Private Data 3.9 Million Members Adult Dating Leaked

Attackers have managed to gain access to a database of popular adult dating site Adult FriendFinder and subsequently the private data of 3.9 million members leaked. It is the sexual preference of users, whether they are heterosexual or homosexual, and extramarital relationships search and e-mail addresses, user names, birth dates, post codes and IP addresses. Among the leaked data are also data from users who had asked the website to delete their account.

Reported that the British television Channel4 . The data of the users would be traded on a black market, where the captured email addresses now with all kinds of spam and infected e-mails are bombarded. The data stolen were also found data from British government and army personnel. Experts warn that these data can be used for targeted attacks on interesting individuals.

In a statement, the dating site says that there are now cooperating with the authorities and a forensic investigation. Depending on the results will take measures to protect the website users. How the attackers access to the database managed to get is unknown.

Nearly 40,000 MongoDB Databases Open Internet

Researchers have found on the Internet thousands MongoDB databases that are directly accessible via the Internet, making sensitive information at risk. MongoDB is an open source NoSQL database that is used by several major websites and services, as well as numerous smaller sites.

According to researchers at the German Center for IT-Security, Privacy, and Accountability (CISPA) a less experienced administrator to set up a MongoDB Web server may forget to set important security measures. "This leads to a completely open and vulnerable database that anyone can approach, and even worse, can manipulate."

Standard running MongoDB on TCP port 27017. An attacker would only need to perform a port scan to find databases. This would only cost a few hours or can be done through a search engine as Shodan. During the first port scan, the researchers discovered 39 890 open MongoDB databases. The researchers note that the figure may be inaccurate.

Many larger providers blocked ie port scan, so there may be much more open MongoDB databases are online. On the other hand, different databases may be set intentionally to be vulnerable and open, for example as a honeypot. The researchers in their report ( pdf ) several recommendations to secure databases. In an update , they emphasize that the problem is not with MongoDB, but the administrators who configure the software insecure.

Researcher Publishes File With 10 Million Passwords

A researcher has published a file of 10 million passwords and usernames in order to improve the security of passwords. According to researcher and security consultant Mark Burnett gives his "carefully selected" dataset insight into user behavior.

Yet he hesitated to make the file public. Following the sentencing of Barrett Brown, the self-proclaimed spokesman for Anonymous. He received a sentence of 15 months because of the link to a file with stolen data. It was here that stolen data was already public. In his own case Burrnett fear not to be arrested. Indeed, he has no intention to commit fraud or facilitate unauthorized access to systems.

Therefore, he has removed as much as possible identifying information, including the domain of the e-mail addresses. In addition to the variety of data sets and the data will not be traced back to one company. Also keywords like company names removed, leading to the possible source of a data breach may indicate. The same applies to information that can be traced back to an individual. The now published passwords, which were collected over a period of 15 years, according to the researcher also mostly "dead passwords".

Yet he publishes them because this is a topic largely ignored and understanding password use can offer. Most researchers, however, would be afraid to publish passwords and usernames together because the two are an authentication feature together, making them a potential threat to be prosecuted. Furthermore Burnett has been download includes a disclaimer, which is necessary for it.