Stories
Slash Boxes
Comments
Search

News for nerds, stuff that matters

Slashdot Log In

Log In

Create Account  |  Retrieve Password

Thousands of Adult Website Accounts Compromised

Posted by kdawson on Tue Dec 25, 2007 04:01 AM
from the how-not-to-handle-a-data-breach dept.
Security
Keith writes "Tens of thousands — or maybe more — accounts to adult websites were recently declared compromised and apparently have been that way since some time in October 2007. The break occurred when the NATS software used to track and manage sales and affiliate revenues was accessed by an intruder. The miscreant apparently discovered a list of admin passwords residing on an unsecured office server at Too Much Media, which makes and maintains NATS installations for adult companies. It would appear that Too Much Media knew of the breach back in October, and rather than fixing the issue tried to bury it by threatening to sue anyone in the adult industry who talked about it." The article gives suggestions for anyone who opened an account at any adult website in the last several months.
+ -
story

Related Stories

Submission: Tens of Thousands of Adult Website Accounts Hacked by Anonymous Coward
This discussion has been archived. No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

Thousands of Adult Website Accounts Compromised 50 Comments More /

 Full
 Abbreviated
 Hidden
More
Loading... please wait.

  • Something came up... (Score:3, Funny)

    by Anonymous Coward on Tuesday December 25 2007, @04:05AM (#21813292)
    Well, I guess that explains why it's so quiet around here.

  • I'm sure they'll... (Score:5, Funny)

    by Bin_jammin (684517) <Binjammin@gmail.com> on Tuesday December 25 2007, @04:05AM (#21813296)
    rub this problem out in a hurry.

  • Compromising Position. (Score:3, Funny)

    by Anonymous Coward on Tuesday December 25 2007, @04:13AM (#21813312)
    ""Tens of thousands -- or maybe more -- accounts to adult websites were recently declared compromised and apparently have been that way since some time in October 2007. "

    Quick! Someone see if Taco's on that list.

  • I have a suggestion too (Score:4, Funny)

    by Glowing Fish (155236) on Tuesday December 25 2007, @04:15AM (#21813320) Homepage
    For everyone who opened up an account on an adult website:

    Usenet.

  • If true, this isn't particularly surprising. (Score:3, Insightful)

    by Anonymous Coward on Tuesday December 25 2007, @04:18AM (#21813328)
    We are, after all, talking about pornography paid for with credit cards. The entity which lost these data is a clearinghouse for porn payments; its customers are the webmasters who run individual adult sites. Webmasters who, of course, have a vested interest in keeping this quiet. The fault was not theirs, per say, but the repercussions if this becomes public knowledge would bear heavily upon them.

    In addition, it's porn. Individual end users cannot protest very much without either A: Admitting they pay for porn online or B: being the subject of askance glances and the occasional, "Methinks he doth protest too much." Some folks won't care, but the kind of people who actually have influence in the real world can't afford that kind of tarnish.

    So, even if the worst happens and large amounts of private data are in nefarious hands, it'll all get dealt with quietly. The victims will sort it out in private with their banks, the webmasters will never speak of it, and the company itself probably won't feel much of a hit. If they really do have 90% market share, I doubt anyone else in the field is ready to just jump in and take over.

    • Re:If true, this isn't particularly surprising. (Score:5, Informative)

      by mochan_s (536939) on Tuesday December 25 2007, @04:41AM (#21813430) Homepage

      In addition, it's porn. Individual end users cannot protest very much without either A: Admitting they pay for porn online or B: being the subject of askance glances and the occasional, "Methinks he doth protest too much."

      You do realize that prepaid credit cards exist, right? You can set any name to it and use it. Since you don't have to have anything physical delivered and it's all online, then you can create fake names and leave out addresses.

      • Re: (Score:2, Insightful)

        by SacredByte (1122105)

        In addition, it's porn. Individual end users cannot protest very much without either A: Admitting they pay for porn online or B: being the subject of askance glances and the occasional, "Methinks he doth protest too much."

