Avast experts have discovered that over 600,000 GPS trackers used to monitor the location of children, elderly people, pets, cars, and more were using the password “123456.”
By using the default password to hack user accounts, attackers can eavesdrop on conversations near the GPS tracker, simulate the device’s real location, and even learn the number of the SIM card connected to the tracker.
It all started with the detection of problems with the T8 Mini trackers from the Chinese IoT company Shenzhen i365-Tech. However, the experts quickly discovered that the password “123456” was also used for 30 other GPS tracker models produced by the same company, some of which were sold under white label and presented on the market under the brands of other companies.
All of the problematic trackers share the same infrastructure, which consists of a cloud server to which the tracker “reports,” a web panel (which customers access through browsers to check the device’s location), and a similar mobile app that also connects to the same cloud server.
Although Avast experts immediately identified a number of problems in the described infrastructure, the most significant is that all user accounts (both in the mobile app and on the web panel) use a user ID and password that are easy to guess. The user ID is based on the tracker’s IMEI and is sequential, and the password, as mentioned above, is the same default for all devices: “123456.”
In effect, this means attackers can launch an automated attack on the Shenzhen i365-Tech cloud server, going through every user ID one by one and using the same password to hijack user accounts.
Fortunately, users are not prohibited from changing the password on GPS trackers, but Avast analysts scanned more than 4,000,000 credentials and found that over 600,000 accounts were still using the default password. The actual number of GPS trackers with default passwords is likely much higher.
Moreover, the problem is compounded by the fact that such devices are equipped with built-in microphones and SIM cards that allow children and elderly people to place SOS calls and communicate with family members. The researchers found that compromising the tracker effectively allowed attackers to call its number, answer those calls, and then spy on and locate the owner.
The vulnerabilities found also threaten the manufacturer itself. The fact is that vulnerable accounts are created in the cloud immediately after GPS trackers are manufactured. In theory, a competitor could take control of these accounts even before the devices are sold and change the passwords, locking out the accounts and causing problems for Shenzhen i365-Tech and resellers.
All the problems described by the experts remain unresolved, as representatives of Shenzhen i365-Tech did not respond to the researchers’ numerous requests. Avast analysts strongly urge users of vulnerable trackers to change their passwords immediately. A complete list of vulnerable devices is provided at the end of the expert report.
