Follow Slashdot stories on Twitter

 


Forgot your password?
Close
typodupeerror
×
Security

Thousands of Adult Website Accounts Compromised 167

Posted by kdawson from the how-not-to-handle-a-data-breach dept.
Keith writes "Tens of thousands — or maybe more — accounts to adult websites were recently declared compromised and apparently have been that way since some time in October 2007. The break occurred when the NATS software used to track and manage sales and affiliate revenues was accessed by an intruder. The miscreant apparently discovered a list of admin passwords residing on an unsecured office server at Too Much Media, which makes and maintains NATS installations for adult companies. It would appear that Too Much Media knew of the breach back in October, and rather than fixing the issue tried to bury it by threatening to sue anyone in the adult industry who talked about it." The article gives suggestions for anyone who opened an account at any adult website in the last several months.
This discussion has been archived. No new comments can be posted.

Thousands of Adult Website Accounts Compromised More

Thousands of Adult Website Accounts Compromised

Comments Filter:

  • Something came up... (Score:3, Funny)

    by Anonymous Coward on Tuesday December 25, 2007 @04:05AM (#21813292)
    Well, I guess that explains why it's so quiet around here.

  • I'm sure they'll... (Score:5, Funny)

    by Bin_jammin ( 684517 ) <Binjammin@gmail.com> on Tuesday December 25, 2007 @04:05AM (#21813296)
    rub this problem out in a hurry.

  • Compromising Position. (Score:3, Funny)

    by Anonymous Coward on Tuesday December 25, 2007 @04:13AM (#21813312)
    ""Tens of thousands -- or maybe more -- accounts to adult websites were recently declared compromised and apparently have been that way since some time in October 2007. "

    Quick! Someone see if Taco's on that list.

  • I have a suggestion too (Score:4, Funny)

    by Glowing Fish ( 155236 ) on Tuesday December 25, 2007 @04:15AM (#21813320) Homepage
    For everyone who opened up an account on an adult website:

    Usenet.

  • If true, this isn't particularly surprising. (Score:3, Insightful)

    by Anonymous Coward on Tuesday December 25, 2007 @04:18AM (#21813328)
    We are, after all, talking about pornography paid for with credit cards. The entity which lost these data is a clearinghouse for porn payments; its customers are the webmasters who run individual adult sites. Webmasters who, of course, have a vested interest in keeping this quiet. The fault was not theirs, per say, but the repercussions if this becomes public knowledge would bear heavily upon them.

    In addition, it's porn. Individual end users cannot protest very much without either A: Admitting they pay for porn online or B: being the subject of askance glances and the occasional, "Methinks he doth protest too much." Some folks won't care, but the kind of people who actually have influence in the real world can't afford that kind of tarnish.

    So, even if the worst happens and large amounts of private data are in nefarious hands, it'll all get dealt with quietly. The victims will sort it out in private with their banks, the webmasters will never speak of it, and the company itself probably won't feel much of a hit. If they really do have 90% market share, I doubt anyone else in the field is ready to just jump in and take over.

    • Re:If true, this isn't particularly surprising. (Score:5, Informative)

      by mochan_s ( 536939 ) on Tuesday December 25, 2007 @04:41AM (#21813430)

      In addition, it's porn. Individual end users cannot protest very much without either A: Admitting they pay for porn online or B: being the subject of askance glances and the occasional, "Methinks he doth protest too much."

      You do realize that prepaid credit cards exist, right? You can set any name to it and use it. Since you don't have to have anything physical delivered and it's all online, then you can create fake names and leave out addresses.

      • Re: (Score:2, Insightful)

        by SacredByte ( 1122105 )

        In addition, it's porn. Individual end users cannot protest very much without either A: Admitting they pay for porn online or B: being the subject of askance glances and the occasional, "Methinks he doth protest too much."

        You do realize that prepaid credit cards exist, right? You can set any name to it and use it. Since you don't have to have anything physical delivered and it's all online, then you can create fake names and leave out addresses.

        Do you realize that not every Joe-Sixpack takes the time to

      • Re: (Score:1)

        by Seumas ( 6865 )
        Who the hell feels embarrassed for porn? It's 2007. Yeah, if you were ripped off by a payment processor that put "iloveyoungboys.com" on your bill, that's one thing. But in general, who cares?! Oh no, you might have to admit that you are a guy, have testosterone and might wank off to hot sluts. Boy, how embarassing.

        • Re: (Score:3, Insightful)

          by DarkVader ( 121278 )
          No, the embarrassing part wouldn't be watching porn - everybody does that.

