Connect with us
ANE Scholarship
Categories:
X

Technology

Zero-day flaws in GPS tracker pose surveillance, fuel cut-off risks to vehicles

Published

on

Zero-day flaws in GPS tracker pose surveillance, fuel cut-off risks to vehicles
Share this post:

Broader architectural failings of Chinese vendor potentially puts 1.5m devices at risk.

A raft of zero-day flaws found in a popular automotive GPS tracking device “could have disastrous and even life-threatening implications”, security researchers warn.

Six as-yet-unpatched vulnerabilities unearthed by BitSight researcher Pedro Umbelino affect the API server, GPS tracker protocol, and web server of the MV720 GPS tracker, which was developed by China-based company MiCODUS.

Successful abuse of the bugs could see attackers “cut fuel to an entire fleet of commercial or emergency vehicles”, use GPS data “to monitor and abruptly stop vehicles on dangerous highways”, or “track individuals or demand ransom payments to return disabled vehicles to working condition”, according to research (PDF) from BitSight.

Huge attack surface

According to the cybersecurity firm, the MiCODUS MV720 provides theft protection and fleet management functionality to customers in at least in 169 countries, including a Fortune 50 energy company, a national military in South America, a federal government in Western Europe, a national law enforcement agency in Western Europe, and a nuclear power plant operator.

Alarmingly, BitSight said Umbelino also uncovered security issues associated with the firm’s cloud-based device management interface for the web, iOS, and Android, a finding which means other MiCODUS GPS tracking models could also be insecure. If MiCODUS’ own figures are accurate, that equates to 1.5 million potentially vulnerable devices worldwide.

With security patches yet to materialize, BitSight has urged users to “immediately stop using or disable any MiCODUS MV720 GPS trackers until a fix is made available”.

security advisory from the US Cybersecurity and Infrastructure Security Agency (CISA) said that “no known public exploits specifically target these vulnerabilities” in the MV720 GPS tracker.

Authentication issues

Two critical authentication issues in the API server, both notching a CVSS score of 9.8, enable “an attacker to send SMS commands directly to the GPS tracker as if they were coming from the GPS owner’s mobile number”.

One bug relates to a hard-coded master password (CVE-2022-2107) and the other, resulting from improper authentication (CVE-2022-2141), potentially enables manipulator-in-the-middle (MitM) attacks.

The devices and the mobile interface are preconfigured with the default password ‘123456’, which BitSight classed as a high severity (CVSS 8.1) issue, although CISA declined to assign a CVE. “There is no mandatory rule to change the password nor is there any claiming process”, according to BitSight, which found that 94.5% of 1,000 responding device IDs still had the default password.

With the device ID easily predictable and the server seemingly lacking password brute force mitigations such as rate-limiting, attackers can easily access random GPS trackers.

A high severity (CVSS 7.5) reflected cross-site scripting (XSS) vulnerability affecting the main web server, meanwhile, could enable attackers to “fully compromise the device”.

The main web server also contains a pair of authenticated insecure direct object reference vulnerabilities, tracked as CVE-2022-34150 (CVSS 7.1) and CVE-2022-33944 (CVSS 6.5).

“Having a centralized dashboard to monitor GPS trackers with the ability to enable or disable a vehicle, monitor speed, routes and leverage other features” is as potentially dangerous as it is useful, suggested BitSight.

“Unfortunately, the MiCODUS MV720 lacks basic security protections”, and with only “limited testing, BitSight uncovered a multitude of flaws affecting all components of the GPS tracker ecosystem”.

BitSight said it first disclosed the flaws to the vendor on September 9, 2021, and after responding initially, MiCODUS failed to reply to multiple subsequent requests for updates, both from BitSight and CISA. BitSight published its findings yesterday (July 19).


Get More Stories Like This On: Facebook: @AllNaijaEntertainment, Twitter: @AllNaijaEntertainment

Click to comment

Leave a Reply

Your email address will not be published.

