MiSafes' child-tracking smartwatches are easy to hack | Hacker News Reader

MiSafes' child-tracking smartwatches are easy to hack

bbc.com

86 pointswil_I_am_2743 comments

I suggest the title be change from "easy to hack" to "easy to compromise" - I was hoping to see that someone had created a custom firmware for them or something :(

It's BBC, they don't know there's a difference.

As much as "hackers" wish to keep the word hacker to mean what it used to mean, I think "hacking" has fully entered the English lexicon with the meaning as used in the headline. No amount of complaining and correcting can change that now. It still means what it used to in some circles, but the primary meaning is hacking as in cracking.

Just like we will "literally" never get the literal cat back in the bag.

I get that, but I was suggesting it being changed here, as in this community the word retains much of its original meaning.

Who in that company would be liable, should there ever be an incident where a child is tracked, abducted and harmed utilizing this gps device? Just the CEO, or will board members also feel shared pain?

Would or should.

I imagine many lawyer-hours would find that "this peon employed to ensure the device is secure" is found to be entirely responsible.

Probably so. Gone are the good ol' days of Bushido and Seppuku.

[1] - https://en.wikipedia.org/wiki/Seppuku

These are Japanese concepts, while the manufacturer is Chinese.

Yes. I want to see that applied to all businesses, all cultures. If Earth elects me as Emperor, I will bring these practices back.

If the corporate info in the terms of use are accurate (Shenzhen Langya Electronics Co., Ltd registered in the Republic of Ireland) then the company would already be bankrupted and assets transferred to a duplicate company in the time it takes a prosecutor lick the envelope

Edit: This ToS is hilarious

  No Data Mining or Harmful Code.

  You agree that you will not
 (a) obtain or attempt to obtain any information from the Service;
 (b) intercept, examine or otherwise observe any proprietary communications protocol used by the Service, whether through the use of a
     network analyzer, packet sniffer or other device; or
 (c) use any type of bot, spider, virus, clock, timer, counter, worm, software lock, drop dead device, Trojan-horse routing, trap door, time
     bomb or any other codes, instructions or third-party software that is designed to provide a means of surreptitious or unauthorized
     access to, or distort, delete, damage or disassemble the Site or the Service.

> the company would already be bankrupted and assets transferred to a duplicate company in the time it takes a prosecutor lick the envelope

I've always been told that judges are in fact humans who can see that for the no-op it is and are unlikely to be amused by such a stunt.

This is a Chinese company we're talking about. I'm not sure how much influence an American judge is going to have.

"registered in the Republic of Ireland"

If I remember correctly, quite a few companies register in Ireland for use as a tax haven?

Jokes on them, I just used a magnifying glass to distort their site!

Seriously though, what the hell?

I'd like to remind of a few priority items if you're in the US:

1. We desperately need to fix incentives for prosecutors. We as a people need to decide what we are trying to optimize for because I'm pretty sure we are not trying to optimize for a near 100% conviction rate. Prosecutors and attorney generals are humans and they react to incentives.

2. We must repeal the CFAA. While an appeals court has apparently ruled that a terms of services (TOS) violation is not a criminal offense, because we have not fixed 1 (above), this will continue to be a problem. As impossible it might seem to repeal, I think it is much easier than to do 1.

Some people might say that we need the CFAA in some form and that we just need to amend it. Say no to such calls for "moderation". You wouldn't pick the "middle road" between being alone and being dead. I want to be very much alive. The "middle way" of pleasing everyone doesn't always work.

Repeal the CFAA (and don't replace it with anything).

That's a pretty silly scenario. If you want to abduct a child - just go to the park. What use would this device be?

It's not actually.

Someone wanting to abduct a specific child is, contrary to popular belief, multiple orders of magnitude more common than someone wanting to abduct an arbitrary child.

Exactly. This past Halloween our neighborhood bulletin board lit up with people freaking out about young children trick-or-treating unsupervised. Someone even cited registered sex offender statistics.

Trying to explain to them that it was more likely that a child would be kidnapped by a friend or family member - or to die in an auto or airplane accident - was seemingly impossible.

Without this device, they have to drive up, close and personal. They have to essentially stalk their victims. There is a greater chance of getting captured on CCTV or having eye witnesses that might get their license plate.

With this device there are a few problems:

1) Parents will have a false sense of security. They may let their child wander off a litter farther, possibly out of view.

2) The abductors can passively determine which kids are likely to be farther away from their parents and determine the safest path to extract their victim.

In terms of being silly: This could be a former (abusive) parent that is legally blocked from seeing their kid unsupervised. This is the most common scenario and many of the amber alerts are for this.

