Investigating Foreign Tech from Online Retailers

Investigating Foreign Tech on Amazon

Michael Cordera, VP of Cyber Solutions at Secure Inc., details a process of investigating foreign technology purchased from online retailers, specifically focusing on tracking the supply chain of a smartwatch bought on Amazon.

Background: Chinese Sellers and Amazon's Issues

Chinese sellers constitute a significant portion (estimated 50% of top 10,000 sellers) of Amazon's marketplace.

Many of these companies use random strings of letters as brand names, a tactic that emerged after Amazon's 2015 requirement for trademarks to combat quality issues. This method bypasses due diligence.

Abuses on Amazon include fake reviews, counterfeit products, and fake IP claims.

Amazon is described as a victim of its own success, and consumers are also part of the problem by continuing to purchase these products.

Tariffs on electronics are noted as a developing story with potential impacts on trade.

Concerns about product safety are highlighted, with examples of flammable products, high lead content in cups, faulty smoke detectors, and melting power banks. The Consumer Product Safety Commission website is recommended for further information.

A key problem is that flagged companies often rebrand and continue selling, making the issue persistent.

Case Study: A Smartwatch on Amazon

The investigation was prompted by a friend asking about the safety of a $30 smartwatch purchased on Amazon.

The smartwatch appeared attractive, had many reviews, and was cheaper than similar products, making it a tempting purchase.

Influencer marketing also plays a role in promoting such products.

Open Source Intelligence (OSINT) on the Smartwatch

Brand Information: The smartwatch brand was identified as "Rxing Eggs" (or similar, pronunciation uncertain), trademarked by "Wing Xin Ding." The provided address pointed to a soccer field in China.

Attorney and PO Box: The attorney of record, Jen Lu Leu (nicknamed "Anson"), used a PO Box in Los Angeles.

Company Information: The actual company, "Seway New," claims to be the sole authorized seller and translates to "think carefully."

Contact Information: An email (vipvipasg.com) and a WhatsApp number provided pivot points for further investigation.

Further Pivoting:

The email led to a YouTube channel "Hake Fit" and mentions of a "Dr. Schmid," with an app manual found on the channel.

The associated app and company information were abandoned around August 23, 2023, and indicated a location in Italy.

Pivoting on the email also led to another company, "Fospat," with multiple Amazon products and the same trademark lawyer, "Anson."

Reverse Image Searches: Brands and watches from "Rxing Eggs" and "Fospat" appeared very similar, suggesting they are likely the same product under different branding.

Summary of OSINT Findings: Multiple company names, a UK-based WhatsApp number, Italian location claims, questionable emails, a "Dr. Schmidt," and associated apps were found.

Hardware Analysis

Purchase: The smartwatch was purchased for deeper analysis as OSINT alone was insufficient.

FCC ID: An FCC ID was found, which is required for devices emitting RF signals in the US.

Manufacturer and Import Data: A manufacturer was identified, and European import groups were found, along with resources like Panjiva and ImportYeti for shipping data.

Product Availability: The specific model investigated was no longer available on Amazon shortly after purchase.

FCC Report Details: FCC reports can provide valuable information, including:

Internal circuit board pictures.

Confidentiality requests from manufacturers.

Names of US importers.

Different model numbers for essentially the same product (e.g., G35 vs. K35), indicating rebranding.

Internal Components: The smartwatch contained common components:

Realtek chipsets (Taiwanese).

Puya Semi chip (Shanghai) for firmware.

LCD screen (difficult to trace due to multiple suppliers).

Bluetooth module from a Shenzhen company.

It runs Android and uses relatively cheap components, consistent with the low price point.

Firmware Extraction: Attempts to extract firmware were challenging, with some mistakes made during the process. The device was powered on by connecting to battery pads.

Bluetooth Analysis: No significant vulnerabilities were found in the Bluetooth communication.

Software Analysis (Android App)

App Functionality: The smartwatch connects via Bluetooth to a smartphone app, which handles data transmission to the internet.

Tools for Analysis:

A Linux Virtual Machine (VM) is recommended.

Obtaining an APK file for the app is necessary.

Mobile Security Framework (MobSF) is highly recommended for its comprehensive analysis capabilities.

AI tools for reverse engineering are emerging but not yet widely used by the speaker.

**App Analysis (DeepFit):

The smartwatch was associated with several apps, including "DeepFit," which was used for analysis.

Concerns were raised about apps targeting children's smartwatches and the data collected.

Permissions: The app requested extensive permissions, including background location and the ability to answer phone calls.

Traffic Encryption: A significant finding was that the app transmitted data in clear text, without encryption, which is considered a major security flaw.

Data Destination: Analysis showed that a lot of the data was sent to infrastructure located in China.

Conclusion and Takeaways

"Cheap is Tempting, Buyer Beware": Consumers often get what they pay for, and low prices can indicate compromised quality or security.

Privacy Concerns: Users should consider the privacy implications of using such devices, especially regarding data collection and transmission.

Due Diligence: Thorough research is crucial, particularly for electronic devices.

Supply Chain Security: The cyber supply chain is a critical and ongoing issue, influenced by geopolitical tensions, shortages, and cost volatility. Digital systems are prone to cyberattacks.

Tool Recommendation: Mobile Security Framework (MobSF) is highlighted as a valuable and accessible tool for app security analysis.