Researcher Cracks 4000 Passwords Ashley Madison

A researcher has managed to crack 4000 passwords of users of Ashley Madison, which demonstrates how important it is to choose a strong password. Attackers managed last month to steal a large amount of data from Ashley Madison, the site for cheaters.

The data were published last week in part. Among the stolen data there were also 36 million password hashes. Ashley Madison had the passwords are not stored in plain text, but in hashed form. This makes them not directly readable, but they can be cracked. Dean Pierce, Linux security engineer at chip giant Intel, password hashes ended with his special "squat machine" to crack.

Computer Pierce consists of four R9 290 ATI video cards. For hashing the password had Ashley Madison the bcrypt algorithm used, and there was also a "salt-made 'use. This makes it much more difficult to crack password hashes. In a weaker algorithm, such as MD5, it is possible to try millions of password combinations per second. In the case of the make bcrypt hashes came Pierce with his computer not go beyond 156 hashes per second.

The experiments also revealed the extent of the number of password hashes problematic, so he could load 6 million of the 36 million password hashes. For cracking the hashes he used the RockYou dictionary. RockYou is a company developing widgets for social media. In 2009 it was hacked, giving attackers more than 32 million managed to steal passwords. These passwords were stored in plain text, and finally appeared on the Internet. Since then the passwords of RockYou be used by many researchers as the default password cracking.

Crack Time

Pierce had his machine power for five days, during which he finally managed to crack 4000 passwords. That equates to 32.6 cracked passwords per hour. It also showed that there were 1191 unique passwords between. The most common password is "123456", which occurred 202 times. It also showed that 105 users had chosen the password "password". Pierce made ​​a Top 20 of the most common passwords. The list is very similar to other password lists that are regularly published.

According to the researcher, it is probably impossible to crack each bcrypt password, but will in the case of Ashley Madison eventually many passwords are outdated anyway. It is in this case especially for weak passwords which are found in many dictionaries, or simply through brute force to retrieve his. Thus, on the list of passwords of the short Pierce especially less than eight characters.

Hackers: Website Ashley Madison Was Poorly Protected

The security of Ashley Madison, the hacked website for adulterers, was far below par, say the hackers who carried out the hack. Last month the site was hacked, with data of some 32 million people, as well as all kinds of business data were captured.

The data this week were put partly online. There is now 30GB published on stolen data. In an interview with Vice Magazine let the hackers know they still have 300GB of emails from employees and documents from the internal network. Nor would they have held tens of thousands of photos of subscribers of the website and some chats and messages. One third of the images were photographs of male genitalia that they will not publish, which is also true for most emails from employees of the company.

The Impact Team, as hackers call themselves, denounce especially the absent protection from Ashley Madison. "We did our best to make the attack undetectable, but when we arrived it turned out that there was no security to get around." The security of a site by the hackers as "poor" circumscribed. "There was no monitoring. No security. The only thing was a segmented network." Furthermore, it was also easy to gain root access on the servers of Ashley Madison, as they note.Regarding the future, the hackers do not exclude that they also other sites, businesses and possibly corrupt politicians will hacking.

Subscribers Ashley Madison Extorted via E-mail

Several subscribers cheaters website Ashley Madison became the target of extortionists who threaten to inform their partner unless they pay an amount in bitcoin. Both American and New Zealand subscribers have received the email.

The email warns that the cost of a divorce lawyer if the partner comes behind the cheating, or anything revealing to have the data for consequences if someone is already in a separation procedure. It also warned of the reaction of family and friends as they discover that the person in question was active on Ashley Madison, so reporting CoinDesk and Stuff.

The extortionist then demands two bitcoins, what with the current exchange rate is 410 euros. How many subscribers have received the e-mail or run from the threat is unknown. Attackers managed last month to hack the website Ashley Madison this week and made ​​a part of the data publicly available. The media has already speculated that subscribers would be extorted possible.

Customer Data 600 In Stolen Data Ashley Madison

The personal data of users can be found in the stolen and published online database of Ashley Madison. These are e-mail addresses, mailing address and IP addresses, reports Yahoo! News that the stolen data analyzed.

A group of attackers managed to hack the website for cheaters last month and thereby made ​​gigabytes of data booty. It's about user profiles, as well as credit card transactions. In this final data set the data of the Dutch have been found. The data of 32 million users were on Monday put online. Tonight the attackers have again stolen data published reports Vice Magazine. This time it comes to 20GB of data, including e-mail inbox Noel Biderman, CEO of Avid Life Media, the parent company of Ashley Madison.

