Slashdot Mirror
'TeenSafe' Phone Monitoring App Leaked Thousands of User Passwords (zdnet.com)
An anonymous reader quotes a report from ZDNet: At least one server used by an app for parents to monitor their teenagers' phone activity has leaked tens of thousands of accounts of both parents and children. The mobile app, TeenSafe, bills itself as a "secure" monitoring app for iOS and Android, which lets parents view their child's text messages and location, monitor who they're calling and when, access their web browsing history, and find out which apps they have installed. But the Los Angeles, Calif.-based company left its servers, hosted on Amazon's cloud, unprotected and accessible by anyone without a password.
"We have taken action to close one of our servers to the public and begun alerting customers that could potentially be impacted," said a TeenSafe spokesperson told ZDNet on Sunday. The database stores the parent's email address associated with their associated child's Apple ID email address. It also includes the child's device name -- which is often just their name -- and their device's unique identifier. The data contains the plaintext passwords for the child's Apple ID. Because the app requires that two-factor authentication is turned off, a malicious actor viewing this data only needs to use the credentials to break into the child's account to access their personal content data.
"We have taken action to close one of our servers to the public and begun alerting customers that could potentially be impacted," said a TeenSafe spokesperson told ZDNet on Sunday. The database stores the parent's email address associated with their associated child's Apple ID email address. It also includes the child's device name -- which is often just their name -- and their device's unique identifier. The data contains the plaintext passwords for the child's Apple ID. Because the app requires that two-factor authentication is turned off, a malicious actor viewing this data only needs to use the credentials to break into the child's account to access their personal content data.
Recently it seems every week we read about data "leaks" or data "breaches".
The government needs to step up and create both civil and criminal forms of punishment such that a strong incentive exists for responsible parties to do more toward preventing data from being exposed.
Of course things will still go wrong, but strong disincentives which provide for civil and / or criminal penalties should at least act to reduce such events.
As an aside, I remember a year or so ago, a person I know smugly told me that "WhatsApp" was a 100% secure means of communicating which could not be spied on. My reply was : "I doubt that will be true for long".
Given the many incidents involving data exposed on Amazon Cloud, is there an issue with the Amazon Cloud defaults?
Apps!
Really? Know what else happened this week? A volcano in Hawaii destroyed some homes and cars, and an asshole in Texas tried to murder roughly two dozen people, successfully killed about half of his intended victims. Consider laws against both of these events. In the case of a volcano, you can outlaw them all you like, volcanoes dont give a fuq. Murder perpetrated by a human, OTOH, was outlawed... the penalties are pretty severe and the living breathing bag of human excrement responsible in this case will probably never walk free again, since heâ(TM)s looking at 400 years in the electric chair, probably he knew that, and fuck all hell, he did it anyway. The all-stick, no-carrot approach is not a panacea for all the challenges facing our society. Maybe proving expert guidance on how to set up a password protected system because the way things are now, I think every tech company is out for itself, going it alone, and THAT could be part of the problem.
Our reign has gone on long enough. Indeed. Summon the meteors.
Sorry... replying on slashdot on an iPad using Safari, it doesnt offer a preview link...
Maybe PROVIDING expert guidance, I was saying, might be helpful, more than threatening people in the event of a breach. Also, providing criminal penalties will only discourage hacking targets from coming forward, which is worse for everyone. Imagine if they treated banks like that after a stick-up or heist. Blaming the victim like this... shit... I wonder if that is how rape victims feel...
Our reign has gone on long enough. Indeed. Summon the meteors.
> discourage hacking targets from coming forward, which is worse for everyone. Imagine if they treated banks like that after a stick-up or heist
That's certainly an issue. Sharing information is important, knowing what kinds of attacks are being done against which kind of targets, etc. Companies like Cisco Talos and Alert Logic are able to better protect customers by proactively taking action to protect customers A and B against the type of attacks currently coming at Company C.
What we're just starting to see is cybersecurity being handled similarly to bank security and fire safety - insurance companies setting standards to avoid having a problem, ahead of time. Insurance companies are really, really good at managing risk, at determining through statistics and other means which safeguards will best reduce risk.
Businesses are penalized (via higher premiums) not afterwards for ending up a victim, but for being sloppy - before anything bad happens. Better protection means lower risk and lower premiums.
The applet to keep children safe, demands less safety for children. The USA has its own style of irony. What it really means is, the start-up wasn't designed to protect precious snowflakes, it was designed to encourage neurotic/overworked parents to spend money. The lack of corporate responsibility in the USA ensures these fuck-ups will occur again.
Any guess why they want you to disable 2FA? My best guess is they use this information to query Apple for information usually only available to the owner, such as Find My Phone. But either way, this seems beyond terrible.