        You do realize that prepaid credit cards exist, right? You can set any name to it and use it. Since you don't have to have anything physical delivered and it's all online, then you can create fake names and leave out addresses.

        Do you realize that not every Joe-Sixpack takes the time to

        • Re: (Score:3, Insightful)

          by DarkVader (121278)
          No, the embarrassing part wouldn't be watching porn - everybody does that.

          What would be embarrassing would be getting caught PAYING for porn in 2007. Now that would be embarrassing.

          (And yes, I'm quite sure my credit card information hasn't been compromised in this incident.)

    • Re:If true, this isn't particularly surprising. (Score:5, Interesting)

      by Archon-X (264195) on Tuesday December 25 2007, @06:56AM (#21813854)
      You've made a lot of assumptions, most of them wrong

      #1 - CC data wasnt stolen
      #2 - NATS does NOT process credit cards. It simply coordinates transactions, just like when you buy something from a site via paypal - the transaction is done at paypal, the yes/no result is shipped back to NATS.
      #3 - Don't assume because it's the 'porn industry' that it's seedy and business ethics are out of the window. There are a lot of large companies with a lot of money invested, and the security of their clients makes sense. Why would you want to rip off or mal-treat your clients? There are definitely arseholes in the industry, just as there are everywhere, for example, the post of this article [he released 300 webmaster usernames / passwords to the world, resulting in huge financial thefts.
      #4 - There are multiple industry options: MPA, Epoch, CCBill, etc. NATS has a large market share because the software is good, primarily because it was the first piece of software that had 'no shave' option, ie, the software couldnt steal sales.

      Like it's been said already, this issue was a clusterfuck, and handled badly by TMM, but there is so much misinformation, especially about te threat of stolen CCs and slamming the industry, that I'm compelled to say something.

    • Re:If true, this isn't particularly surprising. (Score:5, Informative)

      by owlnation (858981) on Tuesday December 25 2007, @07:04AM (#21813876)

      In addition, it's porn. Individual end users cannot protest very much without either A: Admitting they pay for porn online or B: being the subject of askance glances and the occasional, "Methinks he doth protest too much." Some folks won't care, but the kind of people who actually have influence in the real world can't afford that kind of tarnish.
      You're looking at this from an English speaking World perspective. Note that in countries such as Holland or Germany, where most of the adult/sex industry is completely legal, consumers of adult products have as much rights as any other consumer. There's also not the stigma attached to such things as there is in the UK or the US. People there would sue, and would sue openly.

      All in all, in countries like Germany there's a much healthier attitude to sex and the adult industry. Both consumers and providers are much better protected there.

      It seems to me that in the UK in particular (which is a semi-fascist state at best anyway) the repression and legislation of the adult industry is increasing, from what was already a very repressed and intolerant level. This is not healthy, this simply makes it easier for organized crime, and incidents like this one to occur.
  • .. Oh boy, that *SUCKS*

  • Suddenly..... (Score:4, Funny)

    by edwardpickman (965122) on Tuesday December 25 2007, @04:30AM (#21813380)
    There was a great disturbance in the geek community.

  • Wait... (Score:4, Funny)

    by c.r.o.c.o (123083) on Tuesday December 25 2007, @04:34AM (#21813400)
    There are people who actually PAY for pr0n?!?
  • "pwned" becomes "pr0ned"?

  • Gift Cards (Score:5, Informative)

    by harlows_monkeys (106428) on Tuesday December 25 2007, @05:00AM (#21813484) Homepage
    This is what gift cards are for, available from numerous outlets (Safeway, Office Depot, Wal-Mart, and similar places). You can get prepaid VISA and Mastercard giftcards, which work great for purchasing porn, or other questionable things of an online nature, where you can't trust the vendor. A $50 card will typically cost about $55.

    After you buy it, you go to a web site from the card vendor, enter the card number and security code, and then set the user name and billing zip code. Then go wild (well, to the extent that you can go wild with $50...). Here's one such card [allaccessgift.com] that is available at a lot of places.

