16 ms·

Who Hacked Ashley Madison?

410 points by david_shaw 11y ago

smtddr 11y ago
I don't condone this hack, but morals/ethics aside for a moment: The one positive thing this hack has done is really give serious ammo to the battle for online privacy, because the demographic hit by this hack is the most politically & economically powerful demographic in the world....
- jgrahamc 11y ago
  One positive thing this hack has done is really give serious ammo to the battle for online privacy How?
  - kinghajj 11y ago
    It's literally the next phrase in the sentence: > because the demographic hit by this hack is the most politically & economically powerful demographic in the world.... They're saying that because those affected have the ability to actualize change, it's more likely that some action will be taken to further online privacy.
  - ewzimm 11y ago
    It's basically the strategy John Oliver used to raise awareness about government surveillance. Most people don't care about privacy until it gets sexual. https://cantheyseemydick.com/ https://cantheyseemydick.com/
    - btilly 11y ago
      They missed a great straight line. "But if they realize that your dick is American, they do try to forget that they saw your dick."
- ck2 11y ago
  You'd think the 1986 law that allows any entity in the government can read anyone's email is bigger ammo It's the ultimate hack, because it's in plain sight and somehow no-one cares. But run your own private email server in your home to prevent warrantless abuse and everyone loses their damn minds.
  - joelrunyon 11y ago
    Why can't both be bad and unacceptable? Playing the shades of grey game is a great wait to force dissent in an area that should incite cooperation.
    - ck2 11y ago
      Of course they are both "bad" - it is a matter of degrees. One is a lazy, immoral company started on a whim that took off and "surprise" they ran their business in a lazy immoral way. The other is government sanctioned, taxpayer funded, broadly used abuse of police powers without oversight, based on a law that is 30 years old.
- cookiecaper 11y ago
  This is going to have some long-lasting repercussions on the industry. I fully expect there to be a push in the legislature to require PCI-like compliance from anyone who takes "sensitive data". That would have very serious effects for the startup community.
  - Scarbutt 11y ago
    I wish the push was more of a law that let users delete their data immediately and completely from a service with the click of a button.
    - FilterSweep 11y ago
      I second those wishes, but thats feasibly impossible without vast auditing resources. DB backups, logging, and the general "archive-first" nature of the modern web essentially prevents this from happening.....even if service providers wanted to give this opportunity to its users...and most do not.
      - Scarbutt 11y ago
        that's true, but if such law was implemented, services providers will now have to think about running things legally or illegally.
    - superuser2 11y ago
      Any architecture that facilitates this will lose massive amounts of customer data, full stop. Backups have to be in places where live systems can't touch them, or can append only. Backups have to be offline and immutable. If you can mutate a backup based on a user request, it's not a backup. Offline backups are, however, pretty hard to steal (unless you're stealing the physical tapes). So... immediately, maybe. Completely, no fucking way.
      - icebraining 11y ago
        That's what encryption is for - burn the key, and the backups are useless even if they're immutable.
- vezzy-fnord 11y ago
  I'd argue the opposite. The AM hack hasn't helped at all, since enough people view it as a just retribution due to it being about a pet moral value that is held dear, namely marital fidelity. And to others, it's all a big joke. The cheating cheaters (who likely never got the opportunity to cheat) have been named and shamed, and because of those asserting that it's acceptable to do this if it strokes their personal moral vendetta, then this type of chilling privacy violation is on its way to being normalized.
  - nostrebored 11y ago
    Yeah, well if you engage in a promise with someone that you're going to be in a monogamous relationship -- let's be real, that's what marriage is for the vast majority -- you're a prick if you attempt to break that commitment, and again, that's what being on AM is about. Pretending otherwise is delusional, and having morals isn't a bad thing. Is doxxing always unethical?
    - sbarre 11y ago
      Yes, it absolutely is always unethical. Who are you, or anyone else, to question or evaluate "commitment" in a relationship that you have no part of, and know nothing about? Or to force someone's personal private life out in the open where it will be used to judge them without context? Nothing is as black and white as you are claiming it to be.
      - chrischen 11y ago
        Privacy isn't a natural right, just like lying to someone via marriage isn't universally considered unethical. Your right to privacy isn't naturally guaranteed, and is only granted by some mutually agreed upon rules in the form of privacy laws. But if I know some fact about you, what gives you any right to say I can't reveal that information? Wouldn't you be limiting my speech? If you argue that lying in marriage is a complex issue, then privacy rights is also a complex issue that's not black and white. A world with no secrets and a world where everyone has a right to secrecy are both potentially equally valid.
- x0x0 11y ago
  What I find weirdest about the whole thing is the data wasn't sold back to Ashley Madison. The hacker(s) could have leaked 10 or 20 juicy names then probably cleared $10 million dollars or better. It would have been a bargain to Ashley Madison at that price.
  - eghri 11y ago
    The problem with digital data is that it can be replicated at no cost and with no trace, so there wouldn't be any way for Ashley Madison to ever be sure the leak was contained. They could pay $10MM for a copy of the data... and two months later it can anonymously show up on Tor. Not to mention the hackers would need to come forward to collect the $10MM, which might land them in a jail cell before they can collect.
    - gwern 11y ago
      There is no need for it to be a lump sum. A (much smaller) regular monthly payment to a Bitcoin address is perfectly adequate a mechanism.
      - bduerst 11y ago
        >"Perfectly Adequate" All bitcoin transactions are public record, and even if you tumble you are setting yourself for getting caught by repeatedly doing the same actions. Besides, the value of the information decreases over time, meaning you're going to be making the large payments up front.
        gwern 11y ago
        > even if you tumble you are setting yourself for getting caught by repeatedly doing the same actions. By doing what? Making payments to an address? > Besides, the value of the information decreases over time, meaning you're going to be making the large payments up front. Any lumpsum can be structured as an equivalent series of regular payments. Whatever the present value of not having the data released is, it can be turned into a set of finite or indefinite payments, which last 1 year or 5 years or 10 years or however long the company feels the harm will be non-neglible. And by doing this, you still get the anti-defecting incentive of a stream rather than one-off payment.
