Attackers can surveil, disrupt vehicles outfitted with popular GPS tracker, CISA warns

Experts say the vulnerabilities found in the MiCODUS GPS tracker reflect a larger security problem in the Internet of Things ecosystem.

Six vulnerabilities in a popular GPS tracking device could allow malicious hackers to secretly track, disrupt or even remotely shut off vehicles, federal cybersecurity officials warned Tuesday.

“Successful exploitation of these vulnerabilities could allow an attacker control over any MV720 GPS tracker, granting access to location, routes, fuel cutoff commands and the disarming of various features (e.g., alarms),” according to the Cybersecurity and Infrastructure Security Agency.

The Chinese-made tracker in question is known as the MiCODUS MV720 GPS tracker. It’s used across the globe by consumers and businesses alike seeking theft protection and location management, according to the cybersecurity company BitSight, which discovered the problem earlier this year and notified CISA. BitSight and CISA collaborated on the vulnerability alert.

Government, military and law enforcement agencies as well as corporations spanning a variety of industries such as aerospace, energy, engineering, manufacturing and shipping rely on the MiCODUS tracker, BitSight said in a press release.

Security and privacy experts have long complained about GPS trackers putting people at risk due to built-in vulnerabilities. Additionally, devices such as the Apple AirTag have been used to track people without their consent. A Connecticut man was arrested and charged with stalking in February after police found an AirTag in his ex-girlfriend’s car. Law enforcement in multiple states have issued warnings alerting the public to how criminals can deploy AirTags.

Experts say the vulnerabilities in easily available GPS trackers are not that surprising because many inexpensive, internet-connected devices are built on insecure code and outdated software.

Ron Brash, a GPS hacking expert and a CTO with the software security company aDolus Technology, said many manufacturers sell devices such as GPS trackers without updating security settings or patching existing vulnerabilities.

Most consumers prioritize price over quality, he said, a reality that has led to a vast number of vulnerable and insecure devices such as MiCODUS being in use today.

“Most internet of trash devices are insecure on their own; it’s just how you use it and in what context where the where the dangers start to arise,” said Brash. “This is just the tip of the iceberg … There’s so many dead bodies or skeletons in most embedded products.”

There are 1.5 million MiCODUS 720 devices now in use across 169 countries, according to BitSight. Organizations using the trackers include a Fortune 50 energy, oil and gas company; a national military in South America; a Fortune 50 technology company; a nuclear power plant operator; and state officials in the U.S., according to BitSight.

The insecurity of GPS trackers carries serious national security implications, too, given that some cars in the U.S. are outfitted with tracking devices that Chinese military officials could conceivably shut down.

“If China can remotely control vehicles in the United States, we have a problem,” Richard Clarke, a former presidential adviser on cybersecurity, said in a prepared statement included in the BitSight press release. “With the fast growth in adoption of mobile devices and the desire for our society to be more connected, it is easy to overlook the fact that GPS tracking devices such as these can greatly increase cyber risk if they are not built with security in mind.”

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure