All your GPS Trackers belong to US
summary
Bought ten popular consumer trackers and received seven for testing; set up a BladeRF base-station inside a Faraday cage to sniff GPRS and SMS, reverse-engineer protocols, and run active attacks. Discovered SMS-based configuration and serial-number tokens sent in clear text, default passwords that are incremental, management backends hosted in China/UAE, and exposed HTTP APIs. Wrote a custom GPS client to inject fake coordinates, intercepted configuration SMS (including banking OTPs), and pulled stored audio recordings and location history from management servers.
AI-written summary · about
chapters (12)
- 0:00Introduction to GPS tracker security
- 1:56Black box analysis approach
- 6:23Attack vectors and vulnerabilities
- 9:13Live demo setup and SMS interception
- 13:09Manipulating tracker data via fake base station
- 18:16Reverse engineering tracker protocols
- 22:59New sensor trends in GPS trackers
- 25:55Web app vulnerabilities and API flaws
- 28:48Mobile app and hardware security issues
- 31:17Geofence and privacy concerns
- 33:31Real-world tracking examples and impact
- 34:33Conclusion and call to action
related talks
30mUnfit Story of Fitness Trackers: Hacking BLE Fitness Trackers
30mUnfit Story of Fitness Trackers: Hacking BLE Fitness Trackers
03mHighlights - Secure Your Data
39mSecure Your Data
01h 06mLTE & IMSI Catcher Myths
42mBreakMi: Reversing, Exploiting & Fixing Fitness Tracking Ecosystems
25mAll Your GPS Are Belong To Us: Towards Stealthy Manipulation of Road Navigation Systems
24mEnhancing Physical Perimeter Defense Using SDR