Supplier of covert surveillance app spills passwords for 62,000 customers

The maker of a cellphone app that’s marketed as offering a stealthy means for monitoring all actions on an Android system spilled electronic mail addresses, plain-text passwords, and different delicate information belonging to 62,000 customers, a researcher found not too long ago.

A safety flaw within the app, branded Catwatchful, allowed researcher Eric Daigle to obtain a trove of delicate information, which belonged to account holders who used the covert app to watch telephones. The leak, made doable by a SQL injection vulnerability, allowed anybody who exploited it to entry the accounts and all information saved in them.

Unstoppable

Catwatchful creators emphasize the app’s stealth and safety. Whereas the promoters declare the app is authorized and supposed for fogeys monitoring their kids’s on-line actions, the emphasis on stealth has raised considerations that it is being aimed toward individuals with different agendas.

“Catwatchful is invisible,” a web page selling the app says. “It can’t be detected. It can’t be uninstalled. It can’t be stopped. It can’t be closed. Solely you’ll be able to entry the data it collects.”

The promoters go on to say customers “can monitor a cellphone with out [owners] realizing with cell phone monitoring software program. The app is invisible and undetectable on the cellphone. It really works in a hidden and stealth mode.”