    There are also cards that you can refill from your "real" credit card, but then you are easier to trace. Might as well use a non-refillable card, purchased with cash. That way, if "all models 18 or over, proof on file" turns out to not quite be true, no credit card that can be tied to you will be in the site's records. :-)

    If that's not a concern, though, and you are just trying to limit exposure of your real credit card, then go ahead with the refillable cards. In fact, there are even some that are purely online. They don't provide a physical card. You just go to their site, sign up with your credit card, and they give you a credit card number to use online, with a limit of whatever you want to transfer from your credit card. Here is one such virtual card [www-card.com].

    NOTE: some gift cards cannot be used for porn or gambling, so choose appropriately. And some can be so used, but add a surcharge for porn.

    • Re:Gift Cards (Score:5, Informative)

      by Archon-X (264195) on Tuesday December 25 2007, @05:33AM (#21813598)
      No credit card information was stolen. It's impossible.
      CC information does not, repeat, does not [read: is illegal to keep] on the servers of sites.
      It is maintained by the billers and processors, who thankfully, have better security.

      The threat of stolen CC info is FUD by the poster.
      • I'm not sure that such laws exist here in Australia (and if anyone knows of any, _please_ enlighten me!). Your contract with your merchant will require certain things of you wrt to what you do with any CC information you have taken by whatever means (phone, physical swipe machine, internet, etc), but I'm not aware of any criminal laws that exist.

        We effectively turned away a client who wanted to host their web site on our server because it obviously kept credit card information in a database. We just didn't
      • [quote]No credit card information was stolen. It's impossible.[/quote]

        Interesting that you note something entirely possible to be impossible. CC information can be stolen. If you ever find yourself in a situation where you come to believe that your system is so secure that it's impossible, you probably haven't understood exactly what security, in the context of electronic commerce, means.

        [quote]read: is illegal to keep[/quote]

        Interesting legal analysis. Patently false, but hey, who's counting. All you might
    • My Citbank has such a card. I can decide for myself how much I want the card to be worth with a minimum of 1 EUR and the card is valid for 2 months.

      It generates a new number, the limit, valid from tru, a cvv2 number and the account holders name. This is for www.citibank.be. No idea why not more banks do this.

      I use a new number for each online purchase that I do. The worst that can happen is that the goods are not deliverd and I loose the amount I payed. However I am not worried wether someone in Georgia (no
  • Thank god for BitTorrent. Get all your pr0nz and don't even need a user name. Sometimes being an anonymous coward has its advantages.

    Of course, really, unless there is someone with a high-profile in that list accessing some really really naughty stuff, this breach won't affect the average Joe Blow out there.

  • they should do... (Score:5, Funny)

    by nguy (1207026) on Tuesday December 25 2007, @05:06AM (#21813494)
    ... more penetration testing

  • RE: The Truth (Score:5, Informative)

    by Archon-X (264195) on Tuesday December 25 2007, @05:26AM (#21813570)
    Let me be the first to actually point out the key factors in the situation.
    I work in adult, and have worked with this CMS very closely for the last 2 years.
    I'm not on anyone's side, but unfortunately this problem has been surrounded by a lot of misinformation.

    • No credit card information was stolen. Website owners seldom [read: never] have access to this data, it's kept by the credit card processors
    • The information that WAS compromised was member information, primarily email addresses, for use in spamming. It 'makes sense' - a list of verified buyers is like the 'holy grail' for spammers.
    • The hackers used a list of admin accounts to poll everyone's CMS systems on the hour, and pull out this data. They have either covered their tracks well, or not at all, because they left reams of IP data, and you can see in the logs of the system itself, what information they've pulled.


