IoT device manufacturers: It's time to secure our children's smartwatches

The PII problem

A report published by the Norwegian Consumer Council showed that many smartwatches marketed toward children were riddled with attack vectors and access points for hackers to uncover and retrieve personally identifiable information (PII) from families.

Although the study was meant to serve as a catalyst to force change in the IoT industry, the very same security flaws are still plaguing children’s smartwatches a year and a half later. Despite such compelling data on the unsettling amount of vulnerabilities, gaping security holes still remain. A more recent article from Schneier on Security showed that the same geolocation issues were found during a data breach from smartwatch backend company Gator. Even with stricter rules in place after the implementation of the EU’s GDPR, unencrypted data still traversed foreign servers, making it easy for third-party attackers to access.

It’s time to fix this problem. There are easy measures to take to secure families’ important data while also ensuring the safety of kids.

Solution No. 1: Tokenizing watch data

One of the main issues the study uncovered was a lack of tokens to conceal and preserve sensitive geolocation data. In addition to seeing live locations of users, third-party attackers could also access a database filled with the PII of users linked to specific locations. Email addresses, contact information and worse remained at risk.

Utilizing tokens is a simple fix, although not a thorough one. Had the location info been tokenized at the user level, geolocation data, geofencing and live data could still be at risk. However, user-centric PII would have at least been sufficiently masked, as the token would protect the identities of those using the service.

The Schneier article also showed how this data was commonly centralized through a single access point that simply required super admin access to obtain. Tokens would be even more powerful if the information was decentralized among different server locations, further concealing identities and preventing malicious actors from obtaining contextualized data.

Solution No. 2: Decryption keys

While tokens cover the transmission and storage of PII, location-based data is still available in plain view. End-to-end encryption at the source might mean parents need to take extra steps to glean crucial data, but it provides ample security.

For example, if a child were to press their SOS button to alert a family member to their location, that data could require an extra authentication step to see. In this imagined workflow, a guardian would receive an alert, type in their unique pin — or, for added safety, the key from a two-factor authentication program like Google Authenticator — to see the decrypted data.

Encrypting information at the user level would prevent third-party actors from intercepting live geolocation data and seeing geofencing barriers that families establish around their own homes. This has an added benefit of preventing unauthorized access at the hardware level — if a parent’s phone is stolen or otherwise compromised, incorporating a decryption pin would prevent further catastrophe.

Solution No. 3: The all-in-one

Of course, neither of the above solutions completely addresses the problems outlined by reports all on their own. Implementing both tokens and encryption together for a two-fold security program prevents both real-time and stored historical data from falling into the wrong hands, and could coincide with more rigorous permission-based access controls for even more secure data sharing.

A common pattern across all smartwatch carriers is that consumers are not able to decide which information the watch app could access and when it could do so. While many parents may feel justified in turning over all of their information, setting permissions could help them stay in the know about exactly what they’re turning over and when.

The most comprehensive solution would — and should — give parents complete control of exactly what data is being shared when it is shared and how it is stored.

Takeaways: It just takes one device

So, what does this mean for IoT security overall? In 2019, connected devices are only going to become smarter, broader and more proliferated. Furthermore, more consumers will turn to them for the sake of convenience and the superficial feeling of security. While that puts companies that specialize in IoT in the driver’s seat, it also means that holistic thinking about security is required to prevent products from turning into problems.

Now is the time for companies to take action and make sure they are doing all they can to protect the privacy of their users. This is not a radical assumption — in fact, regulatory laws like GDPR require it. If smartwatch companies desire to give their consumers true peace of mind about the whereabouts of their children, then transparency and security should be a top priority.

My company is currently working on a system to help organizations comply with GDPR and other privacy regulations for IoT and beyond. Make sure to sign up here to learn more about what we’re doing to make devices safer for users of all ages.

All IoT Agenda network contributors are responsible for the content and accuracy of their posts. Opinions are of the writers and do not necessarily convey the thoughts of IoT Agenda.