32 Million Users Data Ashley Madison Put Online

The attackers knew who last month at the Ashley Madison website to break in and loot that made ​​the data of millions of users have now put the data online. It involves account information and login details of around 32 million users of the website for cheaters, reports Wired.

In addition also published a list of seven years credit and payment transactions. This data consists of millions of payment transactions, including names, addresses, email addresses and amounts paid. The latter have been given four digits of the credit card. The stolen data is now distributed via Tor websites and torrent files. They can be downloaded from download sites like Rapidshare and Mega. The attackers had the data already published two days ago on Reddit, but it has now been picked up by the media.

The attackers demanded that Ashley Madison hacked the website and the website Established They were taken offline, otherwise they would make the data public. In a statement, the attackers set to Avid Life Media, the company behind Ashley Madison and Established Men, created thousands of fake profiles of women. The attackers The website also called a scam."Chances are good that you signed up for one of the largest websites for affairs, but have never had one." Victims of data theft getting the attackers advice to sue the company.

The database would be some 15,000 e-mail addresses ending in .gov and .mil. It is in this case to addresses used by the US military and government. In a statement enables Avid Life Media that does not involve hacktivism, but there is a crime.Meanwhile, the FBI would be involved in the investigation. According to the company, the attackers will eventually be caught.

Update

Security expert Robert Graham analyzed the stolen data and says that it is more than 36 million accounts. 28 million accounts are men, while five million women had registered for the website. The other accounts could not be determined.When analyzing the credit Graham came only men took against. In addition, there are 250,000 possible deleted accounts, since the password of it was removed. The account information includes full name, email address and password hash, but also data such as height and weight.

Also, mailing address and GPS coordinates were found in the data dump from 9,7GB. "I suspect that many players from creating a fake profile, but with an app that passed their real GPS coordinates," Graham says. The passwords are hashed with bcrypt. A stronger algorithm than MD5. Yet Graham expects hackers will succeed especially many weak passwords to "crack". Users with a strong password, however, would be safe.

No New Data Ashley Madison Users Put Online

Several media reports that the attackers behind the hack of Ashley Madison information of users have put online, but it is the same data that Sunday had already been made ​​public. Attackers then made ​​known to the data of over 37 million users had captured, as well as all kinds of business data of a site for cheaters.

The attackers threatened to remove all data online as Ashley Madison has not been taken off the air. The website is still online. Still, the threat has not yet been implemented and there are no new data made public. In announcing the hack data from two users were mentioned. It is the real name, username, registration date, complete address, email address, sexual fantasies, desires and password hash of an American man.

In the case of the second user it comes to someone from the "full delete" function had used. This option allows users of the website for $ 19 it removed their profile. However, the purchase details have been preserved, said the attackers. In this case it is the user's name, address and sexual fantasies. His username, password hash and email address are not mentioned.Ashley Madison is a website for people who want to cheat. Because of the incident, the website decided users free of charge to raise their profile.

Database AdultFriendFinder Offered For 15,000 Euros

The man who claims to be responsible for the break-in at the erotic dating site Adult Friend Finder now offers the full database of private information for sale, amounting to 70 bitcoins. With the current exchange rate, that equates to more than 15,000 euros, as discovered IT consultant Bev Robb.

There had already been a part of the database containing the sexual preference of 3.9 million members , as well as their email addresses, user names, birth dates, post codes and IP addresses put online. The complete database would also contain credit card information. In a FAQ about the incident late AdultFriendFinder however, know that there is no evidence that personal financial information or passwords have been compromised. The man behind the burglary is also announced that he can hack any website within a week, with a budget of 750 bitcoins is requested. That would be the current exchange rate is 165,000 euros.

Private Data 3.9 Million Members Adult Dating Leaked

Attackers have managed to gain access to a database of popular adult dating site Adult FriendFinder and subsequently the private data of 3.9 million members leaked. It is the sexual preference of users, whether they are heterosexual or homosexual, and extramarital relationships search and e-mail addresses, user names, birth dates, post codes and IP addresses. Among the leaked data are also data from users who had asked the website to delete their account.

Reported that the British television Channel4 . The data of the users would be traded on a black market, where the captured email addresses now with all kinds of spam and infected e-mails are bombarded. The data stolen were also found data from British government and army personnel. Experts warn that these data can be used for targeted attacks on interesting individuals.

In a statement, the dating site says that there are now cooperating with the authorities and a forensic investigation. Depending on the results will take measures to protect the website users. How the attackers access to the database managed to get is unknown.