The short version of this: A security researcher claimed to have downloaded sensitive info from 13 million MacKeeper accounts.
I have recently downloaded over 13 million sensitive account details related to MacKeeper, Zeobit, and/or Kromtech […] stuff like names, email addresses, usernames, password hashes, computer name, ip address, software license and activation codes, type of hardware (ex: “macbook pro”), type of subscriptions, phone numbers and computer serial numbers.
The researcher, Chris Vickery, contacted the companies hosting the insecure data, and the companies eventually sealed up the security holes.
This story is receiving a lot of press, at least in part, because of the strong feelings people have about MacKeeper. From the MacKeeper Wikipedia page:
MacKeeper is a utility software suite for Mac OS X. It is heavily promoted and has been the subject of a class-action lawsuit for false advertising. Some reviewers say that MacKeeper secures and optimizes a system, while others say that crash-prone Macs can be cured by removing MacKeeper.
And:
In January 2014 a class action lawsuit was filed against Zeobit in Illinois. The lawsuit alleged that “neither the free trial nor the full registered versions of MacKeeper performed any credible diagnostic testing” and reported that a consumer’s Mac was in need of repair and was at-risk due to harmful error. In May 2014 a lawsuit was filed against Zeobit in Pennsylvania, alleging that MacKeeper fakes security problems to deceive victims into paying for unneeded fixes.
Karma.
Wait, 13 million people bought MacKeeper? SMH
It baffles my mind that fake flash update ads that installs MacKeeper aren’t marked as fraudulent by browsers and ad blockers. I know so many people whose Mac is infected with MacKeeper.
Wait a minute… there seems to be a misunderstanding. You (and all other media outlets reporting about this) say
“A security researcher claimed to have downloaded sensitive info from 13 million MacKeeper ACCOUNTS.” [emphasis mine]
but the researcher actually said:
“I have recently downloaded over 13 million sensitive account DETAILS […] stuff like names, email addresses, usernames, password hashes, computer name, ip address, software license and activation codes”
So he’s clearly not talking about 13 millions separate accounts, but 13 millions single bits and pieces, belonging to probably a much smaller number of actual accounts.
Sure, it’s much more clickbaity to talk about “13 million accounts”, and that’s why all media sites are reporting this wrong. I feel it’s worth pointing out that, again, the actual facts are ignored in order to have the bigger story.
No, take a closer look at that screen shot. It’s a database listing showing that the ‘users’ table has 13 million rows., so yes, 13 million accounts, which says something for selling fraudulent software as a business model….
Copy Paste Journalism by Dave Mark
You can read the actual facts here: https://mackeeper.com/blog/post/173-mackeeper-security-advisory