This may appear scary to users of cloud-based vehicle tracking device. A hacker with the username “L&M” has infiltrated two China based GPS (Global Positioning System) vehicle-tracking service providers, ProTrack and iTrack, gaining access to more than 27,000 accounts in South Africa, Morocco, India, the Philippines, and other countries.
The hacker could see customer details such as names and models of the GPS tracking devices, real names of users, home addresses, phone numbers, usernames, email addresses, and device IMEI numbers.
The hacker disclosed to Motherboard, a technology news site, in an online chat that their first step in hacking the systems was to reverse-engineer the ProTrack and iTrack Android Apps, exploiting a very basic vulnerability in the GPS tracking apps – the assigning of the same default password “123456” to their customers. Both apps share the same code and user interface. By doing reverse engineering, the hacker was able to successfully breach the user accounts, taking advantage of the apps API (Application Programming Interface) to brute-force millions of usernames and then logged in using the stolen usernames and default passwords. The hacker claimed they successfully hacked more than 20,000 ProTrack and 7,000 iTrack accounts and was able to monitor their location and movement.
For certain accounts, if the vehicle was traveling less than 13 mph (about 30km/hr), L&M had the option to remotely shut down the engine, but didn’t do so because their target was the company, not the customers. “My target was the company, not the customers. Customers are at risk because of the company…….. They need to make money and don’t want to secure their customers,” L&M told Motherboard. The hacker claimed they demanded money from the two companies and got what they wanted.
While iTrack has not commented on the breach, ProTrack denied it even occurred and issued this statement to Motherboard: “Our system is working very well and changing password is normal way for account security like other systems.”
However, Luis Corrons, Avast security expert stressed the importance of adding security to the design of any and every system. “This breach is the best example of what should never be done — the same default password for all users and no 2-factor authentication,” Corrons said.
Source: Security Boulevard
