Security Agency (CISA) warned in an advisory.<\/p>\n
Introduction:<\/p>\n
The vulnerabilities exist in the ST-900 and ST-915 SinoTrack GPS tracking hardware that uses default passwords to secure access to the device.<\/p>\n
SinoTrack provides vehicle tracking solutions for companies and individuals worldwide.<\/p>\n
However, these security vulnerabilities bring to light a severe threat to vehicle owners and connected fleet management companies.<\/p>\n
Sub-heading 1:<\/p>\n
Dr.<\/p>\n
Oliver Matula from ERNW Enno Rey Netzwerke, who discovered these vulnerabilities, said the issues could be classified into two.<\/p>\n
Firstly, there\u2019s the improper validation of password vulnerability (CVE-2021-3979).<\/p>\n
It allows an attacker to bypass the password authentication, granting unauthorized access to the GPS tracker via the Hyper Text Transfer Protocol (HTTP) interface.<\/p>\n
Second in line is the storage of hard-coded credentials vulnerability (CVE-2021-3980).<\/p>\n
It allows a malicious actor to gain unauthorized access due to the default credentials that are embedded in the firmware of the GPS device.<\/p>\n
Sub-heading 2:<\/p>\n
The presence of these vulnerabilities enables cyber-attackers to hijack vehicles remotely, turning on alarms, disabling the engine and more.<\/p>\n
They could also potentially use the compromised systems as stepping stones to breach an organization’s broader network.<\/p>\n
Real-World Example:<\/p>\n
In a real-world scenario, an attacker could use a simple HTTP client, like a web browser, to send requests to the GPS device\u2019s IP address.<\/p>\n
Given the vulnerable GPS devices expose their web interface on port 5019, the attacker could easily gain control by exploiting the security gaps.<\/p>\n
Advice to Professionals:<\/p>\n
CISA and ERNW have urged users to change all default passwords, emphasizing the importance of unique, complex passwords.<\/p>\n
Minimizing network exposure for all control system devices and making sure that they are not accessible from the internet is also paramount.<\/p>\n
If remote access is necessary, secure methods like Virtual Private Networks (VPNs) should be used.<\/p>\n
Conclusion:<\/p>\n
SinoTrack\u2019s vulnerabilities are a potent reminder of the security risks that come with Internet of Things (IoT) devices.<\/p>\n
It insists on the need for organizations and individuals to take IoT security seriously and adopt best practices to keep them secure.<\/p>\n
For more detailed, technical information on these vulnerabilities, you can check out the following references:<\/p>\n
Security Agency (CISA) warned in an advisory. Introduction: Unpatched SinoTrack GPS Vulnerabilities The vulnerabilities exist<\/p>\n","protected":false},"author":1,"featured_media":3580,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"pmpro_default_level":"","_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[2,5],"tags":[],"class_list":["post-3578","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","category-news","pmpro-has-access"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/aegislens.com\/home\/wp-json\/wp\/v2\/posts\/3578","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/aegislens.com\/home\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/aegislens.com\/home\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/aegislens.com\/home\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/aegislens.com\/home\/wp-json\/wp\/v2\/comments?post=3578"}],"version-history":[{"count":1,"href":"https:\/\/aegislens.com\/home\/wp-json\/wp\/v2\/posts\/3578\/revisions"}],"predecessor-version":[{"id":3581,"href":"https:\/\/aegislens.com\/home\/wp-json\/wp\/v2\/posts\/3578\/revisions\/3581"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/aegislens.com\/home\/wp-json\/wp\/v2\/media\/3580"}],"wp:attachment":[{"href":"https:\/\/aegislens.com\/home\/wp-json\/wp\/v2\/media?parent=3578"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/aegislens.com\/home\/wp-json\/wp\/v2\/categories?post=3578"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/aegislens.com\/home\/wp-json\/wp\/v2\/tags?post=3578"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}