Virtual Keyboard Developer Leaked 31M Client Records | Hacker News Reader

Virtual Keyboard Developer Leaked 31M Client Records

mackeepersecurity.com

226 pointsdanso72 comments

These guys write Mac malware for a living and use nefarious tactics to fool users into installing it, while making it really hard to uninstall. I've seen it on the Mac of many less technically inclined people.

Things like: “your Mac has been infected, click here” while the user is downloading some torrent or watching porn. Faking the system's dialog boxes, using chatbots “is your Mac slow?”, etc.

I'm amazed Apple hasn't banned them from the Mac App Store. I don't know how these people sleep at night.

MacKeeper ads was the reason I finally started using AdBlock. Terrible advertising (including modal alert popups) seemingly optimized to mislead computer novices, and many forum posts out there asking "How do I get rid of this thing."

> I don't know how these people sleep at night.

Are you talking about Apple management or the malware developers?

Not the GP, but...yes. ;)

Yeah. Either they have really strong connections at Apple or Mac App Store is more of a ghost town than I'd like to admin.

Never attribute to malice…

Interestingly, one of my family members just fell for one of their "DOWNLOAD" ads, while doing some work for a class. She installed it, thinking it was an app for the class, and I had to wipe all of the junk it installed.

After that, I installed uBlock Origin for her.

Yes, really.

They're the worst.

There's a possibility that its affiliate advertisers to blame.

One day we will find out what Windows 10 sends home too. Is it "only" ad tracking data like ads, or what several security advisors suggest it acts like a key logger?

The problem I see, a smartphone is me thing. A PC of your lawyer, your doctors is a hell another dimension. And unfortunately it's a group of jobs like these that run on Windows Professional often without an admin or AD server. Guess what, it's a wet dream for them.

>When researchers installed Ai.Type they were shocked to discover that users must allow “Full Access” to all of their data stored on the testng iPhone, including all keyboard data past and present. It raises the question of why would a keyboard and emoji application need to gather the entire data of the user’s phone or tablet?

I have a suspicion that due to how cheap bulk storage is these days, that companies collect as much information as they can get away with in hopes that _maybe_ it will be useful one day. That mixed with poor security practices is just going to keep leading to these sorts of events happening.

I thought most keyboards at least ask for Full Access, though may not necessarily mandate it:

https://techcrunch.com/2014/10/04/everything-you-need-to-kno...

I was never sure what "Full Access" meant, other than keyboard data (including keystroke recording if the dev wanted it) going forward. But surely it doesn't mean everything, as in access to keyboard-non-related data (user photos, etc).?

The documentation for that is here:

https://developer.apple.com/library/content/documentation/Ge...

The gist of it is that requesting "full access" allows them to access the internet and some other bits automatically, but they need to ask for further permissions for photos, location, contacts, etc.

Yep, it's not everything, but "full access" gets a scary name because when you give your keyboard a network connection it can easily log and send off all of your passwords. Very few things on iOS have that level of access.

iOS doesn't allow custom keyboard to be used for password inputs. Any input element which masks the users input will only open with the iOS stock keyboard.

Oh, that's a good policy. Wasn't aware since I use the stock keyboard everywhere.

I tried some alternate ones for swype style typing, but frankly they were all worse than the stock Google keyboard from my days on Android so I gave up on it and learned to type with my thumbs again.

If you haven't tried it, Google's GBoard is now on iOS and is quite good.

Thanks for the recommendation! It does seem good.

Bummer that it has a giant search bar at the top of the keyboard, which is an enormous waste of space on an iPhone SE. If you don't give it full access, the same space is used to constantly beg for full access to turn on the search bar, and accidentally touching that will pull you out of your app over to the Gboard app, which gives you a button to open the Settings app.

I can see why they do it. No way to serve ads to the keyboard, so searches are the only way to make money off of it. Shame they had to crap it up though, I'd have happily paid money for this keyboard, but I think I'll have to pass.

In keeping with this thread, I'm not that into the idea of giving Google access to my keystrokes even if they pinky-swear to not use them. We're talking about the same company currently being sued for deliberately working around iOS's privacy protections:

https://9to5mac.com/2017/11/30/google-safari-work-around-cla...

On Android, this search bar can be disabled. Maybe it's the same on iOS.

Doesn't look like it. The "Search" section in their settings has options to disable Predictive search, enable Contacts search, turn on location access, Clear Gboard search history, or Reset Google Usage ID. No way to disable the whole bar.

EDIT - the search prompt actually only pops up if you bump the G button at the left side, otherwise the bar is text predictions once you start typing. Maybe I'll give this a shot.

Android version definitely lets you disable the G button. It's listed right next to the "Predictive search" setting, so I'm fairly sure this can not be disabled on iOS. https://www.ghacks.net/2016/12/19/remove-g-button-android-ke...

Haha, give all your info to Google and Apple at the same time.

