16 ms·

Spyware Company Leaves ‘Terabytes’ of Selfies, Messages, Location Data Exposed

356 points by wglb 8y ago

0xCMP 8y ago
Well at least this company is trying to solve the problems! So many times this ends up with the company attacking the researcher.
MichaelApproved 8y ago
> “Every day our team takes great strides to enhance our site’s security and we certainly anticipate that this recent data breach is the last,” McBroom said. Holy shit. They left an Amazon S3 bucket wide open, their admin site was wide open, and their API stream of contacts was wide open. Their concept of secuity is non-existant and they think this will be the last breach? I doubt you'd hear any competent IT director ever say they won't experience data breaches in the future. The incompetency is mind boggling.
- retSava 8y ago
  The embodiment of an oxymoron :) The concept of "incompetent and unaware of it" comes to mind. Edit: the Dunning-Kruger effect, https://en.wikipedia.org/wiki/Dunning%E2%80%93Kruger_effect https://en.wikipedia.org/wiki/Dunning%E2%80%93Kruger_effect
  - zentiggr 8y ago
    Unknown unknowns?
  - vanderZwan 8y ago
    > The concept of "incompetent and unaware of it" comes to mind. Well, I see that you also invoked Hanlon's Razor. I don't know if I want to give these guys that benefit of doubt - I think they genuinely don't care. Mainly because if they did they had those kinds of standards to begin with, I would expect them to also have the kinds of standards that would make it unlikely to be in this line of business. [0] https://en.wikipedia.org/wiki/Hanlon%27s_razor https://en.wikipedia.org/wiki/Hanlon%27s_razor
- jakeywankenobi 8y ago
  Yeah. I mean, at what point does this level of neglect become criminal?
  - MichaelApproved 8y ago
    In the US? No time soon. The party in power is cutting regulations, not adding them. The customer has to watch their own back. It seems simple. The free market will kill incompetent companies, right? Customers see data breaches and stop doing business with them. Sounds good in theory but realistically, customers don't have time to do the research required for a completely free market to self regulate.
    - emodendroket 8y ago
      It's not clear how I, an individual consumer, even choose to avoid doing business with Equifax.
      - bluGill 8y ago
        You could make sure you put on all loan applications that they will not check Equifax. Probably they won't even know how to handle that though and will either reject you, or ignore it.
      - dv_dt 8y ago
        Don't do business with them is a bogus missive, but you could lock your credit with all the agencies and only unlock the agencies you care to do business with when requested. But that often makes things difficult and not all users of that data will have an account with an alternative provider. (nor is the locked access the only product for which your data is offered...)
    - FilterSweep 8y ago
      It has less to do with research, even. Equifax, like many Fortune-N companies, has a heavily funded sales and PR team working actively against your individual research. Should you, as an individual, apply to a company or attempt to buy a product that has been “sold” the Equifax product suite, you’re still beholden to Equifax services(or leave without the job or house). You’re effectively stuck, unless you have the resources(time/money) to look for employers or products that stay away from Equifax.
- benatkin 8y ago
  AWS might be partly to blame, for not warning them, actively or passively, in my opinion. It might just be infrastructure as a service, but it seems that major cloud providers like AWS act as an IaaS provider when convenient, and a PaaS when convenient. They censor content all the time. I don't think it would be too much to ask to send an email when a big security change is made (the emails and audit log GitHub provides for its users are great). Plus their interfaces (UI and command line) are clunky. They should have a non-clunky dashboard of some sort where people can get a broad level overview of their security choices. I'm not talking legal blame for the past mistake, just that at some point in the near future their IAM interface should be fixed. For one thing it should be easy to give permissions to view the permissions without giving keys to the kingdom. For another thing, there's a mental overhead to working with multiple AWS accounts [1]. I get the impression that Google Cloud Platform is ahead right now (while lots of other Google properties are not, heh). Edit: the spyware company is absolutely to blame, but the complexity of AWS permissions including permission to view the permissions seems like a footgun to me. However, leaving open the admin site is something I wouldn't expect AWS to help with. https://engineering.coinbase.com/you-need-more-than-one-aws-account-aws-bastions-and-assume-role-23946c6dfde3 https://engineering.coinbase.com/you-need-more-than-one-aws-...
  - ryanmarsh 8y ago
    AWS defines a pretty clear delineation of responsibilities. They are responsible for security of the cloud, you are responsible for security in the cloud. https://aws.amazon.com/compliance/shared-responsibility-model/ https://aws.amazon.com/compliance/shared-responsibility-mode... I’ve not seen AWS censor content, although I’m sure some cases might warrant it. That has nothing to do with a company that was negligent. I don’t find AWS’ UI or command line clunky at all. In fact I find them clearer than most Unix tools. It is not hard to know if you have world readable buckets in S3. They should have a non-clunky dashboard of some sort where people can get a broad level overview of their security choices. The AWS CLI allows you to easily pull the policy data attached to any resource and you can process it however you choose.
