'MSpy' of surveillance application leaks customer information for millions of people, the second large leak in 3 years

by Markus Spiske

" MSpy " providing monitoring application revealed that the password, call record, message, contact information, location information, etc. of the millions of paying customers were leaked. mSpy will leak the user's personal information for the second time in the past three years.

For 2nd Time in 3 Years, Mobile Spyware Maker mSpy Leaks Millions of Sensitive Records - Krebs on Security
https://krebsonsecurity.com/2018/09/for-2nd-time-in-3-years-mobile-spyware-maker-mspy-leaks-millions-of-sensitive-records/

Security researcher Nitish Shah discovered an open database that can query both the transactions done on mSpy's official website and the information mSpy's software gathered from mobile phones.

This database is already offline at the time of article creation and it is unusable, but it seems that data including user name, password, private encryption key etc. of mSpy users are stored, someone It was obvious that the information was disclosed illegally. If there is a "private encryption key" in the public information, anyone will be able to trace the details of the mobile device that is running mSpy's software.

Also, it seems that the database also included Apple's iCloud account name, authentication token, and iCloud backup file. Shah said he was able to view Whatsapp and Facebook messages uploaded from the mobile device that installed mSpy's software.

Other information stored in the database seems to include transaction details when purchasing the mSpy license in the past 6 months, such as customer name, e-mail address, address, payment amount. In addition, the published data also included the mSpy user's log, and it seems that browser information and IP address of the user who accessed mSpy's official site were also written.

Mr. Shah told mSpy the leak of user information, but he seems to have been ignored by the company's support staff. After that, the security blog Krebs on Security warns the mSpy side, after which it will finally get in touch from mSpy's security officer. MSpy's security officer who calls himself Andrew said, "We've worked hard to protect the system against hacking, attacks, leakage of personal information.All customer accounts are securely encrypted, data is encrypted It will be erased in a short period of time ", insists that mSpy's security aspects are perfect.

mSpy has been hacked once in May 2015 and has experience of opening customer data on the dark web . At that time, from the data published on the dark web, many users understood that mSpy's database was hacked, but mSpy did not recognize the fact that it was hacked for more than a week. After that, eventually, I acknowledged that mSpy was hacked, they are victims of attacks and explained on the BBC that "they do not comply with the monetary request of the threater side".

According to mSpy's official website, it is clear that there are offices in the United States, Germany and the UK, but the location is not stated. However, according to the website registration record, it is clear that mSpy is connected to a company called MTechnology LTD in the UK. MTechnology LTD does not already exist.

The founding members of mSpy are written by Aleksey Fedorchuk and Pavel Daletski as being programmers, according to a document obtained from Companies House, the official registration agency of British companies. According to this document, Mr. Daletski is a British citizen, Mr. Fedorchuk is known to be from Russia, but Krebs on Security wrote that neither person could get a comment. I will.

mSpy is the strongest monitoring application.
https://www.mspy.jp/

In addition, court documents when mSpy was brought into a trademark dispute from rival company Retina-X Studios remains in the district court of Jacksonville, Florida, USA, according to which mSpy is based in Mountain View, California In the company, Mr. Daletski says that he is a registered person in the Bitex Group.

Krebs on Security wrote that "Regulators and law enforcement in the United States are not closely watching companies offering mobile spyware services like mSpy", but in September 2014 the US authorities seemed to be mSpy We are arresting Hamad Akbar, CEO of StealthGenie, which sells spyware apps. According to the Department of Justice, Mr. Akbar said that it is the first case to admit criminal activities to promote and sell spyware that invades victims' secret communications.

In addition, mSpy says that about 40% of its users are enthusiastic parents for the protection of children.