5 ms·

So, what is the specific threat model here? Who is going to hack these children's phones, and what are they going to do with that access?

dharmab 8y ago
Think about divorced/separated families. Many child kidnappings are unauthorized custody by a parent or family member.
- Eridrus 8y ago
  Does the watch vulnerability meaningfully increase the risk here? These people would know what a child's routine is already, and would not need smartwatch info. And we're talking about people to are also technically savvy enough to reverse engineer this software. It seems more likely that even in this situation, the watch would be a help rather than a harm. I'm not saying we shouldn't care about security, but people tend to over-react whenever children are involved.
  - yellowapple 8y ago
    As frustrating as it can be sometimes, if children are involved, it's almost certainly a better idea to overreact than underreact.
    - macintux 8y ago
      Agreed. I hate the "won't someone think of the children" attitude towards social norms, but they are for the most part utterly defenseless and deserving of some basic protection.
  - alasdair_ 8y ago
    >Does the watch vulnerability meaningfully increase the risk here? Yes. You can turn on remote listening and spy on the wearer (and anyone else nearby).
  - andrewaylett 8y ago
    They're sold as a tool for enhancing the security of your children, but it's fairly trivial to subvert them to both not do the job they're sold for, as well as giving the attacker extra information they could otherwise have only got through proximity. If there's a real risk (and while it might be relatively rare, real risks do exist) then the regular routine is hopefully already set up to mitigate the risk. The value to the attacker is in being able to take advantage of deviations from routine that would apart from the watch be invisible to them.
tyingq 8y ago
A zero effort hack that yields photo, name, gender and date of birth, height, weight, parent phone numbers, and the phone number assigned to the watch. And, you can enumerate all kids. Pretty much everything you need for a new app..."Kin-der". People worry about chat rooms where you would have to social engineer any of that.
gwbas1c 8y ago
Anything that doesn't use encryption is very easy to hack. You just need to use a tool like Fiddler to understand the protocol. If there is lax authentication, as the article implies, this is something that an ameture can do. It's also very easy to spoof caller ID, so this opens up children to unsolicited calls.
- stef25 8y ago
  Anyone who can't handle an unsolicited call shouldn't have a phone in the first place
  - Gaelan 8y ago
    This was a phone being specifically marketed as unable to recieve unsolicited calls.

dharmab 8y ago

Think about divorced/separated families. Many child kidnappings are unauthorized custody by a parent or family member.

Eridrus 8y ago
Does the watch vulnerability meaningfully increase the risk here? These people would know what a child's routine is already, and would not need smartwatch info. And we're talking about people to are also technically savvy enough to reverse engineer this software. It seems more likely that even in this situation, the watch would be a help rather than a harm. I'm not saying we shouldn't care about security, but people tend to over-react whenever children are involved.
- yellowapple 8y ago
  As frustrating as it can be sometimes, if children are involved, it's almost certainly a better idea to overreact than underreact.
  - macintux 8y ago
    Agreed. I hate the "won't someone think of the children" attitude towards social norms, but they are for the most part utterly defenseless and deserving of some basic protection.
- alasdair_ 8y ago
  >Does the watch vulnerability meaningfully increase the risk here? Yes. You can turn on remote listening and spy on the wearer (and anyone else nearby).
- andrewaylett 8y ago
  They're sold as a tool for enhancing the security of your children, but it's fairly trivial to subvert them to both not do the job they're sold for, as well as giving the attacker extra information they could otherwise have only got through proximity. If there's a real risk (and while it might be relatively rare, real risks do exist) then the regular routine is hopefully already set up to mitigate the risk. The value to the attacker is in being able to take advantage of deviations from routine that would apart from the watch be invisible to them.

tyingq 8y ago

A zero effort hack that yields photo, name, gender and date of birth, height, weight, parent phone numbers, and the phone number assigned to the watch. And, you can enumerate all kids. Pretty much everything you need for a new app..."Kin-der". People worry about chat rooms where you would have to social engineer any of that.

gwbas1c 8y ago

Anything that doesn't use encryption is very easy to hack. You just need to use a tool like Fiddler to understand the protocol. If there is lax authentication, as the article implies, this is something that an ameture can do. It's also very easy to spoof caller ID, so this opens up children to unsolicited calls.

stef25 8y ago
Anyone who can't handle an unsolicited call shouldn't have a phone in the first place
- Gaelan 8y ago
  This was a phone being specifically marketed as unable to recieve unsolicited calls.