          What would be embarrassing would be getting caught PAYING for porn in 2007. Now that would be embarrassing.

          (And yes, I'm quite sure my credit card information hasn't been compromised in this incident.)
      • Or, you know, you could just admit that you look at porn. Is there really anyone that close to you who still thinks looking at porn is an awful stigma? Why?

        Cheers.

      • Re: (Score:2)

        by piojo ( 995934 )

        You do realize that prepaid credit cards exist, right? You can set any name to it and use it. Since you don't have to have anything physical delivered and it's all online, then you can create fake names and leave out addresses.
        This seems rather useful. Are these normally gotten through one's bank? If not, where does one get such a service?

        • ...where does one get such a service?

          I don't know where you are, so this may not be applicable. I'm in Texas. We have Ace Cash Express stores (check cashing places, mostly) all over the place. You just walk up to the window and ask for a gift card and tell them how much money you want to put on it, up to $250. The cost is $5 over the amount on the card.

          Here's a tip: If they start asking you for identity information (name, address, etc.) they've misunderstood your request and are trying to sell you a re

    • Re:If true, this isn't particularly surprising. (Score:5, Interesting)

      by Archon-X ( 264195 ) on Tuesday December 25, 2007 @06:56AM (#21813854)
      You've made a lot of assumptions, most of them wrong

      #1 - CC data wasnt stolen
      #2 - NATS does NOT process credit cards. It simply coordinates transactions, just like when you buy something from a site via paypal - the transaction is done at paypal, the yes/no result is shipped back to NATS.
      #3 - Don't assume because it's the 'porn industry' that it's seedy and business ethics are out of the window. There are a lot of large companies with a lot of money invested, and the security of their clients makes sense. Why would you want to rip off or mal-treat your clients? There are definitely arseholes in the industry, just as there are everywhere, for example, the post of this article [he released 300 webmaster usernames / passwords to the world, resulting in huge financial thefts.
      #4 - There are multiple industry options: MPA, Epoch, CCBill, etc. NATS has a large market share because the software is good, primarily because it was the first piece of software that had 'no shave' option, ie, the software couldnt steal sales.

      Like it's been said already, this issue was a clusterfuck, and handled badly by TMM, but there is so much misinformation, especially about te threat of stolen CCs and slamming the industry, that I'm compelled to say something.

    • Re:If true, this isn't particularly surprising. (Score:5, Informative)

      by owlnation ( 858981 ) on Tuesday December 25, 2007 @07:04AM (#21813876)

      In addition, it's porn. Individual end users cannot protest very much without either A: Admitting they pay for porn online or B: being the subject of askance glances and the occasional, "Methinks he doth protest too much." Some folks won't care, but the kind of people who actually have influence in the real world can't afford that kind of tarnish.
      You're looking at this from an English speaking World perspective. Note that in countries such as Holland or Germany, where most of the adult/sex industry is completely legal, consumers of adult products have as much rights as any other consumer. There's also not the stigma attached to such things as there is in the UK or the US. People there would sue, and would sue openly.

      All in all, in countries like Germany there's a much healthier attitude to sex and the adult industry. Both consumers and providers are much better protected there.

      It seems to me that in the UK in particular (which is a semi-fascist state at best anyway) the repression and legislation of the adult industry is increasing, from what was already a very repressed and intolerant level. This is not healthy, this simply makes it easier for organized crime, and incidents like this one to occur.

      • Re: (Score:2)

        by Tim C ( 15259 )
        I'm not so sure I agree with your interpretation of the situation in the UK. Sure, we're rather more repressed than some (many?) other parts of Europe, but I don't think we're as bad as the US. You can buy softcore porn mags in almost any newsagents, there are topless women in our tabloids, etc.

        Yes, Nu Labour is talking about cracking down on prostitution - but that strikes me as a way of distracting from the incredibly damaging fallout from the multiple data loss incidents, the sort of thing to generate di

  • Re: (Score:2, Funny)

    by account_deleted ( 4530225 )
    Comment removed based on user account deletion

  • Suddenly..... (Score:4, Funny)

    by edwardpickman ( 965122 ) on Tuesday December 25, 2007 @04:30AM (#21813380)
    There was a great disturbance in the geek community.

  • Wait... (Score:4, Funny)

    by c.r.o.c.o ( 123083 ) on Tuesday December 25, 2007 @04:34AM (#21813400)
    There are people who actually PAY for pr0n?!?
  • "pwned" becomes "pr0ned"?