Snapchat enables parents to keep an eye on who their kids are messaging on the platform
Technology5 hours ago

Snapchat enables parents to keep an eye on who their kids are messaging on the platform

Former Super Eagles assistant coach takes over as manager of Danish team Jammerbugt
Sports5 hours ago

Former Super Eagles assistant coach takes over as manager of Danish team Jammerbugt

Alex Iwobi: "We were unfortunate" Everton can compete against any team
Sports5 hours ago

Alex Iwobi: “We were unfortunate” Everton can compete against any team

The DG exhorts NYSC members to accept postings in good faith
News6 hours ago

The DG exhorts NYSC members to accept postings in good faith

Students urge the FG once more to abide by the demands of ASUU
Education6 hours ago

Students urge the FG once more to abide by the demands of ASUU

IG orders a comprehensive review of the Intelligence Units and expresses displeasure with police brutality and extortion
News6 hours ago

IG orders a comprehensive review of the Intelligence Units and expresses displeasure with police brutality and extortion

Buhari celebrates Ngige as he turns 70
News6 hours ago

Buhari celebrates Ngige as he turns 70

News12 hours ago

Troops strike the Boko Haram commander and 27 others in Borno

Director of "Blood Sisters" Biyi Bandele passes away at 54
Entertainment12 hours ago

Director of “Blood Sisters” Biyi Bandele passes away at 54

Entertainment12 hours ago

Davido posts a screenshot of himself and Chioma on a video conversation with the caption, “My gist partner.”

Dame Olivia Newton-John, a star of Grease, passes away at age 73
Entertainment12 hours ago

Dame Olivia Newton-John, a star of Grease, passes away at age 73

The Comanche warrior paint's significance is explained by Prey star Amber Midthunder
Entertainment12 hours ago

The Comanche warrior paint’s significance is explained by Prey star Amber Midthunder

Hold Me Closer, a collaboration song between Britney Spears and Sir Elton John, making the singer's first single to be released since 2016
Entertainment12 hours ago

Hold Me Closer, a collaboration song between Britney Spears and Sir Elton John, making the singer’s first single to be released since 2016

Your daily horoscope for Monday, July 25, 2022
Horoscope13 hours ago

Your daily horoscope for Tuesday, August 9, 2022

BBNaija S7: Phyna, Bryann, Groovy, Ilebaye, and Khalid are up for eviction
Entertainment22 hours ago

BBNaija S7: Phyna, Bryann, Groovy, Ilebaye, and Khalid are up for eviction

Entertainment22 hours ago

“I’m sorry for all the embarrassment I’ve caused my wife, my kids, my mother and all our families,” – Two Face Idibia

How and when to view the best meteor shower of the year, the Perseids meteor shower, in 2022
Technology22 hours ago

How and when to view the best meteor shower of the year, the Perseids meteor shower, in 2022

Technology22 hours ago

Apple allegedly instructs suppliers to avoid labeling shipments to China with “Made in Taiwan”

Sports22 hours ago

Super Eagles hero celebrates Premier League accomplishment as “Dream Turns Reality”

Frenkie de Jong makes Chelsea transfer decision in phone call with Todd Boehly
Sports23 hours ago

Frenkie de Jong makes Chelsea transfer decision in phone call with Todd Boehly

News1 day ago

Police re-arrest 25 other suspects and the escapee from Jos prison

News1 day ago

Lagos policeman shoot and murder an ex-convict while battling with armed criminals

News1 day ago

Cleaner received an eight-month sentence for stealing a laptop bag

Dariye and Nyame recover their freedom, 4 months after Buhari's pardon
News1 day ago

Dariye and Nyame recover their freedom, 4 months after Buhari’s pardon

Education1 day ago

BREAKING: WAEC announces the 2022 WASSCE results

"Buga" is a victory song for Nigerian medalists
Entertainment1 day ago

“Buga” is a victory song for Nigerian medalists

Kizz Daniel dazzles in a sold-out performance in Uganda
Entertainment1 day ago

Kizz Daniel dazzles in a sold-out performance in Uganda

After four years of marriage, Gideon Okeke's wife is getting a divorce
Entertainment1 day ago

After four years of marriage, Gideon Okeke’s wife is getting a divorce

Beauty's brother burns critics over disqualification: "Calm down, her script was wonderful."
Entertainment1 day ago

BBNaija S7: Beauty’s brother burns critics over disqualification: “Calm down, her script was wonderful.”

