https://community.isc2.org/t5/Industry-News/How-to-connect-to-pretty-much-anybody-with-your-helmet-speakers/m-p/19847#M2350 <P>Outdoor Tech makes the <A href="https://nakedsecurity.sophos.com/2019/03/06/ski-headphones-flaw-unlocks-mountain-of-user-data" target="_blank" rel="noopener">Chips 2.0 speakers</A> for your audio equipped ski helmet.&nbsp; It give you the ability to have conversations with your other friends on the ski slope via a Bluetooth connection to your smartphone, and thence over the Internet.</P><P>&nbsp;</P><P>First problem: all the conversations go through Outdoor Tech's servers.</P><P>&nbsp;</P><P>Second problem: in order to set up conversations with your friends, you have to set up a group.&nbsp; You have to search for your friends names.&nbsp; While searching, it turns out you can, with very little effort, find absolutely anyone who has registered the speakers.&nbsp; And their email addresses.&nbsp; And their phone numbers.</P><P>&nbsp;</P><P>You can also find out where they are.</P><P>&nbsp;</P><P>And reset their passwords.</P><P>&nbsp;</P><P>This would make a good gift for your skiing friends who don't think security is important ...</P> Wed, 06 Mar 2019 17:20:19 GMT rslade 2019-03-06T17:20:19Z https://community.isc2.org/t5/Industry-News/How-to-connect-to-pretty-much-anybody-with-your-helmet-speakers/m-p/19847#M2350 <P>Outdoor Tech makes the <A href="https://nakedsecurity.sophos.com/2019/03/06/ski-headphones-flaw-unlocks-mountain-of-user-data" target="_blank" rel="noopener">Chips 2.0 speakers</A> for your audio equipped ski helmet.&nbsp; It give you the ability to have conversations with your other friends on the ski slope via a Bluetooth connection to your smartphone, and thence over the Internet.</P><P>&nbsp;</P><P>First problem: all the conversations go through Outdoor Tech's servers.</P><P>&nbsp;</P><P>Second problem: in order to set up conversations with your friends, you have to set up a group.&nbsp; You have to search for your friends names.&nbsp; While searching, it turns out you can, with very little effort, find absolutely anyone who has registered the speakers.&nbsp; And their email addresses.&nbsp; And their phone numbers.</P><P>&nbsp;</P><P>You can also find out where they are.</P><P>&nbsp;</P><P>And reset their passwords.</P><P>&nbsp;</P><P>This would make a good gift for your skiing friends who don't think security is important ...</P> Wed, 06 Mar 2019 17:20:19 GMT https://community.isc2.org/t5/Industry-News/How-to-connect-to-pretty-much-anybody-with-your-helmet-speakers/m-p/19847#M2350 rslade 2019-03-06T17:20:19Z