Kids Smartwatches Sold On Amazon Might Be Tracking Your Children

We live in an era where escaping technology is almost impossible. These smart pieces of hardware have also paved their way into kids' accessories. But they still raise eyebrows when it comes to privacy and security. Now, it has been reported that some of the cheap smartwatches sold on Amazon could be quite dangerous, notes a security investigation.

The cheap smartwatches for children allow strangers to override the parental control settings and track the children. Smartwatches with location tracking and messaging features were picked for the study, which showed some serious security lapses.

Children's Smartwatches On Amazon

The Boston-based security firm Rapid7 randomly bought children's smartwatches on Amazon.com that cost roughly between Rs. 1,400 to Rs. 2,500. GreaSmart Children's SmartWatch, Jsbaby Game Smart Watch, and SmarTurtle Smart Watch for Kids were the brands that were picked from the dozens of offers on Amazon. All of these smartwatches were marketed for grade school-aged children.

According to Deral Heiland, the research lead for IoT technology, all three smartwatch brands were manufactured in China and shared identical hardware, software, security issues, and more. Authorized users could view and change the configuration details by texting the watch directly with certain commands. But in reality, "unlisted numbers could also interact with the watch," the report said.

A vendor released firmware could easily solve the security issue, but it is unlikely an update will turn up as the device providers are difficult to trace. Rapid7 said its researchers weren't able to contact neither the sellers nor its manufacturer, (who they believe is) a Chinese company called 3g Electronics Co.

Smartwatches With Weak Passwords

The children's smartwatches on Amazon ship with a default password '12345', but one of the manuals doesn't mention the password. The second mentioned the password in a blog, but not in its printed material. The last seller doesn't characterize the numbers as a password nor does it provide instructions on how to change it, says Rapid7.

The report says: "Given an unchanged default password and a lack of SMS filtering, it is possible for an attacker with knowledge of the smartwatch phone number to assume total control of the device, and therefore use the tracking and voice chat functionality with the same permissions as the legitimate user (typically, a parent)."

The Chinese company 3g Electronics Co didn't respond to Bloomberg News yet. As for the products, the GreaSmart Children's SmartWatch is longer on Amazon. GreaSmart, Jsbaby, SmarTurtle didn't respond to a request for comment. Oltec, the merchant selling the SmarTurtle watch on Amazon has responded.