    - mehrdadn 8y ago
- ryandrake 8y ago
  Its hollow, phony Corp-Speak. Just like the “We at Company X take Y very seriously.” PR statement that always gets made right after Company X is caught not taking Y seriously.
zentiggr 8y ago
Well, they may as well set up a website with subpages per spyed device, and per device's collected content types, and just make it official that they are publishing third party information to the whole f*ing world. Wow. And their customers are likely not going to know enough or care enough to realize how much privacy they've lost.
- gnode 8y ago
  > how much privacy they've lost You mean that those who they've been spying on have lost?
samstave 8y ago
The copy on that "EULA" is in poor English. Also, anyone who uses an app/service like this, and that service has the word "spy" in their company/product name deserves to have their data and identity compromised.
- bmarkovic 8y ago
  Perhaps. But those that they spy on (spouses, children, employees..) don't.
  - MichaelApproved 8y ago
    Not even perhaps. Stop blaming the victims.
EthanHeilman 8y ago
>Steve McBroom, a Spyfone representative, told Motherboard on Monday that the company is investigating the leak, and expressed relief that the person who found it had good intentions. Unlike spyfone whose intentions appeared to be profiting off of violating the privacy of others. I wonder if they have done the market research to determine if their core demo is domestic abusers.
- 8_hours_ago 8y ago
  SpyFone can only be used with consent of the device owner. From the Terms of Use (https://spyfone.com/terms-of-use/ https://spyfone.com/terms-of-use/): "You will only install the SpyFone software on devices for which you are the owner, or on devices for which you have received consent from the owner of the device." Their service cannot be used by domestic abusers, obviously. (sarcasm)
  - deleted 8y ago
    [deleted]
  - gowld 8y ago
    Google Maps has a location sharing feature. It goes to great lengths to notify the device owner through both on-device and off-device methods that the phone is being monitored, and by whom. That's the only way to run a legitimate monitoring system.
    - bigiain 8y ago
      I'm not sure - given their recent location-privacy related coverage - that Google should be held up as "gold standard" here...
      - m-p-3 8y ago
        At least their Google Maps location sharing is upfront about it.
      - verall 8y ago
teachrdan 8y ago
> “Spyfone appears to be a magical combination of shady, irresponsible, and incompetent,” Eva Galperin, the director of cybersecurity at digital rights group Electronic Frontier Foundation, told Motherboard. Leave it to EFF to have the pithiest quote in the article. Is it possible that companies that are shady are more likely to be irresponsible in their security practices, because they're focused on immediate profit?
- Sharlin 8y ago
  Is it more likely that drug dealers that are shady are more likely to be irresponsible in their safety practices because they’re focused on immediate profit?
  - drewmol 8y ago
    More likely than (drug dealer who are not shady)? Most likely yes.
    - Sharlin 8y ago
      That was the point. "Shady" and "irresponsible" pretty much go hand in hand.
      - dummyfunnytoo 8y ago
        Not necessarily. I'd expect the leader of an organized crime group to be very responsible but shady as hell.
dachshound665 8y ago
Alright, so where's the list of customers then. So far it's all just hear say
- MichaelApproved 8y ago
  Did you bother to read the article? The company admitted fault.
lqet 8y ago
I find this level of incompetence hard to believe. Is it possible that the company knowingly and intentionally left the collected data and their customers list unprotected to secretly channel it somewhere else? It would at least give them the opportunity to state incompetence if they should ever be accused of selling their customers private data on the dark market.
- monksy 8y ago
  It's completely easy to believe. People are releasing crap software under the guise of MVP.
  - twothamendment 8y ago
    MVP - Most vulnerable product? Yeah, it is easy to cut the corners that the public won't notice.
  - keithnz 8y ago
    I watched with fascination on Twitch the other day someone programming a point of sale system, the dev was an older guy who said he'd been programming from 85 and was coding in C# (which is similar to me). First thing that struck me was the file he was editing he had a connection string embedded in the code, with what looked like the real plaintext credentials for the database. I then watched with interest as each query he copy pasted the connection string and other code for querying and then tried to create new queries by appending strings together with variables. I tried to give him some constructive advice, but he said "I'm in a bit of a rush, I just want to get this working". I watched for another 30 minutes or so as he tried to get it working. It was trivial what he wanted to do, he annouced how he hated SQL and has spent years writing sql and huge massive queries. Yet his problem was easily solvable with SQL. Looking at the code, it seems to have been done over quite some time and was really really really bad and really insecure. But the "just need to get it done any way possible" attitude means it will get deployed like that.
