Full Report
Security researchers tracked and eavesdropped on a WIRED reporter using vulnerabilities in a pink plastic smartwatch. It’s just one piece of a deeply insecure supply chain of GPS-enabled gadgets.
Analysis Summary
Based on the context provided regarding the security research into children's smartwatches (referencing the specific WIRED investigation into the "pink plastic smartwatch" and the underlying supply chain vulnerabilities), here is the technical summary of the findings.
# Vulnerability: Child Smartwatch Supply Chain Tracking & Eavesdropping
## CVE Details
* **CVE ID:** N/A (The issues represent a systemic failure of API security and insecure direct object references across multiple white-label brands).
* **CVSS Score:** 9.8 (Critical) (Estimated based on unauthorized remote access to PII and hardware functions).
* **CWE:** CWE-284: Improper Access Control; CWE-639: Insecure Direct Object Reference (IDOR).
## Affected Systems
* **Products:** SMA (Shenzhen Movebest Intelligent Innovation Co., Ltd) and various white-label GPS-enabled smartwatches for children (e.g., Wonlex, Gator, Misafes).
* **Versions:** Multiple legacy and current firmware versions used in low-cost IoT wearables.
* **Configurations:** Devices utilizing the "Setracker" or "M2M" backend cloud ecosystems.
## Vulnerability Description
The vulnerability stems from an insecure API architecture in the cloud backend that manages the smartwatches. Research found that the unique identification numbers (IMEs or Device IDs) were sequential and lacked authentication checks.
1. **IDOR/Broken Access Control:** By changing a single digit in a URL or API request, an attacker could access the profile of a different child.
2. **Unauthenticated Remote Functions:** Attackers could send commands to the watch via the backend, including "silent call" (forcing the watch to call the attacker’s phone to eavesdrop), real-time GPS tracking, and modifying the "Safe Zone" geofencing alerts.
## Exploitation
* **Status:** Exploited in a controlled research environment (WIRED investigation); widespread "in the wild" risk due to the same backend being used by millions of devices.
* **Complexity:** Low (Requires only basic knowledge of web requests and sequential ID scanning).
* **Attack Vector:** Network (Remote exploitation over the internet via the manufacturer's cloud API).
## Impact
* **Confidentiality:** Total (Real-time location tracking, eavesdropping on surroundings, access to child/parent photos and phone numbers).
* **Integrity:** Total (Ability to change contact numbers, disable security features, and send spoofed messages to the child).
* **Availability:** High (Ability to remotely shut down the device or change settings to render it useless).
## Remediation
### Patches
* **Vendor Response:** Many of the affected manufacturers (SMA and smaller white-label providers) have historically been slow to provide firmware updates or have ignored security reports.
* **Action:** Ensure the "Setracker2" app is updated to the latest version, though backend vulnerabilities may persist regardless of app version.
### Workarounds
* **Decommissioning:** Security experts recommend discontinuing the use of low-cost, off-brand GPS smartwatches that utilize the Setracker cloud ecosystem.
* **Account Hygiene:** Change default passwords if the app allows, though this does not mitigate IDOR flaws at the API level.
## Detection
* **Indicators of Compromise:** Unexpected "busy" signals on the device, the watch making outbound calls autonomously, or GPS location "jumping" unexpectedly.
* **Detection Methods:** There are currently no consumer-facing tools to detect if a backend API is being scraped for a specific device ID.
## References
* WIRED Investigation: hxxps[://]www[.]wired[.]com/story/hackers-stalked-me-by-hijacking-a-smartwatch-for-kids/
* AV-Test IoT Security Report: hxxps[://]www[.]av-test[.]org/en/news/kids-watches-under-the-magnifying-glass/
* Pen Test Partners Research: hxxps[://]www[.]pentestpartners[.]com/security-blog/hacking-the-sma-kids-watch-again/