Safety experts say a popular Chinese-made automobile followed device poses a serious risk of cyberattacks.
A cyberattack is an attack on or through a computer network.
The device, made by Shenzhen-based MiCODUS, is used by people around the world to protect their vehicles from theft.
A report by US cybersecurity firm BitSight warned that the system has severe software vulnerabilities.
The issues could allow attackers to from a distance hijack vehicles using the tracking device, security researchers said. This could give attackers the ability to cut fuel or take control of the vehicle while it’s moving, BitSight said in its report.
The MV720 device costs less than $25, according to BitSight. Researchers recently issued a press release urging all users of the device to stop using it until a fix for the vulnerabilities is available.
BitSight’s report came as a US government agency issued an official advisory also outlining the device’s vulnerabilities.
BitSight told The Associated Press that it has been trying since September to contact representatives from MiCODUS to discuss the security risks it has identified. He said these attempts were unsuccessful. BitSight said the US agency investigating the device, the Cybersecurity and Infrastructure Security Agency (CISA), joined efforts to contact MiCODUS in April.
The Associated Press emailed MiCODUS about it, but said it had not received a response.
CISA said in a statement that it was not aware of “any exploitation» vulnerabilities.
GPS trackers are used around the world to track groups of vehicles, from trucks to school buses to military vehicles. The devices also act as security to prevent vehicles from getting lost or stolen.
In addition to collecting vehicle tracking data, many devices are also equipped to examine other information about vehicle and driver actions. This information may include driver behavior and fuel consumption. Many devices are capable of controlling a vehicle’s fuel or locking systems and more.
Using the MV720 device, BitSight said, a cyberattacker could remotely shut off a moving vehicle’s fuel line. An attacker might also be able to see where a vehicle is in real time for spying purposes, said BitSight researcher Pedro Umbelino.
One of the main vulnerabilities of the device is that it comes with a default password that more than 90% of users do not change, found BitSight. It also discovered security flaws in the software the web server uses to control devices on the internet.
MiCODUS says around 1.5 million devices are used by 420,000 clients.
BitSight said its research revealed that customers included a major energy company, an aerospace company, and national armies from South America and Eastern Europe. Others included a nuclear power plant operator and a national law enforcement agency in Western Europe. BitSight did not name any of the companies. The countries with the most users are Brazil, Mexico, Spain and Russia.
Richard Clarke is a former senior US cybersecurity official. He told the AP that while he didn’t believe the device was designed to be “used mischievously by the Chinese government”, it remains a possibility.
Clarke said the threat is real because Chinese companies are required by law to follow their government’s orders. “You’re just wondering, how often are we going to find these things that are Infrastructure – where there is a potential for Chinese abuse – and users don’t know? Clarke said.
I am Brian Lynn.
The Associated Press reported this story. Bryan Lynn adapted the report for VOA Learning English.
__________________________________________________________
words in this story
Track – v. record the development progress of something
vulnerable – adj. capable of being injured or at risk of being injured
from a distance –adv. from afar
to exploit– v. to use or develop something for your own benefit
default– adj. what usually exists if no changes are made
customer – nm someone who buys goods and services from a company
malicious – adj. intended to hurt or upset someone
Infrastructure – nm the basic equipment and structures (such as roads and bridges) that are needed for a country or region
potential – nm a possibility when the necessary conditions exist
_______________________________________________________________
What do you think of this story? We want to hear from you. We have a new comment system. Here’s how it works:
- 1. Write your comment in the box.
- 2. Below the box, you can see four images for social media accounts. They are for Disqus, Facebook, Twitter and Google.
- 3. Click on an image and a box appears. Enter your social media account ID. Or you can create one on the Disqus system. It’s the blue circle with “D” on it. It’s free.
Every time you come back to comment on the Learning English site, you can use your account and see your comments and replies. Our feedback policy is here.