    - monksy 8y ago
      In a nutshell .. that's what the whole MVP thing is about. The minimal you have to do so business can sell immediately.
ChuckMcM 8y ago
Wow, S3 is the gift that keeps on giving. My favorite quote from the article: “Spyfone appears to be a magical combination of shady, irresponsible, and incompetent,” Amazing how people don't lock down S3 data.
- lapnitnelav 8y ago
  Started playing around lately with AWS. Gosh, getting the access rights to work properly between the various types of controls in place, whether it's the groups, the access policy and whatnot is kind of mind numbing and makes you feel very stupid. Not that it excuses anything but it is confusing and I can foresee an overworked engineer going "Ah fuck it, no time to read up on that, just go for the easiest stuff to get started on using S3".
  - ChuckMcM 8y ago
    That is exactly the problem I see as well. Basically it is so hard to get it working "correctly" (and by that we mean in a way that isn't trivially exposed to the full frontal Internet), that engineers under pressure just punt after getting it to work at all. Sort of "Ok, here it is working, we'll fix the security concerns later, in the mean time try it out." and they get swept into another project because this part is "working" and nobody comes back to to do the hard work of figuring out the right way to make it work. As a result 'war driving' through the S3 namespace continues to yield up PII, and CUI nuggets of gold to bad actors.
  - duxup 8y ago
    Just AWS's UI confuses me sometimes....
- 3pt14159 8y ago
  The S3 docs / error responses are so annoying. Very basic questions could be answered with simple examples, but it's almost like they go out of their way to make it hard to do the right thing. If you give me a couple dozen developers, all of whom has never had to deal with: 1. S3/AWS 2. BackBlaze/B2 3. DigitalOcean/BS/Spaces And you made a graph for how long it took to do different tasks I would be able to tell which people were assigned to S3 from across the room.
caymanjim 8y ago
I'm not sure that this discovery will have any effect. While there are claims that this software is marketed to businesses, I'm skeptical that it's anything more than a drop in the bucket compared to use by shady individuals. Non-business users (like nosy parents and controlling spouses) probably won't ever know about this security breach. I have no sympathy for anyone who uses software like this, I strongly feel there is no justification for software like this that outweighs the invasion of privacy and other harms, and I don't think this functionality should even be possible at the phone OS level, nor should it be allowed for sale in application stores. The security failure itself isn't surprising in the least, though. Only bad people write this kind of software. They've already limited their pool of potential hires to people with no ethical or moral standards. Also, look at the image in the article containing the description of SpyFone. They can't even perform basic copy-editing. Poor grammar in commercial products is a solid barometer for overall product quality.
- occamrazor 8y ago
  BTW every reputable company has server-side auditable logs and relies on phone apps only to wipe mobile devices or bulk install/uninstall apps.
- gowld 8y ago
  Agreed. The app's intended design purpose was to leak private data. The data breach happened as soon as the software was installed; the exposed S3 bucket is irrelevant.
  - anfilt 8y ago
    Doesnot mean the people targeted by software fair any better with such data leaked on the internet.
- scarface74 8y ago
  I have no sympathy for anyone who uses software like this, I strongly feel there is no justification for software like this that outweighs the invasion of privacy and other harms, and I don't think this functionality should even be possible at the phone OS level, nor should it be allowed for sale in application stores. Most of these features aren’t available on iOS. From what I can tell, you have to know thier iCloud credentials and be in a position to do the 2FA.
komali2 8y ago
>Motherboard was able to verify that the researcher had access to Spyfone’s monitored devices’ data by creating a trial account, installing the spyware on a phone, and taking some pictures. Hours later, the researcher sent back one of those pictures. I love that they told us exactly how they verified it. Too often in the news do we just get "was verified" or "an independent source verified," which, I get that you gotta protect sources, but still doesn't give any insight into their methodology. I could ask for example "how do you know you can trust your independent source?" because I have no idea their history together. Tech news like this is a bit easier to actually show your work for, but even when that's the case so many security articles or people on Twitter don't show the money like this. As much as everyone likes shitting on bitfi, for example, it was quite a while before someone actually demonstrated a hack was done, with reproducible methodology, rather than just blow smoke about how it's insecure.