  • Gift Cards (Score:5, Informative)

    by harlows_monkeys ( 106428 ) on Tuesday December 25, 2007 @05:00AM (#21813484) Homepage
    This is what gift cards are for, available from numerous outlets (Safeway, Office Depot, Wal-Mart, and similar places). You can get prepaid VISA and Mastercard giftcards, which work great for purchasing porn, or other questionable things of an online nature, where you can't trust the vendor. A $50 card will typically cost about $55.

    After you buy it, you go to a web site from the card vendor, enter the card number and security code, and then set the user name and billing zip code. Then go wild (well, to the extent that you can go wild with $50...). Here's one such card [allaccessgift.com] that is available at a lot of places.

    There are also cards that you can refill from your "real" credit card, but then you are easier to trace. Might as well use a non-refillable card, purchased with cash. That way, if "all models 18 or over, proof on file" turns out to not quite be true, no credit card that can be tied to you will be in the site's records. :-)

    If that's not a concern, though, and you are just trying to limit exposure of your real credit card, then go ahead with the refillable cards. In fact, there are even some that are purely online. They don't provide a physical card. You just go to their site, sign up with your credit card, and they give you a credit card number to use online, with a limit of whatever you want to transfer from your credit card. Here is one such virtual card [www-card.com].

    NOTE: some gift cards cannot be used for porn or gambling, so choose appropriately. And some can be so used, but add a surcharge for porn.

    • ...Man, I hate to tell you this, but I think you got phished - someone seems to be posting adverts using your account. Wait! You haven't been browsing for some Hard-Core-Adult-Action lately, have you?

      I kid, I kid.
    • I do agree with what is said 1. Who pays for porn anyways? and 2. Gift cards are the coolest thing since sliced bread. When I was little you could go to the store and get an American Express card whenever parents wouldn't let you order stuff online and voila! Was used more for purposes in which you really didn't want some stuff to come back and bite you (aka domain purchases) but it still has many uses even now that I'm in my 20s.

    • Re:Gift Cards (Score:5, Informative)

      by Archon-X ( 264195 ) on Tuesday December 25, 2007 @05:33AM (#21813598)
      No credit card information was stolen. It's impossible.
      CC information does not, repeat, does not [read: is illegal to keep] on the servers of sites.
      It is maintained by the billers and processors, who thankfully, have better security.

      The threat of stolen CC info is FUD by the poster.

      • Re: (Score:2)

        by jamesh ( 87723 )
        I'm not sure that such laws exist here in Australia (and if anyone knows of any, _please_ enlighten me!). Your contract with your merchant will require certain things of you wrt to what you do with any CC information you have taken by whatever means (phone, physical swipe machine, internet, etc), but I'm not aware of any criminal laws that exist.

        We effectively turned away a client who wanted to host their web site on our server because it obviously kept credit card information in a database. We just didn't

        • You just can't educate some people.

          What's wrong with storing CC info? They had a valid business case for it, as does my employer. How would you handle charge on ship with preorders/backorders?

      • Re: (Score:2)

        by mxs ( 42717 )
        [quote]No credit card information was stolen. It's impossible.[/quote]

        Interesting that you note something entirely possible to be impossible. CC information can be stolen. If you ever find yourself in a situation where you come to believe that your system is so secure that it's impossible, you probably haven't understood exactly what security, in the context of electronic commerce, means.

        [quote]read: is illegal to keep[/quote]

        Interesting legal analysis. Patently false, but hey, who's counting. All you might

      • CC information does not, repeat, does not [read: is illegal to keep] on the servers of sites.
        I'm dubious of the illegal claim, and I know for a fact the rest is false. There are plenty of sites keeping credit card data on their servers. I knew a guy who was keeping credit card data on a shared server - sent shivers down my spine.

      • Re: (Score:2)

        by eison ( 56778 )
        Nonsense.
        It's a contractual violation to keep CID/CCV2/CVC2 or raw magstripes, yet people still do that, particularly in log files.
        It's explicitly allowed to keep card numbers on file. How do you think people bill you every month?
    • Comment removed based on user account deletion
    • Some banks offer one-time credit card numbers that you can just generate dynamically over the web. Unlike gift cards, they don't cost extra, you don't have to prepay, and you can get them in any amount you need.
  • Thank god for BitTorrent. Get all your pr0nz and don't even need a user name. Sometimes being an anonymous coward has its advantages.

    Of course, really, unless there is someone with a high-profile in that list accessing some really really naughty stuff, this breach won't affect the average Joe Blow out there.

