Post: #151

I don't have enough popcorn for this.
My reaction
   
The people who used the site's current state of mind
   
Their partners reactions
   
The site's response
   
And divorce lawyers up and down the country
   

Post: #152

Pride goeth before the fall:

http://arstechnica.com/security/2015/08/...stigators/


Ashley Madison hackers leave footprints that may help investigators
People releasing more than 200,000 CEO e-mails left server interface wide open.

by Dan Goodin - Aug 22, 2015 9:10am PDT
Share Tweet
26

Enlarge / The Web interface for a server used to seed a BitTorrent containing more than 200,000 e-mails belonging the Noel Biderman, CEO of Ashley Madison parent company Avid Life Media.
Mr. Green
The people who leaked more than 200,000 e-mails from the Ashley Madison dating service for cheaters left behind footprints that will almost certainly be of interest to police and company officials.

The BitTorrent file containing e-mail for Noel Biderman, the CEO of Ashley Madison parent company Avid Life Media, was originally uploaded by someone using a server operated by Ecatel Ltd., a web host headquartered in the Netherlands. A Web interface for administering the BitTorrent server was left exposed to the Internet without a password, making it possible for outsiders to access. A few hours after the BitTorrent went live, the server went dark after an outsider accessed the wide-open interface and began making changes to the server configuration. The above screenshot, published by a Twitter user calling himself Mr. Green, is just one example of such an outside access.

"Somehow, the person(s) setting up the original uploading (=seeding) of the file forgot to password protect the Web interface, or turn the feature off," Per Thorsheim, an independent security researcher in Bergen, Norway, told Ars. "I suspect [the hackers] used the Web interface to administer the various uploads of the leaks using BitTorrent."

The box seeding the torrent was located at 94.102.63.121. Police and private investigators working feverishly to identify the people who hacked Ashley Madison and published user profiles, transactions, credit-card data, and a wide range of other sensitive data will almost certainly try to perform a forensic analysis of the physical server. They are also sure to check how the server was accessed. If the hackers didn't use Tor or a similar anonymity service, the investigators may be able to collect clues from the IP address used to log in to the box.

FURTHER READING


2ND DUMP FROM ASHLEY MADISON HACK TWICE THE SIZE, INCLUDES CEO E-MAIL
"You can admit it's real now," hackers taunt parent company's CEO.
So far, almost everyone downloading the torrent has been able to recover only 93 percent of the file. That's because the original seeder went dark and only one person appears to have downloaded the entire thing. That lone downloader also left the BitTorrent pool, leaving everyone else with only the partial copy of the original. Despite the download problems, multiple researchers have been able to unpack the file, titled noe.biderman.mail.7z. According to security firm TrustedSec, the 7z archive file leads to a 30-gigabyte file called [email protected]_[Gmail]_All Mail.mbox that contains more than 200,000 e-mails taken from the CEO's Gmail account. In all, the e-mail includes about 6,800 unique senders and 3,600 recipients. The torrent was originally published late Friday night or early Saturday morning, after the archive errors included in an earlier BitTorrent made it impossible to unpack the e-mail file.
In the few statements Avid Life Media has made public since the breach, company officials have vowed to vigorously track down and prosecute the people responsible. Ecatel promises to fiercely guard customer privacy and accepts anonymous BitCoin payments, so it's not clear how much success investigators will have. Still, if the people who seeded the BitTorrent left a Web interface wide open, there's no telling what other evidence they left behind.

Post: #153

(08-21-2015 09:19 PM)ThrustMaster Wrote:  

(08-21-2015 05:33 PM)The Beast1 Wrote:  So what's with all of this hubbub about the email and CC leak then if the torrents don't contain any personally identifiable data?

My comment was about the second 20gb file, the first leak 9.6gb does contain credit card information but only in CSV files (fully greppable) but the DB dumps don't unless you used actual information in your profile.

Thanks I found it now.

If you want to access the data that's available you'll need a MySQL server on your machine to load up the content. So far i'm not too curious about opening the archive.

Post: #154

A most amusing bust is Islamic apologist Hamza Tzortzis, now attempting damage control on Twitter.

Post: #155

If you were busted what would be your explanation?

I think mine would be, "I used it as a dating site before I met you"

Post: #156

(08-22-2015 02:47 PM)monster Wrote:  If you were busted what would be your explanation?

I think mine would be, "I used it as a dating site before I met you"

1. credit card fraud.
2. "I was curious heard about it on a news cast, logged in to look around - forgot about it..."

Post: #157

(08-22-2015 02:47 PM)monster Wrote:  If you were busted what would be your explanation?

Black Knight:

"I side with the Homosexuals: Puritan Morality is dead and should be forever mocked. Are you anti-gay?" #lovewins

Post: #158

Hack-inspired class-action suit filed in Canada:

http://time.com/4007374/ashley-madison-5...it-canada/

Quote:"Numerous former users of AshleyMadison.com have approached the law firms to inquire about their privacy rights under Canadian law,” the firms said in a statement. “They are outraged that AshleyMadison.com failed to protect its users’ information. In many cases, the users paid an additional fee for the website to remove all of their user data, only to discover that the information was left intact and exposed.

Post: #159

(08-23-2015 10:38 AM)JayR Wrote:  Hack-inspired class-action suit filed in Canada:

http://time.com/4007374/ashley-madison-5...it-canada/

Quote:"Numerous former users of AshleyMadison.com have approached the law firms to inquire about their privacy rights under Canadian law,” the firms said in a statement. “They are outraged that AshleyMadison.com failed to protect its users’ information. In many cases, the users paid an additional fee for the website to remove all of their user data, only to discover that the information was left intact and exposed.

Second I looked at that I knew it would be Strosberg. Hes the top dog in Canadian Class Actions. All the more impressive is that he doesn't even work in one of the major financial centers.

Post: #160

This database is going to be part of standard issue background checks for executive level hires, government, and finance roles before the end of the year.

If my information was listed in there, I'd get PR to counteract it ASAP to present the other side of the story - whether your excuse is that you were hacked, it's someone else with your name, marriage trouble, whatever.

Post: #161

Payback time:

Post: #162

I just googled "Ashley Madison names" for some sleazy boredom reading. One of the news stories that popped up "Wives React To Finding Their Husbands' Names".

Now, that may be slightly entertaining, but I'd much rather see husbands react to seeing their wives names on there...Couldn't find any stories on that.

I suspect women are more communicatively dramatic (emotions, words, blogs, etc...really fake drama that doesn't actually mean anything) whereas guys just check out emotionally (get a divorce, maintain status quo but go get a couple girlfriends, end any emotional relationship with wife).

That and the 'women are victims' mentality of the media.

Post: #163

(08-23-2015 05:55 PM)polar Wrote:  This database is going to be part of standard issue background checks for executive level hires, government, and finance roles before the end of the year.

IMO highly doubtful. Every C-level I know is banging or has banged at least some of his lieutenants' wives. Not.Going.To.Happen.

Besides any background search agency is subject to libel suits (they would also be subject to discovery rules) and wouldn't touch illegally gained information like this without a 10 foot pole.

Post: #164

This is why you always use a fake name and fake email account for your infidelities boys.

Post: #165

(08-24-2015 08:53 AM)ThrustMaster Wrote:  

(08-23-2015 05:55 PM)polar Wrote:  This database is going to be part of standard issue background checks for executive level hires, government, and finance roles before the end of the year.

IMO highly doubtful. Every C-level I know is banging or has banged at least some of his lieutenants' wives. Not.Going.To.Happen.

Besides any background search agency is subject to libel suits (they would also be subject to discovery rules) and wouldn't touch illegally gained information like this without a 10 foot pole.

Depends upon the company. Some use Business Intelligence detectives to spy on potential hires and potential promotion hires. Some follow you to your kids baseball games and make sure you are the family man you claim to be.

Post: #166

(08-24-2015 09:00 AM)TravelerKai Wrote:  Depends upon the company. Some use Business Intelligence detectives to spy on potential hires and potential promotion hires. Some follow you to your kids baseball games and make sure you are the family man you claim to be.

Unless there is an unspoken agreement between the agency and the employer, there's no way to get away with this legally. I'm thinking libel/slander laws and lawsuits. We're talking folks who have 5-10 million + US/monthly salaries here, they're not "fucking around" haha.

Post: #167

Predictably, people have started killing themselves because their details have been published:

http://www.bbc.co.uk/news/technology-34044506

Post: #168

(08-24-2015 09:05 AM)ThrustMaster Wrote:  

(08-24-2015 09:00 AM)TravelerKai Wrote:  Depends upon the company. Some use Business Intelligence detectives to spy on potential hires and potential promotion hires. Some follow you to your kids baseball games and make sure you are the family man you claim to be.

Unless there is an unspoken agreement between the agency and the employer, there's no way to get away with this legally. I'm thinking libel/slander laws and lawsuits. We're talking folks who have 5-10 million + US/monthly salaries here, they're not "fucking around" haha.

Books have been written about this. Like this one:



Very good book by the way. I highly recommend it.

Post: #169

Post: #170

Quote:IMO highly doubtful. Every C-level I know is banging or has banged at least some of his lieutenants' wives. Not.Going.To.Happen

Quote:We're talking folks who have 5-10 million + US/monthly salaries here, they're not "fucking around" haha.

Actually, it sounds like they are.

(08-24-2015 11:13 AM)TravelerKai Wrote:  

(08-24-2015 09:05 AM)ThrustMaster Wrote:  

(08-24-2015 09:00 AM)TravelerKai Wrote:  Depends upon the company. Some use Business Intelligence detectives to spy on potential hires and potential promotion hires. Some follow you to your kids baseball games and make sure you are the family man you claim to be.

Unless there is an unspoken agreement between the agency and the employer, there's no way to get away with this legally. I'm thinking libel/slander laws and lawsuits. We're talking folks who have 5-10 million + US/monthly salaries here, they're not "fucking around" haha.

Books have been written about this. Like this one:



Very good book by the way. I highly recommend it.

All the agencies need is one source in the public domain. They don't need to claim an exact match. Something like this will do:

Quote: A blog by Linda East, a self-described "feminist fatass" and "journalist", published the complete alleged records of men implicated in the Ashley Madison hack. This list included three people by the name of John Doe, one of which resides in West Bumblefuck, Nebraska, who supposedly solicited BSDM encounters and rape reenactments from at least four women on the website. His dating profile was described as "extremely misogynistic" by Linda.

Please note that the candidate under investigation, Jonathan Doe, also resides in Bumblefuck, NE. Local newspapers and public records indicate that he recently underwent a divorce in which his wife claimed adultery as the reason.

All the agency needs to do is cite publicly available information and provide a CYA disclosure like

Quote:This allegation could not be independently verified and may be a name match only.

Yes, this is an exaggeration, but if even a fraction of this shows up in the background check, Mr. Doe, JD, MBA, etc. isn't getting the job. The official reason will just be that "someone else was a better fit with the company culture." HR can always spin a reason.

If your name is unique, like Abdhul-Amir Chin-Khan-McAndrews? That shit will be on the first page of Google, and good luck playing the "common name" card.

Post: #171

John McAfee offers his take. I thought the same thing - makes perfect sense. If he's half right, they'll catch the perp in short order.

Quote:Yes, it is true. Ashley Madison was not hacked - the data was stolen by a woman operating on her own who worked for Avid Life Media. The reason that I am so late to the second act of the Ashley Madison affair is that, without a supercomputer, it has taken over a week to finish the analysis of the massive data dumps that the perpetrator has so generously provided us with.

A hacker is someone who uses a combination of high-tech cybertools and social engineering to gain illicit access to someone else's data. But this job was done by someone who already had the keys to the Kingdom. It was an inside job.

More about the Ashley Madison leak
How to download and search leaked adultery website database email addresses [Update]
Hack as it happened: Who is named in cheating site's big data leak?
In my first IBTimes UK article about Act One of the Ashley Madison Affair, I alleged that the group of hackers claiming responsibility for the "hack" simply did not exist. I gleaned this information from reliable sources within the Dark Web – which have yet to fail me. I also claimed that it was the act of a single person.

Any adept social engineer would have easily seen this from the wording in the first manifesto published by the alleged hacking group. I was one of the first practitioners of social engineering as a hacking technique and today it is my only tool of use, aside from a smartphone – in a purely white hat sort of way. But if you don't trust me, then ask any reasonably competent social engineer.

Lone female operative

Today, I can confidently claim that the single person is a woman, and has recently worked within Avid Life Media. I have provided IBTimes UK background information and pertinent elements of the woman's data dump to prove both my access to the data and also to confirm elements of my research, under the strict conditions that it is to be referenced and then destroyed. The data I provided included such delicate material as the decoded password hash tables of every Avid Life and Ashley Madison employee, which I have also now destroyed.

How did I come to this conclusion? Very simply. I have spent my entire career in the analysis of cybersecurity breaches, and can recognise an inside job 100% of the time if given sufficient data - and 40GB is more than sufficient. I have also practiced social engineering since the word was first invented and I can very quickly identify gender if given enough emotionally charged words from an individual. The perpetrator's two manifestos provided that. In short, here is how I went about it.

How did I discover that it was an inside job? From the data that was released, it was clear that the perpetrator had intimate knowledge of the technology stack of the company (all the programs being used). For example, the data contains actual MySQL database dumps. This is not just someone copying a table and making into a .csv file. Hackers rarely have full knowledge of the technology stack of a target.

Strange files

More important, large companies are heavily departmentalised, in spite of having centralised databases. When a hacker gains access to any corporate data, the value of that data depends on which server, or sometimes a single person's computer, that the hacker gains access to. For example: the personnel work scheduling for equipment maintenance will normally exist only on the workstation of the maintenance manager.

Likewise, the data for options for stock shares in a company, an extremely private set of data, will exist only in a private file on the workstation of the VP of Finance, or the CEO, or possibly both. It would require an equal amount of work to gain access to the personnel schedule for maintenance as it would to acquire a list of potential corporate owners. Hackers don't have all the time in the world, so they pick and choose wisely. Among the data that the perpetrator released is the following:

An office layout for the entire Ashley Madison offices. This would normally exist only in the office of personnel management, the maintenance department, and possibly a few other places. It would certainly not be in the centralised database. Neither would it be of much value to the average hacker.

Up to the minute organisation charts for every Avid Life division. This might be of value to certain hackers, but considering the hacker had already made off with everyone's credit card info, billions of dollars worth of blackmail information, every private email of the CEO (fascinating, by the way), and everything else of value, it would seem odd to dig up the organisation charts as well.

A stock option agreement list, with signed contracts included. The hacker would have had to gain access to the private files of the CEO or the VP of Finance to obtain this material – a job requiring as much time to implement as a hack of the centralised database. Again, of what value would this be considering the hacker had already made off with potentially billions.

IP addresses and current status of every server owned by Avid Life – of which there were many hundreds scattered around the world. Why any hacker would trouble themselves with such a task, considering what was already taken, is mind boggling.

The raw source code for every program Ashley Madison ever wrote. This acquisition would be a monumental task for any hacker and, unless the hacker planned on competing with Ashley Madison, has no value whatsoever.
These are just a few of the many strangely included files that would take even a top notch hacker years to gather, and seem to have little or no value. Any reasonable cybersecurity expert would come to the conclusion that only someone on the inside, who could easily gain all of the files through deception and guile, could have done the job.

If we include the fact that the perpetrator's two manifestos clearly state a strong personal dislike of the VP of Information Technology (whom the perpetrator referenced as having made specific comments in the past) and the CEO, and specifically names employees that are liked and are doing a good job, then it seems, without a shadow of doubt, to be an open and shut case.

As to gender of the perpetrator, there were a number of telling signs in the manifestos. The most telling was a statement calling men "scumbags" (for those readers that don't speak American/Canadian English, this is a word that only a woman would ever use to describe men). In a separate section, the perpetrator describes men as cheating dirtbags. I think in any language this would suggest that a woman is speaking.

If that fails to convince you, then this must: In the first manifesto two names of male members were released. In describing one of them the perpetrator states the he "spitefully" joined Ashley Madison the day after Valentine's Day. Anyone who ever had a significant other knows that women rate Valentine's Day higher than Christmas, and men think so little of it that they have to remind each other the day is nearing. To call an act the day after Valentines Day "spiteful", is a thought that would enter few men's minds. If this does not convince you then you need to get out of the house more often.

I must, at this point, thank my lead data analyst, Jacque Donahue, for working 24-hours-a-day for the past few days helping analyse more than 40GB of data.

I think McAfee is a member of this forum somewhere.....

Post: #172

What are the chances that she'll be unmasked?

Post: #173

^ Great find Slickyboy. Glad McAfee is still at large

Post: #174

(08-25-2015 01:44 AM)MMX2010 Wrote:  What are the chances that she'll be unmasked?

Not guaranteed, but much greater than you'd think. I read somewhere that the "hackers" left a big, obvious back door open, making it easier for the FBI and RCMP to narrow their search. Since most hackers are male and the manifesto is so female, it's likely just a pissed off insider who had too much access. It also could have been in combination with a real hacker on the outside to aid in the exfiltration of the data. Throw in the $500 million dollar reward for their capture and makes it unlikely they'll stay anonymous for very long.

Like Thrust suggested, they went too far when they took software and IP along with the rest - this is industrial espionage.

Post: #175

So has all the code for Ashely Madison and Established Men been posted up for download?