Airscanner Advisory #07062901: FlexiSPY Victim/User Database Exposure (Full world readable access to ALL SMS/Emails/Voice data from victims/users)

http://airscanner.com/security/07062901_flexispy.htm

Airscanner Mobile Security Advisory #07062901: FlexiSPY Victim/User Database Exposure (Full world readable access to ALL SMS/Emails/Voice data from victims/users) Product: FlexiSpy.com Website

Platform:
NA

Requirements:
NA

Credits:
Seth Fogie
Airscanner Mobile Security
http://www.airscanner.com
June 14, 2007

Risk Level:
High - Sensitive information disclosure for all devices on which FlexiSpy is installed

Summary:
FlexiSpy.com's user administration web application contains a critical bug that allows anyone to view anyone elses captured voice, SMS, email, or location. This can be accessed via a 'Demo' account from the FlexiSpy.com website.

Details:
FlexiSpy is a program sold as 'Spy Software for mobile / cell phones' with which you can 'Catch cheating husbands wives and employees'. The software comes in several version, the most powerful of which has the following features:

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related securityfocus.com Links bugtraq certification focus-bsd focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics incidents libnet linux-secnews ms-secnews pen-test secpapers secprog sectools secureshell security-basics securityjobs sf-news vuln-dev webappsec Request more information about Pantek

SMS Logging (incoming/outgoing)

Email Logging (incoming/outgoing)

Call History (incoming/outgoing)

Call Duration (incoming/outgoing)

Contact Name in Address book linked to each call/sms

When an event occurs, the information related to that event is uploaded to their secure server. The person who purchased the software can then log into the website and review the information. The following figure is a screenshot taken from the 'Demo' page, which gives prospective users a chance to see what kind of data is collected.

Figure 1: Screenshot of administration screen for 'demo' user

To view information about an item, a user has to click on the link under the 'Type' column, which will then show the information related to that email, SMS, or call. Various bits of data are collected, such as callers phone number, the contents of the SMS message, and copies of the text in captured emails.

Do you need more help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related securityfocus.com Links bugtraq certification focus-bsd focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics incidents libnet linux-secnews ms-secnews pen-test secpapers secprog sectools secureshell security-basics securityjobs sf-news vuln-dev webappsec Request more information about Pantek

Figure 2: Example of capture email

Each item is assigned a specific id, which is contained in the URL:

http://flexispy.com/report.do?act=doGetDetail&id=2471018

The problem with the application is that the ID number can be manually changed (e.g. http://flexispy.com/report.do?act=doGetDetail&id=2471000), thus allowing access to other users data. As a result, people who have the FlexiSpy program loaded on their phones are not only being subjected to the spying activities of the person who installed the spyware, but also have potentially been exposed to anyone who found this vulnerability.

Note:

Given that the numbers are for the most part sequentially assigned, a malicious hacker could have created an application that downloaded the details for each and every item stored in the database for each and every user/victim of the software.

Workaround:
Uninstall the software from the victim's phone. Delete all existing messages that are stored on FlexiSpy's server.

Copyright (c) 2007 Airscanner Corp.

Can we help you?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related securityfocus.com Links bugtraq certification focus-bsd focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics incidents libnet linux-secnews ms-secnews pen-test secpapers secprog sectools secureshell security-basics securityjobs sf-news vuln-dev webappsec Request more information about Pantek

Permission is granted for the redistribution of this alert electronically. It may not be edited in any way without the express written consent of Airscanner Corp. If you wish to reprint the whole or any part of this alert in any other medium other than electronically, please contact Airscanner Corp. for permission.

Disclaimer: The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use on an AS IS condition. There are no warranties with regard to this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from use of, or reliance on, this information. Received on Fri Jun 29 14:14:20 2007