- snissn 8y ago
  I was very loosely following the bitfi drama on twitter - and it seemed like the same day that the bitfi devices actually arrived to the public people were posting exploits (as i recall)
- adtac 8y ago
  IMO, you don't trust the independent source, you trust the journalist. Naturally, you'll only trust journalists who have proven to be right most of the time.
aaroninsf 8y ago
It's not a "breach" when there were no defenses.
Yhippa 8y ago
> Steve McBroom, a Spyfone representative, told Motherboard on Monday that the company is investigating the leak, and expressed relief that the person who found it had good intentions. >“Thank god it is a researcher, someone good trying to protect,” McBroom said in a phone call. Mr. McBroom needs to be worried about people with ill intentions who have accessed this data in the past and they have no idea about. Given this is a routine S3 bucket access breach I'd assume lots of bad people have rainbow dictionary found this by now. You can assume people are basically doing that for public buckets all the time now.
- sorokod 8y ago
  "Thank god..." It is most reassuring when divine entity is invoked especially in a data breach context. Especially when the intervention is of a monotheistic kind.
automathematics 8y ago
"Wait, hiring a security guy is how much? Fuck that... How much is a Senior engineer to make our API? .... Shit. That would definitely cost me my third corporate lease... How much to hire those kids that emailed us out of the blue? Yeah, I'm sure they'll do a fine job, just hire them.
lion121 8y ago
„Every day our team takes great strides to enhance our site’s security and we certainly anticipate that this recent data breach is the last,” Yeah, granting public access to s3 buckets sounds like a great effort to enhance data security
zinssmeister 8y ago
Incredibly difficult to even figure out who the company behind Spyfone is. Anyone know?
jenscow 8y ago
The most unfortunate side, is that the data isn't exactly that of their customers.
calimac 8y ago
Who is gaurding the hen house n these companies? Experian Target Spyfone ????
deleted 8y ago
[deleted]
auslander 8y ago
Spyfone Supported devices: - Android operating system must be Android 4.0 or higher. - iOS operating system must be iOS 7 to iOS 8.4 or iOS 9.0 to 9.1 (Oct 2015) Just make sure your target is not using iPhone :) https://spyfone.com/compatibility-policy/ https://spyfone.com/compatibility-policy/
xupybd 8y ago
Spyfone's response: "Dear Valued Customers of SpyFone.com, Within the last 10 days, one of our servers experienced a data breach and an unauthorized third party gained access to the data of approximately 2,200 customer accounts. The potentially exposed personal information of those affected could include pictures, call logs, and emails. While our team is taking steps to enhance our site’s security and we have since taken action to ensure that all accounts are fully encrypted, we are notifying you that your account may have been one of those negatively impacted by the unauthorized access. In an evolving landscape of online threats, SpyFone.com is committed to the highest standards of accountability and transparency, and proactively works to ensure the safety and security of our users. We will continue to work to address this matter as we partner with leading data security firms to assist in our investigation, and coordinate with law enforcement authorities."
scarface74 8y ago
First the requirements for installing it on Android phones is a lot less.... Android Requirements: You Need Physical Access To Device For Install Supports Android Versions (4.1 - 8.1+) iOS Requirements: If 2 factor is on you need physical access to device iCloud login access is required Then look at the features.... https://spyfone.com/features/ https://spyfone.com/features/ It says a lot about Android that anyone with physical access to an unlocked phone can put this type of spyware on it. Even if someone does leave their iPhone unlocked long enough for someone to install the app, they still couldn't do it without authorization and even then you have to know the targets iCloud credentials and have physical access to the phone if it has 2FA.
- jiggunjer 8y ago
  The way I see it, it is easier to get your hands on someones iCloud credentials than on an unlocked physical device. So iphone without 2FA is less secure than android. E.g. if I wanted to spy on my partner I'd prefer she had an iphone.
  - scarface74 8y ago
    But you stil have to have physical access to the person phone to install the app. If they can do all they claim they can do on a non jail broken iOS device (and they have a disclaimer that all features don't work on all version of iOS), I would be amazed.
technion 8y ago
Here's the irony: For the last few weeks, my Facebook feed has been plastered with scare stories about certain apps being unsafe for kids. People posting image macros about things like Roblox, getting 50+ responses about how scary it is. This situation, which imo is a real danger, will get 0 attention outside the tech community. I really wish I had an answer. Maybe I should make of this or something in order to make people share it.
jiggunjer 8y ago
My gf was stalked by an ex using this type of crap. Had to wipe her phone and change her cloud credentails. Still worry my personal photos are now floating around on the web.

