eyes by johnsie · · Score: 1

    Easy to track someone when you're standing beside them.

    1. Re:Or an attacker could use their eyes by Opportunist · · Score: 1

      Sure, but you could be seen by someone who thinks it's odd that an adult undresses a kid with his eyes and follows said kid around. People do tend to be sensitive to that kind of thing by now.

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
  15. One link in TFA is wrong by Anonymous Coward · · Score: 0

    First link points here:

    https://www.nejm.org/doi/full/10.1056/NEJMoa1808779
    A Randomized Trial of E-Cigarettes versus Nicotine-Replacement Therapy

    Doesn't seem to have anything to do with kid tracking watches.

  16. Change the entire system, this has gone too far. by Anonymous Coward · · Score: 1

    Even worse, your own government can track individual citizens with the same kind of devices. On top of that,all your interaction data is being sold to other people and companies, sometimes with complete profiles of you.

    That seems equally as bad,if not worse. Why not fix the root problem rather than 'think of the children' lameisms

    I don't want to be tracked or sold either. Child, adult, why should it matter?

  17. Who watches the Watchkids? by Anonymous Coward · · Score: 0

    This playground is afraid of me. I've seen it's true face.

  18. 6+ years of this shit... Will anything happen? by wardrich86 · · Score: 1

    I've been reading stories like this since at least 2012 with some VTech devices. When will the manufacturers be held accountable for the shit security in their devices?

  19. Attackers indisutinguishable from company by hermi · · Score: 1

    It's not worse that attackers can do that than that the company can do that.