Date:09/09/19
GPS trackers are helpful tools for families, whether they're used for children, the elderly, or with pets. However, a security firm discovered that the devices may not be as secure and safe as users may think.
People often use small GPS trackers to help them locate children, elderly family members, or even pets. These devices are easy to carry because of the small size, with some even having microphones or cameras, and they are easy to find on sites such as Amazon and eBay for decent prices that range between $25 and $50.
However, a recent discovery by security firm Avast reveals that hundreds of thousands of such GPS trackers may not be secure. Upon testing the T8 Mini GPS Tracker from manufacturer Shenzen i365 Tech as well as 29 similar GPS trackers mostly from the same company, researchers from Avast Threat Labs found that the International Mobile Equipment Identity (IMEI) of the units only have 11 digits when the international standard says it should have 15. What’s more, they also found that these devices all have the same default password: 123456.
Because of this, the researchers easily found over 600,000 devices being used with the same password, all transmitting data in plaintext using commands that are easily reverse engineered.
This means that the potential attackers can have access to the data, and can even modify it to report different coordinates than the ones reported by the tracker. They can also send a text message to the phone attached to the account, thereby obtaining the said phone number, and also restore the devices to factory settings among other privacy and security issues such as access to the microphone.
“As you can see there are strong indicators that this issue goes far beyond the scope of one vendor. We found similar APIs being used by different applications also found models that are not being made by this particular vendor that is linked to this cloud infrastructurem” researchers wrote.
The GPS trackers as well as the 50 affected apps can be found in the Avast report. Researchers reached out to the vendor of the GPS trackers last June 24 but did not get a response.
Security Flaw: over 600,000 kid-friendly GPS trackers use 123456 as default password, posing security threat
GPS trackers are helpful tools for families, whether they're used for children, the elderly, or with pets. However, a security firm discovered that the devices may not be as secure and safe as users may think.People often use small GPS trackers to help them locate children, elderly family members, or even pets. These devices are easy to carry because of the small size, with some even having microphones or cameras, and they are easy to find on sites such as Amazon and eBay for decent prices that range between $25 and $50.
However, a recent discovery by security firm Avast reveals that hundreds of thousands of such GPS trackers may not be secure. Upon testing the T8 Mini GPS Tracker from manufacturer Shenzen i365 Tech as well as 29 similar GPS trackers mostly from the same company, researchers from Avast Threat Labs found that the International Mobile Equipment Identity (IMEI) of the units only have 11 digits when the international standard says it should have 15. What’s more, they also found that these devices all have the same default password: 123456.
Because of this, the researchers easily found over 600,000 devices being used with the same password, all transmitting data in plaintext using commands that are easily reverse engineered.
This means that the potential attackers can have access to the data, and can even modify it to report different coordinates than the ones reported by the tracker. They can also send a text message to the phone attached to the account, thereby obtaining the said phone number, and also restore the devices to factory settings among other privacy and security issues such as access to the microphone.
“As you can see there are strong indicators that this issue goes far beyond the scope of one vendor. We found similar APIs being used by different applications also found models that are not being made by this particular vendor that is linked to this cloud infrastructurem” researchers wrote.
The GPS trackers as well as the 50 affected apps can be found in the Avast report. Researchers reached out to the vendor of the GPS trackers last June 24 but did not get a response.
Views: 480
©ictnews.az. All rights reserved.
Similar news
- Cellphone Use May Raise Cancer Risk
- Australian police pushes cyber safety education
- Vietnam aims to lead in e-government
- Senate Website Gets Hacked
- US builds net for cyber war games
- Japan enacts anti-computer virus law
- India passes law vs e-waste
- Anonymous Declares War On The City Of Orlando
- Microsoft highlights evolving dangers as online identity data proliferates
- Consumers want internet security to be provided by banks
- Government facilities targets of cyber attack
- South Korean web attacks might been war drill
- Sri Lanka to Establish National Passport Database to Increase Border Security
- Hi-tech crime agencies set to employ information security professionals
- Phone hacking and online campaign bring down the News of the World
