Android stalkerware, a danger for victims and stalkers

ESET research shows that Android stalkerware apps are affected by vulnerabilities that further threaten victims.

ESET research reveals that common Android stalkerware apps are affected with vulnerabilities that could expose the privacy and security of the victims.

Mobile stalkerware, also known as spouseware, is used by a stalker to spy on a victim, it allows to collect GPS location, spy on conversations, access browser history, images, and other sensitive data stored on the device. ESET researchers revealed that this kind of software has become very popular in the last couple of years.

This software could be easily found online, in many cases, their developers advertise them as a solution to protect children, but they offer spyware features that could be also abused by a third party.

ESET researchers have analyzed 86 Android stalkerware apps and discovered more than 150 security vulnerabilities in 58 Android stalkerware apps that further expose the victims to other privacy and security risks.

“Hence, we manually analyzed 86 stalkerware apps for the Android platform, provided by 86 different vendors. In this analysis we define a person who installs and remotely monitors or controls stalkerware as a stalker. A victim is a targeted person that a stalker spies on via the stalkerware. Finally, an attacker is a third party whom the stalker and the victim are not usually aware of. An attacker can carry out actions such as exploiting security issues or privacy flaws in stalkerware or in its associated monitoring services.” reads the post published by ESET.

The issue could be exploited to take over the victim’s device, it could also threaten the victim by uploading fabricated evidence. The researchers disclosed the flaw to the development team following their 90-day coordinated disclosure policy. At the time of this writing, only six vendors have addressed the flaws discovered by the researchers, and only seven vendors plan to fix them, and in one case a vendor decided not to fix the reported issues.

Most common issues include the insecure trasmission of victim’s PII (22) and the storage of sentitive data on external media (19).

“The research should serve as a warning to potential future clients of stalkerware to reconsider using software against their spouses and loved ones, since not only is it unethical, but also might result in revealing the private and intimate information of their spouses and leave them at risk of cyberattacks and fraud.” concludes the post. “Since there could be a close relationship between stalker and victim, the stalker’s private information could also be exposed.”

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini
International Editor-in-Chief
Cyber Defense Magazine