Slashdot Mirror

← Back to Stories (view on slashdot.org)

TicTocTrack Smartwatch Flaws Can Be Abused To Track Kids (threatpost.com)

Posted by BeauHD on from the safety-alert dept.

secwatcher shares a report from Threatpost: A popular smartwatch that allows parents to track their children's whereabouts, TicTocTrack, has been discovered to be riddled with security issues that could allow hackers to track and call children. Researchers at Pen Test Partners revealed vulnerabilities in the watch (sold in Australia) on Monday, which could enable hackers to track children's location, spoof the child's location or view personal data on the victims' accounts. The parent company of the TicTocTrack watch, iStaySafe Pty Ltd., has temporarily restricted access to the watch's service and app while it investigates further. Researchers found that the service's back end does not make any authorization attempt on any request -- besides the user having a valid username and password combination. That means that an attacker who is logged into the service could remotely compromise the app and track other accounts that are based in Australia.

The smartwatch, available in Australia for $149 (USD), is designed for children and uses GPS to track the movement of the wearer every six minutes, and offers voice calling and SMS features. The smartwatch's API can be attacked by changing the FamilyIdentifier number (which identifies the family that the user belongs to), which then could give a bad actor complete access to the user's data -- including the children's location, parent's full names, phone numbers and other personal identifiable information. Researchers with Pen Test Partners collaborated with security researcher Troy Hunt to test the attack. Hunt uploaded a video showing how the smartwatch vulnerability could be exploited to call his daughter -- and how her smartwatch would answer automatically without any interaction needed from her end.

12 of 42 comments (clear)

  1. Didn't work for me by Drunkulus · · Score: 2

    I tried calling his daughter but for some reason she never picks up. On the plus side, I was able to use the watch to have his Tesla pick me up and give me a ride to work. 3 stars, would buy again.

  2. Re: Not abused. It was the point. by Anonymous Coward · · Score: 1

    I'm pretty sure having random people call and track your child wasn't a selling point

  3. Precision English is hard by Tablizer · · Score: 2

    If they treat it as a consumer product, there should be a minimum set of security guidelines and steps a company is required to take. None of this "license agreement" crap.

    However, writing down the guidelines and steps in a clear-cut way into law is difficult. If the text is too specific, then companies find a way around them, and if they are too general, they are messy and expensive to enforce, for both sides. This includes abuse of law against the company. A fuzzy cannon shoots out of both ends.

    --
    Table-ized A.I.
    1. Re:Precision English is hard by Immerman · · Score: 1

      I'd argue in favor of a somewhat vague "general principles" law that also includes specific cases of behavior that would *definitely* be a violation of those principles to make it easy to prosecute those who violate any of the examples thought of while writing the law, without letting criminals escape justice by adhering to the letter of the law.

      I'd ague that - except that was the guiding principle of the U.S. Bill of Rights, and good luck bringing someone to justice for violating a non-enumerated right.

      --
      --- Most topics have many sides worth arguing, allow me to take one opposite you.
    2. Re:Precision English is hard by Anonymous Coward · · Score: 1

      "license agreement" crap will not fly in Australia if is a consumer. Consumer law will say its not fit for purpose, and refunds will flow IF you cite the relevant legal clauses. Now to get that companies ABN and pull the directors up.

  4. Google and RoboCallers by Anonymous Coward · · Score: 1

    1. Google are already tracking your children.
    2. Real and robocallers can already call your children, and pretty much anyone with a phone.

  5. Re: There are plenty of differences lol. by GrumpySteen · · Score: 1

    If those people stopped voting for candidates who push the policies that result in the problems you describe, they wouldn't have those problems and we wouldn't make fun of them for being stupid.

  6. Is there a secure one? by Opportunist · · Score: 2

    This is hardly the first report of kids' smartwatches being insecure tracking devices. We've heard that in 2017, in 2018 again, quite bluntly, if you haven't heard it by now, you probably don't give a rat's ass about your kids' privacy.

    Then again, buying such a watch is already a pretty good indicator that you don't give a fuck about your kids' privacy, so...

    --
    We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
    1. Re:Is there a secure one? by pnutjam · · Score: 1

      Well, what do you expect parents to do? Talk to their kids, learn their routines, get to know their friends, engage with them daily? or... just slap a tracker on them and call it good, it's the tech version of the leash you see on kids.

      --
      Cheap storage VM.
    2. Re:Is there a secure one? by Opportunist · · Score: 1

      What people forget is that kids have WAY more time to figure out how to cheat and manipulate those things than they have to set them up. Not to mention that the average 8 year old knows more about mobile devices than his parents.

      And through the ages kids have spent half their wits and smarts (and that of their friends) to escape parental supervision. The other half was spent cheating on school tests.

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
    3. Re:Is there a secure one? by pnutjam · · Score: 1

      I think people also forget they are training a future adult. It's easy to constrain, but harder to train. Your point is also good, your ability to constrain is never as good as you think it is.

      I understand the desire to know where your kid is all the time, but independence is a big part of growing up.

      --
      Cheap storage VM.
  7. Re: There are plenty of differences lol. by desdinova+216 · · Score: 1

    and that's a real catch-22 situation isn't it