Schneier on Security

müzso • September 6, 2019 11:09 AM

message by John Corner does not redirect to Yahoo Costumer Service…

It doesn’t. But it didn’t even claim to. The text/title of the link was “Yahoo Customer Service” and not “Yahoo Costumer Service”. 😉

As for the article …

Avast should have done a bit of “googling” before they started to reverse engineer a randomly selected device from China.

A few helpful links:
https://www.traccar.org/
https://www.traccar.org/devices/
https://github.com/traccar/traccar
https://github.com/traccar/traccar-web

This is an oss GPS tracker backend (with a web UI in the second repo link). It’s development started several years ago, the GitHub repo’s first release (which was already v2.0) dates back to 2013.

The project includes support for 195 different protocols (or at least protocol variants) based on it’s master branch at this moment, and 1048 device models as documented on it’s website (or at least the table on the Devices page has these many rows).

The referenced Avast post included one of the major protocol families from this set. I’m guessing that after or during their investigation into this unit they might have found Traccar and their followup article will involve a more thorough estimation of the affected device count, including devices with all sorts of protocols from the Traccar project.

Off the shelf locked device
It seems that every device’s account is active from the time the device is manufactured, so an attacker can lock-out the user out of the account even before he buys his tracker just based on the IMEI number because you can change the password of an account which belongs to a device that has not been used yet.

I think they are wrong or maybe just the phrasing of the sentence was not quite right. There’s no need for the manufacturer to pre-register or activate an account for every device. The tracker service merely accepts all sorts of deviceID’s during the registration/signup phase. I guess you can register a device with non-existing IMEI (or with an IMEI from a different manufacturer) too. Chinese companies are all about cost-efficiency. Why go to the trouble of keeping track of the registered units and only allow in through the web interface the ones belonging to their own products? It’s more work/cost, than just letting any registration in.

Getting to know the phone number
However, if the user doesn’t put the number of the SIM card of their tracker into the account, an attacker (seeing only the account) won’t know it. But it’s easy to get it. Through the account, an attacker can make the tracker send an SMS to a phone number of a phone in his possession which allows him to tie the ID of a tracker with its phone number.

This only works if:

• the attacker is the first to register the account of the tracker
• and the owner/user of the tracker doesn’t change the IP+port combination used by the tracker to report to.

I agree that for most users this will be the case.

I’ve purchased a low-cost GPS tracker clone as well (i.e. it’s a clone of another, pricier product), but I looked up all the information I could get my hands on and made the purchase more or less informed.
One can reach a certain level of security even with these low-cost gadgets:

• I installed my own instance of Traccar on an “always free” GCP instance
• The server is set up so it doesn’t store GPS history after 7 days, i.e. if it gets hacked into, the attacker won’t get years worth of GPS logs.
• Obviously I’ve changed the default password of the tracker.

One could easily automate a TOTP (Time-based One-time Password) as well assuming that you can send SMS to the tracker at a fairly low price. 🙂 Eg. a mobile app (or merely a Tasker task) could regularily change the password of the tracker every day or even every hour. It’d require some adjustments to Traccar, but nothing too demanding for a (Java) developer with a few years of experience. Of course this is a bit of an overkill compared to the low level of added security, since the entire clientserver communication is flawed from the very beginning (there’s no real authentication, spoofing doesn’t require the resources of a nation state, etc.).

And there’s always a chance that despite changing the server’s IP+port (that the tracker reports to), the unit’s firmware could have a phoning home built into it, so the manufacturer (or an agency of the state that the manufacturer is forced to obey to) could send commands to the unit at a later time. Eg. once I had a low-cost tablet that had a phoning home app on it by default that reported the make&model and the IMEI to a Chinese server. It’s always a “delight” to find these things … 🙂