FlexiSpy Spyware/Monitoring Apps

Sinai

So I've just made the switch and couldn't be more happy! GrapheneOS is the answer to modern day mobile security for sure.

However, I am still fighting blindfolded and have no idea how secure this device really is.

I was hacked for many years by my own (disowned) mother and her partner, they used some sort of spyware like FlexiSpy that monitored my Android phone completely. I am in my thirties.

Even after figuring this out, I bought a new (android) phone & sim without any paper trail and sim card attached to somebody else's name.

They still managed to hack me. So I bought a Pixel 6a. I'm running rethink DNS with a firewall (on top of disabling network permissions for most of my apps when unused) and a VPN on the rethink DNS app.

Although obviously more secure than a regular Android, I am still paranoid after all those years and damage done from being hacked.

I know that it is suggested to use either WiFi on airplane mode, or an Ethernet cable. I might do this, but I would still much prefer to carry on using my current sim as it is convenient to use outside of home, at a park on or on the metro etc.

If they were to know my new number, or use geolocation type of hacking - how safe is my GOS phone? Apparently all a monitoring service like FlexiSpy needs is your phone number to plant their stealthy spyware.

Am I secure with using GOS from spyware services on a phone number (sim) that could be known?
My router is def hacked too at home, would my GOS phone be safer on the WiFi network instead of the cellular network?

I'm not so worried about location tracking but more concerned about the actual monitoring of my device.

Any tips and answers to the concerns that I have would be much appreciated.

Thank you

flighty_sloth

Sinai It's HIGHLY doubtful that it would be installed remotely using only your phone number. Those sorts of exploits are typically very expensive and reserved for very high value targets and are tightly kept secrets by whoever may have it. These generic "spy" apps generally would need to be installed with physical access under most circumstances I would think.

de0u

Sinai Apparently all a monitoring service like FlexiSpy needs is your phone number to plant their stealthy spyware.

Skeptical. See: https://www.flexispy.com/en/flexispy-remote-installation-service.htm

Sinai

flighty_sloth

Hmm I don't know why you would say that it would be so expensive and can only be done with physical access with so much conviction?

I said apps like FlexiSpy, not FlexiSpy particularly.

Look here: https://spyx.com/

This is what the landing page says:

"Undetectable Phone Spy Solution
without Having Target Phone
photo
2023 latest release: more features, less trouble, real-time sync.
photo
No need to install any app on the target phone.
photo
Set up in just 2 minutes.
photo
100% secure monitoring anywhere, anytime."

Welcome to the jungle

de0u

Sinai Look here: https://spyx.com/

OK, I did. From their FAQ:

Q1: Do I need access to the target phone?

It depends. To use SpyX phone tracker, you need to have the iCloud/Google account, password, and verification code of the target iPhone or Android phone. If the same iCloud/Google account has been signed in on other devices before, you can use those devices to complete the verification steps. Access to the target phone is not always necessary.

de0u

Sinai Welcome to the jungle

You could sign up for one (or more) of those services and see if they can successfully penetrate a GrapheneOS phone remotely without any credentials. I suspect not, unless the service is provided by one of the extremely expensive shadowy companies who generally contract only with governments -- or unless the service is provided by a well-resourced criminal gang (also likely expensive, and risky to deal with).

There is lots of marketing hype on landing pages.

flighty_sloth

Sinai Anyone can claim anything they want, doesn't mean they can back it up. I say it's expensive because as others have said typically the main actors to actually have working remote exploits at a given time have been shadow organizations that charge obscene amounts of money for their tools/services. I wasn't referring to Flexispy specifically but also other tools advertised with sensational claims they can't back up.

EmLeX932

For SPYX atleast if you read trough their FAQ it dosen't need and app because they use google's cloud to do it. so they get mapdata and other stuff from the google account thats logged in on the phone. so not a real danger for graphene. and someone would need your google password to do it. or get access to some place you are logged in to autorize their service to your account.

And they get what's app data from the what's app cloud backups stored on your google. so you can encrypt that before upload, or just not use google cloud etc.

Seems pretty darn harmless or easy to fool if you know someone has done it to you especially on grapheneos and multiple users.

Sinai

de0u

Thanks for your suggestion, that's a pretty good one. I will try using their services for my own device.

Another couple of things, would GOS be safer on my data only sim or compromised router at home? The WiFi works well but it has def been hacked, wondering if with the Rethink DNS app running and the GOS device randomizing the MAC address - would my GOS phone be more secure on a compromised WiFi network or cellular network?

One last thing, apparently messaging apps like WhatsApp or LINE messenger are easily exploited, how safe would these apps be on a secondary profile on my GOS device?

Thanks again.

de0u

Sinai Would GOS be safer on my data only sim or compromised router at home? The WiFi works well but it has def been hacked, wondering if with the Rethink DNS app running and the GOS device randomizing the MAC address - would my GOS phone be more secure on a compromised WiFi network or cellular network?

MAC-address randomization is a privacy tool, not a security tool. Some SOHO routers don't handle it well when a lot of different devices visit in a short period of time, and MAC-address randomization causes one device to appear to be multiple devices, so turning off that privacy feature for one's home router is often useful.

If you must use a network you are actively suspicious of, a real VPN (which Rethink DNS is not) would probably be prudent. But it might be best to just not use a network if you have good reason to believe it is actively hostile.

de0u

Sinai apparently messaging apps like WhatsApp or LINE messenger are easily exploited, how safe would these apps be on a secondary profile on my GOS device?

If you must use a messaging app that you believe is actively hostile, one mitigation to consider would be isolating that app on a device that has nothing else installed on it (which could be powered off when not using that app).

A secondary profile on GrapheneOS is probably pretty good, and might be the best thing for your personal thread model and financial resources (and convenience requirements).

Sinai

de0u

I have downloaded protonvpn config files and that's been imported and used as a VPN on the the rethink DNS app (on top of a firewall and a DNS service).

Not sure what you mean by suggesting to turn off the privacy feature of randomizing the MAC address?

de0u

Sinai Not sure what you mean by suggesting to turn off the privacy feature of randomizing the MAC address?

Randomizing one's MAC address on one's home Wi-Fi network gains one basically nothing. It is not likely to be effective at protecting oneself from a home router one believes to be malicious. Meanwhile, it causes some home routers to become unstable. It is up to you whether or not to enable the feature, but enabling it will not increase the security of one's device on one's home network.

Randomizing one's MAC address improves privacy when one repeatedly visits a network run by somebody else that is visited by many other users, because it stops that network from identifying you across visits. It also stops that network from collaborating with other networks to track you.

Sinai

Its been really difficult and damaging especially after realizing that you've been hacked for years without knowing it.

Thanks guys for your considerate responses and helping me clarify my doubts.

To show some love to GOS I'll def start donating.

Have a great day wherever you are :)

antsyboy

I haven't seen anyone else mention this, but I'm sorry if I missed the mention of this, but make sure to use secure and different passwords for all your accounts and devices. These services seem to rely on having access either to the phone itself or the target's Google account. Making sure that no one but you can access these accounts is very important, so I would recommend changing your Google account's password and also changing your phone's passcode to something that you have never used before and haven't told anyone. Also make sure that no one watched you log into these accounts if that's something you're worried about, so try to stay away from things like cameras while unlocking your phone or accounts in general.

MoonshineMidnight

First thing on its main page SpyX markets itself for parental control. Spying on your kids. What is texted/emailed, who is contacted, what apps are used, what is browsed, location, etc. Essentially control of the device remotely. Thus, if you have a kid who holds on tight to their phone -- remote, secret access is a thing if the account is in the name of the parents and they pay the bills. That gives them a lot of control over the account legally and technically. OP stated age was 30's, but you still have a fair amount of people who are still on the phone plans of their parents at that age - and even if they don't live at home. Outside of these parents needing to get a life, I don't see a concern for GOS or any OS if you paid for the phone and service and control the account yourself. OP could afford to buy a 6a. Get on your own cell plan with Mint or similar for a few bucks a month and that should shut down any concerns.

Sinai

My phone (GOS) does not have an account attached to it, especially not google. I am 36 and use my own prepaid plan of course. These "parental monitoring apps" can be used by anyone, obviously people with malicious intent will use it for the wrong purpose. These services know this and love it as they get many people to buy their service.

I'm still concerned as I have been hacked in multiple ways, through messenger apps, compromised WiFi router, parental monitoring apps, and geolocation tracking.

I got my pixel 6a for around $215 USD (secondhand) - a very reasonable price to pay to ensure security and privacy after years of damage done by hacking.

Peace & Love

raccoondad

Sinai No 'parental control app' can be used without some kind of access to the device or an account the device uploads data to.

The parental control application you linked to for example ('spyx.com') uses the devices logged in google account to access the information. Its not like anyone can just access this information on command.

Every single piece of ~~abusive stalkerware~~ 'parental control apps' require at least some kind of access to the device or something the device is linked to. So just manage your phones physical security and what accounts are linked to it.

Just about every real world attack using stalkerware was done by accessing the device physically and unlocked, so just avoid that and you should be fine. Keep your passwords secure as well

Sinai

Nobody has ever had physical access to my device, I live by myself mostly. As I had mentioned in my first post I'm fighting blindfolded. But it was def a stealthy spyware app that was installed remotely. Anyway, not going back to regular android or iOS ever!

Still a bit concerned and paranoid with my current GOS phone, but if y'all say GOS is pretty safe then all good.

MoonshineMidnight

Sinai And I explained to you how it would happen remotely if you were on the cell plan of your parents and especially if they had the log-on credentials to your Google account. Also, some time back a lot of celebrities had their iPhone/iCloud accounts hacked to get dirty pics to post online due to weak passwords.

With GOS and strong 2FA passwords (use a password manager) for apps nothing is going to happen. Strong 2FA passwords will protect iOS or Google/Android user accounts from this too - and especially if you are on your own cell plan. So your problem is solved this way. Did not have to go to GOS to resolve this, but it's a great privacy/security OS to have. I can't imagine anything happening to you with what I have suggested when your threat model is your parents. And no, the NSA is not after you.