Security researcher Sergei Volokitin has presented findings on hardware vulnerabilities discovered in Xiaomi devices, including the company’s S3 smartwatch, during a presentation at a major cybersecurity conference.

The research was conducted as part of a collaborative security event where researchers and vendors work together to identify and address device vulnerabilities.

The security research was conducted during the conference’s “Hard Pwn” event in November 2024, where independent security researchers gathered to examine various consumer electronics for potential vulnerabilities.

The event, which takes place annually in the Netherlands and the United States, brings together security experts and device manufacturers in a collaborative environment focused on improving hardware security.

During the multi-day event, researchers were provided with professional-grade equipment, including soldering irons, heat guns, and oscilloscopes, to conduct their hardware analysis.

The format enables security experts to collaborate directly with vendor representatives to identify vulnerabilities and report findings that can enhance device security.

Xiaomi Smartwatch Hacked

The 2024 event specifically featured Xiaomi products, including Mi Band fitness trackers, smartwatches, headphones, and other consumer electronics. Previous years have seen similar collaborative security examinations of devices from major technology companies, including Meta’s Oculus products and Google’s Nest ecosystem.

Sergei Volokitin, who specializes in low-level security analysis and conducts independent security research alongside bug bounty work and security consultancy, focused their attention on two primary Xiaomi devices during the event.

Initially examining an outdoor camera system, the researcher discovered that recorded footage was stored in plain text format on the device’s file system, allowing potential attackers to recover video content.

The camera analysis revealed additional security concerns beyond unencrypted storage. The researcher identified that security tokens used for backend communication were stored in accessible locations on the device’s file system.

These tokens could potentially be exploited by attackers who gain physical access to the device. Both vulnerabilities were reported to Xiaomi, and the company acknowledged the security findings.

Following the camera research, the security expert shifted focus to Xiaomi’s S3 smartwatch, noting that the device presented interesting security challenges due to its limited third-party application support.

Modern smartwatches, the researcher explained, function similarly to smartphones with restricted capabilities but still handle sensitive user data, including text notifications, calendar information, fitness and health metrics, and payment card data for contactless transactions.

The smartwatch also supports Bluetooth connectivity for phone integration and NFC capabilities for both payments and device unlocking features with Xiaomi smartphones. This combination of sensitive data access and multiple connectivity options makes such devices attractive targets for security research.

The research highlights the increasing importance of hardware security in consumer electronics, particularly for devices that users carry daily and may lose or have stolen.

Unlike stationary devices in secure environments, wearable technology faces unique security challenges due to its portable nature and the sensitive personal data it stores and processes.

The collaborative approach demonstrated at HardPwn represents an industry trend toward proactive security research, where manufacturers work directly with security researchers to identify and address vulnerabilities before malicious actors can exploit them.

This partnership model allows for responsible disclosure and security improvements that benefit all users of these increasingly connected devices.

Meet the cyber warriors Who Stopped the WannaCry Ransomware attack => Free Live Webinar

The post Xiaomi Smartwatch Hacked Using Touch Point to Find Unlock PIN coordinates appeared first on Cyber Security News.