SoylentNews is people
SoylentNews
Submitted via IRC for SoyCow4408
A company that markets cell phone spyware to parents and employers left the data of thousands of its customers—and the information of the people they were monitoring—unprotected online.
The data exposed included selfies, text messages, audio recordings, contacts, location, hashed passwords and logins, Facebook messages, among others, according to a security researcher who asked to remain anonymous for fear of legal repercussions.
Last week, the researcher found the data on an Amazon S3 bucket owned by Spyfone, one of many companies that sell software that is designed to intercept text messages, calls, emails, and track locations of a monitored device.
[...] The researcher said that the exposed data contained several terabytes of "unencrypted camera photos."
"There's at least 2,208 current 'customers' and hundreds or thousands of photos and audio in each folder," he told Motherboard in an online chat. "There is currently 3,666 tracked phones."
The company's backend services were also left wide open, not requiring a password to log into them, according to the researcher, who said he was able to create admin accounts and see customer data.
Spyfone also left one of it's APIs completely unprotected online, allowing anyone who guesses the URL to read what appears to be an up-to-date and constantly updating list of customers. The site shows first and last names, email and IP addresses. As of Thursday, there were more than 11,000 unique email addresses in the database, according to a Motherboard analysis.
(Score: 5, Informative) by requerdanos on Friday August 24 2018, @08:33PM (3 children)
To be fair, their customers knew Spyfone's privacy position ("against it") when they agreed to become customers.
(Score: 1, Insightful) by Anonymous Coward on Friday August 24 2018, @09:08PM
I concur; there is no honor among those that profit from violating others.
(Score: 0) by Anonymous Coward on Friday August 24 2018, @09:09PM (1 child)
What about their spouses etc who were exposed to the malware?
(Score: 3, Insightful) by requerdanos on Friday August 24 2018, @10:23PM
They were already victims of Spyfone and the "customer", now they are being victimized to a larger extent due to Spyfone's practices and the poor judgment of "customer".
(Score: 1, Funny) by Anonymous Coward on Friday August 24 2018, @08:37PM (8 children)
In the Soviet UK, Halogen bans EU!
(Score: 0) by Anonymous Coward on Friday August 24 2018, @09:01PM (3 children)
Ok who is running the shitty chat bot?? Either this person can't tell the difference between slashdot and soylentnews or it is a shitty bot.
Not sure I understand why someone would program a bot to post the above.
(Score: 0) by Anonymous Coward on Friday August 24 2018, @09:10PM (2 children)
because it's not a bot and just was some dude that wasn't funny to you?
the internet is full of people that can be replaced with simple scripts, that doesnt mean they have benefitted from it yet.
(Score: 0) by Anonymous Coward on Friday August 24 2018, @09:24PM (1 child)
Incorrect, this joke is meant for slashdot which at this moment has the story 2nd from the top. The EU halogen ban story has not run on SN yet. I made that point already, am I arguing with a bot now?
(Score: 1, Funny) by Anonymous Coward on Friday August 24 2018, @10:24PM
No, it just was some dude that wasn't that bright to you?
(Score: 2) by turgid on Friday August 24 2018, @09:44PM (3 children)
The UK isn't Soviet at the moment, it's fascist.
I refuse to engage in a battle of wits with an unarmed opponent [wikipedia.org].
(Score: 1, Insightful) by Anonymous Coward on Saturday August 25 2018, @02:57AM (2 children)
The distinction beyond ideological semantics between both systems is close to nil.
(Score: 2) by turgid on Saturday August 25 2018, @09:40AM (1 child)
They're completely different economically.
I refuse to engage in a battle of wits with an unarmed opponent [wikipedia.org].
(Score: 2, Insightful) by Anonymous Coward on Saturday August 25 2018, @12:20PM
In theory. In practice, all economic systems are the same; rich take everything, poor get shit on.
(Score: 1, Insightful) by Anonymous Coward on Friday August 24 2018, @09:27PM (2 children)
Is this some shit marketed to parents to install on their kids' phones? If so, how much CP is stored out in the open on Amazon?
(Score: 0) by Anonymous Coward on Friday August 24 2018, @10:39PM (1 child)
But they have to install it to protect the children, you can't be too safe!
(Score: 3, Touché) by MostCynical on Saturday August 25 2018, @12:08AM
Nothing to hide, othing to be afraid of.
Well, now they have nothing that isn't hidden. Close enough!
"I guess once you start doubting, there's no end to it." -Batou, Ghost in the Shell: Stand Alone Complex
(Score: 2) by SomeGuy on Friday August 24 2018, @10:25PM (4 children)
So anyone got a torrent link? :P
(Score: 2) by SomeGuy on Friday August 24 2018, @10:32PM (1 child)
Aw crap, now I notice the post above screws the context of my joke. The point is this data is certain to contain lots of stuff that could be used for blackmail, embarrassment, fraud, or such, and THIS TIME there is only the grace of the researcher that prevents this data from being downloadable in bulk to every last person on the planet.
(Score: 2) by takyon on Saturday August 25 2018, @12:21AM
I wonder what the breakdown is on whether white hats or black hats get to this stuff first. Because we've heard of plenty of security holes like this one that *potentially* left data accessible, but is apparently detected by a security researcher or the company first. Or at least, the stuff isn't just dumped online somewhere... yet.
[SIG] 10/28/2017: Soylent Upgrade v14 [soylentnews.org]
(Score: 2) by janrinok on Saturday August 25 2018, @06:39AM (1 child)
(Score: 2) by janrinok on Saturday August 25 2018, @06:40AM
(Score: 0) by Anonymous Coward on Sunday August 26 2018, @04:51AM
Do you see it?
"There is[sic] currently 3,666 tracked phones."
ARE