- serve_yay 11y ago
  I hadn't considered that, but it's an interesting point. That said, all the standard moralizing accompanying this is so gross.
  - nostrebored 11y ago
    What would you prefer, some amorphous undefinable moral relativism where everyone is somehow a good person, and we're all the same? Public shaming is a pretty decent prosocial incentive.
    - ori_b 11y ago
      How about people not sticking their noses into other people's relationships? We used to have the state jail, or even torture, adulterers. Society eventually agreed that it's not their job to do that. Let's hold off on forming lynch mobs.
      - nostrebored 11y ago
        Where are the lynch mobs? For the vast majority of these people, they're being called assholes because they were being assholes. I'm okay with that. The same "not sticking our noses into other people's relationships" was the root of the Family Values crowd in the 80's saying that domestic violence is a family issue, incest is a family issue, etc. Where do you draw the line at sticking your nose into other people's relationships? I find public shaming for deplorable behavior to be perfectly fine. And if a ton of these people are non-monogamous, then perhaps we as a society should have a discussion abuot how our values are shifting and what new families look like, but something tells me that there aren't suddenly millions of non-monogamous marriages.
        vezzy-fnord 11y ago
        They're not just being called assholes, they're having all personal and financial details dumped in the process. There's a difference. We've generally determined that sexual practices, as long as they're consensual and do not involve harm to anyone outside the participants themselves, should not be subject to persecution. This includes incest, as much as it may disgust you. A lot of people are disgusted by coprophagia, that doesn't mean we should publicly shame people for having sexual tastes that aren't to our fancy. It is as arbitrary as shaming people for musical preferences. Domestic violence is a wholly separate problem altogether. There's nothing that doxing will do to solve it.
- gyardley 11y ago
  Politically and economically powerful people don't need some obviously-for-suckers website to have an affair.
  - differentView 11y ago
    How would you have an affair if you're politically and economically powerful?
    - mahouse 11y ago
      Cucking has existed since forever, for both the poor and the wealthy.
    - tedunangst 11y ago
      Call up the local high end madam and ask for a "date".
      - differentView 11y ago
        Maybe some of them fear that using professional escort services make them bigger targets for blackmail or their information will be used to cut deals when the escort service is busted. Also, some may be looking for more than sex with professionals.
    - anigbrowl 11y ago
      You trade money/favors for discretion from the smallest number of people possible, with the unspoken implication that if they betray you'll spend at least as much on inconveniencing them afterward.
- pascalmemories 11y ago
  Unfortunately, that's not how the "politically & economically powerful demographic in the world" works. What you will see is lots of new laws to crack down on hackers, encryption and any type of computing not specifically 'approved' by some sort of security overlord department. Look at what the UK is proposing (way before AM became news) and you'll have a rough starting point. The laws will be the exact opposite of improved privacy.
  - ryandrake 11y ago
    And, the laws that we really need, namely harsh criminal penalties for companies negligently handling people's private data, will be absent.
  - patcon 11y ago
    Yes, but then someone creates a network for cheater spouses that gets in the news cycle because it's "impossible to hack due to futuristic maths" (ie. peer-to-peer). And now suddenly something decentralized and provably private seems very interesting and practical to those who were previously interested in legislative solutions. But I'm an optimist :)
- jjtheblunt 11y ago
  How do you figure? Seems that the demographic hit is just a bunch of people with dysfunctional people skills.
- Nelson69 11y ago
  What ammo? Some people of questionable ethic and questionable intelligence gave a third party incriminating information about themselves and also gave them money all while hoping for discretion. (I say questionable intelligence because the real rich and powerful use different services provided by different people..) Any privacy agreement was a private one between 2 parties, at best covered by civil law, maybe Canadian civil law. Certainly nothing binding in any substantial way was signed. It's certainly making light of online privacy but I'm not sure there is a battle here, it's just demonstrating that it's still very much the wild west out there. What should happen here? Should AM pay a fine to some government? Class action law suit? (I think that idea is particularly hilarious..) Riddle me this, so suppose AM goes bankrupt. Can their creditors just take that data and sell it? It's an asset, right? Is it possible for a EULA or some sort of agreement to prevent that? Hackers or not, all that information could be in someone else' hands, that the users have no agreement with. AM is sort of the poster child for these problems but you may have given a lot of information to companies that you wouldn't want other companies to have.
- Eric_WVGG 11y ago
  If anyone here is a science fiction fan (seems unlikely right?), there's a great comic called The Private Eye which takes place in a society which experienced a fallout from an event not unlike this (though on an even larger scale). https://en.wikipedia.org/wiki/The_Private_Eye https://en.wikipedia.org/wiki/The_Private_Eye http://panelsyndicate.com http://panelsyndicate.com, "pay what you like"
- walshemj 11y ago
  I could defiantly see some stricter privacy laws being passed - also might I'mpact google etc if they have to start vetting staff in the same way big telcos do. Back in my BT days I knew team leaders who had to get PV'd (aka TS) clearance.
- jsn117 11y ago
  One day Tinder will be hacked like this as well, imagine the fallout.
  - CamperBob2 11y ago
    I've never used Tinder -- do you have to give your real name and/or billing info to sign up with it?
    - mahmud 11y ago
      You login with your Facebook credentials.
- s73v3r 11y ago
  Not really. If anything, it's done the opposite, because people were all happy that "a bunch of cheaters got what they deserved."
- CyberDildonics 11y ago
  It shows the solution really. Turn the focus on the people making decisions. Put them under surveillance and see if they still think everyone needs to have all their communication public for their own safety.
lifeisstillgood 11y ago
This seems awfully meta - as the AM hack revealed 30m people to have lost any real privacy in the digital age, the person seemingly / likely / possibly responsible is hunted down and much of his life laid out like a private investigators report through his digital trail. It's curious - we are all being affected by the new digital pollution
- deleted 11y ago
  [deleted]
- dublinben 11y ago
