Securus is the widely abused location-tracking tool that exploits a loophole in privacy law to allow police to extract realtime and historical cellphone location data without a warrant or any accountability.
Such a tool has enormous power for abuse by criminals as well as dirty cops: it’s a stalker-rapist’s best friend, an all-clear system for housebreakers, and the perfect snoop for blackmailers and voyeurs. So let’s hope they’ve got really good security!
A hacker has provided Motherboard’s Joseph Cox with login credentials for Securus. The hacker says it was very easy to obtain these, because Securus has really bad security.
The hacker who breached Securus provided Motherboard with several internal company files. A spreadsheet allegedly from a database marked “police” includes over 2,800 usernames, email addresses, phone numbers, and hashed passwords and security questions of Securus users, stretching from 2011 up to this year. A hash is a cryptographic representation of a piece of data, meaning a company doesn’t need to store the password itself. But the hashes themselves were created using the notoriously weak MD5 algorithm, meaning attackers could learn a user’s real password in many cases. Indeed, some of the passwords have seemingly been cracked and included in the spreadsheet. It is not immediately clear if the hacker that provided the data to Motherboard cracked these alleged passwords or if Securus stored them this way itself.Most of the users in the spreadsheet are from US government bodies, including sheriff departments, local counties, and city law enforcement. Impacted cities include Minneapolis, Phoenix, Indianapolis, and many others. The data also includes Securus staff members, as well as users with personal email addresses that aren’t explicitly linked to a particular government department.
Hacker Breaches Securus, the Company That Helps Cops Track Phones Across the US [Joseph Cox/Motherboard]