GPS trackers found to have serious security flaws

Certain brands of GPS trackers – relied upon to keep children and elderly people safe across the world – have been found to hold serious security flaws, according to Avast.

The T8 Mini GPS tracker and nearly 30 other models by the same manufacturer, Shenzhen i365 Tech, were discovered to be vulnerable to hackers.

Marketed to keep kids, seniors, pets, and even possessions safe, instead these devices expose all data sent to the cloud, including exact real-time GPS coordinates. Further, design flaws can enable unwanted third-parties to spoof the location or even access the microphone for eavesdropping.

Researchers at Avast Threat Labs estimate that there are 600,000 unprotected trackers in use globally, including several hundred in use across ANZ. The researchers also emphasise that these IoT security issues go far beyond the scope of a single vendor.

Martin Hron, senior researcher at Avast who led this research, advises buyers of these products to opt for an alternative from brands that have built security into the product design, specifically secure login and strong data encryption. As with any off-the-shelf device, we recommend changing the default admin passwords to something more complex; however, in this case, even that will not stop a motivated individual from intercepting the unencrypted traffic. “We have done our due diligence in disclosing these vulnerabilities to the manufacturer, but since we have not heard back after the standard window of time, we are now issuing this Public Service Announcement to consumers and strongly advise you to discontinue use of these devices,” Hron said.

Avast Threat Labs first analysed the T8 Mini onboarding process, following the instructions to download the companion mobile app from http://en.i365gps.com — notably, a website served over HTTP protocol as opposed to the more secure HTTPS. Users can then login to their account with their assigned ID number and very generic default password of “123456”. This information was transmitted over insecure HTTP protocol, too.

The ID number is derived from the International Mobile Equipment Identity (IMEI) of the device, so it was easy for researchers to predict and enumerate possible ID numbers of other trackers by this manufacturer. Combined with the fixed password, practically any device following this sequence of IMEI numbers would be able to be broken into with little effort.

Using a simple command lookup tool, researchers discovered that all of the requests originating from the tracker’s web application are transmitted in unencrypted plain-text.

Of more concern, the device can issue commands beyond the intended uses of GPS tracking, such as:
● Call a phone number, enabling a third-party to eavesdrop through the tracker’s microphone
● Send an SMS message, which could allow an attacker to identify the phone number of the device and thus use inbound SMS as an attack vector
● Use SMS to reroute communication from the device to an alternate server in order to gain full control of the device or spoof information sent to the cloud
● Share a URL to the tracker, allowing a remote attacker to place new firmware on the device without even touching it, which could completely replace the functionality or implant a backdoor

The companion mobile app AIBEILE (on both Google Play and iOS App Store) was also found communicating with the cloud through a non-standard HTTP port, TCP:8018, sending unencrypted plain-text to the endpoint. Upon dissecting the device itself to analyse how it speaks to the cloud, Avast Threat Labs confirmed that the data again travels unencrypted from the GSM network to the server without any authorisation.

In addition to the device that is the focus of this research, Avast has identified 29 other models of GPS trackers containing these security vulnerabilities — most of which are made by the aforementioned vendor — as well as 50 different mobile applications sharing the same unencrypted platform discussed above. Researchers estimate there are more than 600,000 devices in the wild with default “123456” passwords and upwards of 500,000 downloads of the mobile apps. Repeated notifications to the device maker revealing the flaws received no response.