How the most damaging hack In cyber history was met with little notice

How the most damaging hack In cyber history was met with little notice

The 14 largest Megachurches in the world range from the Lakewood Church in Houston Texas (45,000 Members) to the Yoido Church in Seoul Korea (253,000 Members). They all denounce homosexuality as a sin. It is comforting to note that the pastors of only two of these churches were members of Adult Friend Finder, (the online dating service and swinger personals community website for FriendFinder, Inc.), and both were searching for anonymous gay hookups. Of the 535 members of congress, only 16 Congressmen and two Senators were members of this adult website. Most were interested in BDSM (bondage). Only three were interested in gay hookups.

hackOf the fortune 500 corporations, fewer than 1,420 executives (directors, VPs and above) were members of Adult Friend Finder. Another 230,000 or so rank and file employees of fortune 500 companies were also members – following in the footsteps of their admired superiors no doubt. Their interests ranged widely. Of the 2,400,000 odd employees of the Federal Government, we find a measly 120,000 or so who were members. This warms my heart.

When I tell you, however, that over 90 percent of all these members accessed the website, perused photographs (mostly naked or semi-naked), sent texts and emails and shared fascinating sexual fantasies with uncountable numbers of people while on the job and while using government or corporate computers, you might raise an eyebrow or two.

The above tragically fascinating information comes from a well publicized hack of Adult Friendfinder, accomplished last week by “ROR[RG]”, a hacker living in the beautiful and magical city of Bangkok, Thailand.  This was absolutely not the first hack of Adult Friend Finder.  I am personally aware of seven previous hacks and there are rumors of dozens, if not hundreds of prior hacks.

An extraordinary leak, but not unique

I need to make something perfectly clear.  The hacks that reach public awareness are extremely rare.  For a hack to reach public awareness someone has to make a serious mistake, or they are demanding money or some other asset or, in the case of ROR[RG], they have an ax to grind.  ROR[RG] insisted that Adult Friend Finder (the company) owed a friend of his nearly a quarter of a million dollars.  He wanted his friend to get paid, so he went public.  I would estimate that for every computer hack that reaches the public’s knowledge there are 100 hacks that go unnoticed.

All previous hacks of Adult Friend Finder that I am aware of were done by hackers who simply wanted to know whether their girlfriend, or boyfriend was possibly cheating on them.  Hacks of this nature seldom reach the Surface Web, and thereby, the attention of the press.  For an adept hacker, Downloading the entire Friend Finder database is no more difficult than going to the library and checking out a book.  It’s not that Friend Finder has substandard security, it’s simply that very little, to a determined and talented hacker, is immune to access.

Ransom for the info

I am not a top notch hacker, but I did spend most of my life attempting to stop hackers from accessing or damaging data.  It was my job.  As part of my job, I had to know how hackers did their jobs and became moderately good at it.  It may sound devious or somehow over the line, but would you buy a lock from a lock manufacturer that professed to know nothing about how a lock is picked?  I would not.

RELATED:  Cici's Pizza data breach serves a slice of credit card theft

Anyway, with my limited talents I could easily have walked into the Friend Finder database and collected the same thing that ROR[RG] collected and, using it for analysis, written my story.  That would have been illegal however.  Instead I went to ROR[RG]’s area where he had placed the data.  As usual, being a day late and a dollar short, by the time I knocked on the door he was selling incomplete segments of the database for non-exclusive use for $16,000.  That’s more than I make for an article, so paying him (he wanted bitcoins by the way) was out of the question.  I briefly considered barging in, grabbing what I needed and taking off without leaving any trace, but, let’s face it, he wanted money for it, so I would be committing theft.  Part of me kept nagging that Google does the same thing with nearly everyone on earth a billion times a day – stealing our personal data — but such reasoning is the first act of making a criminal.  Google may commit whatever crimes it likes.  It doesn’t mean that I have to follow suit.

