I spy another mSpy breach: Millions more stalkerware buyers exposed

Commercial spyware maker mSpy has been breached – again – and millions of purchasers can be identified from the spilled records. mSpy showed up on Have I Been Pwned on July 11, with the site revealing hacktivists were responsible for the theft of millions of Zendesk support tickets from buyers unable to use the software. mSpy …

[Yorick Hunt]

"Best update that SSID and password ASAP if you own one of the offending routers, and while you're doing that why not update your router firmware, too?" just scrap the thing and get something that isn't full of Cisco holes.

[Sandtitz]

Linksys

Cisco holes? Cisco sold off the Linksys brand stuff over a decade ago.

Fortinet has invested millions into the brand lately to boost the security - and apparently failed in doing so.

[Doctor Syntax]

Re: Linksys

Irrespective of who owns the company, why should a router be sending information like that to AWS irrespective of whether it's encrypted or not?

[Yorick Hunt]

Re: Linksys

I've seen plenty of evidence of $millions being invested into marketing; security not so much.

Having had a look at the firmware of the latest-generation Cisco ATAs, I see that 99% of it is still the original Sipura firmware, even after almost two decades. Similarly, I doubt very much that Fortinet would've bothered to rip and replace dodgy firmware on acquired product lines.

[Blazde]

The greatest trick the dark pattern ever pulled..

'Possible dark patterns' - darker than the unambiguous dark patterns but not as dark as the dark patterns they missed?

[lglethal]

PTC

PTC are the makers of Creo, which used to be known as Pro/Engineer or Wildfire. It's a program used in a lot of (smaller) engineering firms.

So that's a lot of small companies potentially in a lot of big trouble.

[Elongated Muskrat]

Irony

Definition:

Having your privacy breached by someone breaching the privacy-breaching software you installed on someone's phone to breach their privacy.

[Michael Strorm]

Hacking via zombified IE?

Lemme guess, does it require the user to let it run an ActiveX control on a website that looks best running Internet Explorer at a resolution of 800 x 600?

Then takes over everything because Windows 10 has secretly been Windows 95 with a pretty new skin and no security all along?