An Australian company behind a GPS tracking smartwatch for children backed to the tune of $1 million by the Queensland government has been found to be vulnerable to a security flaw that computer security researchers say allowed them to track a child, make them appear in another location, call them, and listen to them - without any interaction from the user.
Subscribe now for unlimited access.
$0/
(min cost $0)
or signup to continue reading
It's every parent's worst nightmare: discovering the smartwatch tracking device you bought to protect your child could be used instead by a stranger to stalk them.
But that's the reality confronting those who purchased the $210 smartwatch marketed by Australian mother Karen Cantwell, from Brisbane, who is behind the TicTocTrack device.
The company sent an email to users about the issue on Monday afternoon explaining why it would temporarily shut down its service after Ken Munro, a computer security researcher from Britain, told it of the flaw over the weekend. Mr Munro also worked with Troy Hunt, another researcher from Brisbane, to uncover the vulnerability and demonstrate how "trivial" it was to exploit.
"It's a failure to correctly check that the person logged in to the account is the person authorised to access that data," Mr Munro said in an email. "As a result, anyone can access anyone else's data."
Mr Munro and Mr Hunt both described the flaw in detail on separate blog posts on their respective websites. Mr Hunt also filmed a video of his six-year-old daughter Elle using the watch as it was remotely accessed by an unauthorised third party, who spoke to her.
"If you can count you can exploit this risk," Mr Hunt said, describing how the flaw meant it was as easy as changing a number in a URL address to access another child's smartwatch.
"I would never buy one of these watches for my children.
"The only reason I bought this was to demonstrate the flaw. If I were a parent who bought one with the intention of using it I would return it and ask for a refund."
The watch, which requires a SIM card and monthly subscription of between $6 and $20, has been on sale in Australia since 2014 and makes use of hardware made by Chinese company Gator.
The software was developed in partnership with Sri Lanka-based Nibaya, although Ms Cantwell said TicTocTrack dealt with the head of the company's development team in Perth.
On Monday evening, Ms Cantwell labelled as "a generalisation" the researchers' explanation of what they said they were able to do with the flaw.
"This is yet to be confirmed as an issue beyond the penetration testing conducted by Ken Munro," Ms Cantwell said, declining to reveal how many TicTocTrack smartwatches have been sold in Australia.
Earlier this month, Ms Cantwell told ABC News that sales had increased by 600 per cent over the past three years. Mr Hunt estimates sales could be around 3500 if the number assigned to the watch he bought was sequential. "We'll pass on this question," Ms Cantwell said when asked.
In an email to users and a media statement on Monday, Ms Cantwell said there had "never been a security breach that has lead to our customers' personal data being used for malicious purposes".
Ms Cantwell added that as soon as a technical assessment had taken place, she would release a report detailing what security issues were apparent and what steps it would take and when.
"We hope to have the service back up and running by close of business Wednesday the 17th of April however will continue to keep you informed as we progress through our investigations," she said.
In another statement on Tuesday afternoon, Ms Cantwell said her company had received additional information from the researchers that had allowed it to further investigate.
"Any and all security issues are being addressed and will be fixed as soon as possible," she said.
In addition to receiving money from the Queensland government, Ms Cantwell's company is a registered National Disability Insurance Scheme provider.
In November 2017, news website WeLiveSecurity reported that German parents were being told to destroy smartwatches they bought for their children after the country's communications regulator put a ban in place to prevent their sale following revelations about similar security flaws.
- SMH/The Age
