“That 6-digit group code simply isn’t random enough,”
Livall’s ski and bike helmet apps have about a million users. A six-digit code was the only thing guarding each group’s live location and audio chat, and Pen Test Partners could brute force every group in minutes. Livall ignored the January 7 report and only moved once TechCrunch called. The founder then refused to pull the apps while the fix was pending. A helmet that broadcasts where you are to anyone with a for loop.