  There isn't any contradiction, if you were implying there was. All of the information compiled in this article was published to the public. Any private information that has been revealed about this individual is likely misdirection or irrelevant.
  - lifeisstillgood 11y ago
    No, no contradiction just ... We are all in the gutter, covered in the same mud.
- onewaystreet 11y ago
  The hacker is a criminal, he's being hunted by the FBI. Brian Krebs is good at tracking down people but he's not a vigilante. In the end the hacker will be arrested and have his day in court.
Benichmt1 11y ago
Ah, another internet witch hunt. Good thing this account seems to be taking credit for it. Otherwise this could've been ugly.
take901 11y ago
Doesn't it seem just a bit odd that a hacker (or a close associate) that just held ransom a massive company would post on twitter of all places evidence that they are connected to the hack? Call me a skeptic but this seems like a distraction... obviously Krebs did a ton more research than I did, but I found this when snooping around his profile: http://186.42.193.241/FRaboudan/status/635121718202208257 http://186.42.193.241/FRaboudan/status/635121718202208257
philangist 11y ago
> They said Avid Life employees first learned about the breach on July 12 (seven days before my initial story) when they came into work, turned on their computers and saw a threatening message from the Impact Team accompanied by the anthem “Thunderstruck” by Australian rock band AC/DC playing in the background. This reads like a scene straight out of Hackers or some other campy tech movie. Life imitates art.
- vezzy-fnord 11y ago
  It's art imitating life. Old school warez, demoscene and hacker groups have always had a very "campy" countercultural aesthetic to them. Hackers the film doesn't hold a candle to the real-life cDc. These types of groups are a dying breed, though.
  - dopamean 11y ago
    cDc == cult of the dead cow? I haven't seen them referenced in ages. Probably since my own arrest actually.
    - maaku 11y ago
      You don't leave that one hanging. What's the story? Care to share?
      - dopamean 11y ago
        It's really not that interesting. I was 15 and played around with some computers that belongs to the US Navy. Then one day at 6 am I heard a loud knock on the front door.
        bdempsey 11y ago
        Would .. you .. like .. to .. play .. a .. game?
        beachstartup 11y ago
lawl 11y ago
So Krebs has no conclusive proof for anything? As he himself admits: > It is possible that Zu is instead a white hat security researcher or confidential informant Jeez, how about talking to the police and let them do their job, or at the very least censor the name. This is just a witch hunt.
- watty 11y ago
  Why do they need to censor an alias account for someone connected to the hack? There is no "Zu", the photos of Zu and his locations are copied from the internet.
  - lawl 11y ago
    For the same reason I don't go around and post an article how "watty" did $x. It doesn't matter if this is a pseudonym and what kind of avatar you use. If watty might be implicated in something illegal I should go talk to the police and not publicly witch hunt your handle, no?
    - watty 11y ago
      I still don't see the problem. If this handle was directly connected with $x I would fully expect people to be discussing my handle in blogs/forums. Going to the cops is fine and dandy too of course. Krebs even clarifies "If Zu wasn’t involved in the hack, he almost certainly knows who was.".
      - deleted 11y ago
        [deleted]
      - Nadya 11y ago
        So I'm 85% sure that ${User} is connected to a CP ring in some way. Should I publicly out ${User} even though I could be wrong and let them suffer the ramifications that it causes? If they lose their job, spouse, shunned by family, receive death threats, and have an internet hate mob trying to find where they live because the evidence was "leaning towards them" does that make it okay for me to call them out as being connected? "Oops, I was wrong. They aren't connected after all." doesn't fix ${User}'s life. Even if it opens up a defamation lawsuit, it won't fix their life - and the lawsuit will be expensive - and even when they win they'll hardly see any money because I'm some nobody who doesn't have any money for them to sue for to begin with. Do you still not see the problem? Edit: Not to mention I may not even be in their country.
satanrepents 11y ago
Half a million in Canadian dollars? Is that like paying it out in monopoly money?
- deleted 11y ago
  [deleted]
- cdelsolar 11y ago
  No
deleted 11y ago
[deleted]
deleted 11y ago
[deleted]
graycat 11y ago
Can we also ask, HOW did they hack Ashley Madison?
- smtddr 11y ago
  http://digg.com/2015/ashley-madison-hack http://digg.com/2015/ashley-madison-hack Not a complete answer, but: "MOTHERBOARD: How did you hack Avid Life Media? Was it hard? The Impact Team: We worked hard to make fully undetectable attack, then got in and found nothing to bypass. MOTHERBOARD: What was their security like? The Impact Team: Bad. Nobody was watching. No security. Only thing was segmented network. You could use Pass1234 from the internet to VPN to root on all servers."
  - graycat 11y ago
    Wow! It's easy to make jokes, but actually this is serious -- a lot of people are going to be hurt, and so far already two have died. Sounds like AM's computing was all f__ked up! In US Army terminology, FUBAR. Or SNAFU. Gads. Wonder how AM paid, maybe I should say, compensated, their server farm system administration staff? Their server farm security was wide open? Should the users have expected something else?
    - shitsandwich 11y ago
      it's an internet dating site, did you really expect more?
    - sbierwagen 11y ago
      1.) They could be lying. 2.) My read is that, instead of no security, (or else AM would be have been compromised instantly by script kiddies) they used manufacturer default passwords on internal firewall appliances.
  - jaredandrews 11y ago
    I googled "Pass1234" assuming it was some sort of exploit tool but didn't find anything. Can anyone explain what this answer means?
werber 11y ago
My impression is that Zu is actually an author researching a real life cyber crime novel.
GigabyteCoin 11y ago
>To say that Zu tweets to others is a bit of a misstatement. I have never seen anyone tweet the way Zu does; He sends hundreds of tweets each day, and while most of them appear to be directed at nobody, it does seem that they are in response to (if not in “reply” to) tweets that others have sent him or made about his work. Consequently, his tweet stream appears to the casual observer to be nothing more than an endless soliloquy. Perhaps that's all Zu is? A bot, or a covert chat channel of some kind. Perhaps prime numbered words from every third tweet contain the real message, or something like that?
- watty 11y ago
  Some tweets may be a bot but it's clear someone is typing direct responses and tweets from this account.
- fowkswe 11y ago
  It seems like the tweets are selectively pulled responses from a chat stream.
futureYCalum 11y ago
Did I find the culprits? http://www.impactteam.info/ http://www.impactteam.info/
madrinator 11y ago
AshleyMadison reward = $500k CAD ($376k USD) divided by 40M users = $0.01 #privacy should be worth more than 1 cent!
- unreal37 11y ago
  The privacy of the 40 million cannot be bought back.
