API requests not authenticated by mobile device monitoring services

Consumer spyware is often sold under the guise of child or family surveillance software, but is also known as stalkerware because of its ability to track and monitor.

The website TechCrunch uncovered a security problem with this type of software, which compromises the phone data, messages and locations of hundreds of thousands of devices, collecting personalised information and sending it to a server infrastructure, controlled by an operator, as the Vietnam-based website states.

Specifically, the backend infrastructure shared by multiple mobile device monitoring services does not properly authenticate and authorise API requests, creating an IDOR (Insecure Direct Object Reference) vulnerability.