Per all the discussion here, Google can't get your info unless you grant "full access" to the keyboard

This is why I'm a believer in this type of regulation - you have two options:

1) Collect only the data strictly necessary for the functioning of the service. If you suffer a data breach, you used security best practices, and notified the corresponding authorities and your users in due time, then you shouldn't be punished at all, with very few exceptions. If you didn't use best security practices, you may see some small to moderate fines, depending on each case.

2) Collect whatever you want (while still mentioning it in your Privacy Policy, and the whole thing). But if you suffer a data breach, and that data is exposed, you should need a big fat banking account to survive the fine that will be imposed on you. The fines should be big enough that they should deter even the big players from collecting too much of the data they don't need.

Absolutely. Good regulation is that which effectively disincentivises anti-consumer behavior. Businesses are playing risk/reward games all the time, and regulation should just pile on some huge extra risk in places where it's needed to protect consumers, and the health of the market as a whole.

This risk/reward mechanism works only for large, established companies. There is no real responsibility for a startup. If they make a mistake and are caught, they can shut down the company and start a new one with the same staff.

That only works if you and the developer are in the same legal environment.

I think it should be other way: in many countries surveillance is prohibited. The developers who collect those data should be treated the same way. And their software should be treated as a spyware.

UPD: For example, we often hear news about hackers from some Eastern European country that were obtaining personal information in large quantities. Their actions are very similar to what the developers of this keyboard did.

GDPR is effectively forcing companies into #1 (at least those who operate in Europe with some minimum # of employees)

Also those that have European customers!

"all keyboard data". for a keyboard app? seems right on point. why wouldn't it want it?

With the basic permissions the keyboard can only type, it has no capability to send the keystrokes out to the internet or store them where they could be sent.

If you don't trust the keyboard developer to not be an idiot with your keystrokes, better to not give that access.

why would you ever install a keyboard from someone you don't trust?

Security is one reason. You need to be able to put absolute trust in the developer of the keyboard.

What past data is being stored?

Is this simply frequently typed emoji/words?

Past data is useful for building a personalized typing and autocorrect model from the get go. That's the key conviency vs. security/privacy concerns tradeoff for many if these keyboards.

Could it be made illegal to store personal information of users? Or even just restricted to particular industries? How many services do you use that even need it?

Sure could. If I'm not mistaken, Europe does that to some extend.

I have a hard time believing this company is GDPR ready.

This is an Israeli company. What were they doing with the data before they leaked it? Who were they selling it to?

One of the revelations that came out of the "binary option" fiasco is that it's legal in Israel to scam non-Israelis.[1] Financed by the binary option industry, which is 40% of Israel's financial sector, Israel's organized crime sector has become much larger. They need sucker lists for marketing. Data from phones is a good way to figure out who has spare cash.

Although a recent law change in Israel is expected to shut down the binary option industry next January, the law is very narrow. The scammers are moving to "forex" and initial coin offerings.[2]

[1] https://www.timesofisrael.com/knesset-committee-to-vote-mond... [2] https://www.timesofisrael.com/cryptocurrencies-may-be-the-ne...

Note: This story was co-published with ZDNet. I know "MacKeeper" is not a brand loved by all, but I chose to link the version from the MacKeeper Security blog rather than ZDNet, because of how the latter blasts users with an autoplay video: http://www.zdnet.com/article/popular-virtual-keyboard-leaks-...

> I know "MacKeeper" is not a brand loved by all

And the understatement of the year award goes to...

I am old enough to remember that keyloggers used to be a stealthy install. Now users install them willingly, giving it full permissions.

What an amazing future we live in.

In the past, a keyboard was a physical thing with keypresses that were just keypresses. You could pick out what physical keyboard you wanted based on some preference, but it was up to the OS to determine input events from the keyboard. It's a whole different ballgame now.

Aside from the spacing/layout/etc. preferences from a soft keyboard, they function differently. Samsung's default keyboard is by far the worst thing to work with from a development standpoint. I've never had an issue working with any other soft keyboard, but the way Samsung handles certain input events is orthogonal to other major keyboards.

Yeah, well I remember when I had to punch drivers in via the front panel before I could even use my keyboard.

On the good side, those drivers didn't have Internet connection capability.

Or so you thought.

I wrote a Flakey Keyboard Simulator for the Apple ][ to annoy my brother.

I wanted a little USB dongle that would turn any keyboard into a Dvorak keyboard so I could make pair programming easier on our group (3 Dvorak typists out of 8 people).

I found some, but I realized the hardware was basically a keylogger with a little extra code. Made me too uncomfortable to suggest it to my coworkers.

I wonder from a societal point of view how data is put into the "public" and "private" camp. This is one of hundreds of leaks, and there are many more thousands to come over the next decade. It's to the point where I just assume my contacts, keyboard data, location history, voice searches and more are just public and somebody has access.

Apple, Google, Microsoft have shown no interest in wanting to actively prevent these apps from being on the app store [1], [2], try spotting the fakes.

And the fact that there is no legislation against this behaviour, and there's no real way to punish leaks like this in a purely objective way.