  • they should do... (Score:5, Funny)

    by nguy ( 1207026 ) on Tuesday December 25, 2007 @05:06AM (#21813494)
    ... more penetration testing

  • RE: The Truth (Score:5, Informative)

    by Archon-X ( 264195 ) on Tuesday December 25, 2007 @05:26AM (#21813570)
    Let me be the first to actually point out the key factors in the situation.
    I work in adult, and have worked with this CMS very closely for the last 2 years.
    I'm not on anyone's side, but unfortunately this problem has been surrounded by a lot of misinformation.

    • No credit card information was stolen. Website owners seldom [read: never] have access to this data, it's kept by the credit card processors
    • The information that WAS compromised was member information, primarily email addresses, for use in spamming. It 'makes sense' - a list of verified buyers is like the 'holy grail' for spammers.
    • The hackers used a list of admin accounts to poll everyone's CMS systems on the hour, and pull out this data. They have either covered their tracks well, or not at all, because they left reams of IP data, and you can see in the logs of the system itself, what information they've pulled.


    It is interesting and rather important to note: The poster of the blog article is an absolute douchebag. I'm not happy with the situation obviously, I had my own system compromised, but this guy is an idiot on a warpath - 95% of what's written on his blog is off in the fairyland.
    He fails to mention that he's hated by the industry, mainly for the reason that he posted 300 username / password combinations of webmasters publically, which resulted in a lot of them having money stolen from online accounts, etc.
    More intelligent ramblings from this guy: My Guide To Tax Evasion [gofuckyourself.com] - Why The Unibomber was right [keithkimmel.com]

    Summary: The breach was real. Scope seems to be limited ONLY to member data. Signed up? Expect some spam. Signed up with a password that you use on all your accounts? check your head, change the passwords.

    Read more about our friend "minusonbit" - here - on an industry forum [gofuckyourself.com] and judge for yourself.

    • Re: (Score:1)

      by Kasis ( 918962 )
      Just WOW. Even if this person had a legitimate point about personal data being stolen, his credibility just went down the pan.

      I don't live in the USA but I presume Keith Kimmel does. If I did live in the USA I'd be wary about posting this information in public forums. He admits to tax evasion, not just a few undeclared dollars but big-time tax evasion. He admits to supporting terrorism - "Its unfortunate that people had to die so that his message could be heard, but I think in the end it was a worthwhil

    • Re: (Score:2, Informative)

      by minusonebit ( 1207734 )
      As has been clarified on GFY several times, I did NOT post anyone's passwords anywhere. I linked to a Google cache of about 300 of them that was exposed due to another one of this industry's miserable failings in the security area - a poorly design admin area that did not censor the passwords that got stored in Google. And I covered that on my blog as well. I have never heard the end of that because other people in the industry were upset that another dirty little adult industry secret made it out for every
      • QFT

        I honestly could not care less. Yes, I am pretty much universally hated in the adult industry.
    • The links in the parent to www.gofuckyourself.com aren't safe to open at work or in front of more conservative family members. Otherwise it is a very informative post.

      • Re: (Score:2, Informative)

        by jmac1492 ( 1036880 )
        I originally modded this up, but then I read the post again. The website is "gofuckyourself.com" Any address with the word fuck in the title should probably be considered NSFW or NSFMCFM ("More conservative family members"). Especially when the OP called it a fourm for porn industry insiders. Duh.

        So I'm posting to undo the moderation.

  • TMM are a bunch of lying bastards (Score:2, Informative)

    by Anonymous Coward
    The real kicker is that every one of our customers that use NATS have been complaining that their affiliates (people that send traffic to them) are being spammed on one-time-use addresses they only typed into NATS. TMM told them that it was our systems that had been hacked, even after we submitted detailed information to them.

    Our customers are not happy.

    • Re: (Score:2)

      by Bigbutt ( 65939 )
      Funny. I'm one of them with the one-time-use e-mails. As soon as I started getting spammed, I had to do some searching to figure out just why I was getting spammed. I sent an e-mail off to the company identified by the e-mail to let them know they may have been hacked. I also mentioned that I didn't know why I was all of a sudden getting spammed. After a few e-mails, he asked if I'd subscribed to a porn site for a few months last year. Heh, I thanked him as they'd apparently used a "brown paper bag" company

  • I am the guy who wrote the story.

    I have already been threatened with a libel lawsuit by a senior executive of Too Much Media for publishing this. I published it anyway. They are still making lawsuit threats http://www.gfy.com/showpost.php?p=13561241&postcount=418 [gfy.com]. I honestly do not care about their threats, I will continue to give media interviews and I will continue to push this story out there. Because people need to know what the industry does not want to tell you.

