“mSpy, the makers of a software-as-a-service product that claims to help more than a million paying customers spy on the mobile devices of their kids and partners, has leaked millions of sensitive records online, including passwords, call logs, text messages, contacts, notes and location data secretly collected from phones running the stealthy spyware,” Brian Krebs reports for KrebsOnSecurity.
“Less than a week ago, security researcher Nitish Shah directed KrebsOnSecurity to an open database on the Web that allowed anyone to query up-to-the-minute mSpy records for both customer transactions at mSpy’s site and for mobile phone data collected by mSpy’s software,” Krebs reports. “The database required no authentication.”
“Before it was taken offline sometime in the past 12 hours, the database contained millions of records, including the username, password and private encryption key of each mSpy customer who logged in to the mSpy site or purchased an mSpy license over the past six months,” Krebs reports. “In addition, the database included the Apple iCloud username and authentication token of mobile devices running mSpy, and what appear to be references to iCloud backup files. Anyone who stumbled upon this database also would have been able to browse the Whatsapp and Facebook messages uploaded from mobile devices equipped with mSpy.”
MacDailyNews Take: So, it seems that this breach only potentially affects mSpy customers and/or devices with mSpy’s software installed.
Much more in the full article here.
MacDailyNews Take: Shockingly an outfit that secretly spies on people seems to be rather lax about privacy and security.
Caveat emptor.
I hope it’s clear that it is foolhardy to place any trust or confidence in a company whose reason for existence is secretly spying on people. Alas, the only customers who can truly “trust” a company like this are those who don’t care about the privacy and security of the device owner being spied upon. – Brian Krebs
This company has a blind spot!
A blind spot even bigger than mine, lol. They thrive off of people’s misstrust of each other, and that’s pretty low. I’m glad the company got this awakening, and hope that the people affected have learned their lesson.
Devin Prater Assistive Technology Instructor certified by World Services for the Blind JAWS certified
>
I shocked, SHOCKED!
Oh dear. What a shame.