Security flaws in GPS trackers put global fleets at risk • The Register

A handful of vulnerabilities, some crucial, in MiCODUS GPS tracker units could enable criminals to disrupt fleet functions and spy on routes, or even remotely management or reduce off fuel to motor vehicles, according to CISA. And there is certainly no fixes for these stability flaws.

Two of the bugs gained a 9.8 out of 10 CVSS severity rating. They can be exploited to mail instructions to a tracker system to execute with no significant authentication the other individuals contain some degree of distant exploitation.

“Thriving exploitation of these vulnerabilities could allow an attacker control in excess of any MV720 GPS tracker, granting entry to spot, routes, gas cutoff instructions, and the disarming of a variety of capabilities (e.g., alarms),” the US government company warned in an advisory posted Tuesday.

As of Monday, the gadget manufacturer, based mostly in China, had not supplied any updates or patches to deal with the flaws, CISA additional. The company also encouraged fleet house owners and operators choose “defensive steps” to minimize risk.

This seemingly involves making sure, wherever doable, that these GPS tracers are not obtainable from the net or networks that miscreants can get to. And when remote regulate is necessary, CISA recommends utilizing VPNs or other safe strategies to control access. That appears like generic CISA suggestions so potentially a genuine workaround would be: prevent utilizing the GPS gadgets completely.

Bitsight safety researchers Pedro Umbelino, Dan Dahlberg and Jacob Olcott identified the 6 vulnerabilities and claimed them to CISA immediately after seeking considering the fact that September 2021 to share the results with MiCODUS. 

“After fairly exhausting all alternatives to arrive at MiCODUS, BitSight and CISA identified that these vulnerabilities warrant general public disclosure,” in accordance to a BitSight report [PDF] released on Tuesday.

About 1.5 million shoppers and corporations use the GPS trackers, the scientists claimed. This spans 169 nations around the world and includes government organizations, army, law enforcement, aerospace, vitality, engineering, producing and transport businesses, they added.

“The exploitation of these vulnerabilities could have disastrous and even everyday living-threatening implications,” the report authors claimed, introducing:

For its investigate, the BitSight workforce utilised the MV720 design, which it reported is the firm’s least costly style with gasoline slash-off features. The gadget is a cellular-enabled tracker that employs a SIM card to transmit position and site updates to supporting servers and obtain SMS commands.

Here is a rundown of the vulnerabilities:

CVE-2022-2107 is a difficult-coded password vuln in the MiCODUS API server. It acquired a 9.8 CVSS score and allows a distant attacker to use a hardcoded master password to log into the web server and send SMS instructions to a target’s GPS tracker. 

These would look like they are coming from the GPS owner’s cell variety, and could make it possible for a miscreant to achieve handle of any tracker, entry and observe vehicle area in actual time, cut off gas and disarm alarms or other characteristics supplied by the gadget.

CVE-2022-2141, due to damaged authentication, also been given a 9.8 CVSS rating. This flaw could let an attacker to ship SMS instructions to the monitoring system without authentication.

A default password flaw, which is in-depth in BitSight’s report but was not assigned a CVE by CISA, nonetheless “signifies a extreme vulnerability,” according to the stability seller. There is certainly no obligatory rule that users transform the default password, which ships as “123456,” on the products, and this makes it fairly effortless for criminals to guess or think a tracker’s password.

CVE-2022-2199, a cross-web site scripting vulnerability, exists in the primary website server and could make it possible for an attacker to completely compromise a device by tricking its user into creating a request — for illustration, by sending a destructive website link in an electronic mail, tweet, or other information. It acquired a 7.5 CVSS ranking

The main world-wide-web server has an insecure immediate object reference vulnerability, tracked as CVE-2022-34150, on endpoint and parameter device IDs. This means they settle for arbitrary product IDs with no further verification.

“In this scenario, it is doable to accessibility knowledge from any System ID in the server database, no matter of the logged-in user. Supplemental information able of escalating an attack could be readily available, these types of as license plate numbers, SIM card figures, mobile quantities,” BitSight discussed. It received a 7.1 CVSS score.

And last but not least, CVE-2022-33944 is another insecure direct item reference vuln on the primary world wide web server. This flaw, on the endpoint and Submit parameter “Machine ID,” accepts arbitrary product IDs, and gained a severity rating of 6.5.

“BitSight recommends that individuals and organizations at this time working with MiCODUS MV720 GPS tracking products disable these units till a correct is created available,” the report concluded. “Organizations making use of any MiCODUS GPS tracker, regardless of the product, ought to be alerted to insecurity with regards to its process architecture, which may well location any device at chance.” ®