356 points by wglb 8y ago

Well at least this company is trying to solve the problems! So many times this ends up with the company attacking the researcher.

MichaelApproved 8y ago

> “Every day our team takes great strides to enhance our site’s security and we certainly anticipate that this recent data breach is the last,” McBroom said. Holy shit. They left an Amazon S3 bucket wide open, their admin site was wide open, and their API stream of contacts was wide open. Their concept of secuity is non-existant and they think this will be the last breach? I doubt you'd hear any competent IT director ever say they won't experience data breaches in the future. The incompetency is mind boggling.

retSava 8y ago
The embodiment of an oxymoron :) The concept of "incompetent and unaware of it" comes to mind. Edit: the Dunning-Kruger effect, https://en.wikipedia.org/wiki/Dunning%E2%80%93Kruger_effect https://en.wikipedia.org/wiki/Dunning%E2%80%93Kruger_effect
- zentiggr 8y ago
  Unknown unknowns?
- vanderZwan 8y ago
  > The concept of "incompetent and unaware of it" comes to mind. Well, I see that you also invoked Hanlon's Razor. I don't know if I want to give these guys that benefit of doubt - I think they genuinely don't care. Mainly because if they did they had those kinds of standards to begin with, I would expect them to also have the kinds of standards that would make it unlikely to be in this line of business. [0] https://en.wikipedia.org/wiki/Hanlon%27s_razor https://en.wikipedia.org/wiki/Hanlon%27s_razor
jakeywankenobi 8y ago
Yeah. I mean, at what point does this level of neglect become criminal?
- MichaelApproved 8y ago
  In the US? No time soon. The party in power is cutting regulations, not adding them. The customer has to watch their own back. It seems simple. The free market will kill incompetent companies, right? Customers see data breaches and stop doing business with them. Sounds good in theory but realistically, customers don't have time to do the research required for a completely free market to self regulate.
  - emodendroket 8y ago
    It's not clear how I, an individual consumer, even choose to avoid doing business with Equifax.
    - bluGill 8y ago
      You could make sure you put on all loan applications that they will not check Equifax. Probably they won't even know how to handle that though and will either reject you, or ignore it.
    - dv_dt 8y ago
      Don't do business with them is a bogus missive, but you could lock your credit with all the agencies and only unlock the agencies you care to do business with when requested. But that often makes things difficult and not all users of that data will have an account with an alternative provider. (nor is the locked access the only product for which your data is offered...)
  - FilterSweep 8y ago
    It has less to do with research, even. Equifax, like many Fortune-N companies, has a heavily funded sales and PR team working actively against your individual research. Should you, as an individual, apply to a company or attempt to buy a product that has been “sold” the Equifax product suite, you’re still beholden to Equifax services(or leave without the job or house). You’re effectively stuck, unless you have the resources(time/money) to look for employers or products that stay away from Equifax.
benatkin 8y ago
AWS might be partly to blame, for not warning them, actively or passively, in my opinion. It might just be infrastructure as a service, but it seems that major cloud providers like AWS act as an IaaS provider when convenient, and a PaaS when convenient. They censor content all the time. I don't think it would be too much to ask to send an email when a big security change is made (the emails and audit log GitHub provides for its users are great). Plus their interfaces (UI and command line) are clunky. They should have a non-clunky dashboard of some sort where people can get a broad level overview of their security choices. I'm not talking legal blame for the past mistake, just that at some point in the near future their IAM interface should be fixed. For one thing it should be easy to give permissions to view the permissions without giving keys to the kingdom. For another thing, there's a mental overhead to working with multiple AWS accounts [1]. I get the impression that Google Cloud Platform is ahead right now (while lots of other Google properties are not, heh). Edit: the spyware company is absolutely to blame, but the complexity of AWS permissions including permission to view the permissions seems like a footgun to me. However, leaving open the admin site is something I wouldn't expect AWS to help with. https://engineering.coinbase.com/you-need-more-than-one-aws-account-aws-bastions-and-assume-role-23946c6dfde3 https://engineering.coinbase.com/you-need-more-than-one-aws-...
- ryanmarsh 8y ago
  AWS defines a pretty clear delineation of responsibilities. They are responsible for security of the cloud, you are responsible for security in the cloud. https://aws.amazon.com/compliance/shared-responsibility-model/ https://aws.amazon.com/compliance/shared-responsibility-mode... I’ve not seen AWS censor content, although I’m sure some cases might warrant it. That has nothing to do with a company that was negligent. I don’t find AWS’ UI or command line clunky at all. In fact I find them clearer than most Unix tools. It is not hard to know if you have world readable buckets in S3. They should have a non-clunky dashboard of some sort where people can get a broad level overview of their security choices. The AWS CLI allows you to easily pull the policy data attached to any resource and you can process it however you choose.
  - mehrdadn 8y ago
ryandrake 8y ago
Its hollow, phony Corp-Speak. Just like the “We at Company X take Y very seriously.” PR statement that always gets made right after Company X is caught not taking Y seriously.