    It is interesting and rather important to note: The poster of the blog article is an absolute douchebag. I'm not happy with the situation obviously, I had my own system compromised, but this guy is an idiot on a warpath - 95% of what's written on his blog is off in the fairyland.
    He fails to mention that he's hated by the industry, mainly for the reason that he posted 300 username / password combinations of webmasters publically, which resulted in a lot of them having money stolen from online accounts, etc.
    More intelligent ramblings from this guy: My Guide To Tax Evasion [gofuckyourself.com] - Why The Unibomber was right [keithkimmel.com]

    Summary: The breach was real. Scope seems to be limited ONLY to member data. Signed up? Expect some spam. Signed up with a password that you use on all your accounts? check your head, change the passwords.

    Read more about our friend "minusonbit" - here - on an industry forum [gofuckyourself.com] and judge for yourself.

    • Re: (Score:2, Informative)

      by minusonebit (1207734)
      As has been clarified on GFY several times, I did NOT post anyone's passwords anywhere. I linked to a Google cache of about 300 of them that was exposed due to another one of this industry's miserable failings in the security area - a poorly design admin area that did not censor the passwords that got stored in Google. And I covered that on my blog as well. I have never heard the end of that because other people in the industry were upset that another dirty little adult industry secret made it out for every
    • The links in the parent to www.gofuckyourself.com aren't safe to open at work or in front of more conservative family members. Otherwise it is a very informative post.

      • Re: The Truth (Score:4, Informative)

        by Archon-X (264195) on Tuesday December 25 2007, @09:04AM (#21814264)

        Really? Not even when the user signs up for the account and enters the credit card number?

        Now, I've never actually bought porn before, but assuming that porn sites work like every other ecommerce site in existance, the credit card number is most certainly entered into a form that's sent to the web server of the porn site. And if the web site has been compromised by a shell account that has premissions to modify the website software (like, say, it has been), then the credit card numbers of anyone who has signed up since the breach are likely to have been stolen.
        It actually doesn't work like that.
        NATS, the software in question here, acts as a gateway to the payment processor. CC information is never entered or passed through NATs.
        It's just the same as when you make a purchase on a website through paypal. No CC information information is ever given to the site, all they receive is a postback. That's exactly the situation here, CC data is stored on the processing servers, and is completely distinct from this mess.

        It was reported that CC data was stolen, or may have been but this is entirely untrue as you can see above.

        You gave a privileged SSH account to a third party, what did you expect?!
        No, I didn't. The accounts were NOT ssh accounts, they were logins to Web UI systems.

        Seems? So even you admit you don't actually know whether credit card numbers were stolen.
        I do. CC numbers are not stored on this system [I sound like a broken record]. When I say 'seems', I mean that the hacker did not try to take any other information, such as affiliate information, statistics information, or anything else stored in NATS, the software in question.

        I'll bet you some were stolen. Any account opened since the breach or that used a recurring payment scheme should check to make sure their credit card wasn't stolen.
        Rubbish. This information is not stored in the software or on any of the servers. You can 'bet' all you want. I'll take you on that wager, because you're posting and not knowing what you're talking about.

  • TMM are a bunch of lying bastards (Score:2, Informative)

    by Anonymous Coward
    The real kicker is that every one of our customers that use NATS have been complaining that their affiliates (people that send traffic to them) are being spammed on one-time-use addresses they only typed into NATS. TMM told them that it was our systems that had been hacked, even after we submitted detailed information to them.

    Our customers are not happy.

  • I am the guy who wrote the story.

    I have already been threatened with a libel lawsuit by a senior executive of Too Much Media for publishing this. I published it anyway. They are still making lawsuit threats http://www.gfy.com/showpost.php?p=13561241&postcount=418 [gfy.com]. I honestly do not care about their threats, I will continue to give media interviews and I will continue to push this story out there. Because people need to know what the industry does not want to tell you.

