Security flaw in a popular smart helmet allowed silent location tracking
The maker of a popular smart ski and bike helmet has fixed a security flaw that allowed the easy real-time location tracking of anyone wearing its helmets.
Livall makes internet-connected helmets that allow groups of skiers or bike riders to talk with each other using the helmet’s in-built speaker and microphone, and share their real-time location in a friend’s group using Livall’s smartphone apps.
Ken Munro, founder of U.K. cybersecurity testing firm Pen Test Partners, said Livall’s smartphone apps had a simple flaw allowing easy access to any group’s audio chats and location data. Munro says the two apps, one for skiers and one for bike riders, collectively have about a million users.
At the heart of the bug, Munro found that anyone using Livall’s apps for group audio chat and sharing their location must be part of the same friends group, which could be accessed using only that group’s six-digit numeric code.
“That 6-digit group code simply isn’t random enough,” Munro said in a blog post describing the flaw. “We could brute force all group IDs in a matter of minutes.”
