Incident: Children's Smartwatches Vulnerable to Hacks and Privacy Breaches

Published Date: 2018-11-14

Postmortem Analysis
Timeline 1. The software failure incident involving MiSafes child-tracking smartwatches happened in November 2018 [Article 77890, Article 77867].
System 1. MiSafes Kid's Watcher Plus [77890, 77867] 2. Smartwatches marketed for kids by JBC, Polywell, Starlian, Pingonaut, ANIO, and Xplora [104666]
Responsible Organization 1. Manufacturers of smartwatches marketed for kids, such as JBC, Polywell, Starlian, Pingonaut, ANIO, and Xplora, who had severe vulnerabilities in their products [104666]. 2. MiSafes, the company behind the MiSafes Kid's Watcher Plus, which was relatively easy to hack, leading to security vulnerabilities [77890, 77867].
Impacted Organization 1. Children using smartwatches designed for kids [104666, 77890, 77867] 2. Parents who purchased the smartwatches to track their children [104666, 77890, 77867] 3. Researchers who discovered the vulnerabilities in the smartwatches [104666, 77890, 77867] 4. Companies involved in manufacturing and selling the vulnerable smartwatches [104666, 77890, 77867]
Software Causes 1. Lack of encryption and authentication in communications with the server in smartwatches designed for kids [104666] 2. Vulnerabilities in the MiSafes child-tracking smartwatches, including unencrypted data and lack of account security [77890, 77867] 3. Easy-to-hack security measures in the MiSafes child-tracking smartwatches, allowing for tracking movements, eavesdropping, and spoof calls [77890] 4. Vulnerabilities in the MiSafes Kids Watch Plus, such as revealing personal information of children and parents [77867]
Non-software Causes 1. Lack of encryption and authentication in the communication between the smartwatches and the server [104666, 77890, 77867] 2. Inadequate security measures in the design and implementation of the smartwatches, including vulnerabilities in the backend server [104666, 77890, 77867] 3. Failure to respond to security warnings and reports from researchers and consumer protection agencies [104666, 77890, 77867] 4. Lack of proper authentication mechanisms, allowing hackers to impersonate legitimate users [104666] 5. Use of easily accessible software to mimic app communications and change ID numbers, leading to unauthorized access [77890, 77867]
Impacts 1. The software failure incident involving vulnerabilities in kids' smartwatches allowed hackers to track a target child's location, send voice and text messages appearing to come from parents, intercept communications between parents and children, and eavesdrop on a child's surroundings [104666]. 2. The security flaws in MiSafes child-tracking smartwatches made it relatively easy for hackers to track children's movements, listen in to their activities, make spoof calls to the watches, and access personal information of the children and their parents [77890, 77867]. 3. The vulnerabilities in the MiSafes smartwatches could potentially put children at risk by revealing their location to strangers and allowing strangers to eavesdrop on their conversations, posing a serious safety concern [77867]. 4. The security researchers were able to bypass features meant to limit the watch to accepting calls from authorized parties, allowing them to spoof calls and potentially manipulate children into leaving their homes [77890]. 5. The software failure incident led to a sales ban on the MiSafes watches by online marketplaces like Amazon due to the severe security issues, indicating a significant impact on the product's availability and reputation [77890].
Preventions 1. Implementation of encryption and authentication protocols in the communication between the smartwatch and the server could have prevented the software failure incident [104666, 77890, 77867]. 2. Regular security audits and testing of the smartwatch software to identify and fix vulnerabilities before they are exploited by hackers [104666, 77890, 77867]. 3. Prompt response and action by the smartwatch companies upon receiving reports of security vulnerabilities from researchers could have prevented the incident [104666, 77890, 77867]. 4. Compliance with security standards and regulations to ensure that the smartwatches meet satisfactory security standards before being released to the market [77867]. 5. Proactive measures by the smartwatch manufacturers to address security flaws and continuously improve the security of their products based on previous research findings and public warnings [104666, 77890, 77867].
Fixes 1. Implementing encryption and authentication in communications between the smartwatch and the server to prevent spoofing and unauthorized access [104666]. 2. Fixing authentication flaws in the backend server to prevent hackers from sending commands as any other user [104666]. 3. Adding TLS encryption in communications with the server to protect against interception and spoofing of messages [104666]. 4. Ensuring that the smartwatch software has proper security measures in place, such as encryption, authentication, and secure communication protocols [77890, 77867].
References 1. Security researchers at Münster University of Applied Sciences in Germany [104666] 2. Pen Test Partner's Ken Munro and Alan Monie [77890] 3. Norwegian Consumer Council [77890, 77867] 4. Austrian cyber-security company [77890] 5. MiSafes [77890, 77867]

