Eskenzi PR ad banner Eskenzi PR ad banner
  • About Us
Thursday, 30 March, 2023
IT Security Guru
Eskenzi PR banner
  • Home
  • Features
  • Insight
  • Events
    • Most Inspiring Women in Cyber 2022
  • Topics
    • Cloud Security
    • Cyber Crime
    • Cyber Warfare
    • Data Protection
    • DDoS
    • Hacking
    • Malware, Phishing and Ransomware
    • Mobile Security
    • Network Security
    • Regulation
    • Skills Gap
    • The Internet of Things
    • Threat Detection
    • AI and Machine Learning
    • Industrial Internet of Things
  • Multimedia
  • Product Reviews
  • About Us
No Result
View All Result
  • Home
  • Features
  • Insight
  • Events
    • Most Inspiring Women in Cyber 2022
  • Topics
    • Cloud Security
    • Cyber Crime
    • Cyber Warfare
    • Data Protection
    • DDoS
    • Hacking
    • Malware, Phishing and Ransomware
    • Mobile Security
    • Network Security
    • Regulation
    • Skills Gap
    • The Internet of Things
    • Threat Detection
    • AI and Machine Learning
    • Industrial Internet of Things
  • Multimedia
  • Product Reviews
  • About Us
No Result
View All Result
IT Security Guru
No Result
View All Result

Avast Discovers Security Flaws In Widespread GPS Trackers Exposing Locations Of Over Half A Million Children And Elderly.

by The Gurus
September 19, 2019
in Software
Avast Discovers Security Flaws In Widespread GPS Trackers Exposing Locations Of Over Half A Million Children And Elderly.
Share on FacebookShare on Twitter

Avast [LSE:AVST], a global leader in digital security products, has discovered serious security vulnerabilities in the T8 Mini GPS tracker and nearly 30 other models by the same manufacturer, Shenzhen i365 Tech. Marketed to keep kids, seniors, pets, and even possessions safe, instead these devices expose all data sent to the cloud, including exact real-time GPS coordinates. Further, design flaws can enable unwanted third-parties to spoof the location or access the microphone for eavesdropping. Researchers at Avast Threat Labs estimate that there are 600,000 unprotected trackers in use globally, but emphasize that these IoT security issues go far beyond the scope of a single vendor.

Martin Hron, senior researcher at Avast who led this research, advises buyers of these products to opt for an alternative from a more trustworthy brand that has built security into the product design. As with any off-the-shelf device, we recommend changing the default admin passwords to something more complex; however, in this case, even that will not stop a motivated individual from intercepting the unencrypted traffic. “We have done our due diligence in disclosing these vulnerabilities to the manufacturer, but since we have not heard back after the standard window of time, we are now issuing this Public Service Announcement to consumers and strongly advise you to discontinue use of these devices,” Hron said.

Red flags right out of the box

Avast Threat Labs first analyzed the T8 Mini onboarding process, following the instructions to download the companion mobile app from http://en.i365gps.com — notably, a website served over HTTP protocol as opposed to the more secure HTTPS. Users can then login to their account with their assigned ID number and very generic default password of “123456”. This information was transmitted over insecure HTTP protocol, too.

The ID number is derived from the International Mobile Equipment Identity (IMEI) of the device, so it was easy for researchers to predict and enumerate possible ID numbers of other trackers by this manufacturer. Combined with the fixed password, practically any device following this sequence of IMEI numbers would be able to be broken into with little effort.

Everything is unencrypted

Using a simple command lookup tool, researchers discovered that all of the requests originating from the tracker’s web application are transmitted in unencrypted plain-text. Even more concerning, the device can issue commands beyond the intended uses of GPS tracking, such as:

· Call a phone number, enabling a third-party to eavesdrop through the tracker’s microphone

· Send an SMS message, which could allow an attacker to identify the phone number of the device and thus use inbound SMS as an attack vector

· Use SMS to reroute communication from the device to an alternate server in order to gain full control of the device or spoof information sent to the cloud

· Share a URL to the tracker, allowing a remote attacker to place new firmware on the device without even touching it, which could completely replace the functionality or implant a backdoor

Unsurprisingly, the companion mobile app AIBEILE (on both Google Play and iOS App Store) was also found communicating with the cloud through a non-standard HTTP port, TCP:8018, sending unencrypted plain-text to the endpoint. Upon dissecting the device itself to analyze how it speaks to the cloud, Avast Threat Labs confirmed that the data again travels unencrypted from the GSM network to the server without any authorization.