    Go ahead and do what the other p

    • Re: (Score:2, Informative)

      by minusonebit (1207734)
      For those of you who'd like to see how the Industry's media reported on this mess, checkout this link. http://www.xbiz.com/news/88230 [xbiz.com] XBiz whitewashed the story bigtime. And that flat out lied about billing information not being at risk. The hackers had administrative passwords. They had the equivalent of root. It was all there for the taking. No one knows if they were taken because TMM has not been forthcoming or helpful with that end of things. Of course, they say the billing DBs were safe at all times,

    • Re:I WROTE THE STORY. I STAND BEHIND IT 110%. (Score:5, Informative)

      by Archon-X (264195) on Tuesday December 25 2007, @07:01AM (#21813868)
      As posted before, this guy is nothing more than a troll.
      It's very simple: You've cast aspertions that CC data was stolen.

      Post proof. We're waiting.

      Anyone can go to http://www.gofuckyourself.com/forumdisplay.php?f=26 [gofuckyourself.com] an industry forum, search for 'minusonebit', and read for yourself about this guy, and the misinformation that surrounds him.

        • Re:I WROTE THE STORY. I STAND BEHIND IT 110%. (Score:5, Interesting)

          by Archon-X (264195) on Tuesday December 25 2007, @08:45AM (#21814186)

          Prove to me - independently of TMM's press statements - that said was safe
          From all the logs and data I have seen, and trust me, I have seen more than most people in the industry, the users had access to NATS as admins. Admins cannot pull out biller data, that isn't presented.

          Furthermore even if they had, if you were a real webmaster, you'd know: you can login to any biller and cannot see credit card information - CREDIT CARD INFORMATION WAS NOT STOLEN.

          Finally taking the tack that 'all information is compromised unless proven otherwise' is complete rubbish. That's as far-reaching as saying: assume your online banking is compromised because they don;'t email you daily saying it's not.

          The summary is as it was: NATs was breached, and the issue was handled very poorly. You, however, have posted lies, and FUD, once again, to try to engorge your ego. Your posts are full of lies and FUD, it's just that simple - and anyone w/ 5 mins can follow the links in this discussion and see the same.
  • I've seen estimates as high as that 95% of adult sites use NATS and that is just patently not the case. First of all, only sites which have affiliate programs would have any use for NATS at all. Many site owners who have affiliate programs use one of the half dozen other major affiliate program solutions out there or use a custom software solution.

    I can personally vouch for the fact that neither BlueBlood.com [blueblood.com] nor SpookyCash.com [spookycash.com] nor any of their subsidiary or partner sites have ever implemented NATS in an
  • I hope this is the beginning of a trend: hack all adult sites and cause them as much trouble as possible. The world doesn't need that filth.

    Besides, it would be payback for taking over all of the home computers in their attempt to sell their crap.

    • Re: (Score:3, Insightful)

      by Archon-X (264195)
      Your post is a scary reflection of presumably intelligent people who actually believe this FUD.
      #1 - If you consider porn and sex filth, that's a problem in itself.
      #2 - Making a blanket statement that the adult industry is reponsible for your spam is about as intelligent as blaming yourself for stock spam.

    • Contrary to popular belief, we don't all live in our parents' basements. Not all houses have basements. Also, I don't even have 500GB of total hard drive space. Anyway, it is relevant because it happened through the negligence of the person maintaining the originally compromised system. Had the person(s) responsible done their job in keeping the computer secure, the system wouldn't have been compromised. Thus, it serves as warning to all of us, that if we present a sufficient target, we must be proportiona
    • Isn't the lack of paranoia on the part of those who run adult websites how this happened?

      • Re: (Score:2, Interesting)

        by minusonebit (1207734)
        Or the fact that a good portion of them simply don't care. Their solution is to send an army of people here to tag and comment me into the ground. Some of them continue to collect webmaster affiliate account data (which includes tax IDs/SSNs) on pages that have no SSL encryption at all. Despite the fact that I brought it up months ago.
        • Oh, my. Yes, good security does cost some effort to do, and sometimes clients don't want to spend the work and resources. You have my sympathy for this situation.

          I don't suppose you could, very quietly, contact the BBB or the IRS about people being so cavalier with such information?

All trademarks and copyrights on this page are owned by their respective owners. Comments are owned by the Poster. The Rest © 1997-2009 Geeknet, Inc.