As per a report by ZDNet, one of the servers hosted on Amazon’s cloud service was left unprotected and accessible without a password.
An app used to help parents monitor their teens has reportedly leaked thousands of Apple ID user account details of both parents and children thanks to an unprotected server. The app, called TeenSafe, claims to be a secure monitoring app for iOS that allows parents to monitor text messages, location and call history, among other things. Notably, the app doesn’t require parents to get the consent of their children, which is pretty controversial in itself.
As per a report by ZDNet, one of the servers hosted on Amazon’s cloud service was left unprotected and accessible without a password. This could allow anyone to access the information and user credentials in plaintext. Personal information included a list of parent’s and child’s email addresses as well as plaintext passwords for the child’s Apple ID.
Following ZDNet’s report, the company pulled its servers offline. „We have taken action to close one of our servers to the public and begun alerting customers that could potentially be impacted,“ a TeenSafe spokesperson told ZDNet on Sunday. The app has already been criticised on privacy concerns for allowing parents to monitor their children without their consent.
It’s still unclear how much of the information was accessed, but reportedly it won’t take much effort for a bad actor to exploit it since the app requires that two-factor authentication be turned off. So a malicious actor could view the leaked information and hack into a child’s account to access their personal content with ease.
The report adds that the leaked data did not contain photos, messages or location information of either parents or children. At 10,200 records from the past three months were stored in the server shortly before being taken offline. The company claims over 1 million parents use the TeenSafe app. The company said that it has started informing those whose email addresses were leaked.
