9 ms·
A Hacker Has Wiped a Spyware Company’s Servers
- falcolas 9y agoThis is one of those cases where I probably should feel bad for the company being repeatedly hacked to the point of being ripe for being shut down, but I just can't muster the will right now. If you are in the business of collecting data without users' explicit permission, and can't protect that data from being accessed or deleted, you shoudln't be in business.
- JumpCrisscross 9y agoI wish they had done one more thing: notified everyone on whose devices this software was installed. If someone put this on my phone without my knowledge, I would want to know. (I would also almost certainly sue.)
- lighttower 9y agoYes. I want to see that happen also. But I want to separate the part of me who wants to see fireworks from the "right thing to do" I think we need to think through the technicalities of notifying the hacked people, would they even know what to do with your email? Would they consider it spam or phishing and just delete it l? Assuming you're successful, what societal fallout could result? I don't know the answers to these questions. Ultimately it's similar to emailing the partners of the users of Ashley Madison and sending the user profiles to them. What's the intended outcome?
- falcolas 9y ago> What's the intended outcome? Punitive action against the company who collected the data and lost control of it. Punitive penalties are typically just a monetary fine above and beyond damages, but exposing just how badly they screwed up to the public at large should provide a good financial penalty in addition to doing a public good (a reminder of how much "private" data is not actually private).
- ralphc 9y agoThe definition of "your phone" is what comes into play here. If the parent or abusive spouse pays for the phone, it's not "your phone", it's theirs, and can put what they want on it.
- wlll 9y agoI feel like this is a better way of putting it: "If you are in the business of collecting data without users' explicit permission you shoudln't be in business."
- yorby 9y agoHalf of the internet economy would probably disappear... for the better.
- TylerH 9y ago> If you are in the business of collecting data without users' explicit permission, or a warrant from a court, you shouldn't be in business. Fixed that for you
- ric2b 9y agoBut where would all the mathematicians go?
- stryk 9y ago> " Friday morning, after the hacker told us he had deleted much of Retina-X’s data, the company again said it had not been hacked. " I have to admit that, despite all the seriousness of the actual SPYware this obviously terrible company sells, that one sentence brightened up my normal depressing morning experience of reading the weekday morning news on the Internet. That's just funny.
- nodesocket 9y agoHow is this even possible that a 3rd party application can intercept all text messages, call history, and photos and still get published to the Android Play Store? Ins't Google supposed to be reviewing the apps?
- HarryHirsch 9y agoIsn't Google supposed to be reviewing the apps? The real question is: who gets to say in what someone's phone is going to be doing: the programmer, the manufacturer or the phone's owner. Most everyone would agree that the owner should have a word in it, and that the manufacturer should have no say at all. Germany takes another approach: no one gets to do surveillance outside strict limits, privacy is highly regarded over there. The Guardian reports: https://www.theguardian.com/technology/2017/nov/18/germany-bans-childrens-smart-watches-over-surveillance-concerns https://www.theguardian.com/technology/2017/nov/18/germany-b...
- nodesocket 9y agoUnfortunately most phone owners are unaware of technical details, security, and privacy implications. I'd argue Apple has the right approach with their heavy handed reviews and security model.
- greglindahl 9y agoA better question is how can we give the owner a say without the typical owner getting pwned roughly 100% of the time? Which is what's happening on Android at the moment.
- HarryHirsch 9y agoSomeone invoking "personal responsibility" usually means that they try to drop their responsibilities on someone else, but for car maintenance it actually works. People know they should change tires when they are getting bald and leave brake maintenance to their mechanic unless they really know what they are doing. Anyone who gives a game access to their contacts really had it coming to them. (Disclaimer: don't own a smartphone)
- andrewflnr 9y agoThey stored the master key to their entire data store in a publicly distributed app? > ...we have been taking steps to enhance our data security measures. Sharing details of security measures could only serve to potentially compromise those efforts. Maybe they used ROT13 on the API key twice this time!
- deleted 9y ago[deleted]
- kuschku 9y agoThis is a common issue, and many apps do this mistake. Another common mistake is having /.git/ available on the domain itself, often with PHP sites or backend-less SPAs this is common, giving full access to the source, including those API keys. Even major sites do this – The Hill until recently had their git repo, including API tokens and access keys for everything, publicly available.
