TeenSafe is an app used by parents to keep an eye on their teenage children to make sure they are safe at all times. However, recently, some security issues have come to light.
First reported by ZDNet, two of the company's servers, which are hosted on Amazon's cloud service, were left unprotected without a password, meaning the accounts of thousands of parents and their children were exposed.
TeenSafe allows parents to monitor messages, access history, call logs, contacts, and third-party apps, including WhatsApp and Kik messages, while maintaining full control over their children's iPhones or Android phones. TeenSafe also allows parents to "spy" on their children's activity on the dating app Tinder.
Security researcher Robert Wiggins discovered the vulnerability in a server that contained 10,200 exposed files. The database contained the email addresses used to sign up for the TeenSafe service, as well as the email addresses (Apple IDs) of each child.
Additional information, such as the device name, its unique identifier, and plaintext passwords for the children's Apple IDs, were displayed in the database. TeenSafe requires two-factor authentication to be disabled in order to work, which meant there was plenty of material in the database for cybercriminals to extract.
No data such as photos, messages or location data belonging to parents or children was found on the server. The second server found only contained test data, and it is still unclear whether there are other unprotected servers.
TeenSafe blocked public access to its servers after being notified of the vulnerability by ZDNet and said it has "begun notifying customers who may have been affected.".
Teen tracking apps have been criticized in the past because they can undermine trust between parents and children and hinder the latter's ability to learn how to handle risks.
Despite the concern, however, TeenSafe boasts more than 1 million users in the US.