deadlycrayon 11y ago
This is pretty poor journalism. Reminds me of the reddit Boston bombing witchhunt. Note that in the comments, Krebs had to be "reminded" to reach out to Thadeus Zu for comment.
- rememberlenny 11y ago
  He was being reminded to post about reaching out.
mahouse 11y ago
OT: where's the source code for the AM website? Is it inside one of the dumps? Edit: found it in "Ashley Madison 2nd dump 20 GB"
- tempVariable 11y ago
  I'm not asking for a public post, but can you send info how to acquire the AM data dump via EM?
  - mahouse 11y ago
    TPB
voodoochilo 11y ago
well, krebsy, and what if this guy has absolutely nth to do with the whole shebang? i can imagine that 500k may seem tempting, but what if?
LordKano 11y ago
My reaction is still mostly schadenfreude. If/when these people are caught, they should face the consequences of their actions but I'm not going to wrap paranoia over my own peccadillos in fake outrage over internet privacy. I'm opposed to people doing unauthorized things with other people's property on general principles. I'm far more concerned with the IRS's data breach because every victim was legally compelled to submit certain personal information to the IRS. Everyone on Ashley Madison was there voluntarily for nefarious purposes. Catch them and prosecute them but don't cry crocodile tears either.
- dhimes 11y ago
  Agree. But if I understand correctly, the purpose of the hack was to take down a website that was ripping people off and, in the minds (if not experience) of the hacker(s), a scam. In a way, it's not unlike Snowden's revelations. Yes, it was illegal. Yes, some people are embarrassed. But the intent, in the long run, is actually to protect those people. And, regrettably, the fact that sex secrets were exposed is likely to alert much more of the population to the real dangers of privacy erosion than Snowden's revelations.
  - wodenokoto 11y ago
    I read their statement as they were morally angry at the purpose of the enterprise
  - isaacremuant 11y ago
    Read the "Time's up" message they wrote. They pretty much speak in a righteous way to the signed up people. They tell them to "atone and move on" or something of the sort. This reads to me more like "power trip" than anything else.
    - d23 11y ago
      Peoples' motivations for doing things are never cut and dry. Yes, an amount of ego may have snuck in there, but they may have also genuinely thought they were doing a Good Deed.
danblick 11y ago
I can imagine two separate motives for this hack: (1) The hackers dislike the idea of adultery and wanted to harm the site & punish its users; (2) The hackers wanted to blackmail the site and its users by threatening to expose them if they did not pay hush money or perform other services (e.g. reveal secrets). It seems that motive (1) has some acceptance (people are cheering the hackers), but I think (2) seems more plausible. These guys aren't heroes: they found a vulnerable target and went after it.
- nkozyra 11y ago
  Except they didn't do #2 and instead just released it. That kind of kills the blackmail value, doesn't it?
  - mahmud 11y ago
    Maybe they had a private communication with AM, and only released it after the negotiations broke down?
- DavidAdams 11y ago
  (3) They're in it for the lulz, and realized that going after an unsavory company with unsavory clients they'd create a Schadenfreude-fueled media sensation they'd have extra lulz.
- redog 11y ago
  (3) They wanted to sting one poor sap. Added him to the DB, release with motive (2) and done.
andyl 11y ago
If caught, what types of legal liability might the AM hacker face??
mackeeeavelli 11y ago
The AM hack is similar in tenor to the Sony hack. Nothing about the hack has the feel of a lone wolf or black hat operation. I have no doubt someone will get pinned for the hack, but I also think if it wasn't an inside job it was state-sponsored.
- deleted 11y ago
  [deleted]
Zenst 11y ago
The aspect that a company who's business model resolves around people breaking contracts (marriage contracts) finding itself on the downside of what could of been an employee who broke their employment contract is something ironic. Maybe we should not be calling those a hack and more a data-affair. Still one can only hope that we gain some better protection and rights regarding how companies handle data and more so in the area of authority auditing that those rules and standards are maintained.
tempVariable 11y ago
I know it's a giant long shot, and the Zhu is not using his own IP/ISP, but could the FBI use the screenshot showing his desktop with Twitter, Youtube, Google and do an intersection of IPs on those services for the pattern that matches his use on those services ? The twitter user Zhu, who listened to Thunderstruck and went to Google within a time period. edit: I'd like to have 1% of the $500k bounty wired in Dogecoins please
- unreal37 11y ago
  I'm going to guess that if the NSA was at all interested in this guy, they know exactly who he is already. But they're probably not.
ivoras 11y ago
deuszhu's tweets are indistinguishable from a bot's. Well, most of them.
hackuser 11y ago
Hmmm ... is it appropriate for Brian Krebs to dox this person (at least to some extent), in a much more public forum than someplace like 4chan, because Krebs suspects him or in order to compel him to talk to Krebs?
jasonmp85 11y ago
> But there may something else going on here. It is possible that Zu’s approach to tweeting — that is, responding to or addressing other Twitter users without invoking the intended recipient’s Twitter handle — is something of a security precaution. After all, he had to know and even expect that security researchers would try to reconstruct his conversations after the fact. But this is far more difficult to do when the Twitter user in question never actually participates in threaded conversations. People who engage in this way of tweeting also do not readily reveal the Twitter identities of the people with whom they chat most. I love how Krebs has reframed "subtweeting" as some sort of new security practice as opposed to an annoying passive-aggressive thing everyone does from time to time :-D
akash3333 11y ago
Anyone else wondering what tool would Krebs use to download another users timeline?
- akash3333 11y ago
  Never mind, got the answer http://krebsonsecurity.com/2015/08/who-hacked-ashley-madison/comment-page-3/#comment-391736 http://krebsonsecurity.com/2015/08/who-hacked-ashley-madison...
signaler 11y ago
The old narrative of vigilante justice in the hacker set is getting repetitive. I wish reports weren't so biased to use 'hacker' in their stories because it forever connotes hack with something unsavoury. This is an infosec breach, not a hack. The 'Impact Team' even said they did not have to try that hard. Any good hack has hack value, and the only reason AM was booted offline was because it happened on their clock, and not the clock of any other {random} internet database. This could have been any site. Also I wrote this small piece on hackerdom and what paths we can take if we are inclined to hack: http://blog.higg.im/2015/05/27/hacker-with-lots-of-free-time-what-are-you-doing-about-that/ http://blog.higg.im/2015/05/27/hacker-with-lots-of-free-time...
fjbarrett 11y ago
Wow this is elegant. Well-written article and super engaging story. The tab on the screenshot is magical.

