600,000 GPS Trackers Left Exposed Online With a Default Password of '123456' (zdnet.com) 52
According to Avast security researchers, over 600,000 GPS trackers manufactured by a Chinese company are using the same default password of "123456. "They say that hackers can abuse this password to hijack users' accounts, from where they can spy on conversations near the GPS tracker, spoof the tracker's real location, or get the tracker's attached SIM card phone number for tracking via GSM channels," reports BleepingComputer. From the report: Avast researchers said they found these issues in T8 Mini, a GPS tracker manufactured by Shenzhen i365-Tech, a Chinese IoT device maker. However, as their research advanced, Avast said the issues also impacted over 30 other models of GPS trackers, all manufactured by the same vendor, and some even sold as white-label products, bearing the logos of other companies. All models shared the same backend infrastructure, which consisted of a cloud server to which GPS trackers reported, a web panel where customers logged in via their browsers to check the tracker's location, and a similar mobile app, which also connected to the same cloud server. But all this infrastructure was full of holes.
While Avast detailed several issues in its report, the biggest was the fact that all user accounts (either from the mobile app or web panel) relied on a user ID and a password that were easy to guess. The user IDs were based on the GPS tracker's IMEI (International Mobile Equipment Identity) code and was sequential, while the password was the same for all devices -- 123456. This means that a hacker can launch automated attacks against Shenzhen i365-Tech's cloud server by going through all user ID's one by one, and using the same 123456 password, and take over users' accounts. While users can change the default after they log into their account for the first time, Avast said that during a scan of over four million user IDs, it found that more than 600,000 accounts were still using the default password.
While Avast detailed several issues in its report, the biggest was the fact that all user accounts (either from the mobile app or web panel) relied on a user ID and a password that were easy to guess. The user IDs were based on the GPS tracker's IMEI (International Mobile Equipment Identity) code and was sequential, while the password was the same for all devices -- 123456. This means that a hacker can launch automated attacks against Shenzhen i365-Tech's cloud server by going through all user ID's one by one, and using the same 123456 password, and take over users' accounts. While users can change the default after they log into their account for the first time, Avast said that during a scan of over four million user IDs, it found that more than 600,000 accounts were still using the default password.
Cue the references to the same password on luggage (Score:1)
Re: (Score:3)
Re: (Score:2)
Obviously... my point was to imitate a countdown until such comments started.
And true to every expectation, the first post on this story after my own [slashdot.org] did not disappoint, not 30 seconds after I had clicked submit in my previous comment.
That pesky 6 ! (Score:2)
It would have been the same as the combination on the luggage if only it stopped at 5. But the 6 at the end messed it all up.
At least I know that he's afraid of 7, so that makes me feel better already.
That's amazing! (Score:5, Funny)
That's amazing! I have the same combination on my luggage!
Re:That's amazing! (Score:4, Funny)
Re: (Score:2)
I just looked up dick van patten to see if he was still alive....ffff....
Re: (Score:1)
Reference [youtube.com]
Re: (Score:2)
600,000 GPS Users EXPOSED Themselves Online? (Score:2)
Re: (Score:2)
The problem is that some person has a good idea, but other one realizes that it is possible to build something similar with the less possible effort and making money. Then, they flood the market with a device offering the sky on characteristics but made with no quality neither security measures applied. Their only purpose is to make money, they even sell it without a brand attached if the customer likes it that way.
And we have the complete lack of compliance (if that thing even offer any type of prote
Making lemonade (Score:3)
Baller move here would be to turn these devices into an instant social media network.
Re: (Score:2)
Re: (Score:1)
Did they check if the corresponding location was all in the same warehouse?
Re: Only 600,000 is actually pretty impressive (Score:2)
Re: (Score:2)
You sure about that? Power consumption on such gadgets is SO low these days that the ability of a battery to power them probably already outmatches the expected shelf life of the battery, and since installing a power switch along with making the battery user serviceable could cost a cent or two...
Re: (Score:2)
Re: You seem quite sure/full of yourself (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: You are just too funny. (Score:2)
Re: (Score:2)
Re: You're just taking the piss now aren't you? (Score:2)
Re: You're just repeating yourself. (Score:1)
Re: (Score:1)
Re: (Score:1)
Re: (Score:1)
Re: (Score:1)
This means that a hacker can launch automated attacks against Shenzhen i365-Tech's cloud server by going through all user ID's one by one, and using the same 123456 password, and take over users' accounts.
So they weren't 'hacking' the devices, but the server. How do they even know which ID's had been used by actual people?
It seems that every device’s account is active from the time the device is manufactured, so an attacker can lock-out the user out of the account even before he buys his tracker just based on the IMEI number because you can change the password of an account which belongs to a device that has not been used yet.
Oh so they didn't need it to be active, or even sold yet to 'hack' it.
You're right though, they couldn't see it online and hopefully accounted for that in their analysis.
Re: (Score:1)
With so many devices around, the only you need to check is where are them and to figure what it is useful to hack (hear).
For example, let's figure if there are some near Microsoft offices in Redmond. If we find some, let's track them to check if they belong to some Microsoft's employee and later, let's turn on the microphone remotely to hear what people around the GPS owner says. Some conversations will be useless, but others not so much and they even could belong to important people (not that the owner
600,000 GPS Trackers Left Exposed Online With a De (Score:2)
Really? Where are they?
Re: (Score:2)
Re: (Score:2)
Why the fuck does a GPS tracker have a microphone?
For the purpose of spying on thieves, or monitoring carjackings.
Re: (Score:1)
Usually, the tracker itself is a simple, inexpensive devices that carries a SOC (system on chip) module as the main component; a serial bus connects the SOC to a GPS module that provides a location as well as to a GPRS modem that connects to a SIM card which provides DATA+SMS capabilities to the device. Very often, you can also find a microphone and a speaker for phone functionality that is used when the “SOS” button is pressed.
Sorry I didn't mean to read the article, I'm still new here.
Druia Air-Shield Password (Score:1)
123456 is still a stronger password than the one used for the air-shield surrounding planet Druidia.
-- This SIG has been deflated by gnarly gnomes
Re: (Score:2)
Not really. Considering the consecutive nature of the password, the quality is approximately the same.
OH NO! How will we ever find these to fix them? (Score:3)
Oh, right. Never mind.
Time for new password (Score:2)
Obviously 6 digits isn't enough anymore. Time to change it to 12345678 (cause you know hackers are going to try up to 7 next time!)