In which case, is this software violating the Apple user agreement in some way? Or inducing the parents to do so?
Spyware (Because that's what this is.) that requires you to specifically compromise your target by intentionally disabling security features; is, in turn, itself insecure? And people are shocked by this?
Sorry, but I really can't conjure up any sympathy here. This is not a case of someone just screwing up and getting pwned. This is an intentional and malicious attack (and a particularly stupid one at that) that just happened to backfire. Every bad thing that might happen... to either the company or the parents... is richly deserved.
Imagine all the people...
Much of what you said is true, but Amazon chooses the defaults. Amazon chose the defaults before the customer even logged in, so Amazon's choice of default settings can't possibly be the customer's responsibility.
If a customer changes a setting, that's almost 100% on the customer (if it's even sane to offer the option, it's clear what the option does, etc.)
I do security for a living, focused on securing AWS instances. I've been doing security for a living for 20 years. So I'm a tad familiar with security concepts. A few nights ago, I was working late because a co-worker couldn't figure out how to do their work and I had to do it for them. I spun up an EC instance and because I was tired I missed changing the default for the security group.
The average time to I infection for a Windows AWS instance exposed to the Internet is MINUTES, and that's Amazon's default - RDP open to the world. Not just to the IP that set it up, not just your country even, but open to everyone. Sure enough within a few minutes someone on Amazon's "known attacker IPs" list owned the machine. Amazon KNOWS those IPs are attackers, they have them in a list, yet by default they give even known attackers access to every new server. That's a bad default, imho.
Sorry... replying on slashdot on an iPad using Safari, it doesnt offer a preview link...
It also leads one to wonder whether the poster is of intelligence sufficient to figure out how to bypass the lame-as-hell mobile site. C'mon, it's NOT hard, people.
So... Because some people will still break the law you are suggesting we shouldn't have any punishments for breaking any laws?
"TeenSafe" ... "secure" .... "plain-text passwords" ....
Hmmmmmmmmmmmmmmmmmm
Of course, being those creeps, they may do exactly the best thing to prepare their children for living in the upcoming surveillance state and soon-to-follow full-blown fascism. The leakage of the accounts is obviously part of that pedagogic concept. Hence I conclude that this is an absolutely great app that anybody should inflict on their children as soon as possible! Of course, in any self-respecting fascism, children also do surveillance (and denunciation to the authorities) of their parents. A business opportunity for, aehm, "Parentsafe"?
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Yes, it would be great if there was a "security standard" that all these companies implemented. The word "secure" is currently a makerting term and nothing more. It's a "We know our systems are secure!" The problem is that they know so little... probably less than the user.
I am sure there are certifications and such but the media should be out there educating the public. "This company said they were secure, but they didn't have any certification, not even SP112, on their Amazon cloud server."
That will get people talking about those kinds of certifications like people notice with the sweat/rain/shower/pool proofing of their phones. It's not going to make us totally safe, but at least set a low bar. Right now it is a free for all.
Noun
S: (n) safe (strongbox where valuables can be safely kept)
S: (n) safe (a ventilated or refrigerated cupboard for securing provisions from pests)
It's a collection of children, all in one convenient location. Nice work, TeenSafe. Great name, by the way. You had one job...
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
honestly I do not understand parents who do this
yes kids do stupid shit. I remember the stupid shit I did.
let them do stupid shit AND GET IN TROUBLE FOR IT.
this is honestly kind of ironic no?
they sort of deserve it.
Good thing being incompetent isn't illegal or someone would have to pay for this.
If the best companies in the world have fallen to hackers, be it Sony, Equifax, and even the US government, then why should a small company whose job it is to protect kids be able to handle what nation-states cannot?
The bad guys can get into anything these days. It isn't their fault, and most companies cannot afford security. Plus, security has no return anyway, so a company with security will be left in the dust by the competition that doesn't bother.
Slightly off-topic, I know, but: It's sad and wrong that there is even such a thing as this 'app', regardless of how 'secure' it is. What ever happened to teaching your children the value of trust via example, by trusting them, and them respecting the trust put in them? Now you have parents installing what amounts to an ankle monitor like someone under house arrest is required to wear. How sad is that?
> They have no idea what you'll be doing with the server
Yeah they don't know, maybe whatever you're doing would benefit from having 14 partitions on the drive. They don't do that by default, because 99.999% of the time that would be stupid.
Their default security groups are stupid for 99.999% of users.
We are talking about legislation for data breaches. Grown up stuff. Nothing to do with overbearing parents. Do try to keep up. What's that? You can't? Because you have an agenda, that's why.