--- title: Hackers Stalked Me by Hijacking a Smartwatch for Kids description: Security researchers Vangelis Stykas and Felipe Solferini demonstrated live GPS tracking, silent audio eavesdropping, and covert photo capture on a WIRED... canonical: https://daily.dev/posts/hackers-stalked-me-by-hijacking-a-smartwatch-for-kids-i1dboks0w twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Hackers Stalked Me by Hijacking a Smartwatch for Kids | daily.dev og:description: Security researchers Vangelis Stykas and Felipe Solferini demonstrated live GPS tracking, silent audio eavesdropping, and covert photo capture on a WIRED... og:url: https://daily.dev/posts/hackers-stalked-me-by-hijacking-a-smartwatch-for-kids-i1dboks0w og:image: https://api.daily.dev/og/posts/i1dBOkS0w.png og:image:alt: Hackers Stalked Me by Hijacking a Smartwatch for Kids og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Hackers Stalked Me by Hijacking a Smartwatch for Kids **[Hacker News](https://daily.dev/sources/hn)** · 9 min read · 0 upvotes · 0 comments ## Summary Security researchers Vangelis Stykas and Felipe Solferini demonstrated live GPS tracking, silent audio eavesdropping, and covert photo capture on a WIRED reporter wearing a cheap children's smartwatch, exposing critical vulnerabilities across three major GPS device supply chains. Their Black Hat research analyzed over 70 GPS-enabled watches and car accessories, finding that tens of millions of devices trace back to just three Shenzhen-based platforms — YiQingTeng (SETracker), NewGPS2012, and SinoTrack — all with severe security flaws. Vulnerabilities include missing authentication allowing anyone to command any device, SQL injection exposing millions of records, and evidence of prior unauthorized server access. Despite months of disclosure, many flaws remain unpatched, and the white-label model means a single backend vulnerability affects dozens of consumer brands simultaneously. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What security vulnerabilities were found in SETracker-based children's smartwatches? SETracker-based devices had an authentication flaw allowing anyone to send commands to any device on the platform without authorization. An attacker only needs the parent's registered email address to target a specific watch, enabling silent audio eavesdropping, covert photo capture, GPS tracking, location spoofing, and replacement of emergency contacts. Dozens of consumer brands share this same vulnerable backend without consumers knowing. _Developers building IoT or wearable platforms track authentication design patterns and disclosure news on daily.dev._ ### How many GPS tracker devices are affected by the YiQingTeng, NewGPS2012, and SinoTrack vulnerabilities? Tens of millions of GPS tracker gadgets trace back to just three supply chains: YiQingTeng (also known as Wonlex/SETracker), NewGPS2012, and SinoTrack. More than 30 brands use YiQingTeng's backend, another 30-plus use NewGPS2012, and SinoTrack sells car trackers and smartwatches separately. All three platforms were found to have significant security flaws at the time of the Black Hat presentation. _Teams evaluating third-party IoT platforms for supply chain risk find relevant security research on daily.dev._ ## Similar posts on daily.dev - [A KTH student hacked a children's watch](https://daily.dev/posts/a-kth-student-hacked-a-children-s-watch-pcfmn2s7t) · Hacker News · 0 upvotes · 0 comments - [Surveillance vendors caught abusing access to telcos to track people’s phone locations, researchers say](https://daily.dev/posts/surveillance-vendors-caught-abusing-access-to-telcos-to-track-people-s-phone-locations-researchers--2puwjln6z) · TechCrunch · 0 upvotes · 0 comments - [This Week In Security: Stealing Email With AI, AMD Nerfs Chips, The World Cup Nearly Rickrolled, And GPSD Bugs](https://daily.dev/posts/this-week-in-security-stealing-email-with-ai-amd-nerfs-chips-the-world-cup-nearly-rickrolled-and-xarslivpw) · Hackaday · 0 upvotes · 0 comments - [Africa’s most popular phones have a tracking problem](https://daily.dev/posts/africa-s-most-popular-phones-have-a-tracking-problem-aphuhui1l) · TechCentral · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#sql](https://daily.dev/tags/sql) [View this post on daily.dev](https://daily.dev/posts/hackers-stalked-me-by-hijacking-a-smartwatch-for-kids-i1dboks0w) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Hackers Stalked Me by Hijacking a Smartwatch for Kids","url":"https://daily.dev/posts/hackers-stalked-me-by-hijacking-a-smartwatch-for-kids-i1dboks0w","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/hackers-stalked-me-by-hijacking-a-smartwatch-for-kids-i1dboks0w"},"datePublished":"2026-08-07T04:43:08.766Z","dateModified":"2026-08-07T04:44:31.227Z","description":"Security researchers Vangelis Stykas and Felipe Solferini demonstrated live GPS tracking, silent audio eavesdropping, and covert photo capture on a WIRED...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d258d855d499bf5897c9742b3078c7a7?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d258d855d499bf5897c9742b3078c7a7?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Hacker News","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Hacker News","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/hn","url":"https://daily.dev/sources/hn"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/hackers-stalked-me-by-hijacking-a-smartwatch-for-kids-i1dboks0w","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,sql","timeRequired":"PT9M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Hacker News","item":"https://daily.dev/sources/hn"},{"@type":"ListItem","position":3,"name":"Hackers Stalked Me by Hijacking a Smartwatch for Kids"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/hackers-stalked-me-by-hijacking-a-smartwatch-for-kids-i1dboks0w#faq","mainEntity":[{"@type":"Question","name":"What security vulnerabilities were found in SETracker-based children's smartwatches?","acceptedAnswer":{"@type":"Answer","text":"SETracker-based devices had an authentication flaw allowing anyone to send commands to any device on the platform without authorization. An attacker only needs the parent's registered email address to target a specific watch, enabling silent audio eavesdropping, covert photo capture, GPS tracking, location spoofing, and replacement of emergency contacts. Dozens of consumer brands share this same vulnerable backend without consumers knowing. Developers building IoT or wearable platforms track authentication design patterns and disclosure news on daily.dev."}},{"@type":"Question","name":"How many GPS tracker devices are affected by the YiQingTeng, NewGPS2012, and SinoTrack vulnerabilities?","acceptedAnswer":{"@type":"Answer","text":"Tens of millions of GPS tracker gadgets trace back to just three supply chains: YiQingTeng (also known as Wonlex/SETracker), NewGPS2012, and SinoTrack. More than 30 brands use YiQingTeng's backend, another 30-plus use NewGPS2012, and SinoTrack sells car trackers and smartwatches separately. All three platforms were found to have significant security flaws at the time of the Black Hat presentation. Teams evaluating third-party IoT platforms for supply chain risk find relevant security research on daily.dev."}}]} ```