$17 smartwatch sends something to random Chinese IP address A cheap smart watch often peddled on eBay uses a pairing app for Android or iOS that contains a backdoor that quietly connects to an unknown Chinese IP address. The U8 watch sells for just US$17 and offers a 1.48" touch screen, Bluetooth to connect to either Android or IoS phones and the ability to make or answer calls. The …
I think he's suggesting that smart watches are fragmented, not Android based smart watches.
We have an Android app that users have asked for smart watch support, and we've not done it as there isn't enough demand to justify implementing it on Tizen, Android, Pebble, etc. and there isn't a clear leader in that pack that we'd pick over the others. I don't imagine we're alone in thinking that among Android app developers.
Most mobile apps report to random IP addresses in AWS or Apple or Google's cloud, and who knows what happens to the data after that? The fact that this watch reports to a Chinese address maybe just indicates that the opsec of this particular company is particularly poor. You don't have to be Chinese to be a dodgy cracker.
I remember installing one well reviewed and popular mail/productivity app on Android and discovering that it sent my email password to a cloud server (AWS in this case) and logged into my account from there. At no point in the "read more" blurb, installation instructions or setup was I told this would be happening. Uninstall, change password, block specific IP address, one star review.
But do you need the app to use the watch or is it just like the "drivers CD" you get with every little toy that nobody needs because they're actually standard USB devices? Put another way, if it's a proper BlueTooth device it'll use the standard BT profiles to be remote-control for the phone functions, and not need no steenkin' app.
Course it could just be checking for updates...
thanks for making me smile... have an up vote. But surely it will be just newborns that will have this tech implanted. It will be expensive chasing and catching all those middle aged and older persons who resist. You know the ones, those that remember a time when there was privacy.
They just offer them a free taco in exchange for having the implant though. There have been anecdotal studies done where researchers offer people a handful of sweets for filling out questionnaires that are asking for all their personal details. A surprising number of people do it without question. In the one I saw the researchers then chatted with the people about personal information security and such forth, but I bet for a few more sweets (or a taco) they would still do it again.
Watch the TV series Continuum. In that you get implanted if you can't repay your debt to whichever company owns you turning you into a slave making more implants to enslave the next people who can't repay their debts. It's actually a very good satire of capitalism hiding as a science fiction show.
Bless. You should buy your cat a toy mouse to play with and leave that on the table as well.... to be promptly ignored as Fluffykins uses subconscious Cat Powers honed over aeons of evolution in order to identify the most expensive thing to break play with...
If it sends back GPS data, how about spoofing the location to make it look like you are heading for China?
If you can figure out the unique watch ID (assuming they have one), then you could spoof all the watches, and make it look like all the watch owners are heading for China.
If you could physically locate the phone home IP, then you could have everyone heading there :-)
Icon, well you never know...
"Who wouldn't trust "an IP address scrawled on a piece of paper" ?"
Apparently not most of the people who actually use one of those watches, which I guess is not an insignificant number of people. (Though who knows how many buy them, see the scrawled URL and immediately return/bin the watch).
I'd be extremely dubious about downloading an app that could only be acquired from a URL and not via any of the major Android appstores, especially if said URL did not belong to a major known company.
I wouldn't even consider one that gave a URL in the form of an IP address rather than an actual domain name.
So an electronic device bought from some random seller on eBay turns out to be communicating to some unknown server on the Internet....and people are surprised?!
Tell you what, why not buy second hand door and window locks off eBay too...cos there's no danger of anything dodgy happening there, like the keys having been copied and the seller then having your home address which they posted the locks to you!
Apple watches connect to Apple. Seems legit, checking for updates, syncing my settings, usual app phoning home telemetry stuff, etc.
Samsung watches connect to Samsung. Same deal, of course that's what you'd expect.
Chinese watch connects to China. ZOMG hackers!!
Says a lot about our relationship with China. Possibly it also says a lot about our unjustified trust in the big tech companies that we're not worried about the first two.
All you "I don't worry" losers ... you'd better be PERFECT government, compliant, 'do-as-you're-told' citizens.
I am not, nor do I intend to be. Fuck NSA, FBI, GHCQ, Mossad, खुफिया विभाग, ASIS, and the rest of them! I know I'm on a list; couldn't give a shit less.
When I look at their manual (http://www.u8watch.net/U8-usermanual-en.pdf ) and install the 'BT Notification.apk' - connects to: APK Access mode：Downloaded from Web address
IP Address: http://www.chrsz.com which is 116.204.15.137. http://www.chrsz.com/classpro/index/183
a geolocation of that ip shows it to be: Shenzhen, China. which would be Shenzhen Coheretech Co., Ltd.
I wonder if thats where the connections are headed to: http://ipinfo.io/AS17962
well I'm curious if after this ''alert'' about the app sending data to China, if anyone has disassembled the apps (or is it the phone OS itself sending the data?) to see just what and where it is sending data?
ie: it's one thing to cry about a security issue, but where is the investigation and backup to support the allegation please?
I'm certainly not going to install a third party APK on my mobile and quite frankly some of the mediatek smartwatch apps on google play look dodgy as well, so I'd prefer to find out more info first.
If the watch OS itself is the culprit then bring on a self build OS so I can flash the watch and be reasonably secure in the knowledge that it isn't doing anything dodgy.
thank you.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2025
