Surveillance app mSpy exposes millions of customers' personal information, second major leak in three years
By
Monitoring app provider mSpy has revealed that passwords, call logs, messages, contacts, location information, and more from millions of its paying customers have been leaked. This is the second time in the past three years that mSpy has had its users' personal information leaked.
For 2nd Time in 3 Years, Mobile Spyware Maker mSpy Leaks Millions of Sensitive Records — Krebs on Security
https://krebsonsecurity.com/2018/09/for-2nd-time-in-3-years-mobile-spyware-maker-mspy-leaks-millions-of-sensitive-records/
Security researcher Nitish Shah discovered an open database that allows users to query both transactions made on the mSpy website and the information that the mSpy software has collected from mobile phones.
The database, which was taken offline and unavailable at the time of writing, contained information including usernames, passwords, and private encryption keys for millions of mSpy users, and was made public by someone who had illegally released the information. The private encryption keys could allow anyone to track details of any mobile device running mSpy software.
The database also contained Apple iCloud account names, authentication tokens, and iCloud backup files. Shah said he was also able to view Whatsapp and Facebook messages uploaded by mobile devices with the mSpy software installed.
Other information stored in the database included customer names, email addresses, addresses, payment amounts, and transaction details for mSpy licenses purchased over the past six months. The exposed data also included logs of mSpy users, including browser information and IP addresses of users who visited the mSpy website.
Shah reported the leak of user information to mSpy, but was ignored by the company's support staff. After that, security blog Krebs on Security alerted mSpy, and finally received a call from mSpy's head of security. mSpy's head of security, who goes by Andrew, claims that mSpy's security is flawless, saying, 'We have worked hard to protect our systems from hacks, attacks, and personal information leaks. All customer accounts are securely encrypted and data is erased within a short period of time.'
mSpy was previously hacked in May 2015, when customer data was published on the dark web . At the time, many users realized that mSpy's database had been hacked from the data published on the dark web, but mSpy did not acknowledge the fact that it had been hacked for over a week. After that, mSpy finally admitted that it had been hacked, explaining on the BBC that they were the victim of an attack and that 'we have not responded to the financial demands of the blackmailers.'
The official mSpy website reveals that it has offices in the US, Germany, and the UK, but does not list their locations. However, website registration records reveal that mSpy is connected to a UK company called MTechnology LTD, which no longer exists.
According todocuments obtained from Companies House, the official registrar of British companies, mSpy's founding members are listed as programmers Aleksey Fedorchuk and Pavel Daletski. The documents reveal that Daletski is a British citizen and Fedorchuk is of Russian origin, but neither man could be reached for comment, Krebs on Security wrote.
mSpy is the most powerful monitoring app.
https://www.mspy.jp/
Court documents from a trademark dispute between mSpy and rival Retina-X Studios remain in the District Court of Jacksonville, Florida, and state that mSpy is based in Mountain View, California, and that Daletski is a member of the Bitex Group.
Krebs on Security writes that 'U.S. regulators and law enforcement agencies have not been paying much attention to companies that provide mobile spyware services like mSpy,' but in September 2014, U.S. authorities arrested Hamad Akbar, CEO of StealthGenie, a company that sells spyware apps like mSpy. According to the Department of Justice, Akbar is 'the first person to admit to criminal activity in promoting and selling spyware designed to penetrate victims' confidential communications.'
mSpy claims that around 40% of its users are parents who are concerned about protecting their children.
Continued
Millions of customer support tickets containing personal data leaked from mobile spyware 'mSpy,' the third time it's been leaked
Related Posts:
