On Sunday, white-hat hacker Chris Vickery announced on Reddit that he was able to access “13 million sensitive account details” on MacKeeper. MacKeeper is owned by Kromtech, who brought it from the original developer Zeobit.
According to Vickery (who goes by the screen name FoundTheStuff) on Reddit, “The data was/is publicly available. No exploits or vulnerabilities involved. [Zeobit and Kromtech] published it to the open web with no attempt at protection.” Vickery found the vulnerability by doing a random “port:27017” search on Shodan.io.
Since his initial post on Reddit, Vickery has been in contact with the MacKeeper developers. Kromtech told Vickery that they have secured their databases. A post on the MacKeeper website states that the company “will continue to take every possible step to protect the data of our customers from the evolving cyber threats that companies both large and small face on a daily basis.” The statement also said that since MacKeeper uses a third-party merchant, customer credit card and payment information was “never at risk.”
Chris Vickery provided this screenshot on Reddit as proof that he had accessed MacKeeper databases online.
MacKeeper is a Mac maintenance utility that has been scrutinized for its aggressive pop-up advertising on the web and the shady behavior by the company to promote the product. Users doubt the actual usefulness of the software and thousands were involved in a class-action lawsuit.
This isn’t the first time MacKeeper has been in the news for a security issue. In May, a hole in the software could let attackers execute malicious commands on Macs when their owners visit specially crafted Web pages. That vulnerability was fixed with a software update.
MacKeeper can be a difficult app to uninstall, and how to remove MacKeeper is one of the most popular questions received by Macworld.
Author: Roman Loyola, Senior Editor
Roman has covered technology since the early 1990s. His career started at MacUser, and he's worked for MacAddict, Mac|Life, and TechTV.