6 ms·

LetMeSpy, a stalkerware app spying on thousands, says it was hacked

77 points by FinnKuhn 3y ago

jeroenhd 3y ago
More information about what kind of data was leaked by the hack, as well as more info on the company behind the stalkerware and some notable users among the leaked data: https://maia.crimew.gay/posts/fuckstalkerware-1/ https://maia.crimew.gay/posts/fuckstalkerware-1/
- deleted 3y ago
  [deleted]
ramesh31 3y ago
Another wonderful joy brought to the world by Google's complete and total lack of incentive to care about privacy and security. Cool.
- Zambyte 3y ago
  Google doesn't care about your privacy and security. Neither does Apple. The difference is that Apple sees iPhones that have been sold as their property. So does Google, but to a lesser extent right now.
- jeroenhd 3y ago
  This has nothing to do with Google. Stalkerware exists for all common platforms (Android, iOS, macOS, Windows). I'm sure there's a tool out there that works on Linux too, but the dozens of stalkerware victims running Linux probably aren't worth the investment. Personally, I blame Apple with its supposed "safe" walled garden more for the many stalkerware products than Android where the ability to install apps from third parties exists. Their whole walled garden shtick revolves around how they protect their users, after all, which rings pretty hollow when they allow apps like these to exist on their platform. Shows how much Apple really cares about your safety!
  - ramesh31 3y ago
    > Personally, I blame Apple with its supposed "safe" walled garden more for the many stalkerware products than Android where the ability to install apps from third parties exists. Their whole walled garden shtick revolves around how they protect their users, after all, which rings pretty hollow when they allow apps like these to exist on their platform. Shows how much Apple really cares about your safety! These kinds of apps do not exist on the App Store, and are absolutely impossible on iOS outside the realm of security firms and black hats with zero days. Not sure what you're talking about here. Of course with physical access to the device, almost anything is possible. But the key issue here is Google allowing these things to fester on the Play store.
    - saagarjha 3y ago
      Disclaimer: Google pays me to work on this. They do not pay me to talk about it online. Stalkerware does exist on the App Store. The specific things that are possible differ on each platform (for example, getting access to calls and texts is a lot more involved on iOS and most apps will just let you unlock the device and access it directly instead) but there is plenty of potential for abuse on both platforms. In many ways the model is better on iOS with regards to these kinds of things, but we regularly deal with victims that are in situations where there does not exist a platform that I am aware of that can effectively stop stalkerware completely.
      - TechBro8615 3y ago
        Can you link to an example of a stalkerware app on iOS?
        aaomidi 3y ago
        On iOS this is possible through management profiles. People use these as parental control apps: For example: https://apps.apple.com/us/app/parental-control-app-ourpact/id954029412 https://apps.apple.com/us/app/parental-control-app-ourpact/i... This even allows you to live view a screen. Apple doesn’t really tell you that you have a management profile setup.
ignoramous 3y ago
Looking at the graphic shared in TFA, this app, typically used to spy on kids and women, seems to have a huge cluster of customers from India and the US. One country with the most social trust deficit and the other with most money. Also, this won't be the last time that an offensive tech company has the most questionable security. I have been saying this for a long time now [0] (and not only because I co-maintain one): a network monitor has got to be the first thing that goes on everyone's smartphones. [0] https://news.ycombinator.com/item?id=19546159 https://news.ycombinator.com/item?id=19546159
- chaxor 3y ago
  What network monitor for a phone is 1) lightweight and performant enough to not hog resources 2) extremely well-tested and simple (e.g. wireguard-level simple) 3) FOSS and trustworthy? I have not encountered anything even remotely close to this
  - beezlewax 3y ago
    The one you build yourself I guess.
  - ignoramous 3y ago
    I'll point you to the FOSS work I do [0] so that serves your point #3. As for #1, that's an inherent limitation with the APIs. As for #2, it depends on the economics. Most such tools (NetGuard, TrackerControl) are available free of cost with an option to sponsor the project. From experience, I can tell that no one really sponsors or donates. [0] https://github.com/celzero/rethink-app https://github.com/celzero/rethink-app

77 points by FinnKuhn 3y ago

More information about what kind of data was leaked by the hack, as well as more info on the company behind the stalkerware and some notable users among the leaked data: https://maia.crimew.gay/posts/fuckstalkerware-1/ https://maia.crimew.gay/posts/fuckstalkerware-1/

deleted 3y ago
[deleted]

ramesh31 3y ago

Another wonderful joy brought to the world by Google's complete and total lack of incentive to care about privacy and security. Cool.

