A spyware app that has recklessly exposed the data of its users including a generous amount of sensitive photos and phone call recordings have already been named following the shutdown of the site where it was hosted. The database is active for the last six to eight weeks since its discovery, amidst the persistent effort of tech experts and reporters to contact and warn the company that the supposed sensitive and identifiable data was leaked online, the management doesn’t seem to care.
The spyware application was determined to be Mobiispy, a company that markets itself to parents and employers to monitor their children and employees. The company left a database containing more than 95,000 images and more than 25,000 phone call recordings accessible to anyone who has an internet connection. According to Troy Hunt, a researcher who maintains a database that contains all the data breaches he discovered, following his analysis on the said database, revealed that there are more than 16 gigabytes of images and around 3.7 gigabytes of MP3 recordings in it.
In earlier reports, the company was intentionally left unnamed because the sensitive database can be accessed easily and naming the company would radically make it easy for those who have ill intents to locate it online. If that happens, the data of hundreds, maybe thousands of users will be compromised exposing their intimate and identifiable pictures, videos, text messages, and phone recordings for anyone with ill intent to use.
Read More: THERE IS A DATABASE THAT INCLUDES THOUSANDS OF INTIMATE IMAGES AND AUDIO RECORDINGS THAT YOU CAN STILL ACCESS UNTIL NOW
Fortunately today, the company that was hosting the database’s site finally took it down, following the eager attempts of journalists and tech experts to have the database secured.
“Codero has taken action on this matter, and the mentioned URL should no longer be accessible,” Jason Ackley, the vice president of operations and network engineering at Codero said in an interview with Motherboard, the news organization that has made an effort to shut down the site.
Lorenzo Franceschi-Bicchierai, a tech reporter from Vice’s Motherboard, one of the first to report the breach discovered by Cian Heasley, a security researcher who unearthed the database, attempted to contact the company for several times but received little to no response from them. Bicchierai said in an article that he had spent weeks trying to “ethically disclose this vulnerability to the company and to get the private images secured.”
They reached out to the company email and to the Gmail address of the site’s administrator, who appears to be the company’s founder and left voicemail to a Google Voice number listed on the site’s WHOIS details, but all of their efforts were left unsuccessful.
In a continuous attempt to get the database secured, the team also contacted GoDaddy, the domain registrar for the company’s main site and the leaked database but received a comment that there’s not much that the domain company can do about it.
After Franceschi-Bicchierai’s story was published, Codera, the hosting company used by Mobiispy for its website, reached out to him saying that they were trying to contact the company to have the database taken down. Hours later, Ackley said that Codero had “sent communications with a deadline to the customer and will take action if the deadline is exceeded (hours not days).”
Finally, a few hours later, Ackley followed up to alert us that it took down the content.
The data was exposed to the public for a long period of time since January and bore dangerous implications if a cybercriminal happens to get access to it. While the database did not contain any contact details of users, it was still very sensitive as they include nude and intimate images of people that can be used for “sextortion” and “blackmail.”
According to Heasley, the URL of the database was exposed in the source code of the app as is also relatively easy to guess.
“This is the level of security these guys work with,” Heasley, who studies computer security and forensics at Napier University in Edinburgh Scotland, said in an online interview. “It’d be funnier if it wasn’t stalking victim’s data.”
Eva Galperin, who has researched stalkerware and is the director of cybersecurity at Electronic Frontier Foundation, said: “People should not be using these tools in the first place… But the fact that these companies aren’t very good at securing their own data is just the cherry on the bad idea sundae.”
As of writing, the app’s entire website is not accessible anymore.