zentiggr 8y ago

Well, they may as well set up a website with subpages per spyed device, and per device's collected content types, and just make it official that they are publishing third party information to the whole f*ing world. Wow. And their customers are likely not going to know enough or care enough to realize how much privacy they've lost.

gnode 8y ago
> how much privacy they've lost You mean that those who they've been spying on have lost?

samstave 8y ago

The copy on that "EULA" is in poor English. Also, anyone who uses an app/service like this, and that service has the word "spy" in their company/product name deserves to have their data and identity compromised.

bmarkovic 8y ago
Perhaps. But those that they spy on (spouses, children, employees..) don't.
- MichaelApproved 8y ago
  Not even perhaps. Stop blaming the victims.

EthanHeilman 8y ago

>Steve McBroom, a Spyfone representative, told Motherboard on Monday that the company is investigating the leak, and expressed relief that the person who found it had good intentions. Unlike spyfone whose intentions appeared to be profiting off of violating the privacy of others. I wonder if they have done the market research to determine if their core demo is domestic abusers.

8_hours_ago 8y ago
SpyFone can only be used with consent of the device owner. From the Terms of Use (https://spyfone.com/terms-of-use/ https://spyfone.com/terms-of-use/): "You will only install the SpyFone software on devices for which you are the owner, or on devices for which you have received consent from the owner of the device." Their service cannot be used by domestic abusers, obviously. (sarcasm)
- deleted 8y ago
  [deleted]
- gowld 8y ago
  Google Maps has a location sharing feature. It goes to great lengths to notify the device owner through both on-device and off-device methods that the phone is being monitored, and by whom. That's the only way to run a legitimate monitoring system.
  - bigiain 8y ago
    I'm not sure - given their recent location-privacy related coverage - that Google should be held up as "gold standard" here...
    - m-p-3 8y ago
      At least their Google Maps location sharing is upfront about it.
    - verall 8y ago

teachrdan 8y ago

> “Spyfone appears to be a magical combination of shady, irresponsible, and incompetent,” Eva Galperin, the director of cybersecurity at digital rights group Electronic Frontier Foundation, told Motherboard. Leave it to EFF to have the pithiest quote in the article. Is it possible that companies that are shady are more likely to be irresponsible in their security practices, because they're focused on immediate profit?

Sharlin 8y ago
Is it more likely that drug dealers that are shady are more likely to be irresponsible in their safety practices because they’re focused on immediate profit?
- drewmol 8y ago
  More likely than (drug dealer who are not shady)? Most likely yes.
  - Sharlin 8y ago
    That was the point. "Shady" and "irresponsible" pretty much go hand in hand.
    - dummyfunnytoo 8y ago
      Not necessarily. I'd expect the leader of an organized crime group to be very responsible but shady as hell.

dachshound665 8y ago

Alright, so where's the list of customers then. So far it's all just hear say

MichaelApproved 8y ago
Did you bother to read the article? The company admitted fault.

lqet 8y ago

I find this level of incompetence hard to believe. Is it possible that the company knowingly and intentionally left the collected data and their customers list unprotected to secretly channel it somewhere else? It would at least give them the opportunity to state incompetence if they should ever be accused of selling their customers private data on the dark market.

monksy 8y ago
It's completely easy to believe. People are releasing crap software under the guise of MVP.
- twothamendment 8y ago
  MVP - Most vulnerable product? Yeah, it is easy to cut the corners that the public won't notice.
- keithnz 8y ago
  I watched with fascination on Twitch the other day someone programming a point of sale system, the dev was an older guy who said he'd been programming from 85 and was coding in C# (which is similar to me). First thing that struck me was the file he was editing he had a connection string embedded in the code, with what looked like the real plaintext credentials for the database. I then watched with interest as each query he copy pasted the connection string and other code for querying and then tried to create new queries by appending strings together with variables. I tried to give him some constructive advice, but he said "I'm in a bit of a rush, I just want to get this working". I watched for another 30 minutes or so as he tried to get it working. It was trivial what he wanted to do, he annouced how he hated SQL and has spent years writing sql and huge massive queries. Yet his problem was easily solvable with SQL. Looking at the code, it seems to have been done over quite some time and was really really really bad and really insecure. But the "just need to get it done any way possible" attitude means it will get deployed like that.
  - monksy 8y ago
    In a nutshell .. that's what the whole MVP thing is about. The minimal you have to do so business can sell immediately.

