Security flaws found in ‘panic button’ for Colombian activists, journalists

A “panic button” distributed by the Colombian government to high-risk activists and journalists has a number of security flaws, at least one of which is by design, a security firm reported. 

Rapid7 investigated the Eview EV-07S GPS tracker at the behest of The Associated Press. 

Though the manufacturer’s website identifies four main uses for the device — none of them personal security for high-profile targets — the Colombian government issued around 400 of these devices to people at risk, including human rights and labor activists. The site lists main applications of the EV-07S as elderly care, disabled and patient care, child protection, employee management, and pet and animal tracking. 

“I wouldn’t be worried about giving this to my grandma. But I would be more concerned giving it to anyone who might be at risk,” said Deral Heiland, internet of things research lead at Rapid7.

{mosads}Heiland said the most glaring security problem he found was actually a feature listed in the manual — anyone can reset the device from anywhere in the world without a password by sending it a text message reset command. Once the device is reset, an attacker does not need a password to reconfigure the device in any way. 

The group found another six vulnerabilities not listed in the manual. Those include a web portal for the device that allows anyone — even people without passwords — to access GPS coordinates of any device. Anyone who logs into an account on the site has access to other information from all accounts, including phone numbers and device configurations. 

The device also transmits data in “clear,” unencrypted text, allowing anyone to tamper or alter information in transit. 

Rapid7 spoke with the manufacturer in December to relay its findings. Eview has not informed Rapid7 of any intention to repair the security flaws. 

“We thought we had a responsibility to alert users that these vulnerabilities exist,” said Heiland.