What consumers should take away from this research

In addition to the device that is the focus of this research, Avast has identified 29 other models of GPS trackers containing these security vulnerabilities — most of which are made by the aforementioned vendor — as well as 50 different mobile applications sharing the same unencrypted platform discussed above. Researchers estimate there are more than 600,000 devices in the wild with default “123456” passwords and upwards of 500,000 downloads of the mobile apps. Repeated notifications to the device maker revealing the flaws received no response.

Leena Elias, head of product delivery for Avast, urges the public to take caution when bringing cheap or knock-off smart devices into the home. “As parents, we are inclined to embrace technology that promises to help keep our kids safe, but we must be savvy about the products we purchase,” she said. “Beware of any manufacturers that do not meet minimum security standards or lack third-party certifications or endorsements. Shop only with brands you trust to keep your data safe — the extra cost is worth the peace of mind.”

For a deep-dive analysis of the security flaws found in the T8 Mini GPS tracker, please visit the Avast Decoded threat intelligence blog. To hear Leena and Martin discuss the implications for parents, watch this video on the Avast blog.

About Avast
Avast (LSE:AVST) is the global leader in digital security products. With over 400 million users online, Avast offers products under the Avast and AVG brands that protect people from threats on the internet and the evolving IoT threat landscape. The company’s threat detection network is among the most advanced in the world, using machine learning and artificial intelligence technologies to detect and stop threats in real time. Avast digital security products for Mobile, PC or Mac are top-ranked and certified by VB100, AV-Comparatives, AV-Test, OPSWAT, West Coast Labs and others. Visit: www.avast.com.

FacebookTweetLinkedIn
ShareTweetShare
Previous Post

Jaguar Land Rover And BlackBerry Deepen Partnership For Intelligent Vehicles.

Next Post

419 Million phone number of Facebook Users have been exposed.

Recent News

cybersecurity training

Only 10% of workers remember all their cyber security training

March 30, 2023
Pie Chart, Purple

New API Report Shows 400% Increase in Attackers

March 29, 2023
Cato Networks delivers first CASB for instant visibility and control of cloud application data risk

Cato Networks Recognised as Leader in Single-Vendor SASE Quadrant Analysis

March 29, 2023
Outside of cinema with advertising

Back and Bigger Than Ever! The Inside Man Season 5 Takes a Stab at Power Hungry Adversaries

March 29, 2023

The IT Security Guru offers a daily news digest of all the best breaking IT security news stories first thing in the morning! Rather than you having to trawl through all the news feeds to find out what’s cooking, you can quickly get everything you need from this site!

Our Address: 10 London Mews, London, W2 1HY

Follow Us

© 2015 - 2019 IT Security Guru - Website Managed by Calm Logic

  • About Us
No Result
View All Result
  • Home
  • Features
  • Insight
  • Events
    • Most Inspiring Women in Cyber 2022
  • Topics
    • Cloud Security
    • Cyber Crime
    • Cyber Warfare
    • Data Protection
    • DDoS
    • Hacking
    • Malware, Phishing and Ransomware
    • Mobile Security
    • Network Security
    • Regulation
    • Skills Gap
    • The Internet of Things
    • Threat Detection
    • AI and Machine Learning
    • Industrial Internet of Things
  • Multimedia
  • Product Reviews
  • About Us

© 2015 - 2019 IT Security Guru - Website Managed by Calm Logic

This site uses functional cookies and external scripts to improve your experience.

Privacy settings

Privacy Settings / PENDING

This site uses functional cookies and external scripts to improve your experience. Which cookies and scripts are used and how they impact your visit is specified on the left. You may change your settings at any time. Your choices will not impact your visit.

NOTE: These settings will only apply to the browser and device you are currently using.

GDPR Compliance

Powered by Cookie Information