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization, multiple_organization (a) The software failure incident related to security vulnerabilities in smartwatches has happened again at the same organization. MiSafes, the company behind the MiSafes Kid's Watcher Plus, faced a security breach where the devices were found to be easily hackable, allowing hackers to track children's movements, listen in to their activities, and make spoof calls to the watches [77890]. This incident is similar to a previous case involving MiSafes where their Mi-Cam baby monitors were found to have security flaws that could be exploited by hackers [77867]. (b) The software failure incident related to security vulnerabilities in smartwatches has also happened at multiple organizations. The incident involving MiSafes is not isolated, as other smartwatch brands marketed for kids have also been found to have severe vulnerabilities that could be exploited by hackers. Researchers at Münster University of Applied Sciences in Germany detailed their testing of six brands of smartwatches for kids and found several vulnerabilities, including tracking a child's location, intercepting communications, and recording audio from a child's surroundings [104666]. This indicates a broader issue within the industry where children's smartwatches from different manufacturers are susceptible to security breaches.
Phase (Design/Operation) design, operation (a) The software failure incident related to the design phase can be seen in the articles. The incidents involved vulnerabilities in smartwatches designed for kids, allowing hackers to track children's locations, intercept communications, and even eavesdrop on them. The vulnerabilities were attributed to design flaws in the smartwatches' communication systems and backend servers. For example, the MiSafes child-tracking smartwatches lacked encryption and secure authentication, making it easy for hackers to access personal information and manipulate the devices [104666, 77890, 77867]. (b) The software failure incident related to the operation phase is evident in the articles as well. The incidents involved the misuse of the smartwatches by hackers who exploited the lack of encryption and security measures to track children, listen in on their activities, and make spoof calls. The operation failures were due to the ease with which hackers could manipulate the devices using simple techniques and online tools, such as changing ID numbers and spoofing calls to appear as parents [77890, 77867].
Boundary (Internal/External) within_system, outside_system (a) within_system: - The software failure incidents reported in the articles are primarily due to vulnerabilities and security flaws within the smartwatches themselves. - Researchers found that the smartwatches had various security vulnerabilities such as lack of encryption, authentication issues, and SQL injection vulnerabilities [104666]. - The MiSafes child-tracking smartwatches were found to have issues like unencrypted data, lack of account security, and easy-to-hack features [77890]. - Security researchers discovered that the MiSafes Kids Watch Plus could easily be hacked to reveal personal information and track children's locations [77867]. (b) outside_system: - The software failures were exacerbated by external factors such as the lack of response from the companies when alerted about the security flaws in their products. - The MiSafes company did not respond to alerts about the security vulnerabilities in their smartwatches [77890]. - The China-based company listed as the supplier of the MiSafes watch did not respond to requests for comments [77890]. - The MiSafes watchmaker could not be reached for comment when contacted about the security issues [77867].
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident occurring due to non-human actions: - In the incident involving MiSafes child-tracking smartwatches, security researchers found that the devices neither encrypted the data they used nor secured each child's account, allowing for easy hacking to track children's movements, listen in to their activities, and make spoof calls to the watches [77890]. - The MiSafes watch was found to have severe security issues, such as not encrypting data, allowing personal information access, and enabling remote listening and location tracking without proper authentication [77890]. (b) The software failure incident occurring due to human actions: - Security researchers discovered that the MiSafes child-tracking smartwatches could easily be hacked using simple techniques, allowing hackers to reveal a child's location, access personal information, and even impersonate parents through spoof calls [77867]. - Researchers found that using easily available software, a hacker could pretend to be a child's parent using online 'prank call' apps, potentially convincing the child to leave their house and go to a convenient location [77867].
Dimension (Hardware/Software) software (a) The software failure incident occurring due to hardware: - The articles do not specifically mention any software failure incident occurring due to contributing factors originating in hardware. (b) The software failure incident occurring due to software: - The software failure incidents reported in the articles are primarily due to contributing factors originating in software. For example, in the case of MiSafes child-tracking smartwatches, security researchers found that the devices neither encrypted the data they used nor secured each child's account, allowing hackers to track children's movements, listen in to their activities, and make spoof calls to the watches [77890]. - Similarly, in the case of smartwatches used by parents to keep track of their children, security experts warned that the watches could be hacked to reveal a child's location to strangers and eavesdrop on conversations due to software vulnerabilities [77867].
Objective (Malicious/Non-malicious) malicious (a) The software failure incident described in the articles is malicious in nature. Security researchers found that the MiSafes child-tracking smartwatches were relatively easy to hack, allowing hackers to track children's movements, listen in to their activities, make spoof calls to the watches, and even trigger remote listening facilities on the watches [77890]. The vulnerabilities in the smartwatches could be exploited by hackers to spy on children and potentially put them at risk [77867]. (b) The software failure incident is non-malicious in the sense that the vulnerabilities in the smartwatches were not intentionally introduced to harm the system. Instead, they were due to poor security practices and lack of encryption and authentication measures in the design of the smartwatches [104666]. The vulnerabilities were discovered through security testing and probing by researchers, indicating unintentional flaws in the software design and implementation.
Intent (Poor/Accidental Decisions) poor_decisions (a) The intent of the software failure incident related to poor_decisions: - The software failure incidents involving smartwatches for kids, such as the MiSafes Kid's Watcher Plus and MiSafes Kids Watch Plus, were primarily due to poor decisions made by the manufacturers in terms of security measures and encryption [104666, 77890, 77867]. - The devices lacked encryption, did not secure each child's account, and had severe security flaws that allowed hackers to track children's movements, listen in to their activities, make spoof calls, and access personal information [104666, 77890, 77867]. - The security researchers found that the software used in these smartwatches had vulnerabilities that made it relatively easy for hackers to exploit, indicating poor decision-making in terms of security implementation [104666, 77890, 77867].
Capability (Incompetence/Accidental) development_incompetence (a) The software failure incident occurring due to development incompetence: - The articles report on smartwatches marketed for kids that were found to have severe vulnerabilities, including lack of encryption and authentication in communications with the server, allowing hackers to track a child's location, intercept communications, and even eavesdrop on them [104666]. - Security researchers found that MiSafes child-tracking smartwatches were relatively easy to hack, with the devices not encrypting data or securing each child's account, leading to the ability to track children's movements, listen in to their activities, and make spoof calls to the watches [77890]. - The MiSafes Kids Watch Plus, used by parents to keep track of their children, was found to be easily hackable, revealing personal information of the child and parents, including photos, names, phone numbers, and more, due to a simple hack that allowed access to others' accounts [77867]. (b) The software failure incident occurring accidentally: - The articles do not specifically mention any accidental software failures.
Duration permanent The software failure incident related to the smartwatches, particularly the MiSafes Kids Watch Plus, can be considered as a permanent failure [(#77890), (#77867)]. The security vulnerabilities found in these smartwatches, such as lack of encryption, unsecured accounts, and the ability for hackers to track children's movements, listen in on activities, and make spoof calls, indicate a fundamental flaw in the design and implementation of the software. These vulnerabilities were not due to specific circumstances but rather inherent in the product's architecture, making it a long-term and ongoing issue that persisted even after being discovered by security researchers.
Behaviour omission, value, other (a) crash: The articles do not mention any instances of a crash related to the software failure incidents. (b) omission: The software failure incidents involved omission as the system omitted to perform its intended functions at instances. For example, the MiSafes child-tracking smartwatches were found to have severe security flaws that allowed hackers to track children's movements, listen in to their activities, and make spoof calls to the watches that appeared to be from parents [77890]. (c) timing: The articles do not mention any instances of a timing-related failure in the software incidents. (d) value: The software failure incidents involved failures related to the system performing its intended functions incorrectly. For instance, the MiSafes child-tracking smartwatches had vulnerabilities that allowed hackers to access personal information of children, such as photos, names, gender, and date of birth, as well as parents' phone numbers [77890]. (e) byzantine: The articles do not mention any instances of a byzantine-related failure in the software incidents. (f) other: The other behavior observed in the software failure incidents was related to security vulnerabilities that allowed hackers to intercept communications, spoof locations, and impersonate legitimate users, leading to potential risks for children using the smartwatches [104666, 77890, 77867].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence property, non-human, theoretical_consequence, other (a) death: People lost their lives due to the software failure - There is no mention of any deaths resulting from the software failure incidents reported in the articles. [104666, 77890, 77867] (b) harm: People were physically harmed due to the software failure - The articles do not mention any physical harm caused to individuals due to the software failure incidents. [104666, 77890, 77867] (c) basic: People's access to food or shelter was impacted because of the software failure - The articles do not mention any impact on people's access to food or shelter due to the software failure incidents. [104666, 77890, 77867] (d) property: People's material goods, money, or data was impacted due to the software failure - The software failure incidents resulted in potential risks to children's safety and privacy, such as tracking their location, intercepting communications, and spoofing messages. This could be considered as an impact on personal data and privacy. [104666, 77890, 77867] (e) delay: People had to postpone an activity due to the software failure - There is no mention of any activities being postponed due to the software failure incidents. [104666, 77890, 77867] (f) non-human: Non-human entities were impacted due to the software failure - The software failure incidents primarily affected the functionality and security of smartwatches designed for children, which are considered non-human entities. The vulnerabilities in the smartwatches allowed for tracking, eavesdropping, and spoofing of messages. [104666, 77890, 77867] (g) no_consequence: There were no real observed consequences of the software failure - The software failure incidents had significant consequences related to the security and privacy of children using the smartwatches, as detailed in the articles. [104666, 77890, 77867] (h) theoretical_consequence: There were potential consequences discussed of the software failure that did not occur - The articles discuss potential consequences of the software failures, such as hackers being able to track children's locations, intercept communications, and spoof messages. These potential consequences were observed in the testing conducted by researchers. [104666, 77890, 77867] (i) other: Was there consequence(s) of the software failure not described in the (a to h) options? What is the other consequence(s)? - The primary consequence of the software failure incidents was the compromise of children's safety and privacy, as their personal data, location, and communications were at risk of being accessed and manipulated by hackers. This breach of security and privacy could have severe implications for the affected individuals. [104666, 77890, 77867]
Domain information, health (a) The failed system in the articles is related to the information industry as it involves smartwatches designed for kids that are used to send and receive voice and text messages, track a child's location, and communicate with parents through a smartphone app [104666]. (j) The incident also impacts the health industry as the smartwatches are intended to be used by parents to keep track of their children's location and well-being [77867, 77890].

Sources

Back to List