ChuckMcM 8y ago

Wow, S3 is the gift that keeps on giving. My favorite quote from the article: “Spyfone appears to be a magical combination of shady, irresponsible, and incompetent,” Amazing how people don't lock down S3 data.

lapnitnelav 8y ago
Started playing around lately with AWS. Gosh, getting the access rights to work properly between the various types of controls in place, whether it's the groups, the access policy and whatnot is kind of mind numbing and makes you feel very stupid. Not that it excuses anything but it is confusing and I can foresee an overworked engineer going "Ah fuck it, no time to read up on that, just go for the easiest stuff to get started on using S3".
- ChuckMcM 8y ago
  That is exactly the problem I see as well. Basically it is so hard to get it working "correctly" (and by that we mean in a way that isn't trivially exposed to the full frontal Internet), that engineers under pressure just punt after getting it to work at all. Sort of "Ok, here it is working, we'll fix the security concerns later, in the mean time try it out." and they get swept into another project because this part is "working" and nobody comes back to to do the hard work of figuring out the right way to make it work. As a result 'war driving' through the S3 namespace continues to yield up PII, and CUI nuggets of gold to bad actors.
- duxup 8y ago
  Just AWS's UI confuses me sometimes....
3pt14159 8y ago
The S3 docs / error responses are so annoying. Very basic questions could be answered with simple examples, but it's almost like they go out of their way to make it hard to do the right thing. If you give me a couple dozen developers, all of whom has never had to deal with: 1. S3/AWS 2. BackBlaze/B2 3. DigitalOcean/BS/Spaces And you made a graph for how long it took to do different tasks I would be able to tell which people were assigned to S3 from across the room.

caymanjim 8y ago

I'm not sure that this discovery will have any effect. While there are claims that this software is marketed to businesses, I'm skeptical that it's anything more than a drop in the bucket compared to use by shady individuals. Non-business users (like nosy parents and controlling spouses) probably won't ever know about this security breach. I have no sympathy for anyone who uses software like this, I strongly feel there is no justification for software like this that outweighs the invasion of privacy and other harms, and I don't think this functionality should even be possible at the phone OS level, nor should it be allowed for sale in application stores. The security failure itself isn't surprising in the least, though. Only bad people write this kind of software. They've already limited their pool of potential hires to people with no ethical or moral standards. Also, look at the image in the article containing the description of SpyFone. They can't even perform basic copy-editing. Poor grammar in commercial products is a solid barometer for overall product quality.

occamrazor 8y ago
BTW every reputable company has server-side auditable logs and relies on phone apps only to wipe mobile devices or bulk install/uninstall apps.
gowld 8y ago
Agreed. The app's intended design purpose was to leak private data. The data breach happened as soon as the software was installed; the exposed S3 bucket is irrelevant.
- anfilt 8y ago
  Doesnot mean the people targeted by software fair any better with such data leaked on the internet.
scarface74 8y ago
I have no sympathy for anyone who uses software like this, I strongly feel there is no justification for software like this that outweighs the invasion of privacy and other harms, and I don't think this functionality should even be possible at the phone OS level, nor should it be allowed for sale in application stores. Most of these features aren’t available on iOS. From what I can tell, you have to know thier iCloud credentials and be in a position to do the 2FA.

komali2 8y ago

>Motherboard was able to verify that the researcher had access to Spyfone’s monitored devices’ data by creating a trial account, installing the spyware on a phone, and taking some pictures. Hours later, the researcher sent back one of those pictures. I love that they told us exactly how they verified it. Too often in the news do we just get "was verified" or "an independent source verified," which, I get that you gotta protect sources, but still doesn't give any insight into their methodology. I could ask for example "how do you know you can trust your independent source?" because I have no idea their history together. Tech news like this is a bit easier to actually show your work for, but even when that's the case so many security articles or people on Twitter don't show the money like this. As much as everyone likes shitting on bitfi, for example, it was quite a while before someone actually demonstrated a hack was done, with reproducible methodology, rather than just blow smoke about how it's insecure.

snissn 8y ago
I was very loosely following the bitfi drama on twitter - and it seemed like the same day that the bitfi devices actually arrived to the public people were posting exploits (as i recall)
adtac 8y ago
IMO, you don't trust the independent source, you trust the journalist. Naturally, you'll only trust journalists who have proven to be right most of the time.

aaroninsf 8y ago

It's not a "breach" when there were no defenses.

