A consumer spyware The feature called TheTruthSpy has been a constant security and privacy risk for thousands of people whose Android devices have been unknowingly compromised with mobile surveillance apps, mostly because of a simple security flaw that its operators never fixed.
Now, two groups of hackers have independently found the flaw that allows mass access to data on victims’ stolen mobile devices directly from TheTruthSpy’s servers.
Hacker based in Switzerland maia arson crimew said in a blog post that hacker groups SiegedSec and ByteMeCrew discovered and exploited the flaw in December 2023. Crimew, which was given a cache of TheTruthSpy victim data by ByteMeCrew, also described finding several new security vulnerabilities in TheTruthSpy’s software stack.
SPYWARE DETECTION TOOL
You can check if your Android phone or tablet has been hacked here.
In a Telegram post, SiegedSec and ByteMeCrew said they are not releasing the compromised data publicly, given its highly sensitive nature.
Crimew provided TechCrunch with some of the compromised TheTruthSpy data for verification and analysis, which included the unique device IMEI numbers and advertising IDs of tens of thousands of Android phones recently breached by TheTruthSpy.
TechCrunch verified that the new data is authentic by matching some of the IMEI numbers and advertising IDs to a list of previous devices known to have been hacked by TheTruthSpy, as discovered during a previous TechCrunch investigation.
The latest batch of data includes the Android device IDs for every phone and tablet hacked by TheTruthSpy through December 2023. The data shows that TheTruthSpy continues to actively spy on large groups of victims in Europe, India, Indonesia, the United States , United Kingdom and elsewhere.
TechCrunch has added the latest unique identifiers — about 50,000 new Android devices — to its free spyware scanner that lets you check if your Android device has been hacked by TheTruthSpy.
Security flaw in TheTruthSpy exposed victims’ device data
For a while, TheTruthSpy was one of the most prolific applications for facilitating secret surveillance of mobile devices.
TheTruthSpy is one of a fleet of nearly identical Android spyware apps, including Copy9 and iSpyoo and others, that are secretly placed on a person’s device by someone who usually knows their password. These apps are called “stalkerware” or “spouseware” because of their ability to illegally track and monitor people, often spouses, without their knowledge.
Apps like TheTruthSpy are designed to remain hidden on home screens, making these apps difficult to detect and remove, while constantly uploading the contents of the victim’s phone to a dashboard visible to the attacker.
But while TheTruthSpy touts its powerful monitoring capabilities, the spyware company paid little attention to the security of the data it was stealing.
As part of an investigation into consumer-grade spyware apps in February 2022, TechCrunch discovered that TheTruthSpy and its clone apps share a common vulnerability that exposes a victim’s phone data stored on TheTruthSpy’s servers. The bug is particularly damaging because it is extremely easy to exploit and provides unrestricted remote access to all data collected from the victim’s Android device, including text messages, photos, call recordings and precise real-time location data.
However, the operators behind TheTruthSpy never fixed the bug, leaving its victims exposed to further data breaches. Only limited information about the error, known as CVE-2022-0732was subsequently disclosed, and TechCrunch continues to withhold details of the bug due to the ongoing risk it poses to victims.
Given the simplicity of the bug, its public exploitation was only a matter of time.
TheTruthSpy is affiliated with Vietnam-based startup 1Byte
This is the latest in a series of security incidents involving TheTruthSpy and by extension the hundreds of thousands of people whose devices have been hacked and their data stolen.
In June 2022, a source provided TechCrunch with leaked data containing records of every Android device ever hacked by TheTruthSpy. With no way to notify victims (and potentially notifying their abusers), TechCrunch created a spyware search tool to allow anyone to check for themselves whether their devices have been compromised.
The search tool looks for matches against a list of IMEI numbers and advertising IDs known to have been compromised by TheTruthSpy and its clone apps. TechCrunch also has a guide on how to remove TheTruthSpy spyware — if it’s safe to do so.
But TheTruthSpy’s poor security practices and server leaks also helped reveal the true identities of the developers behind the business, who had gone to great lengths to conceal their identities.
TechCrunch later found that a Vietnam-based startup called 1Byte is behind TheTruthSpy. Our investigation found that 1Byte earned millions of dollars in spyware revenue over the years by funneling customer payments into Stripe and PayPal accounts created with fake US identities using fake passports, social security numbers and other forged documents.
Our investigation found that the false identities were linked to bank accounts in Vietnam managed by 1Byte employees and its director, Van Thieu. At its peak, TheTruthSpy made over $2 million in customer payments.
PayPal and Stripe suspended the spyware maker’s accounts following recent investigations by TechCrunch, as did the US-based web hosting companies 1Byte used to host its spyware operation’s infrastructure and store its vast banks of stolen data phone number of the victims.
After US web hosts booted TheTruthSpy from their networks, the spyware is now hosted on servers in Moldova by a web host called AlexHost, run by Alexandru Scutaru, who claims a policy of ignoring copyright takedown requests of the USA.
Although sidelined and downgraded, TheTruthSpy still actively facilitates the surveillance of thousands of people, including Americans.
As long as it remains online and operational, TheTruthSpy will threaten the safety and privacy of its victims, past and present. Not only because of spyware’s ability to invade a person’s digital life, but because TheTruthSpy can’t stop the data it steals from spreading online.
Read more at TechCrunch:
