Slashdot Mirror
PlentyofFish Hacked, Founder Emails Hacker's Mom
hellkyng writes "The online dating site PlentyofFish was hacked, and purportedly 30 million customer records were stolen. The site's founder, Markus Frind, is blaming the security researcher who discovered the vulnerability and the journalist who confirmed the issue."
The researcher who reported the vulnerability is Chris Russo, one of the guys who hacked The Pirate Bay last year. He explained his side of the story as well. Mr. Frind says he tracked down Russo's Facebook page and emailed his mom.
should not affect slashdot crowd since they do not date.
The "hacker" found a weakness in the websites security and exploited it. Then the website found a weakness in the hackers security and did the same in turn. You'd think the hacker in question would be a little more secure about their own personal information.
I was on the site for a while. It was always slightly clunky, but I'd prefer a free, one-man labor of love to a buy-in site that basically tries to promise sex for money. It was particularly helpful in helping me discover that I wasn't as bad as most of the creeps out there... and conversely, creepiness doesn't belong exclusively to those of the male persuasion. That was good to know -- it helped me realize that I need to be picky. (And my pickiness was rewarded many times over when I found my fiancee. In my Sunday School class).
But on the tech side, it irritated the living crap outta me that POF would send me a weekly e-mail with my password IN PLAIN TEXT. Every week, just as a reminder of how easy it would be to log in. Yeah, easy for *anyone* to log in as me and, if I were foolish enough to put important information on POF, to mess with my life. And, of course, if I were foolish enough to use that password for my bank account... well, I think anyone on this site knows the rest.
So I'm not at all surprised that someone found a way to hack POF. Sending a password in plaintext is bad, but not uncommon. Heck, T-Mobile does it. But sending it every week, unsolicited? I'm sorry to be rude, but that's just stupid.
Stressed? Me? Of course not. Stress is what a rubber band feels before it breaks, silly.
So an immature but technically competent jerk cracked you computers and is now trying to get your companies lunch money, metaphorically. Your response is, among other things, to tell his mom.
O_o
You know, that sounds about right.
Not surprised that site got hacked and is full of incompetent developers and people. If you go there every other sentence has some huge grammatical error in it. The guy running it is completely illiterate. The design is horrible too. I'm sure nobody there knows what's going on at all! Who uses MSSQL?!? Get for real. I thought it was funny that the sentence 'there is a serial killer murdering people from the website' was said all non-nonchalantly in the article.
How would a "security researcher" know that a SQL injection bug was being actively exploited if he just uncovered the bug himself?
This sounds a bit odd as using a SQL injection to expose the users' details would require you to deliberately manipulate querystring parameters or form fields. The results will display in your own browser. How would he know whether anyone else were doing this? Was it because he really didn't uncover it himself but found the 30.000 users' details somewhere else?
No, this sounds a lot more like someone mildly proficient (you can use automated tools to find SQL injections so this is just one level above script kiddie) found a bug and wanted to capitalize on it. To underline the seriousness he embellished a little on the "being actively exploited".
I take it that POF has server logs and that they can tell from those whether anyone else exploited the bug.
Reading slashdot one-liner: (irm http://rss.slashdot.org/Slashdot/slashdot).rdf.item | fl title,desc*
Assuming the Plentyoffish guy isn't lying (a definite possibility): http://plentyoffish.wordpress.com/2011/01/31/plentyoffish-hacked/ states:
They then start talking about money because they need to incorporate a company that can deal with companies outside of Argentina and that will cost $15,000. They also needed to know if they were going to make over $100k/year or 500k/year as that would require different registrations
I just looked it up online and found no mention of needing different incorporation types for dealing with customers only in Argentina vs. external to Argentina, The highest fee I found online (although I'm sure there are companies willing to charge more) was USD $1760 to form a "Sociedad Anónima" vs. USD $1370 to form a "Sociedad de Responsabilidad Limitada" (sounds like a standard Limited Liability Corporation, but I'm not an Argentine business lawyer so I could be wrong), far short of the $15,000 they are asking for.
I realise that this is somewhat off-topic, but it can't be a good idea to have a dating site with a domain name that reads as "plenty offish". When will people learn to use hyphens in domain names?
Tried Plenty of Fish for a shortwhile - as a default, the service will mail 'new matches' to the email account you registered with every few days. These emails contain a a plain-text version of your password (which essentially reads as "Remember, your password is :XXXX123").
It's not entirely surprising that the site had its security compromised.
If I got an email that looked like:
I'd assume it was somebody trying to scam me.
here.
I bet PoF used double Rot-13 encryption.
Best Slashdot Co
If this data goes public I am going to email every single effected user on Plentyoffish your phone number, email address and picture. And tell them you hacked into their accounts.
Then i'm going to sue you In Canada, US and UK and argintina. I am going to completely destroy your life, no one is ever going to hire you for anything again, this isn't piratebay and we definately aren't fooling around.
Markus.
Back when Cheswick and Bellovin were doing the original Bell Labs firewalls, and caught a Dutch teenager trying to hack into their site, the Netherlands didn't have any computer security laws that made it illegal. "So we called his mom...."
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
Who in their right mind believes anything on plentyoffish.com, match.com, date.com, cupid.com, eharmony.com... All they are optimized to do is to increase the likelihood NOT to find the correct partner so as to get as much free money as possible. Not doing it this way would be an epic loss of opportunity from a business point of view.
This breaks the previous record for the most logins compromised at once by a factor of 3 (beating Trapster's 10 million)
"When information is power, privacy is freedom" - Jah-Wren Ryel
They've changed all passwords due to the attack (I got a fresh, random one). I have a vague worry that my email address will turn up somewhere I don't want it to, but apart from that there's no other useful personal information on my profile, which, when I come to think of it is kind-of ironic for a dating site :p.
He didn't email the hacker's mother, he emailed the security researcher's mother. Some unknown party hacked his website, and he blames the security researcher that was going out of his way to assist them in closing the vulnerability. After reading the researchers take on this, POF CEO could possibly be facing criminal charges for uttering death threats, harassment and perhaps a civil libel suit.
AccountKiller
*Headline taken from : http://www.krebsonsecurity.com/
A much easier headline.
Despite the term hacker not defining whether good or bad, instead only indicating circumvention of computer security. It has been used so virally in the media, that it now tends to infer that a malicious hack was carried out. In short the headline "PlentyofFish Hacked Founder Emails Hackers Mom"seems to suggest that the founder of PlentyofFish had found the person who breached his servers and then emailed their mother. However that is not the case.
https://secure.wikimedia.org/wikipedia/en/wiki/Hacker
-1 is for flame bait and trolls, not because you disagree with someone.
I have an account. I logged in some time last week and it said my password had expired and I needed to change it. The change screen was sort of crappy and I was able to "reset" my password to the old password. If the rat b@st@rd had said "we've been hacked and you need to change your password", well, I would have changed my password to something else. But, just a simple expiration? Well, really not a reason to change my password.
Bureaucrats get caught with their pants down, don't come clean for a while, and then they go and blame everyone else for their screw ups.
Markus, take a hint. Don't send people's passwords to them in an e-mail once or more a week. Geez... Now, I do have a reason to change my password.
There's a gas station by my house that likes to to put the names of people that bounced checks along with all their contact info on a great big billboard for the entire city to see. It's pretty entertaining.
Reading both accounts of the story (one from the CEO, the other from the security expert), it seems to be a case of "who do you believe". All we truly know is that the site was hacked, these guys were involved somehow, and now they're mad at each other. Everything else is just based on what one side or the other says.
That said, looking through the blog postings of the CEO, he strikes me as having the classic case of paranoid narcissist personality disorder. Every other posting is a rant about how his competitors are all out to get him. Everything they do is about HIM and a response to HIS business. When eHarmony does something, it's not just an innocent business expansion, it's a direct personal attack on this guy. I've worked with presidents and CEOs who use similar wording to this CEO in their daily speech, and whose nuances and mannerisms seem to match this guy's perfectly. Although my examples are only anecdotal, I'd be willing to bet this disorder is quite common among business leaders.
Not knowing more about the situation and only having their two accounts to go with, I would probably fall on the side of believing the security expert's account more, just looking at the level of paranoia and exaggeration in the CEO's blogging history.
Really?? You would, assume any notification of a security breach to be fraudulent until proven otherwise? What web site do you operate, so I can be sure never to sign up or give you any personal details.
Markus is a spoiled, rich crybaby. He's made so much money off that hideous site for so many years (and boasted about it for ages on his blog)... you would think he could afford proper security audits and support to close holes.
Basically he's been sitting on his ass technically for nearly the entire time, and now he's pissy because his lack of attention bit him.
And for the record, OkCupid.com is so immeasurably better than PoF in every way, it's time for the old whale to die.
.sigs are for post^Hers.
Come on, did anyone else but your programmers write the code for your site?
If someone saw a bug and then sent it to you...then guess what it is up to you to patch it right away, if 1 week later this bug is deployed in the wild...then sorry, but you had your chance...that is why you make the millions, and others don't, else we all would have our very own dating websites....you need good coders, and just anyone to do your code for you.
Look, here's why companies pay bounties and don't hire "security researchers" on spec, and, vice versa, here's why "security researchers" need to be very careful about how they go about getting a real job: Pointing out security vulnerabilities and asking for money IS extortion. "Gee, nice construction site you've got here. Too bad you can't afford to work 24 hours a day. Shame if someone were to vandalize your hardware while you were asleep. You know, even I could do that, let me show you*. Buy the way, I'm looking for a job. *=that's the step that's a problem; it's a double problem in the geek world, because the only accreditation that counts is being able to commit the crime that's a problem. So, sure, sleazeballs all around. What'd you expect? It's an online dating site.
What happened after the dude emailed the other dude's mom? Did they make out? This is a nerd's ultimate revenge!
Will it be written in a style similar to APK's bombastic style? I should like to read it, and ALL of its P.S. clauses, when it's published.
How should I subscribe to your newsletter, Sir? I really admire your ideas.
Seriously?
You call dating based on physical attractiveness shallow... Fair enough. I would counter with the question: Why should I date people who aren't attractive to me? Why is physical attractiveness any less important than emotional attractiveness? I'd agree that it's shallow to date on looks alone... But speaking as someone who has tried having romantic relationships relationships with people he isn't physically attracted to, I can say that it doesn't work any better than a relationship with someone I'm physically attracted to but emotionally uninterested in.
You make a great point though that you can't expect to date outside your league. Want a hot chick who's totally intellectual and into nerdy guys? Be an intellectual nerd who has a bit of a sense of style and works out.
So would walking around someone's house trying all the doorknobs to see is one is unlocked, be performing a security audit or attempting to beak into the place?
You need to read How to Win Friends and Influence People, by Dale Carnegie. It's a great book that has sold a brazillion copies about exactly what you're talking about. If you really DO have Asperger's and honestly cannot understand the importance of taking a sincere interest in other people, you will after reading this book.
Comment removed based on user account deletion
Ah, hypocrisy at its finest.
Fascism should more properly be called corporatism because it is the merger of state and corporate power. -- Mussolini
you = stagnated. i make more every day than you've made in 10 years. you want what, a picture of my pay stub? you are nothing. you get nothing.
cower some more, feeb... still waiting for you to update that white pages listing.
ea != ae
you're an idiot.
so says the anonymous coward who trolls others endlessly for no good reason. you're an idiot.
you're an idiot.
you're an idiot.