Over a million Australian men who have tried to cheat on their partners via the Ashley Madison web site whose slogan was “life is short, have an affair” without your partners knowing, are set to be exposed after their contact details were posted online overnight.
The posting includes every name and email address of every member
on the website as well as hashed passwords used to access the site.
When the hack happened a group or individual known as The
Impact Team claimed to be behind the attack and that it had data on all of
Ashley Madison’s 37 million users and its partner sites, Cougar Life and
Established Men including over one million registered customers in Australia.
Now the hackers have posted a data dump that’s 9.7 GB in
size and reveals details like log-ins, member account information, and credit
card and other payment transaction info.
The passwords released in the data dump will enable hackers
to nab private account correspondence, too.
The data dump was posted to the dark web using an Onion
address that could only be accessed through use of the Tor browser.
According to Wired, passwords released in the data dump were
hashed using the bcrypt algorithm for PHP. Robert Graham, CEO of security
company Erratasec, states that despite this method’s security, “hackers are
still likely to be able to ‘crack’ many of these hashes in order to discover
the account holder’s original password.”
On the bright side, plenty of other sites don’t even bother
to encrypt their customer’s passwords. 2013’s hack of Cupid Media revealed over
40 million user passwords stored, unbelievably, in plaintext. “We’re so used to
seeing cleartext and MD5 hashes,” Graham said. “It’s refreshing to see bcrypt
actually being used.”
Last month’s Ashley Madison hacker intrusion, and this
month’s data leak, are aimed at nothing less than the complete removal of both
AshleyMadison and another Avid Life Media website, EstablishedMen, from the
internet.
“Avid Life Media has been instructed to take Ashley Madison
and Established Men offline permanently in all forms, or we will release all
customer records, including profiles with all the customers’ secret sexual
fantasies and matching credit card transactions, real names and addresses, and
employee documents and emails,” says the original statement from Impact Team
following last month’s data breach.
To indicate their seriousness, the hackers posted samples of
some of the details they had uncovered, which included company financial
information and internal network data.
While the hackers appear miffed at the morals of Ashley
Madison and Established Men, Avid Life Media’s alleged business practices are
what really gets their goat. For example, the company promises to delete data
from their database for a $19 fee, but according to the hackers, does not do
so. “Too bad for those men, they’re cheating dirtbags and deserve no such
discretion,” the hackers wrote. “Too bad for ALM, you promised secrecy but
didn’t deliver.”
Accompanying today’s data dump, the Impact Team released
another statement:
“Avid Life Media has failed to take down Ashley Madison and
Established Men. We have explained the fraud, deceit, and stupidity of ALM and
their members. Now everyone gets to see their data.. Keep in mind the site is a
scam with thousands of fake female profiles. They claim 90-95% of actual users
are male. Chances are your man signed up on the world’s biggest affair site,
but never had one. He just tried to. If that distinction matters.
“Find yourself in here? It was ALM that failed you and lied
to you. Prosecute them and claim damages. Then move on with your life. Learn
your lesson and make amends. Embarrassing now, but you’ll get over it.”
Of note: Ashley Madison does not require email addresses to
be verified in order to create accounts, so it’s possible that otherwise
legitimate addresses were hijacked and used by site members.
In a strident response to the huge data breach, Avid Life
Media stated:
“This event is not an act of hacktivism, it is an act of
criminality. It is an illegal action against the individual members of
AshleyMadison.com, as well as any freethinking people who choose to engage in
fully lawful online activities. The criminal, or criminals, involved in this
act have appointed themselves as the moral judge, juror, and executioner,
seeing fit to impose a personal notion of virtue on all of society. We will not
sit idly by and allow these thieves to force their personal ideology on
citizens around the world.”