Zambyte 3y ago
Google doesn't care about your privacy and security. Neither does Apple. The difference is that Apple sees iPhones that have been sold as their property. So does Google, but to a lesser extent right now.
jeroenhd 3y ago
This has nothing to do with Google. Stalkerware exists for all common platforms (Android, iOS, macOS, Windows). I'm sure there's a tool out there that works on Linux too, but the dozens of stalkerware victims running Linux probably aren't worth the investment. Personally, I blame Apple with its supposed "safe" walled garden more for the many stalkerware products than Android where the ability to install apps from third parties exists. Their whole walled garden shtick revolves around how they protect their users, after all, which rings pretty hollow when they allow apps like these to exist on their platform. Shows how much Apple really cares about your safety!
- ramesh31 3y ago
  > Personally, I blame Apple with its supposed "safe" walled garden more for the many stalkerware products than Android where the ability to install apps from third parties exists. Their whole walled garden shtick revolves around how they protect their users, after all, which rings pretty hollow when they allow apps like these to exist on their platform. Shows how much Apple really cares about your safety! These kinds of apps do not exist on the App Store, and are absolutely impossible on iOS outside the realm of security firms and black hats with zero days. Not sure what you're talking about here. Of course with physical access to the device, almost anything is possible. But the key issue here is Google allowing these things to fester on the Play store.
  - saagarjha 3y ago
    Disclaimer: Google pays me to work on this. They do not pay me to talk about it online. Stalkerware does exist on the App Store. The specific things that are possible differ on each platform (for example, getting access to calls and texts is a lot more involved on iOS and most apps will just let you unlock the device and access it directly instead) but there is plenty of potential for abuse on both platforms. In many ways the model is better on iOS with regards to these kinds of things, but we regularly deal with victims that are in situations where there does not exist a platform that I am aware of that can effectively stop stalkerware completely.
    - TechBro8615 3y ago
      Can you link to an example of a stalkerware app on iOS?
      - aaomidi 3y ago
        On iOS this is possible through management profiles. People use these as parental control apps: For example: https://apps.apple.com/us/app/parental-control-app-ourpact/id954029412 https://apps.apple.com/us/app/parental-control-app-ourpact/i... This even allows you to live view a screen. Apple doesn’t really tell you that you have a management profile setup.

ignoramous 3y ago

Looking at the graphic shared in TFA, this app, typically used to spy on kids and women, seems to have a huge cluster of customers from India and the US. One country with the most social trust deficit and the other with most money. Also, this won't be the last time that an offensive tech company has the most questionable security. I have been saying this for a long time now [0] (and not only because I co-maintain one): a network monitor has got to be the first thing that goes on everyone's smartphones. [0] https://news.ycombinator.com/item?id=19546159 https://news.ycombinator.com/item?id=19546159

chaxor 3y ago
What network monitor for a phone is 1) lightweight and performant enough to not hog resources 2) extremely well-tested and simple (e.g. wireguard-level simple) 3) FOSS and trustworthy? I have not encountered anything even remotely close to this
- beezlewax 3y ago
  The one you build yourself I guess.
- ignoramous 3y ago
  I'll point you to the FOSS work I do [0] so that serves your point #3. As for #1, that's an inherent limitation with the APIs. As for #2, it depends on the economics. Most such tools (NetGuard, TrackerControl) are available free of cost with an option to sponsor the project. From experience, I can tell that no one really sponsors or donates. [0] https://github.com/celzero/rethink-app https://github.com/celzero/rethink-app