- bshacklett 9y agoIt should be mentioned that none of that should ever make its way into a Git repo in the first place. If a secret is committed to Git, it's compromised, period. Suck it up and generate a new secret.
- cat199 9y agoonly if your git is published.. I assume this is what you mean - that said: separate integration repo containing encrypted keys + separate, manual managment/configuration of the decryption process is fine for most cases. but yes, bare and in mainline and published, I will agree this is terrible. see also: http://docs.ansible.com/ansible/2.4/vault.html http://docs.ansible.com/ansible/2.4/vault.html
- shkkmo 9y agoNo, you should never commit your secrets, not even to a private github repo, and not even to a privately hosted git server. Doing so increases your attack surface, sometimes in surprising ways. Now, if your secrets are encrypted before being committed (using something like ansible vault) and the encryption key is not stored in the repo, that may be ok. However, you still need to be aware that any time you rotate that key, you also should to rotate every secret hidden behind that key.
- jim_dow_jones 9y agoI see no reason to praise the hacker. He destroyed a legitimate company's private data for no purpose other than his flawed moral reasoning. The company provides a way for parents to monitor their children and other legitimate business practices. Obviously, the software can be used for nefarious purposes but so can almost any other software. U.S. representatives and senators try to ban encryption using the same exact flawed reasoning.
- larrik 9y agoThey also store extensive sensitive data and media about/from/with children with piss poor security. Is that not unambiguously bad?
- jim_dow_jones 9y agoTheir security was bad, no doubt. I don't see how that justifies deleting their data, though.
- stryk 9y ago??!? Their 'data' includes all the photos YOUR KIDS take on their phones. Do you not realize how much absolutely idiotic shit kids do with their smartphones these days? Which they store in an an obviously unsafe way, as evidenced by the fact that they've been hacked via a super-super-super obvious software flaw... twice (that was widely reported on, most likely many more times). They deserve, and they should get, no sympathy. They sure as shit don't deserve to make any money off of it.
- jim_dow_jones 9y agoYou know what other services have data that contains photos of your "YOUR KIDS"? Google, Facebook, Amazon, Apple, Microsoft, Sony, Photobucket, and pretty much every other tech company with hosting services. If these companies get hacked, do they deserve to have their data deleted? The answer is no.
- erikrothoff 9y agoI'm torn by a lot of things here. The validity of the claims in the article, the correctness of the hacker to simply delete data, but also the "stalkerware" as described by the article. Surely there's got to be a better way of dealing with this atrocious software? How can it be legal in the first place?
- JustSomeNobody 9y agoThe software may not be illegal, but particular uses of the software are. I think[0] I prefer it that way less we go down a slippery slope of deciding what software should be legal vs illegal. [0] And do please try and convince me if I should think differently about this.
- JumpCrisscross 9y ago> The software may not be illegal, but particular uses of the software are If you profit from selling software that is predominantly used for illegal purposes, or in the course of illegal activities, and you know it; you should be liable. Not put in jail. Not shut down. Just commercially liable. This is a conservative test (commercial sale, predominantly illegal use, and wilfulness) and a conservative solution. In the long run, however, it balances commercial incentives with broader social ones.
- HarryHirsch 9y agoWe put thieves into prison because if theft were common it would increase distrust, society as a whole has an interest to fight theft, and we permit victims to sue the for restitution. In the same way society has a reason to put strict limits on surveillance. There's the other problem: what damages can someone with a spy app on their phone ask for? There is no monetery value, they can at most ask for relief, that's not much of an incentive to stop.
- JumpCrisscross 9y ago> We put thieves in prison...In the same way society has a reason to put strict limits on surveillance On one hand, we have a stylised burglar. On the other, a stylised lockpicking tool maker. The former is illegal; the latter is more complicated. I am conservative about expanding the scope of the law. You criminalise surveillance apps in one decade and in the next, a security researcher disclosing a bug gets bitten. > what damages can someone with a spy app on their phone ask for? If someone snooped on my phone without my permission, they would see a lot of confidential client information. They may also see my and my loved ones’ protected health information. Finally, they will have sought and procured illicit access to my device, which is itself illegal. Lots of potential monetary damage in there, if only in legal time to ensure everyone who needs to be notified gets notified.
