Children's telephone watches are vulnerable to position monitoring and address book changes.

Many children's mobile phone watches just confirm the identity of the mobile phone.

Hackers only need to know the parents' mobile phone number, and they can infer the ID number of the child's mobile phone watch from this mobile phone number.

The engineer dialed the children's phone watch with his mobile phone, and the word "dad" was clearly displayed on the screen of the children's phone watch.

Most of the increasingly popular children's telephone watches are labeled as "smart", and "safety" and "convenience" are the biggest selling points of the products. In recent two years, children's telephone watches have been favored by parents because of their positioning and calling functions. The original intention of most parents to buy children's phone watches for their children is to gain a sense of security, so can such watches really bring children a sense of security?

Since last year, many vulnerabilities related to children's phone watches have been published on the cloud of domestic security platforms, and the main source of the vulnerabilities lies in the manufacturers' servers. Do these loopholes really exist? If a child's phone watch is found to have security holes, how should parents take security precautions? On the morning of March 14, Du Nan Appraisal entered the Saibao Quality and Safety Testing Center of the Fifth Institute of Electronics, Ministry of Industry and Information Technology, to detect the possible security vulnerabilities of children's telephone watches.

Recognition head

Nearly half of the students in the class have bought telephone watches.

At present, all kinds of children's phone watches have many functions, not only making phone calls and sending WeChat, but also real-time positioning and monitoring functions. It is also very simple to use. After buying a phone card and putting it into a smart watch, download an APP that matches the watch through the mobile phone, and the parents' mobile phone and the children's smart watch can be bound. This kind of children's telephone watch sells well at present. Almost half of the students in many primary schools in Guangzhou have bought different models of children's telephone watches.

"At present, there is no uniform standard for smart wearable devices such as children's mobile phones and watches, and the quality of such products is uneven in terms of information security." Li Le, an information security engineer at Saibao Quality and Safety Testing Center of the Fifth Institute of Electronics, Ministry of Industry and Information Technology, said that since last year, white-hat hackers have exposed vulnerabilities related to children's safety watches on the dark cloud of domestic security platforms, and the main source of the vulnerabilities lies in the manufacturers' servers. "Now all the information of children's smartphones is actually on the background server. Attackers can use this vulnerability to query the server connected to the smart watch, and then they can view the customer information, directly view the geographical location of the child according to the corresponding ID, and monitor the geographical coordinates of the child in real time. Private content such as daily activity tracks and environmental records. "

The background server is the root of the vulnerability, and the number of times to enter the verification code is unlimited.

Appraisal Jun immediately logged on to this website. Through the search engine, you can easily find a lot of information about the security vulnerabilities of children's phone watches, including the password reset of any user, the prevention and control of not logging in and many other aspects. "The user password can be reset at will, which means that if you forget the password, you can also reset it, so your user number will become mine completely." Li Le said that many children's phone watch brands do not limit the number of times the verification code can be entered, and anyone can enter it indefinitely. "The four-digit verification code can be tried out only by computer input for more than 90,000 times at most. Once tried, the password can be reset. " In addition, when the user logs in, the background server has no login prevention and control function, only one-way authentication. "Hackers can try more than 100 passwords in ten minutes."

"In fact, the technical threshold for fixing security vulnerabilities is not high, as long as R&D personnel with certain network development experience can do it. As long as the producers pay attention to it, it is possible to avoid such security loopholes. " Li said, but at present, the country has not formulated detailed network security standards. If manufacturers only pay attention to the user experience to seize the market, but ignore the safety design and research and development of products, the increased network control function may become a channel for malicious attackers to use, and personal information disclosure is inevitable.

Evaluation record

After getting the ID number, you can monitor, locate and change the address book in a few minutes on the computer.

Time: March/morning of KLOC-0/4.

Venue: Saibao Quality and Safety Testing Center, Fifth Institute of Electronics, Ministry of Industry and Information Technology

Sample: A well-known brand of children's telephone watches.

Test tools: computers, security vulnerability codes, etc.

Objective: Is there a security hole in children's telephone watches?

Note: The engineer prepared the code for a children's telephone watch in advance.

A

Enter the watch ID number, latitude and longitude, and locate it clearly.

Li first prepared the attack code, and then opened the corresponding network attack program. "These are actually not complicated for professionals, and some websites even publish codes." Because in reality, parents' mobile phone numbers are bound to their children's mobile phones and watches. Therefore, the hacker only needs to know the mobile phone number of the parents, and can infer the ID number of the child's mobile phone watch from this mobile phone number.

"The ID number of each child's mobile phone watch is unique. After obtaining the ID number, you can directly enter the attack program to attack the child's mobile phone watch. " Li demonstrated it on the spot. He wrote the ID number of a child's phone watch prepared in advance in an attack program, and then attacked it. Soon, the latitude and longitude numbers of this children's phone watch appeared on the computer screen. Input the latitude and longitude into Baidu map, and it will soon show the exact location of this watch, which is the laboratory where you were identified that day. The map is very accurate. "Through this principle, I can actually choose any ID number to locate." Li immediately entered another ID number, and the program quickly reflected its latitude and longitude. According to Baidu map, the location of this children's phone watch is at a certain number in Zhongxing Road, Tongliang County, Chongqing.

B

The watch doesn't seem to work. Surveillance has started.

Why is it so easy to control children's phone watches? "It's mainly due to the fact that after ordinary watches join the networking function, manufacturers use the backend server as the hub to connect parents' mobile phones with children's watches. Because some manufacturers don't pay enough attention to the server, and even some manufacturers don't have their own servers at all, they outsource the most critical service content of children's telephone watches to other service providers, and the security is in doubt. Hackers attack with servers as nodes, and vendors with weak servers are easily controlled. "Li explained that, for example, many children's phone watches only confirm the identity of their mobile phones, and they need to enter the login password for the first time, but they do not protect the identity of the watches, so there is an opportunity.

Li reset an attack program and entered the mobile phone number of the reporter from Nanping into the program. "Because the monitoring generally needs to be carried out without the listener's notice, when I am operating, I control this smartphone to dial out and call you through the program. As soon as you pick it up here, you can hear all the sounds of your child's phone watch. " The appraiser saw at the scene that the attacked children's phone watch was always in a black screen state without any signs, but the reporter's mobile phone showed the number. "This is a children's mobile phone watch." Appraisal Jun took his mobile phone and went outside to answer the phone. Just like an ordinary telephone, he heard all the voices in the room very clearly. If in real life, this children's phone watch worn by children is monitored by hackers, then hackers can always know the children's life and study and master the daily rules.

C

Address book numbers can be modified in the background.

"Children's phone watches basically have a call function. There is an address book in it, which usually stores the telephone numbers of parents, grandparents and other relatives. In fact, I can modify these address book numbers from the background. " Li soon conducted the third experiment.

He first obtained the address book of this watch through the background server, then modified the phone number in the address book through the attack software and sent it back to the server. Soon, he dialed the children's phone watch with his mobile phone, and the words "Dad" were clearly displayed on the screen of the children's phone watch. "From the child's point of view, he saw the phone call from his father, but in fact, this number is not his father's number at all." It is not difficult to imagine that if the child really receives such a call in reality, he will have great trust in the stranger at the other end of the phone.