Welcome to the 21st century I guess?

[1]: https://fnd.io/#/us/search?mediaType=ios&term=whatsapp

[2]: https://play.google.com/store/search?q=whatsapp%20messenger&...

Well, privacy is not binary. Nothing is ever fully public or fully private. Something being more or less private just describes how hard it is for someone to get this information. The inertia of this information.

Do they have to drive to your house to find out where they can break in or can they see from Google StreetView? Do they have to collect a whole bunch of phone books to find out your name+number or is it readily available in a dataset online? Can they just access your PC without hindrance or do they need to strap you to a torture rack to get your password out of you?

And just as well, information loses value over time. Either because it's not anymore correct / particularly relevant, or because it's covered up by more accessible information.

Why worry about fingerprinting one user's browser when billions of people don't even clear their cookies? Why sift through a data leak of 10000 people when a data leak with millions of people is just as well available? Why try to steal the identity of that guy who's data got leaked in one data leak, if there's this other guy with cross-referencable entries in 8 data leaks?

As such, it's still always going to be worth something to try to reduce your data footprint. If you're smarter about your data than most other people are, you'll stop being interesting to data brokers, because you're just too much effort.

I'm still mostly just wondering why the hell a company that does shady advertising and pushes adware is doing security write-ups.

"Researchers were able to access the data and details of 31,293,959 users"

Welll... i wonder whether they kept all that data?

> Summary of what the database contained:

> Phone number,

> full name of the owner,

> IMEI number

> links and the information associated with the social media profiles (birthdate, title, emails etc.)

What's wrong with their users? Why would a keyboard app need this information?

At least I would not install an app requiring those permissions. And I allow the Android phone to connect to the Internet only via my firewall (of course Google servers are blocked from the start).

You do realize that probably 99.9% users don't go to lengths such as firewalls to secure their data. People are not that tech savvy in general. Even among all my tech friends, no one uses VPNs or firewalls.

Leaking customer data is one thing but the article mentions the app also collected contacts from these phones. And that was leaked too!

Really, you’re going to treat Mac "Keeper", well-known malware, as a legit source for security info? Really? Really?

Can someone clarify whether 'Full Access' allows logging of keystrokes on the standard keyboard by these developers? Or doe they just get to see which Rick and Morty gifs I search for when I switch to their board?

Full access permits the normally sandboxed keyboard app to access the internet so in theory means the app developer could have the keyboard log and send all keystrokes

But the third party keyboard can't access the default keyboard (or any other third party keyboard for that matter).

Full Access grants the 3rd party keyboard access to what the user type or paste, but just for the 3rd party keyboard, not the system or other 3rd party keyboards. The 3rd party keyboard can send the data to the internet. Source/Disclaimer: I'm writing an iOS extension Keyboard

"Data is the new oil."

These are the new oil spills.

There need to be a limit on telemetry, eg what data programs collects about you. This is not something new though, but hard drive space is getting cheaper so it's possible to store even more data. All this data is a gold mine for marketing, knowing what you search for, what you have on your hard drive, all your friends, and social contacts.

That's scary. It also made me think of a certain online only grammar checking service that sounds like it could be registered in Libya, where everything you type is sent to their service. Madness - in my mind, at least; their site says nothing about how they protect their customers' data.

The problem is not the software, or how data is handled. There is no such thing as secure data that has been "published". The problem is people accept this level of snooping by software or are ignorant to it.

Does someone know a good keyboard on Android, that doesn't send all your keystrokes to the internet?

This systematic data collection is really annoying and hard to avoid today.

2-step authentication is a must these days, when they can leak keyboard typing, your password becomes useless.

But they are also leaking your phone number next to your keystrokes, so 2FA based on text messages is also broken. (To attack/reroute SS7, the subscriber number is all you need – which isn't much of a secret, but mostly public data, anyway.)

This little comment about Mongo really bothers me... I disagree that it's a flaw. It's obviously the fault of the tech team for not securing the DB

"One flaw is that the default settings of a MongoDB database would allow anyone with an internet connection to browse the databases, download them, or even worst case scenario to even delete the data stored on them"

Insecure by default is flawed by default.

Unless a product requires certification to use it can’t rely on expert knowledge to provide safety.

If you don't bother to read the manual for a piece of software upon which your business depends, that's your own fault.

Imagine that you created a tool that had all security features enabled. The usability of it would be incredibly low and barrier of entry so high that rarely anyone would use your tool. The idea behind allowing "open access" is to allow for a new user to learn the most important aspect of your tool by realizing what problems it solves.

Of course, from a security standpoint, people will still make mistakes like this, but the onus is NOT on the tool developers. They make it configurable for a reason.

Sorry, a world where every tool is riddled with security holes by default and every developer needs to learn them inside and out to close them all through configuration is a ridiculous burden.

Is it really that difficult to require someone to set a secure password before a product is usable?

I agree completely. One must know their tools before they can use them safely. Ask anyone who has used a saw.

Reply on news.ycombinator.com