Tracking the Trackers - How We Took Over 36M GPS Devices

The talk covers consumer GPS trackers sold as child watches and vehicle trackers. The researchers examine three platforms, SETracker, SinoTrack, and TKSTAR/Thinkrace, which they say reach tens of millions of devices across dozens of white-label brands that share the same Chinese backends. They start from a cheap tracker bought online and a companion app, then show that request signing was weak and that the server never checked which command was being sent, so any account holder could issue almost any device command.

Across the platforms they describe harvesting device IDs and parent emails from sequential user IDs with no rate limiting, then using commands for silent audio monitoring, camera capture, overwriting the SOS recipient, and pushing firmware. On one Android watch they report system-level code execution. For SinoTrack they describe SQL injection reachable through a demo login and commands that could unlock doors or cut fuel. For TKSTAR they describe a publicly downloadable backup archive that exposed source code, hard-coded credentials, and a web shell that had sat on a server for about two years. They say they filed 45 CVEs and got little substantive vendor response.

The takeaway is that brand variety hides a shared supply chain, so one flaw can affect many products at once. The speakers urge owners to stop using these devices and argue that basic practices, such as removing hard-coded secrets, validating TLS, parameterizing SQL, and hashing passwords, would have blocked most of the findings.