Title: KTH student hacked a popular children’s smartwatch, found 17 vulnerabilities and full remote access
A former student at KTH Royal Institute of Technology has demonstrated how a popular children’s smartwatch can be fully compromised over the internet. In his thesis, “Ethical Hacking of a Smartwatch for Kids: A Hacker’s Playground,” Gustaf Blomqvist conducted an ethical security assessment of a widely sold kids’ smartwatch and found what he describes as severe security flaws.
The device, identified in Swedish media as the MyFirst Fone R1s by MyFirst, exposed an insecure network service directly to the internet. By scanning for devices, an attacker could identify watches and take complete control of them remotely.
According to the findings, an attacker could access the camera and microphone, eavesdrop on surroundings, read and manipulate text messages, send arbitrary messages, and potentially use the device in denial-of-service attacks. In total, 17 vulnerabilities were discovered.
Blomqvist also found preinstalled malicious code on the watch. The device reportedly connected periodically to a remote server and transmitted detailed information about its contents. The update mechanism for that code was itself vulnerable, making it possible to install additional malicious software.
Children’s smartwatches are marketed primarily as safety devices so that parents can stay in contact with their children. However, the research suggests these products may introduce serious privacy and security risks instead.
Blomqvist says he reported the vulnerabilities to the manufacturer and initially received instructions on where to submit the details, but after that communication stopped. Pontus Johnson, professor of cybersecurity at KTH, commented that many software-based systems remain highly vulnerable and that smaller manufacturers may lack the resources to properly address security issues.
The EU Cyber Resilience Act introduces mandatory cybersecurity requirements for connected products, but full enforcement will not take effect until 2027.
> In this thesis, welldocumented grey-box ethical hacking is conducted of the network service and firmware attack surfaces of the children’s smartwatch myFirst Fone R1s.
I guess some folks at KTH have been looking at this topic for a while now, there was a story about it on SVT (Swedish equivalent of the BBC) two years back: https://www.svt.se/nyheter/inrikes/sa-latt-hackas-ditt-barns...
Same professor, Pontus Johnson, is mentioned that story.
Title: KTH student hacked a popular children’s smartwatch, found 17 vulnerabilities and full remote access
A former student at KTH Royal Institute of Technology has demonstrated how a popular children’s smartwatch can be fully compromised over the internet. In his thesis, “Ethical Hacking of a Smartwatch for Kids: A Hacker’s Playground,” Gustaf Blomqvist conducted an ethical security assessment of a widely sold kids’ smartwatch and found what he describes as severe security flaws.
The device, identified in Swedish media as the MyFirst Fone R1s by MyFirst, exposed an insecure network service directly to the internet. By scanning for devices, an attacker could identify watches and take complete control of them remotely.
According to the findings, an attacker could access the camera and microphone, eavesdrop on surroundings, read and manipulate text messages, send arbitrary messages, and potentially use the device in denial-of-service attacks. In total, 17 vulnerabilities were discovered.
Blomqvist also found preinstalled malicious code on the watch. The device reportedly connected periodically to a remote server and transmitted detailed information about its contents. The update mechanism for that code was itself vulnerable, making it possible to install additional malicious software.
Children’s smartwatches are marketed primarily as safety devices so that parents can stay in contact with their children. However, the research suggests these products may introduce serious privacy and security risks instead.
Blomqvist says he reported the vulnerabilities to the manufacturer and initially received instructions on where to submit the details, but after that communication stopped. Pontus Johnson, professor of cybersecurity at KTH, commented that many software-based systems remain highly vulnerable and that smaller manufacturers may lack the resources to properly address security issues.
The EU Cyber Resilience Act introduces mandatory cybersecurity requirements for connected products, but full enforcement will not take effect until 2027.
Sources: kth.se, expressen.se
Love how they are closing with the CRA reference
Someone really needs to make a watch for kids sans touchscreen but with enough features for parents.
Reminded me of this recent talk from 39C3 regarding another company (Xplora) that also sells smartwatches for children: https://www.youtube.com/watch?v=VRQz9EX2Tl0
I'm very excited for EUs CRA, very promising for the future of digital security in the EU.
presumably, "CRA" in this comment stands for "Cyber Resilience Act" (https://digital-strategy.ec.europa.eu/en/policies/cyber-resi...)
which smartwatch was that?
the source linked in the article is dead, and I only see that AI slop comment here
-- MyFirst Fone R1, singapore
funny that it's called my first, find my first upon your device, haha
https://kth.diva-portal.org/smash/record.jsf?pid=diva2%3A203...
> In this thesis, welldocumented grey-box ethical hacking is conducted of the network service and firmware attack surfaces of the children’s smartwatch myFirst Fone R1s.