back to article That's a nice ski speaker you've got there. Shame if it got pwned

A set of smart speakers intended for ski helmets are a terrible data-leaking pit of badness, according to a Pen Test Partners researcher who innocently bought himself one of the devices. "I love snow sports, and I also like my tunes, so purchasing the Outdoor Tech CHIPS smart headphones was a no-brainer," wrote PTP chap Alan …

  1. Steve Button Silver badge

    Because skiing or snowboarding aren't dangerous enough already?

    I know this story is about security, but really perhaps the bigger threat is from safety.

    Just don't have loud music blasting in your ears when you are hurtling down a piste (or riding a bike or jogging).

    A helmet is for safety, not for blasting choons into your lug holes.

    1. GruntyMcPugh Silver badge

      Re: Because skiing or snowboarding aren't dangerous enough already?

      @Steve Button

      From my experience, by the time you hear someone, it's probably too late (on the piste, that is) totally agree for riding a bike etc.

      1. Martin M

        Re: Because skiing or snowboarding aren't dangerous enough already?

        Not my experience ... as a boarder of 20 years, I absolutely keep my ears open on the slope. There's a massive blind spot to my right (I ride goofy). Skiers who don't realise this - and some boarders who should know better, too - have a habit of putting themselves right in it when they carry out a kamikaze overtaking manoeuvre. I've lost count of the number of times I've aborted a turn, potentially avoiding a nasty accident, based purely on what I've heard.

        I don't really ski, but imagine it might be a bit less useful. Even then, if you're stopped and someone gets out of control on an icy patch above, you can hear scraping from a long way away and well in time to take action. Which for me, last week, wasn't getting out of the way but catching a terrified five year old about to eject themselves off the piste onto a very steep, tree-lined slope.

        Bottom line: no amount of music enjoyment is worth a potentially serious accident, in my book.

        1. Anonymous Coward
          Anonymous Coward

          Re: Because skiing or snowboarding aren't dangerous enough already?

          "Bottom line: no amount of music enjoyment is worth a potentially serious accident, in my book."

          Exactly. I own a ski helmet designed to take these bluetooth speakers, and will never buy the speakers. I bought the helmet because the coarse fabric mesh over the speaker voids lets more sound through than on a conventional ski helmet design, and being able to hear a skier or boarder near you on the slopes can help avoid a serious accident.

        2. GruntyMcPugh Silver badge

          Re: Because skiing or snowboarding aren't dangerous enough already?

          I don't listen to music on the slopes either, in the vain hope it'll prevent collisions, but when you have some a-hole skier who thinks they are Franz Klammer bearing down on you, there usually isn't time to take evasive action. Too many times I've seen fellow boarders look round, just in time to look their assailant in the face, then boom.

          1. Anonymous Coward
            Anonymous Coward

            Re: Because skiing or snowboarding aren't dangerous enough already?

            Trust me - its deliberate ;)

      2. Khaptain Silver badge

        Re: Because skiing or snowboarding aren't dangerous enough already?

        Hi Grunty,

        I was on a recent trip with my colleagues and on several occasions we were carving on relatively empty slopes, one of my colleagues was skiing at the same speed as me and we were constantly just next to each other. Because of the small field of vision of the mask I couldn't see her but I could constantly hear her, this made me keep very aware of her presence and as such I knew not to use the entire piste. We were able to ski like this for long periods.

        If I had been listening to music I would not have not known that she was just next to me.....

        1. ISYS

          Re: Because skiing or snowboarding aren't dangerous enough already?

          Absolutely,

          I Ski and can confirm that part of collision avoidance on busy slopes is hearing what is in your blind spot -you can definitely hear other peoples skis/boards and sometimes the cries of 'look out!' or 'oh shit!' from out-of-control people.

          Wait until you have stopped for a break, order a glass of something nice, admire the view and then listen to music.

      3. CrazyOldCatMan Silver badge

        Re: Because skiing or snowboarding aren't dangerous enough already?

        totally agree for riding a bike etc

        Depends on the type of motorbike (and whether it has a fairing or not). I guarentee you that, on an unfaired bike and doing more than 50mph, you won't hear other vehicles around you anyway because of the wind noise round your helmet. And a lot of bikers tend to wear earplugs anyway - especially if on long rides (to stop long-term hearing loss from the wind noise).

