Is Your GPS Tracker's Data Secure? 7 Questions to Ask Any Vendor

In 2022, CISA published an advisory on a GPS tracker used in roughly 1.5 million vehicles across 169 countries: a hard-coded master password let an attacker send SMS commands as if they were the device owner -- including remotely cutting fuel to the vehicle. The vendor ignored CISA's disclosure attempts. If your tracker has a kill switch, its security isn't a side issue. It's your fleet's security.

Why this matters more for a rental fleet

A consumer tracker on one car is a privacy risk. A fleet tracker with remote lock, unlock, and kill commands is remote control over your entire business -- compromise it, and an attacker can locate, follow, and immobilize cars that have paying guests in them, or lock out a legitimate host. The questions below apply to any vendor, including us.

Seven questions to ask any GPS tracker vendor

1. How is app and API access authenticated?

A good answer sounds like OAuth 2.0 with an authorization-code flow and token revocation, so an app never sees or stores your actual password. A red flag sounds like a shared password or an SMS command interface with no per-user authentication -- the exact design that failed in the 2022 case above.

2. Can access be revoked instantly, per user?

If a co-host or employee leaves, you need to cut their access the same day, not wait for a vendor support ticket.

3. Does the vendor actually respond to vulnerability reports?

The vendor in the CISA case didn't. That alone should be disqualifying for any security-conscious buyer.

4. Is data encrypted in transit, and who can see your location history internally?

HTTPS/TLS in transit is table stakes. Ask specifically who inside the company can access raw fleet location data and why.

5. What's the data retention and sharing policy?

How long is your location history kept, and is it ever sold or shared with third parties?

6. Can the device be commanded by SMS?

Legacy SMS command channels are exactly the kind of hard-coded-password-prone design that caused the 2022 incident. A modern system shouldn't need one.

7. What happens if the vendor's service goes down?

Do you lose access to your own cars entirely, or is there a local fallback? This is a genuinely good question to ask any vendor, including MooveTrax.

How MooveTrax answers the ones we document

We'll only claim what's actually published: MooveTrax's API uses OAuth 2.0 authorization-code flow with refresh tokens, so a connected app never stores your account credentials directly. For availability, MooveTrax's Bluetooth backup lets the lock/unlock handoff keep working at the vehicle itself even when cellular or cloud connectivity is unreachable -- see the full Bluetooth backup breakdown. The kill switch itself is wired Normally Closed in the starter circuit, which is a physical tamper-resistance property, not a software one -- see the full wiring explanation.

We don't claim a specific security certification or encryption standard beyond what's documented above -- if that matters to your fleet, ask us the rest of these seven questions directly. That's exactly the point of this list: ask any vendor, including us, before you trust them with remote control over your cars.

See the full API documentation, or the complete Turo host security guide.

Sources: CISA Advisory ICSA-22-200-01 (MiCODUS MV720 GPS tracker vulnerabilities, July 2022); BitSight Technologies vulnerability research; moovetrax.com/free-gps-tracker-api; moovetrax.com/bluetooth-backup-unlock.