410 points by david_shaw 11y ago

I don't condone this hack, but morals/ethics aside for a moment: The one positive thing this hack has done is really give serious ammo to the battle for online privacy, because the demographic hit by this hack is the most politically & economically powerful demographic in the world....

jgrahamc 11y ago
One positive thing this hack has done is really give serious ammo to the battle for online privacy How?
- kinghajj 11y ago
  It's literally the next phrase in the sentence: > because the demographic hit by this hack is the most politically & economically powerful demographic in the world.... They're saying that because those affected have the ability to actualize change, it's more likely that some action will be taken to further online privacy.
- ewzimm 11y ago
  It's basically the strategy John Oliver used to raise awareness about government surveillance. Most people don't care about privacy until it gets sexual. https://cantheyseemydick.com/ https://cantheyseemydick.com/
  - btilly 11y ago
    They missed a great straight line. "But if they realize that your dick is American, they do try to forget that they saw your dick."
ck2 11y ago
You'd think the 1986 law that allows any entity in the government can read anyone's email is bigger ammo It's the ultimate hack, because it's in plain sight and somehow no-one cares. But run your own private email server in your home to prevent warrantless abuse and everyone loses their damn minds.
- joelrunyon 11y ago
  Why can't both be bad and unacceptable? Playing the shades of grey game is a great wait to force dissent in an area that should incite cooperation.
  - ck2 11y ago
    Of course they are both "bad" - it is a matter of degrees. One is a lazy, immoral company started on a whim that took off and "surprise" they ran their business in a lazy immoral way. The other is government sanctioned, taxpayer funded, broadly used abuse of police powers without oversight, based on a law that is 30 years old.
cookiecaper 11y ago
This is going to have some long-lasting repercussions on the industry. I fully expect there to be a push in the legislature to require PCI-like compliance from anyone who takes "sensitive data". That would have very serious effects for the startup community.
- Scarbutt 11y ago
  I wish the push was more of a law that let users delete their data immediately and completely from a service with the click of a button.
  - FilterSweep 11y ago
    I second those wishes, but thats feasibly impossible without vast auditing resources. DB backups, logging, and the general "archive-first" nature of the modern web essentially prevents this from happening.....even if service providers wanted to give this opportunity to its users...and most do not.
    - Scarbutt 11y ago
      that's true, but if such law was implemented, services providers will now have to think about running things legally or illegally.
  - superuser2 11y ago
    Any architecture that facilitates this will lose massive amounts of customer data, full stop. Backups have to be in places where live systems can't touch them, or can append only. Backups have to be offline and immutable. If you can mutate a backup based on a user request, it's not a backup. Offline backups are, however, pretty hard to steal (unless you're stealing the physical tapes). So... immediately, maybe. Completely, no fucking way.
    - icebraining 11y ago
      That's what encryption is for - burn the key, and the backups are useless even if they're immutable.
vezzy-fnord 11y ago
I'd argue the opposite. The AM hack hasn't helped at all, since enough people view it as a just retribution due to it being about a pet moral value that is held dear, namely marital fidelity. And to others, it's all a big joke. The cheating cheaters (who likely never got the opportunity to cheat) have been named and shamed, and because of those asserting that it's acceptable to do this if it strokes their personal moral vendetta, then this type of chilling privacy violation is on its way to being normalized.
- nostrebored 11y ago
  Yeah, well if you engage in a promise with someone that you're going to be in a monogamous relationship -- let's be real, that's what marriage is for the vast majority -- you're a prick if you attempt to break that commitment, and again, that's what being on AM is about. Pretending otherwise is delusional, and having morals isn't a bad thing. Is doxxing always unethical?
  - sbarre 11y ago
    Yes, it absolutely is always unethical. Who are you, or anyone else, to question or evaluate "commitment" in a relationship that you have no part of, and know nothing about? Or to force someone's personal private life out in the open where it will be used to judge them without context? Nothing is as black and white as you are claiming it to be.
    - chrischen 11y ago
      Privacy isn't a natural right, just like lying to someone via marriage isn't universally considered unethical. Your right to privacy isn't naturally guaranteed, and is only granted by some mutually agreed upon rules in the form of privacy laws. But if I know some fact about you, what gives you any right to say I can't reveal that information? Wouldn't you be limiting my speech? If you argue that lying in marriage is a complex issue, then privacy rights is also a complex issue that's not black and white. A world with no secrets and a world where everyone has a right to secrecy are both potentially equally valid.
x0x0 11y ago
What I find weirdest about the whole thing is the data wasn't sold back to Ashley Madison. The hacker(s) could have leaked 10 or 20 juicy names then probably cleared $10 million dollars or better. It would have been a bargain to Ashley Madison at that price.
- eghri 11y ago
  The problem with digital data is that it can be replicated at no cost and with no trace, so there wouldn't be any way for Ashley Madison to ever be sure the leak was contained. They could pay $10MM for a copy of the data... and two months later it can anonymously show up on Tor. Not to mention the hackers would need to come forward to collect the $10MM, which might land them in a jail cell before they can collect.
  - gwern 11y ago
    There is no need for it to be a lump sum. A (much smaller) regular monthly payment to a Bitcoin address is perfectly adequate a mechanism.
    - bduerst 11y ago
      >"Perfectly Adequate" All bitcoin transactions are public record, and even if you tumble you are setting yourself for getting caught by repeatedly doing the same actions. Besides, the value of the information decreases over time, meaning you're going to be making the large payments up front.
      - gwern 11y ago
        > even if you tumble you are setting yourself for getting caught by repeatedly doing the same actions. By doing what? Making payments to an address? > Besides, the value of the information decreases over time, meaning you're going to be making the large payments up front. Any lumpsum can be structured as an equivalent series of regular payments. Whatever the present value of not having the data released is, it can be turned into a set of finite or indefinite payments, which last 1 year or 5 years or 10 years or however long the company feels the harm will be non-neglible. And by doing this, you still get the anti-defecting incentive of a stream rather than one-off payment.