Turning to the concept first proposed in the movie Minority Report, where people were detained by acts called “Pre-Crime”, I contacted a friend of mine who had sucked up a copy of the database before ROR[RG] had a chance to lock it down and begin asking for cash.  I can only assume that this would be classified as pre-theft and, according to Federal and State statutes, pre-theft was not yet a crime.  I simply asked my good friend – Andrew Aurnheimer – @rabite on Twitter (he demanded I include his name and handle).  He gave me access and I began to analyze it.

Getting the data

This whole affair raises complex questions about ethics and morality of which my brain is not qualified to deal.  If someone steals data, then demands cash for it, and one refuses to pay, it gets tricky.  I did not need to pay, because I could have accessed the exact same data from Adult Friend Finder as easily as a ten year old child with a first grade hackers manual, with absolutely zero chance of getting caught.  However I did not want to steal from Adult Friend Finder, no matter how simple the task or how impossible it would have been to track me.  I was then faced with stealing it from the man who stole it to begin with.  I’m not clear on what rights to possession he may claim, but I didn’t want to test it.  And then there’s Google – sucking up data which rightly belongs to us, constantly in front of the eyes the law with no repercussions.  Anyway, my brain reels.  Let’s get back to our story.

The key to my analysis of the data was the inclusion of the I.P. address accompanying each login.  There were, or course, handles, valid email addresses, age, city and state, sex, race and other key identifiers included in the database, but these can be bogus.  An I.P. address can only be hidden by passing communication through one or more proxy servers.  I have a real time database of all underground proxy servers, as well as all legitimate corporate and government proxy servers, and I can generally work backwards and find the real IP address.  When I cannot, I resort to the same tactic I used to gain access to the Adult Friend Finder database above.  I use my name.  It’s odd how simply naming a successful company after yourself changes people’s perspectives.  Add to that the fact that for two dozen years I actively fought the underground hacking world.  A grudging mutual respect emerged over time that at some point turned into a warm friendship.  I was even invited to keynote DefCon in August of last year in Las Vegas, which I accepted.  And received a standing ovation.  What I’m trying to say is that I can call the owner of a proxy network used for underground, anonymous trafficking in, for example, the Cayman Islands, or anywhere for that matter, introduce myself and ask him to turn over his data to me with the promise it will not be disseminated and he will not be named.  I am, at the very least, well known for keeping my word.  The data is usually turned over to me without question.

RELATED:  Carbon Black buys endpoint protection startup Confer to bolster its security cloud

What was inside the data and what it means

Few of the IP addresses in the Adult Friend Finder database were hidden.  This was the strangest thing about the hack.  You would think that a U.S. congressman, communicating with a young woman about the type of bondage equipment he wanted her to use prior to whipping him with a cane – while on his office computer — might think twice about the pitfalls of ignoring the tools of anonymity that my thirteen year old daughter uses with ease.  But no.

It’s time to get to the meat of this hack.  I could care less about who sleeps with whom and what nameless acts may occur between them.  To be frank, the older I get the funnier sex looks to me, and the less important sex seems as a judgment of character.  However, my attitude isn’t in the majority viewpoint.

ROR[RG] is asking approximately $16,000 for partial, non-exclusive access to the data that he holds.  However, rumor is rampant deep in the Dark Web that an unnamed country has offered him $25 million for exclusive access to the non-redacted database.  Why, you might ask?

Here is the answer:

used gov email address, but their own IP addresses

 

Handle email
verywilling2011 r******s@augustaga.gov
Hrdcore44 j****.k****r@indy.gov
Eaglesfan_6969 W*****m.*****son@Dhs.gov
VuDuDado c********er.****ry@va.gov
stormvet224 j*****y.****e@leo.gov
lirk1251 k*****@plano.gov

 

——————————————————————————————————

used gov ip and their own email addresses

 

