Security → FBI Arrested CEO of 'StealthGenie' for Selling Mobile Spyware Apps

quote:

---

The Federal Bureau of Investigation (FBI) has arrested the CEO of a UK-based company for allegedly advertising and selling a spyware app to individuals who suspect their romantic partners of cheating on them. The dodgy cell phone spyware application, dubbed as StealthGenie, monitors victims’ phone calls, text messages, videos, emails and other communications "without detection" when it is installed on a target's phone, according to the Department of Justice. The chief executive officer of a mobile spyware maker is a Pakistani man collared 31-year-old Hammad Akbar, of Lahore, who was arrested over the weekend in Los Angeles for flogging StealthGenie spyware application and now faces a number of federal charges. According to the US Department of Justice, Akbar operates a company called InvoCode, which sold the StealthGenie spyware app online that can intercept communications to and from mobile phones including Apple, Google, and BlackBerry devices.

---

»thehackernews.com/2014/0 ··· 6cr5.f0j

What makes this interesting is its a step towards (however small) banning monitoring tools. So for example if I suspect someone is making calls from my phone and I put a monitor on it like 'StealthGenie' is it now against the law. I know its a bit of a reach but the question as to what you can and can't monitor and when and where is maybe a little smaller today and the question is how far will these restrictions go in the future.

Blake

Google's cache of the site has:
"Want to know what they are up to on their phone? Find out how StealthGenie can help"
It's probably the difference between your phone & their phone that's creating legal issues.

The feature list looks like the same capability that many apps bring to the phone
Listen to phone calls Live
Record calls
View call history
Spy on SMS Messages
View send and receive SMS
View deleted SMS
Redirect SMS
Track GPS Location
Look at location history
Find out travel routes
Read Emails

I don't think they are wanting to ban parents from monitoring their kid's cellphones. Or employers monitoring employee issued equipment.

Most legitimate monitoring programs have a very onerous and/or specific display that they are being monitored, or the Device user is well aware he or she is being monitored (or made aware through IT policies and other 'house rules'). Programs usually allow such feature to be turned on or off depending on the vendor.

This particular program is meant to be ran without permission and without user knowledge. That is why the coder is facing charges.

He likely he is also facing undisclosed charges related to financial crimes on top of this.

AKA as Don't spy the government hates the competition.

That isn't something the program controls, its how the user uses it, so the question comes around to why is the developer charged for how his users use the software?

Blake

quote:

---

The feature list looks like the same capability that many apps bring to the phone
Listen to phone calls Live
Record calls
View call history
Spy on SMS Messages
View send and receive SMS
View deleted SMS
Redirect SMS
Track GPS Location
Look at location history
Find out travel routes
Read Emails

---

Pretty much my thought. CarrierIQ comes to mind. While I wouldn't think a friend or neighbor would necessarily have access, I would expect most of the software, phone manufacturer, and carrier to have all that. Not to mention who they are selling to.

That he provided the web interface for users to view the logs kept the developer in the loop way too long.

Or "Do as we say, not as we DO".

The person who installs the software on someone else's device doesn't push ads nor generate tax nor facilitate copies of data to gov.
It's not a question of how much can one spy.

quote:

---

Once installed on the phone, it allows conversations to be monitored as they take place, enables the purchaser to call the phone and activate it at any time to monitor all surrounding conversations within a 15-foot radius

---

Or is it?
This software expands the scope of a simple keylogger

Also via Kim Zetter @ Wired Mag:

quote:

---

The indictment this week of the man behind an app designed for surreptitiously monitoring cellphone activity is only the second federal case filed against someone involved in the commercial sale of so-called spyware and stalkingware. But the case could have negative implications for others who make and sell similar snooping tools, experts hope.

The case involves StealthGenie, a spy app for iPhones, Android phones and Blackberry devices that until last week was marketed primarily to people who suspected their spouse or lover of cheating on them but it also could be used by stalkers or perpetrators of domestic violence to track victims. The app secretly recorded phone calls and siphoned text messages and other data from a target’s phone, all of which customers of the software could view online until the government succeeded to temporarily close the Virginia-based site (.pdf) that hosted the stolen data.

---

»www.wired.com/2014/10/st ··· ictment/

From the Wired article

quote:

---

"The government is trying to say it's not enough that the users are responsible, but that the maker is an enabler of this privacy invasion and are potentially liable,"

---

'enabler' is a huge ocean of gray slime that the courts should fear to tread into, for example is Smith and Wesson an enabler, but the NRA would go nuts over that question. Simply put, define enabler.

Blake

They are probably going to go after how it was marketed. If it had simply been marketed as a keep your kids safe product they wouldn't have these issues, no matter what the application is capable of doing.

We want to train our children that they have no expectation of privacy, any time or any where.

The reality is, like any security, once you lose physical control of a device all bets are off. You should expect that once someone has physical control of your device that they can access any information on the device and install software that may not be in your best interest. So, if you fail to maintain control of your device and do not password/PIN protect the device you are opening yourself up to a wide variety of issues.

I trust my wife, but my phone has a password on it to prevent others from easily accessing my data. Is there anything private on the phone, other than a few contacts, no. On the other hand, no one needs to be accessing my device other than me.

Consumerist has an interesting somewhat related article:

Oops: Cops Distributing Spyware To Families As “Internet Safety” Tool
»consumerist.com/2014/10/ ··· ty-tool/

quote:

---

In the name of child safety, it has two major functions: a hard drive search and a keystroke logger. The idea is that parents can use the software to keep an eye on the images, text, and websites their children are encountering.

---

All in the label, I guess. One label gets you apple pie. The other gets you prison time.