pentestpartners.com/security-blog/gps-watch-issues-again

lolol

I would have just published it in the form of a database dump.

I'm sure that would have gotten it much more publicity.

@forest wow - just wow. I like to tell everyone about how "people are just bad at security" but stuff like this is legitimately shocking. Literally 0 access controls to gain access to GPS locations of tens of thousands of children... I wrote better security for the first web apps I made in high school (and let's be clear, the security I baked into my stuff back then was also crap)

@ConorMancone Yep. This stuff isn't even uncommon.

Remember the "smart doll" that recorded children's voices?

Sent it unencrypted to an unauthenticated server somewhere?

And wasn't that server also exposed on Shodan, complete with downloadable audio from thousands of children's rooms and wherever else the dolls were kept?

@forest I've heard enough horror stories so I'm not sure why this one seems especially ridiculous. This is why I avoid IoT devices like the plague. I've basically turned into a grumpy old man who refuses change... sigh

Probably because it includes GPS information which is quite sensitive.

@ConorMancone It seems to be a common thing among security professionals to have a deep disdain for IoT and "smart" devices. Or at least a strong aversion to them.

> We disclosed to TechSixtyFour on the 11th January asking for a resolution within one month, meaning a public disclosure point of 11th February. This may seem short but sensitive data involving 35,000 children was exposed.

I still think it would be more amusing to put it in a torrent. :D

Gentle reminders like this will never convince people.

But alas, I'm too lazy to buy one of these watches just to break it.