Child-Tracking Watches Are 'Easy to Hack'

A location-tracking smartwatch worn by thousands of children has proven relatively easy to hack. A security researcher found the devices neither encrypted the data they used nor secured each child's account.
 
As a result, he said, he could track children's movements, surreptitiously listen in to their activities and make spoof calls to the watches that appeared to be from parents.
 
Experts say the issues are so severe that the product should be discarded. Both the BBC and the researcher involved tried to contact the makers of the MiSafes Kid's Watcher Plus to alert them to the problem but received no reply. Likewise, a China-based company listed as the product's supplier did not respond to requests.
 
'Simple Hack'
The MiSafes watch was first released in 2015. It uses a global positioning system (GPS) sensor and a 2G mobile data connection to let parents see where their child is, via a smartphone app. In addition, parents can create a "safe zone" and receive an alert if the child leaves the area.
 
The adult can also listen in to what their offspring is doing at any time and trigger two-way calls. Pen Test Partner's Ken Munro and Alan Monie learned of the product's existence when a friend bought one for his son earlier this year. Out of curiosity, they probed its security measures and found that easy-to-find PC software could be used to mimic the app's communications.
 
This software could be used to change the assigned ID number, which was all it took to get access to others' accounts, making it possible to see personal information used to register the product, including:
  • a photo of the child
  • their name, gender and date of birth
  • their height and weight
  •  the parents' phone numbers
  • the phone number assigned to the watch's Sim card
"It's probably the simplest hack we have ever seen," he told the BBC. "I wish it was more complicated. It isn't."
 
Rather than compromise other people's watches, the researchers bought several more units to test. With these, they found it was possible to:
  • trigger the remote listening facility of someone else's watch, with the only warning being that a brief "busy" message appeared before its screen returned to blank
  • track the wearer's current and past locations
  • alter the safe zone facility so that alerts were triggered by a child's approach rather than their departure
Pen Test Partners also learned it was possible to bypass a feature supposed to limit the watch to accepting calls from only authorised parties. The researchers did this by using an online "prank call" service that fools receiving devices into showing another person's caller ID number.
 
"Once a hacker has the parent's number, they could spoof a call to appear to come from it and the child would now think it's their mum or dad dialing," said Mr Munro.
 
"So they could leave a voice message or speak to the child to convince them to leave their house and go to a convenient location."
 
Using a different tool, Mr Munro said his team were able to see that about 14,000 MiSafes were still in active use
 
Sales Ban
The Norwegian Consumer Council highlighted other cases of child-targeted smartwatches with security flaws last year. It said the MiSafes products appeared to be "even more problematic" than the examples it had flagged.
 
"This is another example of unsecure products that should never have reached the market," said Gro Mette Moen, the watchdog's acting director of digital services.
 
"Our advice is to refrain from buying these smartwatches until the sellers can prove that their features and security standards are satisfactory."
 
In the UK, Amazon used to sell the watches but has not had stock for some time. The BBC found three listings for the watches on eBay but the online marketplace said it had since removed them on the grounds of an existing ban on equipment that could be used to spy on people's activities without their knowledge.
 
MiSafes previously made headlines in February when an Austrian cyber-security company discovered several flaws with its Mi-Cam baby monitors. SEC Consult said these meant hackers could spy on footage from owners' homes and hijack accounts.
 
BBC
 
You Mighht Also Read:
 
Give Children More Control Of Data Privacy:
 
 
« Millennials Are A Threat To Cybersecurity
US & Singapore Agree Cybersecurity Pact »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

Perimeter 81 / How to Select the Right ZTNA Solution

Perimeter 81 / How to Select the Right ZTNA Solution

Gartner insights into How to Select the Right ZTNA offering. Download this FREE report for a limited time only.

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

TestFort

TestFort

TestFort QA Lab is a specialized software testing company offering independent quality assurance and software testing services.

Beame.io

Beame.io

Beame.io is an information security company that distributes open source authentication infrastructure based on encryption.

Perception Point

Perception Point

Perception Point is a Prevention-as-a-Service company, built to enable digital transformation. Our platform offers 360-degree protection against any type of content-based attack.

Regulus Cyber

Regulus Cyber

Regulus enables drones, robots and autonomous vehicles to operate safely, without malicious or accidental interference to the operation of their mission.

Cyber Security Malta

Cyber Security Malta

Cyber Security Malta is part of Malta's National Cyber Security Strategy which aims to combat cybercrime, strengthen national cyber defence and provide cyber security awareness and education.

ThreatAware

ThreatAware

Total visibility of your business cybersecurity. Monitoring, management and compliance for your cybersecurity tools, people and processes from one easy to use dashboard.

Rentalworks

Rentalworks

Rentalworks is a leading provider of Internet-of-Things (IoT) Asset Lifecycle Management Services including secure data erasure and disposal.

Maven Technologies

Maven Technologies

Maven Technologies specialize in secure data destruction, electronics recycling, asset management, and highly detailed reporting.

CyberSAFE Malaysia

CyberSAFE Malaysia

CyberSAFE Malaysia is an initiative to educate and enhance the awareness of the general public on the technological and social issues and risks facing internet users.

jobsDB.com

jobsDB.com

jobsDB Singapore is a search engine for jobs throughout Singapore.

Networks Unlimited

Networks Unlimited

Networks Unlimited is a leading value-added distributor in Africa, providing technology solutions with a focus on security, networking, enterprise systems management and cloud technologies.

Pionen

Pionen

Pionen are a specialist information security consultancy with excellent people and proven security delivery methodologies at its core.

LogicMonitor

LogicMonitor

LogicMonitor provides SaaS-based IT infrastructure monitoring services for on-premises and multi-cloud environments.

Eviden

Eviden

Eviden is an Atos business that brings together its digital, big data and security business lines. It will be a global leader in data-driven, trusted and sustainable digital transformation.

Cytek

Cytek

Cytek is a leading provider of cybersecurity and HIPAA compliance for dental practices and other industries.

Axient

Axient

Axient advances defense and civilian missions from aerospace to cyberspace with multi-domain test and analysis, mission engineering and operations, and advanced technologies.