Yhippa 8y ago

> Steve McBroom, a Spyfone representative, told Motherboard on Monday that the company is investigating the leak, and expressed relief that the person who found it had good intentions. >“Thank god it is a researcher, someone good trying to protect,” McBroom said in a phone call. Mr. McBroom needs to be worried about people with ill intentions who have accessed this data in the past and they have no idea about. Given this is a routine S3 bucket access breach I'd assume lots of bad people have rainbow dictionary found this by now. You can assume people are basically doing that for public buckets all the time now.

sorokod 8y ago
"Thank god..." It is most reassuring when divine entity is invoked especially in a data breach context. Especially when the intervention is of a monotheistic kind.

automathematics 8y ago

"Wait, hiring a security guy is how much? Fuck that... How much is a Senior engineer to make our API? .... Shit. That would definitely cost me my third corporate lease... How much to hire those kids that emailed us out of the blue? Yeah, I'm sure they'll do a fine job, just hire them.

lion121 8y ago

„Every day our team takes great strides to enhance our site’s security and we certainly anticipate that this recent data breach is the last,” Yeah, granting public access to s3 buckets sounds like a great effort to enhance data security

zinssmeister 8y ago

Incredibly difficult to even figure out who the company behind Spyfone is. Anyone know?

jenscow 8y ago

The most unfortunate side, is that the data isn't exactly that of their customers.

calimac 8y ago

Who is gaurding the hen house n these companies? Experian Target Spyfone ????

deleted 8y ago

[deleted]

auslander 8y ago

Spyfone Supported devices: - Android operating system must be Android 4.0 or higher. - iOS operating system must be iOS 7 to iOS 8.4 or iOS 9.0 to 9.1 (Oct 2015) Just make sure your target is not using iPhone :) https://spyfone.com/compatibility-policy/ https://spyfone.com/compatibility-policy/

xupybd 8y ago

Spyfone's response: "Dear Valued Customers of SpyFone.com, Within the last 10 days, one of our servers experienced a data breach and an unauthorized third party gained access to the data of approximately 2,200 customer accounts. The potentially exposed personal information of those affected could include pictures, call logs, and emails. While our team is taking steps to enhance our site’s security and we have since taken action to ensure that all accounts are fully encrypted, we are notifying you that your account may have been one of those negatively impacted by the unauthorized access. In an evolving landscape of online threats, SpyFone.com is committed to the highest standards of accountability and transparency, and proactively works to ensure the safety and security of our users. We will continue to work to address this matter as we partner with leading data security firms to assist in our investigation, and coordinate with law enforcement authorities."

scarface74 8y ago

First the requirements for installing it on Android phones is a lot less.... Android Requirements: You Need Physical Access To Device For Install Supports Android Versions (4.1 - 8.1+) iOS Requirements: If 2 factor is on you need physical access to device iCloud login access is required Then look at the features.... https://spyfone.com/features/ https://spyfone.com/features/ It says a lot about Android that anyone with physical access to an unlocked phone can put this type of spyware on it. Even if someone does leave their iPhone unlocked long enough for someone to install the app, they still couldn't do it without authorization and even then you have to know the targets iCloud credentials and have physical access to the phone if it has 2FA.

jiggunjer 8y ago
The way I see it, it is easier to get your hands on someones iCloud credentials than on an unlocked physical device. So iphone without 2FA is less secure than android. E.g. if I wanted to spy on my partner I'd prefer she had an iphone.
- scarface74 8y ago
  But you stil have to have physical access to the person phone to install the app. If they can do all they claim they can do on a non jail broken iOS device (and they have a disclaimer that all features don't work on all version of iOS), I would be amazed.

technion 8y ago

Here's the irony: For the last few weeks, my Facebook feed has been plastered with scare stories about certain apps being unsafe for kids. People posting image macros about things like Roblox, getting 50+ responses about how scary it is. This situation, which imo is a real danger, will get 0 attention outside the tech community. I really wish I had an answer. Maybe I should make of this or something in order to make people share it.

jiggunjer 8y ago

My gf was stalked by an ex using this type of crap. Had to wipe her phone and change her cloud credentails. Still worry my personal photos are now floating around on the web.