Hackers Stalked Me by Hijacking a Smartwatch for Kids

Key Points:

• Security researchers Vangelis Stykas and Felipe Solferini demonstrated how cheap, GPS-enabled children's smartwatches, particularly those made by Shenzhen-based manufacturer YiQingTeng and others, can be hacked to track location, take photos, record audio, and intercept messages without the wearer’s knowledge.
• Their analysis revealed that tens of millions of GPS devices, including watches and car accessories, rely on just three vulnerable supply chains—YiQingTeng’s SETracker, NewGPS2012, and SinoTrack—each with significant security flaws such as lack of authentication and SQL injection vulnerabilities.
• The researchers showed that these vulnerabilities allow hackers to remotely control devices, access personal data, spoof locations and messages, and potentially unlock or disable vehicles, exposing millions of children and drivers to serious privacy and safety risks.
• Despite months of warnings, many of these companies have not fully addressed the security issues; only SETracker showed signs of patching vulnerabilities shortly before the researchers’ Black Hat presentation, while SinoTrack and NewGPS2012 remain vulnerable.
• The findings highlight the illusion of consumer choice in the GPS device market, as many different brands use the same insecure backend platforms, meaning a single vulnerability can affect numerous products worldwide, posing widespread risks to users.