Security flaw in a popular smart helmet allowed silent location tracking

TechCrunch reports that security researcher Ken Munro discovered a flaw in Livall’s ski and bike helmet apps where six-digit numeric group codes could be brute-forced, enabling silent joining of groups and exposure of users’ real-time locations and audio; Livall later released app updates introducing alphanumeric group codes, join alerts, and per-user location controls.