CVE-2019-20468
📋 TL;DR
The SeTracker2 app for TK-Star Q90 Junior GPS watches requests excessive Android permissions (READ_EXTERNAL_STORAGE, WRITE_EXTERNAL_STORAGE, READ_CONTACTS) that are not needed for its functionality. This allows malicious apps on the same device to potentially access sensitive user data without proper justification. Users of TK-Star Q90 Junior GPS watches with the SeTracker2 app are affected.
💻 Affected Systems
- TK-Star Q90 Junior GPS watch with SeTracker2 app
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Malicious app exploits these permissions to steal all photos, files, and contact information from the device, potentially leading to identity theft, blackmail, or further attacks.
Likely Case
Malware or spyware apps leverage these unnecessary permissions to exfiltrate personal data from the device without user knowledge.
If Mitigated
With proper app permission controls and security software, unauthorized access attempts would be blocked or detected.
🎯 Exploit Status
Exploitation requires a malicious app to be installed on the same Android device. No public exploit code has been released, but the attack vector is straightforward.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.tk-star.com
Restart Required: No
Instructions:
1. Check TK-Star website for app updates. 2. Update SeTracker2 app through Google Play Store if available. 3. Re-pair watch with updated app.
🔧 Temporary Workarounds
Revoke unnecessary app permissions
androidManually disable the unnecessary permissions for the SeTracker2 app in Android settings
Settings > Apps > SeTracker2 > Permissions > Disable: Storage, Contacts
Use app permission manager
androidInstall a security app that monitors and controls app permissions
🧯 If You Can't Patch
- Discontinue use of the SeTracker2 app and unpair the watch
- Use a different GPS tracking app that follows permission best practices
🔍 How to Verify
Check if Vulnerable:
Check app version in Android Settings > Apps > SeTracker2. If version is 3.1042.9.8656, check app permissions for unnecessary storage and contacts access.Check Version:
adb shell dumpsys package com.tkstar.setracker2 | grep versionNameVerify Fix Applied:
Verify app has been updated to a newer version and that unnecessary permissions are no longer requested or can be disabled.📡 Detection & Monitoring
Log Indicators:
- Unauthorized access attempts to storage or contacts by SeTracker2 app
- Permission requests from SeTracker2 app in Android logs
Network Indicators:
- Unusual data exfiltration from device to unknown destinations
SIEM Query:
source="android" app="SeTracker2" (event="permission_granted" OR event="file_access")