Google Finally Gets Around To Banning Ads For Stalkerware

from the i-spy dept

Stalkerware is one of those things that most people never would have considered when technologies were being developed, but which in hindsight come off as practically inevitable. These apps, often times named as if they would be chiefly marketed to parents trying to keep tabs on their kids, but which instead are also specifically advertised as ways to stalk current romantic partners and exes, are all different flavors of creepily allowing a person to snoop on the location and activities of an unsuspecting other person. The whole concept is so obviously evil that it's a wonder why any platform would allow these apps to be sold in the first place, and yet it was only in 2019 that Google managed to ban them from its app store.

Antivirus company Avast said Wednesday that it's found seven stalkerware apps available on Android's market. In all, they had been installed more than 130,000 times. Google removed four of the apps after Avast reported the privacy violations on Tuesday, and removed the last three on Wednesday.

Google said its policy prohibits commercial spyware apps and encourages people to report any apps that violate its standards.

Since then, Google has regularly had to purge new creepy entrants into the stalking marketplace, but it has done its best to keep up. Because, as Google stated in its policy above, such apps are prohibited on the app store.

But not in Google's advertisements, apparently, at least up until this past week.

In an ad policy update this week, Google said that beginning August 11 it will prohibit ads for products or services marketed for secretly tracking or monitoring someone. This includes, but is not limited to:

Spyware and technology used for intimate partner surveillance including but not limited to spyware/malware that can be used to monitor texts, phone calls, or browsing history; GPS trackers specifically marketed to spy or track someone without their consent; promotion of surveillance equipment (cameras, audio recorders, dash cams, nanny cams) marketed with the express purpose of spying.

Credit where it's due: Google's change in policy is good. And, given the massive ecosystem that is Google's advertising system, it's easy to imagine how the company might not have been initially prepared for the review and purges necessary to keep these sorts of ads off its platform.

But the truth is that's a massively weak caveat, given the nature of these ads. Reading Google's description of the types of ads that are newly banned, it practically yanks the follow up question out of your mouth: Wait, why did you ever allow ads for this sort of thing in the first place? As the Gizmodo post notes, Google has been aware of just how big a problem stalkerware has been on its platforms since at least 2018, and almost certainly before. How has this possibly taken this long?

Filed Under: ads, android, ban, stalkerware
Companies: google

Stalkerware Developer Demands TechCrunch Remove Article Detailing Its Leaking Of Sensitive Data

from the set-weapons-to-'backfire' dept

Last week, stalkerware purveyor ClevGuard was discovered to be hosting tons of sensitive data harvested from victims' phones in an Alibaba data bucket set to public with no password protection. ClevGuard makes KidsGuard, an app whose name suggests it's something parents can use to monitor their children's cell phone use, but the developer has helpfully noted the software's also great for monitoring spouses and employees.

After being notified of the issue, Alibaba secured the bucket and made sure ClevGuard was made aware of the problem. But ClevGuard's not finished being stupid about this. Rather than quietly go about securing its exfiltrated data -- which includes contacts, photos, GPS location data, and content harvested from a variety of messaging apps -- the company has decided it would like to raise its infamy level and ensure even more people know about its horrific stalkerware.

Zack Whittaker broke the news at TechCrunch, publishing a lengthy expose of both the product and its insecure data storage. And now ClevGuard is baselessly demanding he take down his article.

If you can't see/read the tweet, Whittaker says:

We just received an email from ClevGuard asking us to delete the two articles we published this week about the KidsGuard stalkerware, which has been used to spy on thousands of victims.

We declined.

Whittaker has also put together a how-to guide for removing this stalkerware from your device, which probably isn't improving TechCrunch/ClevGuard relations.

And while we're discussing ClevGuard, let's take a quick look at its marketing efforts, which directly contradict the End User License Agreement the company pushes on users.

Here are the limitations ClevGuard supposedly imposes on users, in all of its original, gloriously-broken English:

You comprehend that the Site and ClevGuard will be utilized just for the reasons for underneath (I) parental control of their kids, (ii) on a gadget, which is of your possession, under such situation, you should get authorization from the client being observed, (iii) other legal points as per the laws in your very own purview. The terms of Child is characterized as underneath:

Youngster: Your very own lawful kid that is under the legitimate age of 18 (as characterized by US law). The kid must be observed utilizing a perfect telephone that you possess. You can't screen a kid on the off chance that you hold one of the accompanying connections:

• Brother/Sister
• Step-Brother/Step-Sister
• Step-Father/Step-Mother
• Aunt/Uncle; Cousin/Nephew
• Grandfather/Grandmother
• Great-Grandfather/Great-Grandmother

Worker: Your representative at an organization you claim or a representative at indistinguishable organization from you and you have administrative duties regarding. The representative must be checked utilizing a perfect telephone claimed by the organization and issued to the worker under your organization's approaches with respect to organization telephones. The representative must give assent and be advised they are being observed before checking can start.

So, according to ClevGuard's own EULA, the stalkerware can only "legally" be used to monitor "youngsters" and "workers." (And only on "perfect telephones," which are generally only found in the Oval Office.)

But the company's quasi-blog suggests customers should use the software in ways that break the EULA, offering up reasons why KidsGuard is better than its competitors for stalking spouses and significant others. Here's a post detailing the "2 Best Ways to Track my Girlfriend's Phone," with KidsGuard beating out the built-in "Find My Phone" feature. Here's a list of the "10 Best Couple Tracker Apps" with KidsGuard topping the list. ClevGuard's site is full of "helpful" posts pushing KidsGuard to monitor something other than "youngsters" and "workers," suggesting it's not just "perfect telephones" that can be spied on with ClevGuard's software.

To sum up: ClevGuard is a terrible company offering a horrible product that can be abused to spy on nearly anyone without their knowledge. The data then -- until recently -- ended up in unsecured data buckets. But why should ClevGuard try harder? This sensitive data belongs to people being spied on. Screw them for being covertly surveilled, I guess. Nothing to hide, nothing to fear, etc. The bogus demand TechCrunch remove its article is just the expired icing on ClevGaurd's garbage cake.

Filed Under: data breaches, kidsguard, leaks, sensitive data, stalkerware
Companies: clevguard, techcrunch