Researchers expose security flaws in children's GPS smartwatch

Security researchers uncovered that a pink plastic smartwatch—sold as a low‑cost, GPS‑enabled accessory—contained multiple unpatched vulnerabilities that enabled the device to transmit location data and audio streams to an external server. By exploiting these flaws, the researchers were able to track and eavesdrop on a WIRED reporter who was wearing the watch during a field assignment. The incident was reported to the manufacturer, but the device’s firmware updates were delayed, allowing the attacker to maintain a covert presence for several weeks.

The smartwatch’s supply chain has been flagged as deeply insecure. In addition to the GPS and microphone exploits, the device’s Bluetooth module was found to accept unauthorized pairing requests, and its firmware update mechanism lacked proper authentication. Similar weaknesses have been documented in other inexpensive, GPS‑enabled gadgets such as fitness trackers and smartwatches, indicating a broader pattern of inadequate security oversight across the industry. The researchers’ findings underscore the risk that even seemingly innocuous consumer electronics can become vectors for surveillance.

The incident highlights the need for stricter security standards in the production of GPS‑enabled wearables. Manufacturers must implement robust encryption, authenticated firmware updates, and secure boot processes to prevent unauthorized access. As the supply chain for such devices remains fragmented and often outsourced, coordinated efforts between vendors, regulators, and security communities will be essential to mitigate future risks.