Your daily horoscope for Monday, July 25, 2022
Horoscope2 days ago

Your daily horoscope for Monday, August 8, 2022

BBNaija
Entertainment2 days ago

#BBNaija: Christy O, Cyph evicted

Lewandoski Pedri Gavi Barcelona vs Pumas Joan Gamper Trophy
Sports2 days ago

Deadly Barcelona Thrashed PUMAS to win trophy, Lewandoski gets debut goal

Erling Haaland Manchester City
Sports2 days ago

Reactions to Manchester City’s opening-game 2-0 victory over West Ham: “Erling Haaland is scary.”

Beauty BBNaija
Entertainment2 days ago

BBNaija S7: Beauty eliminated from reality TV show

Erik Ten Hag Manchester United vs Brighton
Sports2 days ago

Erik Ten Hag Chops First Breakfast as Man Utd Manager as Brighton Wins 2-1

Ronaldo
Sports2 days ago

Man Utd must let Ronaldo leave – Wayne Rooney

Scholarship Graduate
Education2 days ago

Australia Scholarship: Apply for Griffith University degree scholarship, 2022

Godwin Obaseki
Education2 days ago

Edo Govt To Recruit 1000 New Teachers, Train 650 Others

Airport
News2 days ago

Ebonyi Govt Laments Destruction Of Airport Fence

Isco
Sports2 days ago

Transfer: Real Madrid star, Isco to Sevilla as free agent

THE WITCH'S DAUGHTER story _ AllNaijaEntertainment
ANE Stories7 days ago

[STORY] THE WITCH’S DAUGHTER (Complete Episodes)

Money Over Love story _ AllNaijaEntertainment
ANE Stories7 days ago

[STORY] MONEY OVER LOVE (Complete Episodes)

WHAT MY ELDER BROTHER'S WIFE TAUGHT ME by Temi Akintade _ AllNaijaEntertainment
ANE Stories7 days ago

[STORY] WHAT MY ELDER BROTHER’S WIFE TAUGHT ME (Complete Episodes)

THE WITCH'S DAUGHTER story _ AllNaijaEntertainment
ANE Stories7 days ago

[STORY] THE WITCH’S DAUGHTER (Episode 07)

SADE'S HEART TALE
ANE Stories7 days ago

[STORY] SADE’S HEART TALE (Episode 19)

THE WITCH'S DAUGHTER story _ AllNaijaEntertainment
ANE Stories7 days ago

[STORY] THE WITCH’S DAUGHTER (Episode 03)

WHAT MY ELDER BROTHER'S WIFE TAUGHT ME by Temi Akintade _ AllNaijaEntertainment
ANE Stories7 days ago

[STORY] WHAT MY ELDER BROTHER’S WIFE TAUGHT ME (Episode 01)

Money Over Love story _ AllNaijaEntertainment
ANE Stories7 days ago

[STORY] MONEY OVER LOVE (Episode 01)

THE WITCH'S DAUGHTER story _ AllNaijaEntertainment
ANE Stories7 days ago

[STORY] THE WITCH’S DAUGHTER (Episode 01)

Money Over Love story _ AllNaijaEntertainment
ANE Stories7 days ago

[STORY] MONEY OVER LOVE (Episode 09)

Daniel Bachmann has won the race to start over Super Eagles goalkeeper Maduka Okoye for Watford this season
Sports5 days ago

Revealed: Why Watford goalkeeper Maduka Okoye was not included in the team on Monday

THE WITCH'S DAUGHTER story _ AllNaijaEntertainment
ANE Stories7 days ago

[STORY] THE WITCH’S DAUGHTER (Episode 05)

WHAT MY ELDER BROTHER'S WIFE TAUGHT ME by Temi Akintade _ AllNaijaEntertainment
ANE Stories7 days ago

[STORY] WHAT MY ELDER BROTHER’S WIFE TAUGHT ME (Final Episode 04)

THE WITCH'S DAUGHTER story _ AllNaijaEntertainment
ANE Stories7 days ago

[STORY] THE WITCH’S DAUGHTER (Episode 04)

WHAT MY ELDER BROTHER'S WIFE TAUGHT ME by Temi Akintade _ AllNaijaEntertainment
ANE Stories7 days ago

[STORY] WHAT MY ELDER BROTHER’S WIFE TAUGHT ME (Episode 02)

THE WITCH'S DAUGHTER story _ AllNaijaEntertainment
ANE Stories7 days ago

[STORY] THE WITCH’S DAUGHTER (Episode 06)

WHAT MY ELDER BROTHER'S WIFE TAUGHT ME by Temi Akintade _ AllNaijaEntertainment
ANE Stories7 days ago

[STORY] WHAT MY ELDER BROTHER’S WIFE TAUGHT ME (Episode 03)

Money Over Love story _ AllNaijaEntertainment
ANE Stories7 days ago

[STORY] MONEY OVER LOVE (Episode 04)

THE WITCH'S DAUGHTER story _ AllNaijaEntertainment
ANE Stories7 days ago

[STORY] THE WITCH’S DAUGHTER (Episode 02)

Money Over Love story _ AllNaijaEntertainment
ANE Stories7 days ago

[STORY] MONEY OVER LOVE (Episode 05)

Money Over Love story _ AllNaijaEntertainment
ANE Stories7 days ago

[STORY] MONEY OVER LOVE (Episode 03)

THE WITCH'S DAUGHTER story _ AllNaijaEntertainment
ANE Stories5 days ago

[STORY] THE WITCH’S DAUGHTER (Final Episode 09)

Money Over Love story _ AllNaijaEntertainment
ANE Stories7 days ago

[STORY] MONEY OVER LOVE (Episode 12)

Money Over Love story _ AllNaijaEntertainment
ANE Stories7 days ago

[STORY] MONEY OVER LOVE (Episode 02)

Money Over Love story _ AllNaijaEntertainment
ANE Stories7 days ago

[STORY] MONEY OVER LOVE (Episode 08)

Money Over Love story _ AllNaijaEntertainment
ANE Stories7 days ago

[STORY] MONEY OVER LOVE (Episode 06)

BBNaija S7: Amaka and Phyna bemoan the lack of condoms in the home
Entertainment6 days ago

BBNaija S7: Amaka and Phyna bemoan the lack of condoms in the home

Epic movie "Anikulapo" by Kunle Afolayan is scheduled to premiere in September
Entertainment7 days ago

Epic movie “Anikulapo” by Kunle Afolayan is scheduled to premiere in September

THE WITCH'S DAUGHTER story _ AllNaijaEntertainment
ANE Stories5 days ago

[STORY] THE WITCH’S DAUGHTER (Episode 08)

Money Over Love story _ AllNaijaEntertainment
ANE Stories7 days ago

[STORY] MONEY OVER LOVE (Episode 14)

Money Over Love story _ AllNaijaEntertainment
ANE Stories7 days ago

[STORY] MONEY OVER LOVE (Episode 11)

Nkem Owoh
Entertainment5 days ago

Nkem Owoh Breaks Silence On Claims He Rejected N10 Million To Endorse Bola Tinubu For President

Money Over Love story _ AllNaijaEntertainment
ANE Stories7 days ago

[STORY] MONEY OVER LOVE (Episode 17)

Money Over Love story _ AllNaijaEntertainment
ANE Stories7 days ago

[STORY] MONEY OVER LOVE (Episode 18)

Money Over Love story _ AllNaijaEntertainment
ANE Stories7 days ago

[STORY] MONEY OVER LOVE (Final Episode 20)

Money Over Love story _ AllNaijaEntertainment
ANE Stories7 days ago

[STORY] MONEY OVER LOVE (Episode 10)

Nancy Isime
Entertainment7 days ago

“Nancy Isime Did Butt Enlargement Surgery” – Blessing Okoro Makes Shocking Revelation

BBNaija S7: Denrele claims that bbnaija candidates send him n*des and millions of naira in order to take part in the show
Entertainment2 days ago

BBNaija S7: Denrele claims that bbnaija candidates send him n*des and millions of naira in order to take part in the show

Money Over Love story _ AllNaijaEntertainment
ANE Stories7 days ago

[STORY] MONEY OVER LOVE (Episode 13)

Money Over Love story _ AllNaijaEntertainment
ANE Stories7 days ago

[STORY] MONEY OVER LOVE (Episode 19)

ANE's Billboard Hots



Join "ANE sabi" clique

Don't miss a thing, get ogbonge ANE latest updates to fuel your conversation daily.