Handle email IP Location
cavcam20 c*********er@msn.com 132.79.10.15 Fort Huachuca, United States
JPDanger3 fr*******hy@gmail.com 131.122.33.187 Navy Network Information Center (NNIC)  Virginia Beach, VA
TheRealSteve2 S*******20@hotmail.com 131.122.52.135 Navy Network Information Center (NNIC)  Virginia Beach, VA
22drew88 dr*****mp@aol.com 204.34.240.100 Clients.usnbgtmo.navy.mil  City
Clutch42Single p****o@yahoo.com 132.79.7.15 hvaarlngwc01.ngb.army.mil  City

——————————————————————————————————

used gov ip and gov email

 

Handle email Domain
Vshah6762 v****y*******@nasa.gov nasa.gov
Hitit1972 E******@llr.sc.gov llr.sc.gov
gaygay61 jo******dy@ssa.gov ssa.gov
cHrisdaha m***.*****m@houstontx.gov houstontx.gov
Hughojh J****es@law.nyc.gov law.nyc.gov
jgarch g***o***@michigan.gov michigan.gov
superfun41 g*****y.****o****@njwg.cap.gov njwg.cap.gov
musicman6009 j***e@ncua.gov ncua.gov

High ranking officials within every agency of the U.S. Government, not to mention six U.S. state governors and 18 members of Congress, and countless aides to the same people, are all members of Adult Friend Finder.  Nearly all of these officials are married with children.  Imagine what would happen if Russia, or China got hold of this information.  They would certainly not demand money to keep quiet.  No — each of these people would be visited by a warm-hearted, well-dressed, kind and empathetic person whose conversation would go like this:

“We are so sorry that you got caught up in this nonsense, and we realize that it in no way taints your character or value as a productive citizen.  Frankly, I myself have done far worse.  We, in Russia, take a more practical view to such issues.  They are not important.  We have done what we can to keep your name out of this sad affair and can guarantee it will never come to light.  That would help no-one, and we wish to hurt no-one.  So you have a friend in me, and a friend in the Country of Russia.  I believe I could even help you gain power and prestige in your own country.  I am privy to much that is happening behind the scenes in Russia and would be willing to advise you on affairs that impact both or our countries.  You may call me at any time.  In fact, the vote coming up in July is one such issue that I can give you good advice on.  Please call me.”

Can’t happen, you say?  I say that nothing will prevent it from happening.  If this hack was not the potentially most damaging hack we have experienced, then prove me wrong and I will eat my shoe.

RELATED:  Distil Networks raises $21M to fight bad bots
photo credit: John McAfee
John McAfee

John McAfee

Dr. John McAfee - This software pioneer and father of antivirus needs little introduction. Once a prince of Silicon Valley and a contemporary of such iconic names such as Jobs, Bushnell and Wozniak, he removed himself to a life of seclusion, adventure and international controversy. His return to technology through the company he founded known as Future Tense Central has produced a number of standout efforts. Among them, his latest visions in the world of security and communications include secure messaging, mobile and computer privacy, encryption, and identity.

About Get McAfee'd
We have all lost freedom. Some more than others. What is left of freedom is all that we have, yet some would insist that they have nothing to hide and that intrusions on privacy are acceptable in exchange for conveniences or the perception of security. This erosion of privacy and the concept of freedom are more than polar opposites, they cannot exist at the same time.The truth that nobody cares more about the security of data than its owner is fallacious, because if the owner cared about the data, they would never have agreed to the terms of the data’s use. So the owner never really owned this data in the first place because of passive agreement to its use.We are all guilty of making this deal to some degree, but you can make a difference by protecting yourself and finding ways to secure your digital life.Take a stand. Visit FutureTenseCentral.com.
John McAfee

SIGN UP HERE FOR THE MCAFEE BULLETIN!

Sign up here for just the updates from Security Columnist John McAfee.

SIGN UP HERE FOR THE MCAFEE BULLETIN!

Sign up here for just the updates from Security Columnist John McAfee.

Submit a Comment

Your email address will not be published. Required fields are marked *

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>

Share This

Share This

Share this post with your friends!