Android stalkerware, a danger for victims and stalkers

ESET research shows that Android stalkerware apps are affected by vulnerabilities that further threaten victims.

ESET research reveals that common Android stalkerware apps are affected with vulnerabilities that could expose the privacy and security of the victims.

Mobile stalkerware, also known as spouseware, is used by a stalker to spy on a victim, it allows to collect GPS location, spy on conversations, access browser history, images, and other sensitive data stored on the device. ESET researchers revealed that this kind of software has become very popular in the last couple of years.

This software could be easily found online, in many cases, their developers advertise them as a solution to protect children, but they offer spyware features that could be also abused by a third party.

ESET researchers have analyzed 86 Android stalkerware apps and discovered more than 150 security vulnerabilities in 58 Android stalkerware apps that further expose the victims to other privacy and security risks.

“Hence, we manually analyzed 86 stalkerware apps for the Android platform, provided by 86 different vendors. In this analysis we define a person who installs and remotely monitors or controls stalkerware as a stalker. A victim is a targeted person that a stalker spies on via the stalkerware. Finally, an attacker is a third party whom the stalker and the victim are not usually aware of. An attacker can carry out actions such as exploiting security issues or privacy flaws in stalkerware or in its associated monitoring services.” reads the post published by ESET.

The issue could be exploited to take over the victim’s device, it could also threaten the victim by uploading fabricated evidence. The researchers disclosed the flaw to the development team following their 90-day coordinated disclosure policy. At the time of this writing, only six vendors have addressed the flaws discovered by the researchers, and only seven vendors plan to fix them, and in one case a vendor decided not to fix the reported issues.

Most common issues include the insecure trasmission of victim’s PII (22) and the storage of sentitive data on external media (19).

“The research should serve as a warning to potential future clients of stalkerware to reconsider using software against their spouses and loved ones, since not only is it unethical, but also might result in revealing the private and intimate information of their spouses and leave them at risk of cyberattacks and fraud.” concludes the post. “Since there could be a close relationship between stalker and victim, the stalker’s private information could also be exposed.”

Follow me on Twitter: @securityaffairs and Facebook

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – hacking, stalkerware)

[adrotate banner=”5″]

[adrotate banner=”13″]

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.