MacKeeper hacked: Data for 13 million accounts exposed
According to Vickery (who goes by the screen name FoundTheStuff) on Reddit, “The data was/is publicly available. No exploits or vulnerabilities involved. [Zeobit and Kromtech] published it to the open web with no attempt at protection.” Vickery found the vulnerability by doing a random “port:27017” search on Shodan.io.
Since his initial post on Reddit, Vickery has been in contact with the MacKeeper developers. Kromtech told Vickery that they have secured their databases. A post on the MacKeeper website states that the company “will continue to take every possible step to protect the data of our customers from the evolving cyber threats that companies both large and small face on a daily basis.” The statement also said that since MacKeeper uses a third-party merchant, customer credit card and payment information was “never at risk.”
MacKeeper is a Mac maintenance utility that has been scrutinized for its aggressive pop-up advertising on the web and the shady behavior by the company to promote the product. Users doubt the actual usefulness of the software and thousands were involved in a class-action lawsuit.
This isn’t the first time MacKeeper has been in the news for a security issue. In May, a hole in the software could let attackers execute malicious commands on Macs when their owners visit specially crafted Web pages. That vulnerability was fixed with a software update.
MacKeeper can be a difficult app to uninstall, and how to remove MacKeeper is one of the most popular questions received by Macworld.