        And it beats hearing the sound of your own voice singing to you in order to stave off boredom..

    2. Khaptain Silver badge

      Re: Because skiing or snowboarding aren't dangerous enough already?

      Couldn't agree more ; and when the insurance company learns that the chav in question was pumping hard bass lines into their ears just before they "accidentally" caused as accident would make for some interesting cases.

      If they do it off-piste , then fine that's his problem. Just don't come onto the pistes amongst others.

      I ski a lot and the pistes are getting busier each year and the number of accidents never goes down... This is not a great idea at all... You have a responsibility for yourself and more important for others when skiing, accidents are quite often serious and when they can be avoided all the better for all concerned.

      I am lucky in that I can ski outside of the tourist seasons when it's mostly the locals. There is a massive difference in attitude during these seasons.

      If people want loud music , then just wait a little until the pistes are closed... Skiing is not worse because your not listening to your favourite vibes....

    3. JimboSmith Silver badge

      Re: Because skiing or snowboarding aren't dangerous enough already?

      GDPR, I wonder if they've heard of it? 4% of turnover sounds quite expensive. Is that the sound of profits going downhill that I hear?

      1. Doctor Syntax Silver badge

        Re: Because skiing or snowboarding aren't dangerous enough already?

        "4% of turnover sounds quite expensive."

        And not acting when you discover the problem is the sort of action that gets pushed into the top tier. It's also possible that they're not a big enough company to be 4%ers. The flat rate can be a lot more than 4% for small businesses if it ever gets applied.

  2. GruntyMcPugh Silver badge

    I'll stick with my Binatone PMR446,....

    ... the only recent technological concession they have digital squelch. We use call signs, so our chatter doesn't reveal our real names. On the slopes, I'm 'Snake' btw,......

    1. Sgt_Oddball

      Re: I'll stick with my Binatone PMR446,....

      Snake? Snaaaake!?

      1. CrazyOldCatMan Silver badge

        Re: I'll stick with my Binatone PMR446,....

        Snake? Snaaaake!?

        Onna plaaaaane!

  3. Anonymous Coward
    Anonymous Coward

    Why ?

    Does a pair of headphone need to be registered and connected realtime to a website? And why does a pair of headphones need GPS info?

    The world is going (or has gone) mad.......

    1. FrogsAndChips Silver badge

      Re: Why GPS?

      Might come in handy when you're buried under the avalanche you didn't hear because of your speakers, if only to recover your frozen body.

  4. jeffdyer

    I've been skiing for over 40 years, so predate helmets, I'm never going to wear one. But I often wear ear buds when I'm skiing on my own. There's no need to worry about anyone coming at me from behind, because I rarely get overtaken. I'd never wear them while cycling though, for me the ski slopes are far safer than cycling on the road.

    1. Khaptain Silver badge

      @Jeff,

      I've only been skiing for 20 years and for 17 of then I never wore a helmet either. 3 years ago I bought my first and honestly I couldn't go back.

      First : They keep you warm :-). I usually start skiing in early december when it's quite cold, -15 is not rare with the wind chill factor.

      Second : I've had my fair share of falls, knocks and bruises and still suffer from a shoulder problem that dates back about 16 years ago after falling on an icy piste, fortunately it was my shoulder and not my head because I know for sure that a woolly hat wouldn't have absorbed much shock....

      Third : I ski with some excellent skiers and all of them wear helmets, they know only too well that at the speed they ski, accidents can and sometimes do happen and that the helmet could potentially save them from very difficult situations. No, it wont save them in all situations but even if though have a 80% chance of avoid major head injuries then that's always a plus.

      Fourth : Skies, boots, piste grooming and technology have improved too such an extent that even beginners can ski much faster than they did many years ago. On top of that the pistes are busier, hence the likelihood of more accidents... A little bit of extra protection is not a bad thing.

      Fifth : They do not remove any of the sensation, you can still hear well and you almost don't feel them on your head.

