CarahCast: Podcasts on Technology in the Public Sector · Carahsoft

Bastille Wireless Threat Detection Podcast Series, Smartwatches

·32 min·1 clip

Researchers found a kids' watch with SMS commands for remote snapshot, wiretap, and location sending.

1. CarahCast: Podcasts on Technology in the Public Sector focuses this episode on Bastille Wireless Threat Detection Podcast Series, Smartwatches. 2. Adrian Sanabria hosts with John Bundy, and both speak as smartwatch users who care about battery life, weather, sleep tracking, and low-friction gadgets. 3. The episode asks whether a smartwatch should be treated as a convenience device, a privacy risk, or a phone-like security problem. 4. Adrian says Apple watches can hand off Wi‑Fi credentials automatically, which shows how much the ecosystem hides from the user. 5. John says smartwatches now resemble mini phones or mini computers, with operating systems, apps, Bluetooth, Wi‑Fi, cellular, NFC, microphones, and sometimes cameras. 6. The discussion separates consumer risk from business risk, and John says the two categories need different threat models. 7. John walks through Wi‑Fi deauthentication frames, spoofed access points, and the 2.4 GHz limit that still matters for many devices. 8. He also notes that WPA3 makes protection against deauthentication mandatory, while older clients and WPA2 deployments still create compatibility trade-offs. 9. Adrian and John connect wearable data to cloud-based exposure by discussing Strava, heat maps, and activity near military facilities. 10. John says that the watch is often only one vector into cloud systems, but the health, sleep, and location data can be personally sensitive. 11. Adrian describes using an Apple Watch as a minimal phone, including cases that turn the watch into a tiny handset with controls. 12. John says that convenience and security trade-offs happen automatically in ecosystems like Apple’s, where Wi‑Fi sharing can occur without explicit setup. 13. The pair discuss clandestine collection in restricted areas, including watches that can record audio, take pictures, or store data for later transfer. 14. John says Bluetooth file transfer can move data around USB restrictions, which matters when a phone is banned but a watch is not. 15. Vendor trust becomes central when they discuss clones, counterfeits, and a storefront run by an ex-colleague that supplied a malicious white-label fitness tracker. 16. John says cheap devices may contain intentional malicious applications or firmware, and he ties that risk to supply-chain uncertainty and 2FA interception. 17. A children’s smartwatch example from around 2020 includes SMS-triggered actions such as remote snapshot, wiretap, and sending location. 18. John says the watch example was patched, but the code names and hidden developer functions still show how much capability can sit inside a wrist device. 19. The tone is technical, practical, and conversational, with Adrian testing examples and John answering in threat-model language. 20. Listeners who care about public-sector security, wearables, or vendor risk will get the most value, while people wanting a casual gadget review may skip it.

As heard by us

A practical review of how wrist-worn devices can slip past phone-focused security policies.

Smartwatches become a credible security blind spot in this opening Wireless Threat Series episode, as Adrian Sanabria and John Bundy look at how Wi-Fi, Bluetooth, cellular service, and sensors widen the attack surface beyond the phone.

Read the full review in PlayNext →

Why you'd press play

Want to test whether your no-phone policy has quietly left the smartwatch loophole open?

Read the full recommendation in PlayNext →

Listen to the show on

Apple Podcasts Spotify

Play clips from this episode More from CarahCast: Podcasts on Technology in the Public Sector