serve_yay 11y ago
I hadn't considered that, but it's an interesting point. That said, all the standard moralizing accompanying this is so gross.
- nostrebored 11y ago
  What would you prefer, some amorphous undefinable moral relativism where everyone is somehow a good person, and we're all the same? Public shaming is a pretty decent prosocial incentive.
  - ori_b 11y ago
    How about people not sticking their noses into other people's relationships? We used to have the state jail, or even torture, adulterers. Society eventually agreed that it's not their job to do that. Let's hold off on forming lynch mobs.
    - nostrebored 11y ago
      Where are the lynch mobs? For the vast majority of these people, they're being called assholes because they were being assholes. I'm okay with that. The same "not sticking our noses into other people's relationships" was the root of the Family Values crowd in the 80's saying that domestic violence is a family issue, incest is a family issue, etc. Where do you draw the line at sticking your nose into other people's relationships? I find public shaming for deplorable behavior to be perfectly fine. And if a ton of these people are non-monogamous, then perhaps we as a society should have a discussion abuot how our values are shifting and what new families look like, but something tells me that there aren't suddenly millions of non-monogamous marriages.
      - vezzy-fnord 11y ago
        They're not just being called assholes, they're having all personal and financial details dumped in the process. There's a difference. We've generally determined that sexual practices, as long as they're consensual and do not involve harm to anyone outside the participants themselves, should not be subject to persecution. This includes incest, as much as it may disgust you. A lot of people are disgusted by coprophagia, that doesn't mean we should publicly shame people for having sexual tastes that aren't to our fancy. It is as arbitrary as shaming people for musical preferences. Domestic violence is a wholly separate problem altogether. There's nothing that doxing will do to solve it.
gyardley 11y ago
Politically and economically powerful people don't need some obviously-for-suckers website to have an affair.
- differentView 11y ago
  How would you have an affair if you're politically and economically powerful?
  - mahouse 11y ago
    Cucking has existed since forever, for both the poor and the wealthy.
  - tedunangst 11y ago
    Call up the local high end madam and ask for a "date".
    - differentView 11y ago
      Maybe some of them fear that using professional escort services make them bigger targets for blackmail or their information will be used to cut deals when the escort service is busted. Also, some may be looking for more than sex with professionals.
  - anigbrowl 11y ago
    You trade money/favors for discretion from the smallest number of people possible, with the unspoken implication that if they betray you'll spend at least as much on inconveniencing them afterward.
pascalmemories 11y ago
Unfortunately, that's not how the "politically & economically powerful demographic in the world" works. What you will see is lots of new laws to crack down on hackers, encryption and any type of computing not specifically 'approved' by some sort of security overlord department. Look at what the UK is proposing (way before AM became news) and you'll have a rough starting point. The laws will be the exact opposite of improved privacy.
- ryandrake 11y ago
  And, the laws that we really need, namely harsh criminal penalties for companies negligently handling people's private data, will be absent.
- patcon 11y ago
  Yes, but then someone creates a network for cheater spouses that gets in the news cycle because it's "impossible to hack due to futuristic maths" (ie. peer-to-peer). And now suddenly something decentralized and provably private seems very interesting and practical to those who were previously interested in legislative solutions. But I'm an optimist :)
jjtheblunt 11y ago
How do you figure? Seems that the demographic hit is just a bunch of people with dysfunctional people skills.
Nelson69 11y ago
What ammo? Some people of questionable ethic and questionable intelligence gave a third party incriminating information about themselves and also gave them money all while hoping for discretion. (I say questionable intelligence because the real rich and powerful use different services provided by different people..) Any privacy agreement was a private one between 2 parties, at best covered by civil law, maybe Canadian civil law. Certainly nothing binding in any substantial way was signed. It's certainly making light of online privacy but I'm not sure there is a battle here, it's just demonstrating that it's still very much the wild west out there. What should happen here? Should AM pay a fine to some government? Class action law suit? (I think that idea is particularly hilarious..) Riddle me this, so suppose AM goes bankrupt. Can their creditors just take that data and sell it? It's an asset, right? Is it possible for a EULA or some sort of agreement to prevent that? Hackers or not, all that information could be in someone else' hands, that the users have no agreement with. AM is sort of the poster child for these problems but you may have given a lot of information to companies that you wouldn't want other companies to have.
Eric_WVGG 11y ago
If anyone here is a science fiction fan (seems unlikely right?), there's a great comic called The Private Eye which takes place in a society which experienced a fallout from an event not unlike this (though on an even larger scale). https://en.wikipedia.org/wiki/The_Private_Eye https://en.wikipedia.org/wiki/The_Private_Eye http://panelsyndicate.com http://panelsyndicate.com, "pay what you like"
walshemj 11y ago
I could defiantly see some stricter privacy laws being passed - also might I'mpact google etc if they have to start vetting staff in the same way big telcos do. Back in my BT days I knew team leaders who had to get PV'd (aka TS) clearance.
jsn117 11y ago
One day Tinder will be hacked like this as well, imagine the fallout.
- CamperBob2 11y ago
  I've never used Tinder -- do you have to give your real name and/or billing info to sign up with it?
  - mahmud 11y ago
    You login with your Facebook credentials.
s73v3r 11y ago
Not really. If anything, it's done the opposite, because people were all happy that "a bunch of cheaters got what they deserved."
CyberDildonics 11y ago
It shows the solution really. Turn the focus on the people making decisions. Put them under surveillance and see if they still think everyone needs to have all their communication public for their own safety.