- Thriptic 9y agoI'm always amazed that people feel the need to utilize these products. People are aware that trust is the bedrock layer of relationships right? The minute someone installs this product, their relationship with the person they are monitoring is already over, they just don't know it yet.
- sosborn 9y agoI get what you are saying, but there can be legal/financial concerns attached to these things.
- Digit-Al 9y agoNo, they are not aware that trust is the bedrock layer in a relationship. In the same way that people who verbally or physically abuse their spouses are unaware. They are filled with an all consuming jealousy that makes any violation of privacy seem justifiable to them. These are not people who are thinking rationally or sensibly.
- cortexio 9y agowould read, but then again, vice.com... no thanks
- JumpCrisscross 9y agoDoes anyone maintain a list of such software vendors? Not much we can do if they’re overseas. But I’m curious about exploring the limits of their liability if they’re based in the United States or Europe.
- Nicksil 9y agoIt seems there's an attempt to quell customer discussion via locking such a thread on their forum[0]. A particularly upset customer's remarks[1]. [0] https://forums.flightsimlabs.com/index.php?/topic/16236-further-information-request-please/ https://forums.flightsimlabs.com/index.php?/topic/16236-furt... [1] https://forums.flightsimlabs.com/index.php?/topic/16236-further-information-request-please/&tab=comments#comment-123979 https://forums.flightsimlabs.com/index.php?/topic/16236-furt...
- click170 9y agoThis is exactly why I don't bother with forums controlled by the company I wish to raise a grievance about. Just go air your complaint on Reddit or something they don't control, it's not worth your time complaining to their forums.
- jlgaddis 9y agoFYI, you posted your comment on the wrong thread.
- Nicksil 9y agoOh man, you're absolutely right. Doesn't look like I can delete it, either. Very sorry, everyone! I had one too many tabs open it seems.
- jjnoakes 9y agoWhat's the connection between Flight Sim Labs and Retina-X?
- quadrangle 9y agoThis is a good case of vigilante justice, but vigilantism is problematic in general. We should probably be formally outlawing the sort of practices these companies have and also putting in place far stronger real privacy measures for all data-collecting companies. Until (if ever) the law catches up, vigilantism will be better than nothing.
- CodeWriter23 9y agoWe already have such laws in the US. Two-party consent wiretapping laws at the state level and the Computer Fraud and Abuse Act at the Federal Level.
- nitrogen 9y agoMany states only require single-party consent, but third-party spyware violates that, too.
- quadrangle 9y agoI don't know exactly the legal details, but over the past several years "privacy policies" have evolved into some sort of "data use policies" (with no privacy to speak of) and the norm is to use terms on apps to basically give companies access to the most invasive and abusive stuff, and we don't see the legal system doing anything to stop this, as long as it isn't directly in medical or legal contexts…
- CodeWriter23 9y agoAgreeing to surrender your privacy, even when through a clickwrap agreement that is subject to change without notice is very different from installing spyware on someone else’s phone.
- trisimix 9y agoRighteous
- mrtweetyhack 9y agoShould expose the data online leaving the companies being sued for millions
- tmnvix 9y ago> “Retina-X Studios is committed to protecting the privacy of its users...” That's rich. The 'users' in this case are not necessarily the people with this appalling software installed on their device.
- LordKano 9y agoNot all heroes wear capes.
- roflchoppa 9y agoDamn PB way to be a thug about it; now this is hacking, not that bs marketing term.
- Bushdavison 9y agoThis might not directly answer your question but i’m sure it would help you a lot.. No one deserves to be cheated on, especially when your full loyalty lies with the betrayer of your trust. Initially, I thought I was just feeling insecure when my wife would just be on her phone at odd hours, until I decided to take a chance to know, knowing is better than self doubts and it was exactly what happened when I employed the services of this particular guy(MASTERSHIELD55@GMAIL .COM) I came across by chance to help check her phone out thoroughly. Now I know when she’s telling the truth and how to curtail her, I think it is not a drastic step if it'll make you feel better. My life got better, I stopped using my precious time to bother about her indiscretions and channeled my energy positively. His services includes: phone call hacks,messages,contacts,social media(viber, whatsapp,facebook, kik e.t.c),emails,Gallery and videos hack,gps location tracking,calendars and reminders.. You can reach him through his email or on WhatsApp Messenger +1 (628) 203 7309 .