In my opinion, if parents are going to rely on something like this, it needs to use military grade encryption and military grade implementation / process and be pentested by numerous independent researchers and come with a multi-million dollar guarantee that it can not be compromised. If that is too difficult with current tech, then this device should not exist. Rather, parents will need to stay with their children until their children are able to defend themselves.

Germany banned smartwatches for children last year: https://www.theverge.com/circuitbreaker/2017/11/19/16671428/...

I think only those smartwatches are banned that allow concealed listening or viewing the camera feed without the kid noticing.

No, the article specifically states "Germany’s telecommunication agency, the Bundesnetzagentur, has banned smartwatches for kids, and is asking parents to destroy them." It used the fact that these are listening devices, yes, but the ban as stated sounds quite absolute.

And other articles state that it is only smartwatches with a listening device. This is why you don't trust a single article from a sensationalist website and rely on exact phrasing within it.

The Bundesnetzagentur does not have the capacity to ban random devices for children.

They banned these devices because they are essentially bugs/covert listening devices and are even marketed as such. Devices that look innocious (such as children's watches or teddy bears) but in reality are covert listening devices are banned in Germany by §90 TKG. [1]

This is why the Bundesnetzagentur banned the smartwatches in question. They even cited cases in which these watches were used to monitor teachers in classrooms. [2]

"Normal" smartwatches are NOT banned. "Normal" smartwatches for children are also NOT banned. Only watches with monitoring functions fall under the §90 TKG law. [3] Note that using an app to bring covert listening functionality to a phone or watch also converts that device into an illegal listening device.

[1] https://www.gesetze-im-internet.de/tkg_2004/__90.html (Just for reference)

[2] https://www.bundesnetzagentur.de/SharedDocs/Pressemitteilung... (German, but google translate works sufficiently well)

[3] https://www.bundesnetzagentur.de/DE/Sachgebiete/Telekommunik... (German, use a translator)

Amusingly, in your second link, Google refers to watches as “watches,” “clocks,” and “watchmen.”

It banned smartwatches that were specifically designed for children - they did not ban children wearing generic smart watches.

It banned smartwatches that have remote cover listening features. Smartwatches for kids that don't have them are fine.

Christ, I'm happy I don't live in a country where the govt decides what kind of watch my child can wear.

This is a viewpoint that reduces to the absurd very quickly.

It went after some specific smartwatches for kids that had illegal features (specifically, covert remote listening) and reminded people that these features are illegal.

The really disturbing thing about this is how devices like this make surveillance even more normal. It's like training your own children to accept what should be an unacceptable loss of freedom and privacy.

So, what is the specific threat model here? Who is going to hack these children's phones, and what are they going to do with that access?

Think about divorced/separated families. Many child kidnappings are unauthorized custody by a parent or family member.

Does the watch vulnerability meaningfully increase the risk here?

These people would know what a child's routine is already, and would not need smartwatch info.

And we're talking about people to are also technically savvy enough to reverse engineer this software.

It seems more likely that even in this situation, the watch would be a help rather than a harm.

I'm not saying we shouldn't care about security, but people tend to over-react whenever children are involved.

As frustrating as it can be sometimes, if children are involved, it's almost certainly a better idea to overreact than underreact.

Agreed. I hate the "won't someone think of the children" attitude towards social norms, but they are for the most part utterly defenseless and deserving of some basic protection.

>Does the watch vulnerability meaningfully increase the risk here?

Yes. You can turn on remote listening and spy on the wearer (and anyone else nearby).

They're sold as a tool for enhancing the security of your children, but it's fairly trivial to subvert them to both not do the job they're sold for, as well as giving the attacker extra information they could otherwise have only got through proximity.

If there's a real risk (and while it might be relatively rare, real risks do exist) then the regular routine is hopefully already set up to mitigate the risk. The value to the attacker is in being able to take advantage of deviations from routine that would apart from the watch be invisible to them.

A zero effort hack that yields photo, name, gender and date of birth, height, weight, parent phone numbers, and the phone number assigned to the watch.

And, you can enumerate all kids. Pretty much everything you need for a new app..."Kin-der".

People worry about chat rooms where you would have to social engineer any of that.

Anything that doesn't use encryption is very easy to hack. You just need to use a tool like Fiddler to understand the protocol. If there is lax authentication, as the article implies, this is something that an ameture can do.

It's also very easy to spoof caller ID, so this opens up children to unsolicited calls.

Anyone who can't handle an unsolicited call shouldn't have a phone in the first place

This was a phone being specifically marketed as unable to recieve unsolicited calls.

Reply on news.ycombinator.com