lifeisstillgood 11y ago

This seems awfully meta - as the AM hack revealed 30m people to have lost any real privacy in the digital age, the person seemingly / likely / possibly responsible is hunted down and much of his life laid out like a private investigators report through his digital trail. It's curious - we are all being affected by the new digital pollution

deleted 11y ago
[deleted]
dublinben 11y ago
There isn't any contradiction, if you were implying there was. All of the information compiled in this article was published to the public. Any private information that has been revealed about this individual is likely misdirection or irrelevant.
- lifeisstillgood 11y ago
  No, no contradiction just ... We are all in the gutter, covered in the same mud.
onewaystreet 11y ago
The hacker is a criminal, he's being hunted by the FBI. Brian Krebs is good at tracking down people but he's not a vigilante. In the end the hacker will be arrested and have his day in court.

Benichmt1 11y ago

Ah, another internet witch hunt. Good thing this account seems to be taking credit for it. Otherwise this could've been ugly.

take901 11y ago

Doesn't it seem just a bit odd that a hacker (or a close associate) that just held ransom a massive company would post on twitter of all places evidence that they are connected to the hack? Call me a skeptic but this seems like a distraction... obviously Krebs did a ton more research than I did, but I found this when snooping around his profile: http://186.42.193.241/FRaboudan/status/635121718202208257 http://186.42.193.241/FRaboudan/status/635121718202208257

philangist 11y ago

> They said Avid Life employees first learned about the breach on July 12 (seven days before my initial story) when they came into work, turned on their computers and saw a threatening message from the Impact Team accompanied by the anthem “Thunderstruck” by Australian rock band AC/DC playing in the background. This reads like a scene straight out of Hackers or some other campy tech movie. Life imitates art.

vezzy-fnord 11y ago
It's art imitating life. Old school warez, demoscene and hacker groups have always had a very "campy" countercultural aesthetic to them. Hackers the film doesn't hold a candle to the real-life cDc. These types of groups are a dying breed, though.
- dopamean 11y ago
  cDc == cult of the dead cow? I haven't seen them referenced in ages. Probably since my own arrest actually.
  - maaku 11y ago
    You don't leave that one hanging. What's the story? Care to share?
    - dopamean 11y ago
      It's really not that interesting. I was 15 and played around with some computers that belongs to the US Navy. Then one day at 6 am I heard a loud knock on the front door.
      - bdempsey 11y ago
        Would .. you .. like .. to .. play .. a .. game?
      - beachstartup 11y ago

lawl 11y ago

So Krebs has no conclusive proof for anything? As he himself admits: > It is possible that Zu is instead a white hat security researcher or confidential informant Jeez, how about talking to the police and let them do their job, or at the very least censor the name. This is just a witch hunt.

watty 11y ago
Why do they need to censor an alias account for someone connected to the hack? There is no "Zu", the photos of Zu and his locations are copied from the internet.
- lawl 11y ago
  For the same reason I don't go around and post an article how "watty" did $x. It doesn't matter if this is a pseudonym and what kind of avatar you use. If watty might be implicated in something illegal I should go talk to the police and not publicly witch hunt your handle, no?
  - watty 11y ago
    I still don't see the problem. If this handle was directly connected with $x I would fully expect people to be discussing my handle in blogs/forums. Going to the cops is fine and dandy too of course. Krebs even clarifies "If Zu wasn’t involved in the hack, he almost certainly knows who was.".
    - deleted 11y ago
      [deleted]
    - Nadya 11y ago
      So I'm 85% sure that ${User} is connected to a CP ring in some way. Should I publicly out ${User} even though I could be wrong and let them suffer the ramifications that it causes? If they lose their job, spouse, shunned by family, receive death threats, and have an internet hate mob trying to find where they live because the evidence was "leaning towards them" does that make it okay for me to call them out as being connected? "Oops, I was wrong. They aren't connected after all." doesn't fix ${User}'s life. Even if it opens up a defamation lawsuit, it won't fix their life - and the lawsuit will be expensive - and even when they win they'll hardly see any money because I'm some nobody who doesn't have any money for them to sue for to begin with. Do you still not see the problem? Edit: Not to mention I may not even be in their country.

satanrepents 11y ago

Half a million in Canadian dollars? Is that like paying it out in monopoly money?

deleted 11y ago
[deleted]
cdelsolar 11y ago
No

deleted 11y ago

[deleted]

deleted 11y ago

[deleted]

graycat 11y ago

Can we also ask, HOW did they hack Ashley Madison?

smtddr 11y ago
http://digg.com/2015/ashley-madison-hack http://digg.com/2015/ashley-madison-hack Not a complete answer, but: "MOTHERBOARD: How did you hack Avid Life Media? Was it hard? The Impact Team: We worked hard to make fully undetectable attack, then got in and found nothing to bypass. MOTHERBOARD: What was their security like? The Impact Team: Bad. Nobody was watching. No security. Only thing was segmented network. You could use Pass1234 from the internet to VPN to root on all servers."
- graycat 11y ago
  Wow! It's easy to make jokes, but actually this is serious -- a lot of people are going to be hurt, and so far already two have died. Sounds like AM's computing was all f__ked up! In US Army terminology, FUBAR. Or SNAFU. Gads. Wonder how AM paid, maybe I should say, compensated, their server farm system administration staff? Their server farm security was wide open? Should the users have expected something else?
  - shitsandwich 11y ago
    it's an internet dating site, did you really expect more?
  - sbierwagen 11y ago
    1.) They could be lying. 2.) My read is that, instead of no security, (or else AM would be have been compromised instantly by script kiddies) they used manufacturer default passwords on internal firewall appliances.
- jaredandrews 11y ago
  I googled "Pass1234" assuming it was some sort of exploit tool but didn't find anything. Can anyone explain what this answer means?

werber 11y ago

My impression is that Zu is actually an author researching a real life cyber crime novel.

GigabyteCoin 11y ago

>To say that Zu tweets to others is a bit of a misstatement. I have never seen anyone tweet the way Zu does; He sends hundreds of tweets each day, and while most of them appear to be directed at nobody, it does seem that they are in response to (if not in “reply” to) tweets that others have sent him or made about his work. Consequently, his tweet stream appears to the casual observer to be nothing more than an endless soliloquy. Perhaps that's all Zu is? A bot, or a covert chat channel of some kind. Perhaps prime numbered words from every third tweet contain the real message, or something like that?

watty 11y ago
Some tweets may be a bot but it's clear someone is typing direct responses and tweets from this account.
fowkswe 11y ago
It seems like the tweets are selectively pulled responses from a chat stream.

futureYCalum 11y ago

Did I find the culprits? http://www.impactteam.info/ http://www.impactteam.info/

madrinator 11y ago

AshleyMadison reward = $500k CAD ($376k USD) divided by 40M users = $0.01 #privacy should be worth more than 1 cent!

unreal37 11y ago
The privacy of the 40 million cannot be bought back.

deadlycrayon 11y ago

This is pretty poor journalism. Reminds me of the reddit Boston bombing witchhunt. Note that in the comments, Krebs had to be "reminded" to reach out to Thadeus Zu for comment.

rememberlenny 11y ago
He was being reminded to post about reaching out.

mahouse 11y ago

OT: where's the source code for the AM website? Is it inside one of the dumps? Edit: found it in "Ashley Madison 2nd dump 20 GB"

tempVariable 11y ago
I'm not asking for a public post, but can you send info how to acquire the AM data dump via EM?
- mahouse 11y ago
  TPB

voodoochilo 11y ago

well, krebsy, and what if this guy has absolutely nth to do with the whole shebang? i can imagine that 500k may seem tempting, but what if?