      You should try one one day, you will be pleasantly surprised to learn that they are not a gadget/gimmick or fashion statement. And they are not even that expensive compared to the price of the helicopter ride :-)

      1. jeffdyer

        Statistics show you're far more likely to injure a leg than any other part of the body, and that most injuries are caused by falling or landing badly after a jump, than by hitting someone else (in which case a head injury seems more possible in a one on one collision).

        https://www.premax.co/au/blog/recent-statistics-on-skiing-and-snowboarding-injuries

        Add in the additional safety feeling that wearing a helmet provides (in all sports) increasing the likelihood of taking greater risks, and helmet wearing doesn't really seem a big issue.

        But don't let me stop you.

        1. Khaptain Silver badge

          <Statistics show you're far more likely to injure a leg than any other part of the body, and that most injuries are caused by falling or landing badly after a jump, than by hitting someone else (in which case a head injury seems more possible in a one on one collision).>

          Statistics are great, so long as you belong in the "broken leg" group..

          Quote : Most injuries (about 75%) for both skiers and snowboarders occur either by falling down or loss of control during a jump

          Most of us do fall, more so as beginners but we fall nonetheless and since 15% of those include head injuries you can't simply ignore that figure..

    2. Anonymous Coward
      Anonymous Coward

      " for me the ski slopes are far safer than cycling on the road"

      I've been knocked off my bike by a careless driver, and I still feel safer cycling than I do on a ski slope.

      This is mostly because the number of people driving right at the limit of their ability on any given road is a lot lower than the number of people skiing at the absolute limit of their ability on any given slope.

    3. Anonymous Coward
      Anonymous Coward

      I'm a very occasional skiier / boarder

      And when I first learned no one was wearing helmets. I took a nasty fall when I lost control on some ice and hit a soft pocket of snow in a depression on that icy slope that halted my out of control momentum all too quickly and face planted on the ice. Got a nice concussion for my trouble - when my girlfriend caught up a minute later she asked me what day it was and I thought it was sometime in November...it was March! :)

      When I learned to board about 10 years ago I wore a helmet, and when I've skiied since I wear one. You need the warmth anyway, and I know I'm nowhere near good enough (or ski / board under near enough control) that I should risk going without a helmet. Especially since that's not the only concussion I've had in my past, and given the news about CTE I don't want to push my luck...

  5. Anonymous Coward
    Anonymous Coward

    >"for me the ski slopes are far safer than cycling on the road" - you've never met my friends on the slopes have you?

    1. Anonymous Coward
      Anonymous Coward

      Well cars won't hit you on the slopes, but ignoring the problem of getting hit by a car or fellow cyclist/skier/boarder I feel I'm much safer on a bike than I am on skis or a board. I'm sure if I had even 1/50th the hours on snow that I do on the road I'd be more competent, but given that a bike has a steering wheel and brakes, and you can only approximate such control on snow it seems ridiculous that anyone would feel less safe on a bike.

  6. The Mole

    Unpleasantly surprised

    When I saw the headline I was expecting some sort of simple bluetooth hijacking type attack - not good but not a massive security issue. This on the other hand is a level of incompetence that goes far beyond that. To expose all that details on a public API is just crazy, and plain inefficient (no limits, really?). I hate to think what other issues the site also has (SQL injection). I wonder if they are covered by GDPR and have notified the authorities of the data breach already?

    1. Doctor Syntax Silver badge

      Re: Unpleasantly surprised

      "I hate to think what other issues the site also has"

      Has Bobby Tables bought a set?

  7. Anonymous Coward
    Anonymous Coward

    Don't get too worried about this

    My original CHIPS only lasted three weeks before they stopped working. By this time next season, none of the current product will be working and there will be no security risk.

  8. Anonymous Coward
    Anonymous Coward

    Yeah, but it's *not* the headphones it's the app

    The headphones are pretty bog standard A2DP/AVRCP & headset profile things.

    All the vulnerabilities being talked about here are in the *optional* app. I get that "oh! IoT thing insecure" is a better headline than "app is crappy", especially as there are MANY apps that are crappy and do awful things with your data, location and otherwise.

    1. Slay
      Thumb Up

      Re: Yeah, but it's *not* the headphones it's the app

      This is the only technically competent comment here so far.

    2. FrogsAndChips Silver badge

      Re: Yeah, but it's *not* the headphones it's the app

      Still, it's only the existence of the app that makes it an "IoT thing". Remove the app and all you have is Bluetooth speakers, not an IoT device.

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon