6 ms·

'More Ashley Madison' data leaked onto dark net

44 points by benevol 11y ago

nickysielicki 11y ago
In the comments on the TPB torrent of the original leak people were debating the legality of downloading/having this information on their computer. Irony of that situation aside, if I was interested in studying these leaks how much legal danger would I be putting myself in by grabbing them? I'm US based.
- deleted 11y ago
  [deleted]
- fweespeech 11y ago
  Minor but they would win if they sued you.
- soylentcola 11y ago
  Guess it depends if anyone is being paid to log the IPs in the swarm and do anything with them. I'd imagine if you treat it like downloading a TV show or something and use a suitable VPN you'll be mostly fine. Probably just comes down to how much someone is willing to pay to go after people downloading it. Otherwise I expect others to analyze the dump and publish their findings in less dodgy formats.
  - toomuchtodo 11y ago
    I'm logging IPs of the swarm for funsies. Might come in handy in the future.
    - hkon 11y ago
      Yes you can "release" that as a torrent as well
      - toomuchtodo 11y ago
        It'll get dumped into the internet archive at some point.
- e40 11y ago
  It's really hard to imagine that AM would go after the downloaders. That would be like pour oil on a fire. Imagine the extra amount of publicity their idiotic security would get.
  - amyjess 11y ago
    They're already DMCAing tweets that contain excerpts from the data. (side note: every time I hear "AM", I think "Aggressive Menace", which sounds about right)
  - differentView 11y ago
    They won't survive this.
wanderfowl 11y ago
Maybe I'm naive, but I'm hoping that the lawsuits from this will be the start of a push for data-breach insurance, and that the insurers, as Bruce Schneier has been advocating for many years, will force the security that the marketing VP doesn't see the need to pay for.
- xlm1717 11y ago
  Maybe you are naive, but you are certainly not as naive as the marketing VP who didn't see the need to pay for security, and is today watching in horror as his business is getting hacked to hell.
  - siegecraft 11y ago
    Is this marketing VP a real person or just a hypothetical scenario? Because it doesn't make any sense to me that a marketing VP would have any decision making power about the need for security.
    - Kalium 11y ago
      In corporate life, what makes sense and what's true are sets that rarely overlap as much as you'd hope.
    - shaggyfrog 11y ago
      In my experience, non-technical stakeholders can have disproportionate authority over technical decisions. For example, if a security best practice results in slower logins, the development team could get immediate pushback to speed up the process, even at the risk of weaker security. Risk can be difficult to quantify, and if the focus is on chasing the short-term, you might be told to damn the torpedoes and get the product launched.
      - iofj 11y ago
        In every programmer's experience, security can have a disproportionate amount of influence. For instance, they are unwilling to do any real development, yet have the authority to demand their stuff be used. There is no reason any authentication process has to use more than a single request + single response (and a single request and immediate reply from the auth server). The usual concerns like replay attacks, allowing third parties to relay data for the auth server can all be solved using encryption. In 15 years of working as a developer, I have encountered one company that actually does this both correct and fast. Security departments demanding that user authentication happen over an LDAP+Kerberos connection, for example, are commonplace and this is stupid and very slow, for no good reason.
rjurney 11y ago
Its hard to feel too bad for the victims of these attacks, given that their behavior hurts others. Oh wow I think I'm getting old.
- DarkTree 11y ago
  Yeah, you certainly don't have to feel bad for the victims, but we should all question whether the hackers are producing an overall net positive effect.
  - xlm1717 11y ago
    Well, if you believe the hackers' motivation for doing this, I don't think it's about producing an overall net positive effect at all, just righting some perceived wrongs. The perceived wrongs are not that AshleyMadison enabled married people to cheat on their spouses. What the hackers have said was their motivation is that AshleyMadison has lied to their users about the userbase, which is supposedly 90+% male, most of which have likely not engaged in an affair since most of the accounts they would interact with are supposedly fake. I don't think a net positive effect can come from this.
- cli 11y ago
  Note that about 40% of those accounts state that they are single. http://dadaviz.com/s/ashley-madison-revealed http://dadaviz.com/s/ashley-madison-revealed
  - nfoz 11y ago
    Do you think it's ethically appropriate to look at the leaked data? Do you think it's ethically appropriate to analyze the leaked data, and publish those analyses for personal gain (which is what this site did afaict) Do you think it's ethically appropriate to read about analyses performed on the leaked data by the above? I honestly don't know how I feel myself! Very curious what other people think about this.
    - Kalium 11y ago
matheweis 11y ago
When this happened to SONY, they went dark immediately and rebuilt from the ground up... Seems to the be the "right" approach, as opposed to business as usual from ALM. You have to wonder if they aren't still infiltrated.
untog 11y ago
I'm surprised - though perhaps not really - to see that this new data contains the CEO's e-mail. If the aim was to punish Ashley Madison (as the leak team have suggested), why not leak that first, before customer details and credit card transactions?
- deleted 11y ago
  [deleted]
- nostrademons 11y ago
  Attention. Get people to pay attention because the leak of customer data is personal (it'll probably affect you or someone you know), and then release the really damaging data once the press cycle has started and everybody's looking for more information. The Snowden leak had a similar structure: it started out with PRISM (which affected every American, and caused widespread indignation), then Snowden claimed responsibility (trying to get out ahead of official government investigations, putting a human face on the leaker and controlling the messaging), and then they followed up with a number of even more damaging leaks (eg. MUSCULAR, the Merkel cables, etc.) once they had the world's attention.
  - differentView 11y ago
    >Attention. Get people to pay attention because the leak of customer data is personal (it'll probably affect you or someone you know), and then release the really damaging data once the press cycle has started and everybody's looking for more information. Then they probably should have released the first data dump on Monday and the second dump on Tuesday. By the time the media dig through the CEO's emails it'll be Friday and lose a lot of steam over the weekend.
    - nostrademons 11y ago
      I think they did - the first Reddit post on it [1] is dated 4 days ago, and the torrent [2] was datestamped for just after midnight on Sunday morning. My guess is that the timing didn't go according to plan - they picked an obscure subreddit to post on, and the first press coverage didn't happen until Tuesday night (having apparently heard about it on Tuesday morning). And then it's generally a good idea to let at least 2 days pass between press releases, otherwise the public doesn't have a chance to absorb the first media cycle. They probably hoped it would be noticed on Sunday night, hit the press first thing Monday morning, and then they could follow up with the CEO dump on Wednesday. [1] https://www.reddit.com/r/AnythingGoesNews/comments/3h71ar/we_are_the_impact_team_we_are_releasing_the/ https://www.reddit.com/r/AnythingGoesNews/comments/3h71ar/we... [2] https://thepiratebay.vg/torrent/12237184 https://thepiratebay.vg/torrent/12237184

44 points by benevol 11y ago

In the comments on the TPB torrent of the original leak people were debating the legality of downloading/having this information on their computer. Irony of that situation aside, if I was interested in studying these leaks how much legal danger would I be putting myself in by grabbing them? I'm US based.

deleted 11y ago
[deleted]
fweespeech 11y ago
Minor but they would win if they sued you.
soylentcola 11y ago
Guess it depends if anyone is being paid to log the IPs in the swarm and do anything with them. I'd imagine if you treat it like downloading a TV show or something and use a suitable VPN you'll be mostly fine. Probably just comes down to how much someone is willing to pay to go after people downloading it. Otherwise I expect others to analyze the dump and publish their findings in less dodgy formats.
- toomuchtodo 11y ago
  I'm logging IPs of the swarm for funsies. Might come in handy in the future.
  - hkon 11y ago
    Yes you can "release" that as a torrent as well
    - toomuchtodo 11y ago
      It'll get dumped into the internet archive at some point.
e40 11y ago
It's really hard to imagine that AM would go after the downloaders. That would be like pour oil on a fire. Imagine the extra amount of publicity their idiotic security would get.
- amyjess 11y ago
  They're already DMCAing tweets that contain excerpts from the data. (side note: every time I hear "AM", I think "Aggressive Menace", which sounds about right)
- differentView 11y ago
  They won't survive this.

wanderfowl 11y ago

Maybe I'm naive, but I'm hoping that the lawsuits from this will be the start of a push for data-breach insurance, and that the insurers, as Bruce Schneier has been advocating for many years, will force the security that the marketing VP doesn't see the need to pay for.

xlm1717 11y ago
Maybe you are naive, but you are certainly not as naive as the marketing VP who didn't see the need to pay for security, and is today watching in horror as his business is getting hacked to hell.
- siegecraft 11y ago
  Is this marketing VP a real person or just a hypothetical scenario? Because it doesn't make any sense to me that a marketing VP would have any decision making power about the need for security.
  - Kalium 11y ago
    In corporate life, what makes sense and what's true are sets that rarely overlap as much as you'd hope.
  - shaggyfrog 11y ago
    In my experience, non-technical stakeholders can have disproportionate authority over technical decisions. For example, if a security best practice results in slower logins, the development team could get immediate pushback to speed up the process, even at the risk of weaker security. Risk can be difficult to quantify, and if the focus is on chasing the short-term, you might be told to damn the torpedoes and get the product launched.
    - iofj 11y ago
      In every programmer's experience, security can have a disproportionate amount of influence. For instance, they are unwilling to do any real development, yet have the authority to demand their stuff be used. There is no reason any authentication process has to use more than a single request + single response (and a single request and immediate reply from the auth server). The usual concerns like replay attacks, allowing third parties to relay data for the auth server can all be solved using encryption. In 15 years of working as a developer, I have encountered one company that actually does this both correct and fast. Security departments demanding that user authentication happen over an LDAP+Kerberos connection, for example, are commonplace and this is stupid and very slow, for no good reason.

rjurney 11y ago

Its hard to feel too bad for the victims of these attacks, given that their behavior hurts others. Oh wow I think I'm getting old.

DarkTree 11y ago
Yeah, you certainly don't have to feel bad for the victims, but we should all question whether the hackers are producing an overall net positive effect.
- xlm1717 11y ago
  Well, if you believe the hackers' motivation for doing this, I don't think it's about producing an overall net positive effect at all, just righting some perceived wrongs. The perceived wrongs are not that AshleyMadison enabled married people to cheat on their spouses. What the hackers have said was their motivation is that AshleyMadison has lied to their users about the userbase, which is supposedly 90+% male, most of which have likely not engaged in an affair since most of the accounts they would interact with are supposedly fake. I don't think a net positive effect can come from this.
cli 11y ago
Note that about 40% of those accounts state that they are single. http://dadaviz.com/s/ashley-madison-revealed http://dadaviz.com/s/ashley-madison-revealed
- nfoz 11y ago
  Do you think it's ethically appropriate to look at the leaked data? Do you think it's ethically appropriate to analyze the leaked data, and publish those analyses for personal gain (which is what this site did afaict) Do you think it's ethically appropriate to read about analyses performed on the leaked data by the above? I honestly don't know how I feel myself! Very curious what other people think about this.
  - Kalium 11y ago

matheweis 11y ago

When this happened to SONY, they went dark immediately and rebuilt from the ground up... Seems to the be the "right" approach, as opposed to business as usual from ALM. You have to wonder if they aren't still infiltrated.

untog 11y ago

I'm surprised - though perhaps not really - to see that this new data contains the CEO's e-mail. If the aim was to punish Ashley Madison (as the leak team have suggested), why not leak that first, before customer details and credit card transactions?

deleted 11y ago
[deleted]
nostrademons 11y ago
Attention. Get people to pay attention because the leak of customer data is personal (it'll probably affect you or someone you know), and then release the really damaging data once the press cycle has started and everybody's looking for more information. The Snowden leak had a similar structure: it started out with PRISM (which affected every American, and caused widespread indignation), then Snowden claimed responsibility (trying to get out ahead of official government investigations, putting a human face on the leaker and controlling the messaging), and then they followed up with a number of even more damaging leaks (eg. MUSCULAR, the Merkel cables, etc.) once they had the world's attention.
- differentView 11y ago
  >Attention. Get people to pay attention because the leak of customer data is personal (it'll probably affect you or someone you know), and then release the really damaging data once the press cycle has started and everybody's looking for more information. Then they probably should have released the first data dump on Monday and the second dump on Tuesday. By the time the media dig through the CEO's emails it'll be Friday and lose a lot of steam over the weekend.
  - nostrademons 11y ago
    I think they did - the first Reddit post on it [1] is dated 4 days ago, and the torrent [2] was datestamped for just after midnight on Sunday morning. My guess is that the timing didn't go according to plan - they picked an obscure subreddit to post on, and the first press coverage didn't happen until Tuesday night (having apparently heard about it on Tuesday morning). And then it's generally a good idea to let at least 2 days pass between press releases, otherwise the public doesn't have a chance to absorb the first media cycle. They probably hoped it would be noticed on Sunday night, hit the press first thing Monday morning, and then they could follow up with the CEO dump on Wednesday. [1] https://www.reddit.com/r/AnythingGoesNews/comments/3h71ar/we_are_the_impact_team_we_are_releasing_the/ https://www.reddit.com/r/AnythingGoesNews/comments/3h71ar/we... [2] https://thepiratebay.vg/torrent/12237184 https://thepiratebay.vg/torrent/12237184