LordKano 11y ago

My reaction is still mostly schadenfreude. If/when these people are caught, they should face the consequences of their actions but I'm not going to wrap paranoia over my own peccadillos in fake outrage over internet privacy. I'm opposed to people doing unauthorized things with other people's property on general principles. I'm far more concerned with the IRS's data breach because every victim was legally compelled to submit certain personal information to the IRS. Everyone on Ashley Madison was there voluntarily for nefarious purposes. Catch them and prosecute them but don't cry crocodile tears either.

dhimes 11y ago
Agree. But if I understand correctly, the purpose of the hack was to take down a website that was ripping people off and, in the minds (if not experience) of the hacker(s), a scam. In a way, it's not unlike Snowden's revelations. Yes, it was illegal. Yes, some people are embarrassed. But the intent, in the long run, is actually to protect those people. And, regrettably, the fact that sex secrets were exposed is likely to alert much more of the population to the real dangers of privacy erosion than Snowden's revelations.
- wodenokoto 11y ago
  I read their statement as they were morally angry at the purpose of the enterprise
- isaacremuant 11y ago
  Read the "Time's up" message they wrote. They pretty much speak in a righteous way to the signed up people. They tell them to "atone and move on" or something of the sort. This reads to me more like "power trip" than anything else.
  - d23 11y ago
    Peoples' motivations for doing things are never cut and dry. Yes, an amount of ego may have snuck in there, but they may have also genuinely thought they were doing a Good Deed.

danblick 11y ago

I can imagine two separate motives for this hack: (1) The hackers dislike the idea of adultery and wanted to harm the site & punish its users; (2) The hackers wanted to blackmail the site and its users by threatening to expose them if they did not pay hush money or perform other services (e.g. reveal secrets). It seems that motive (1) has some acceptance (people are cheering the hackers), but I think (2) seems more plausible. These guys aren't heroes: they found a vulnerable target and went after it.

nkozyra 11y ago
Except they didn't do #2 and instead just released it. That kind of kills the blackmail value, doesn't it?
- mahmud 11y ago
  Maybe they had a private communication with AM, and only released it after the negotiations broke down?
DavidAdams 11y ago
(3) They're in it for the lulz, and realized that going after an unsavory company with unsavory clients they'd create a Schadenfreude-fueled media sensation they'd have extra lulz.
redog 11y ago
(3) They wanted to sting one poor sap. Added him to the DB, release with motive (2) and done.

andyl 11y ago

If caught, what types of legal liability might the AM hacker face??

mackeeeavelli 11y ago

The AM hack is similar in tenor to the Sony hack. Nothing about the hack has the feel of a lone wolf or black hat operation. I have no doubt someone will get pinned for the hack, but I also think if it wasn't an inside job it was state-sponsored.

deleted 11y ago
[deleted]

Zenst 11y ago

The aspect that a company who's business model resolves around people breaking contracts (marriage contracts) finding itself on the downside of what could of been an employee who broke their employment contract is something ironic. Maybe we should not be calling those a hack and more a data-affair. Still one can only hope that we gain some better protection and rights regarding how companies handle data and more so in the area of authority auditing that those rules and standards are maintained.

tempVariable 11y ago

I know it's a giant long shot, and the Zhu is not using his own IP/ISP, but could the FBI use the screenshot showing his desktop with Twitter, Youtube, Google and do an intersection of IPs on those services for the pattern that matches his use on those services ? The twitter user Zhu, who listened to Thunderstruck and went to Google within a time period. edit: I'd like to have 1% of the $500k bounty wired in Dogecoins please

unreal37 11y ago
I'm going to guess that if the NSA was at all interested in this guy, they know exactly who he is already. But they're probably not.

ivoras 11y ago

deuszhu's tweets are indistinguishable from a bot's. Well, most of them.

hackuser 11y ago

Hmmm ... is it appropriate for Brian Krebs to dox this person (at least to some extent), in a much more public forum than someplace like 4chan, because Krebs suspects him or in order to compel him to talk to Krebs?

jasonmp85 11y ago

> But there may something else going on here. It is possible that Zu’s approach to tweeting — that is, responding to or addressing other Twitter users without invoking the intended recipient’s Twitter handle — is something of a security precaution. After all, he had to know and even expect that security researchers would try to reconstruct his conversations after the fact. But this is far more difficult to do when the Twitter user in question never actually participates in threaded conversations. People who engage in this way of tweeting also do not readily reveal the Twitter identities of the people with whom they chat most. I love how Krebs has reframed "subtweeting" as some sort of new security practice as opposed to an annoying passive-aggressive thing everyone does from time to time :-D

akash3333 11y ago

Anyone else wondering what tool would Krebs use to download another users timeline?

akash3333 11y ago
Never mind, got the answer http://krebsonsecurity.com/2015/08/who-hacked-ashley-madison/comment-page-3/#comment-391736 http://krebsonsecurity.com/2015/08/who-hacked-ashley-madison...

signaler 11y ago

The old narrative of vigilante justice in the hacker set is getting repetitive. I wish reports weren't so biased to use 'hacker' in their stories because it forever connotes hack with something unsavoury. This is an infosec breach, not a hack. The 'Impact Team' even said they did not have to try that hard. Any good hack has hack value, and the only reason AM was booted offline was because it happened on their clock, and not the clock of any other {random} internet database. This could have been any site. Also I wrote this small piece on hackerdom and what paths we can take if we are inclined to hack: http://blog.higg.im/2015/05/27/hacker-with-lots-of-free-time-what-are-you-doing-about-that/ http://blog.higg.im/2015/05/27/hacker-with-lots-of-free-time...

fjbarrett 11y ago

Wow this is elegant. Well-written article and super engaging story. The tab on the screenshot is magical.