TL;DR Livall smart ski and bike helmet app leaks the wearers real time position Group audio chat allows snooping on conversations Both issues are due to missing authorisation Bike app affects ~1 million users, ski app affects a few thousand users Fixed by the vendor, but after we had to call on a trusted journalist to escalate at Livall Backstory Some of us at PTP are keen skiers, and all of us are into IoT and connected devices. This means that smart ski tech is right up our straße! Connected / smart products are continually emerging in the ski sector. We’ve looked at some in the past, including some rather cool Oakley / Recon goggles with a head-up display, some smart ski helmet speakers, and other ski tech. This smart ski helmet from Livall caught our attention: We’ve looked at their smart bike helmets in the past, but other than offering a Bluetooth speaker / microphone and LED turn signals, there wasn’t much in the way of smarts to play with, which is fine. That said, they have a popular group chat function that is also present in the ski helmet app. It was also vulnerable to the same issues. These ski helmets have additional functionality; they come with an app that offers a push-to-talk (PTT) function and also the ability to track your friend group. Having lost touch with buddies on the slopes in the past, real-time geolocation can be a real boon. The big difference over the bike helmets is that the PTT function can be used without taking the phone out of a…Read More