Flaws in Smartwatches on Amazon May Let Strangers Track Kids




Children using smart watch
Children using smart watch  

(Bloomberg) -- Security researchers discovered vulnerabilities in cheap smartwatches for children that make it possible for strangers to override parental controls and track kids.

Rapid7 Inc., a cybersecurity firm based in Boston, purchased three smartwatches on Amazon.com, costing from $20 to $35, according to Deral Heiland, research lead for IoT technology. He said the models -- GreaSmart Children's SmartWatch, Jsbaby Game Smart Watch and SmarTurtle Smart Watch for Kids -- were picked randomly from dozens for sale on Amazon and marketed as appropriate for grade school-aged kids.

All three devices offer location tracking, messaging and chat features. They were manufactured in China and shared nearly identical hardware and software. They also had similar security issues, Rapid7 found.

The watches let authorized users view and change configuration details by texting the watch directly with certain commands. In practice, this didn't work and "unlisted numbers could also interact with the watch," Rapid7 said in a report.

This security issue could be fixed with a vendor-supplied firmware update, but "such an update is unlikely to materialize given that the providers of these devices are difficult to impossible to locate," the cybersecurity firm added.

The watches have a default password of "123456," but one of the watch's manuals doesn't mention the password, according to the researchers. Another mentioned the password in a blog but not in its printed material. The third doesn't characterize the numbers as a password nor does it provide instructions on how to change it, according to the researchers.

"Given an unchanged default password and a lack of SMS filtering, it is possible for an attacker with knowledge of the smartwatch phone number to assume total control of the device, and therefore use the tracking and voice chat functionality with the same permissions as the legitimate user (typically, a parent)," Rapid7 said in its report.

An unauthorized user could shut off all the safety protocols a parent had set up on the smartwatch, Heiland said.

Rapid7 said its researchers weren't able to contact the sellers nor what they believe is the manufacturer of the watches, a Chinese company called 3g Electronics Co. The company didn't respond to a message from Bloomberg News seeking comment.

The GreaSmart Children's SmartWatch is no longer for sale on Amazon, according to Rapid7. GreaSmart, Jsbaby, SmarTurtle didn't respond to a requests for comment. Oltec, a merchant that sells the SmarTurtle watch on Amazon, didn't respond to a message sent via Amazon's site.

"Consumers that are concerned with the safety, privacy, and security of their IoT devices and the associated cloud services are advised to avoid using any technology that is not provided by a clearly identifiable vendor, for what we hope are obvious reasons," Rapid7 warned in its report.

To contact the reporter on this story: Andrew Martin in New York at amartin146@bloomberg.net

To contact the editors responsible for this story: Tom Giles at tgiles5@bloomberg.net, Alistair Barr, Andrew Pollack

For more articles like this, please visit us at bloomberg.com

©2019 Bloomberg L.P.

COMMENTS

More Related News

Sanders Goes After JPMorgan CEO Jamie Dimon in New Ad
Sanders Goes After JPMorgan CEO Jamie Dimon in New Ad

(Bloomberg) -- Bernie Sanders goes after Jamie Dimon in a new campaign ad, labeling the JPMorgan Chase & Co. chief executive officer "the biggest corporate socialist in America today."The jab continues criticism by the Vermont senator and presidential candidate after Dimon knocked socialism in an op-ed published last week in Time magazine as part of its coverage of the World Economic Forum in Davos, Switzerland. "Are you kidding me?" a Sanders aide exclaims in the ad, which was posted on Twitter. The spot cites Dimon's pay, including $31.5 million last year, and says JPMorgan received bailouts after the global financial crisis 12 years ago.Dimon, a 63-year-old billionaire, has previously...

Biden, Sanders Pull Further Ahead in ABC-WaPost National Poll
Biden, Sanders Pull Further Ahead in ABC-WaPost National Poll

(Bloomberg) -- Joe Biden and Bernie Sanders, who represent rival visions for the Democratic Party, are solidifying their status as frontrunners in the crowded presidential field, according to a Washington Post-ABC News national poll.Coming just a week before voters finally get to have their say in the Iowa caucuses, the polls show Biden with a solid 32% overall among registered voters who lean Democratic, while Sanders registered support from 23%. Both are doing slightly better than in the same poll in October.Senator Elizabeth Warren, who was once considered a front-runner and earned endorsements from the New York Times a week ago and from the Des Moines Register in Iowa on Saturday, has...

Warren Says She
Warren Says She's Ready to Fight After Major Iowa Endorsement

(Bloomberg) -- The Des Moines Register endorsed progressive favorite Senator Elizabeth Warren a little more than a week before the Iowa caucuses on Feb. 3, saying the Massachusetts lawmaker would "push an unequal America in the right direction." The influential newspaper in Iowa's largest city revealed its pick for the first-in-the-nation nominating contest on its website Saturday evening."At this moment, when the very fabric of American life is at stake, Elizabeth Warren is the president this nation needs," the Register's editorial board said.The Register said that many of Warren's ideas "are not radical. They are right.  They would improve life in America, and they are...

LGBT Rights Group Demands Sanders Renounce Rogan Endorsement
LGBT Rights Group Demands Sanders Renounce Rogan Endorsement

(Bloomberg) -- The Human Rights Campaign is calling on Bernie Sanders to renounce an endorsement from radio host Joe Rogan, who has made derogatory comments about African Americans and LGBTQ people.Rogan, who hosts "The Joe Rogan Experience," one of the most downloaded podcasts, said he would "probably vote for Bernie," adding "I believe in him. I like him a lot."In response, HRC President Alphonso David said in a statement that while Sanders' campaign has been "unabashedly supportive of the rights of LGBTQ people," Rogan "has attacked transgender people, gay men, women, people of color and countless marginalized groups at every opportunity."The statement from the largest LBGTQ advocacy...

Trump Lawyers Still Plan to Start Saturday: Impeachment Update
Trump Lawyers Still Plan to Start Saturday: Impeachment Update

(Bloomberg) -- House managers will wrap up their case against President Donald Trump on Friday, completing three days of arguments in the Senate impeachment trial. Trump's lawyers are set to begin presenting his defense on Saturday.Here are the latest developments:Trump Lawyers Still Plan to Start Saturday (10:19 a.m.)Trump's lawyers still plan to open their defense on Saturday, an administration official familiar with the matter said Friday, hours after the president tweeted that Saturday is the "Death Valley" of television."After having been treated unbelievably unfairly in the House, and then having to endure hour after hour of lies, fraud & deception by Shifty Schiff, Cryin' Chuck...

Leave a Comment

Your email address will not be published. Required fields are marked with *

Cancel reply

Comments

Top News: Economy