    Go ahead and do what the other p

    • Re: (Score:2, Informative)

      by minusonebit ( 1207734 )
      For those of you who'd like to see how the Industry's media reported on this mess, checkout this link. http://www.xbiz.com/news/88230 [xbiz.com] XBiz whitewashed the story bigtime. And that flat out lied about billing information not being at risk. The hackers had administrative passwords. They had the equivalent of root. It was all there for the taking. No one knows if they were taken because TMM has not been forthcoming or helpful with that end of things. Of course, they say the billing DBs were safe at all times,

    • Re:I WROTE THE STORY. I STAND BEHIND IT 110%. (Score:5, Informative)

      by Archon-X ( 264195 ) on Tuesday December 25, 2007 @07:01AM (#21813868)
      As posted before, this guy is nothing more than a troll.
      It's very simple: You've cast aspertions that CC data was stolen.

      Post proof. We're waiting.

      Anyone can go to http://www.gofuckyourself.com/forumdisplay.php?f=26 [gofuckyourself.com] an industry forum, search for 'minusonebit', and read for yourself about this guy, and the misinformation that surrounds him.

      • The intruders had access to the billing data you idiot. They had full access on the entire system. John lost control of his entire company, or most of it. All we have thus far is John's word that the billing data wasn't taken. I flush things down the toilet that are worth more than John's word is right now. I said it may have been stolen, I did not say it *was* stolen. Prove to me - independently of TMM's press statements - that said was safe. Until then, it was compromised. There is no reason to believe th
        • What is your involvement in internet industry of any kind? Have you ever demoed an affiliate program back end? NATS or any other? What makes you think that software for the purpose of tracking affiliate sales across multiple billers would track consumer financial information?

        • Re:I WROTE THE STORY. I STAND BEHIND IT 110%. (Score:5, Interesting)

          by Archon-X ( 264195 ) on Tuesday December 25, 2007 @08:45AM (#21814186)

          Prove to me - independently of TMM's press statements - that said was safe
          From all the logs and data I have seen, and trust me, I have seen more than most people in the industry, the users had access to NATS as admins. Admins cannot pull out biller data, that isn't presented.

          Furthermore even if they had, if you were a real webmaster, you'd know: you can login to any biller and cannot see credit card information - CREDIT CARD INFORMATION WAS NOT STOLEN.

          Finally taking the tack that 'all information is compromised unless proven otherwise' is complete rubbish. That's as far-reaching as saying: assume your online banking is compromised because they don;'t email you daily saying it's not.

          The summary is as it was: NATs was breached, and the issue was handled very poorly. You, however, have posted lies, and FUD, once again, to try to engorge your ego. Your posts are full of lies and FUD, it's just that simple - and anyone w/ 5 mins can follow the links in this discussion and see the same.

    • Because people need to know what the industry does not want to tell you.
      Yeah, yeah. You also think taxes are illegal. What amazes me is that anyone listens to people like you.
  • I've seen estimates as high as that 95% of adult sites use NATS and that is just patently not the case. First of all, only sites which have affiliate programs would have any use for NATS at all. Many site owners who have affiliate programs use one of the half dozen other major affiliate program solutions out there or use a custom software solution.

    I can personally vouch for the fact that neither BlueBlood.com [blueblood.com] nor SpookyCash.com [spookycash.com] nor any of their subsidiary or partner sites have ever implemented NATS in an
    • I was alerted to that error earlier today and just now notice that I had corrected it only at the top of the post. I have since fixed it throughout the article. The correct market penetration - I am told - is somewhere around 35% to 40% of all adult sites online.
      • I read the 95% figure a couple minutes before I posted here. For that matter, where do you get the 35% to 40% figure?
        • A program owner within the adult industry who asked that I please not drag his name out into the public limelight.
    • HAHAHaHHAHAH "Penetration"!! Hehehehehehe omg rotflmao
    • Please don't use slashdot to advertise your services while your competition is imploding. Even being in porn, you should be able to recognize how tacky that is. It's one thing to have it in your sig - lord knows I do too - but to stand there and pretend like you're making idle conversation while you namedrop stuff like that? Honestly.

      You don't see me posting when some random hosting provider does something bad. There's making yourself visible, and there's being a vulture. Which side of the line do you

  • Trend? (Score:2, Funny)

    by Porchroof ( 726270 )
    I hope this is the beginning of a trend: hack all adult sites and cause them as much trouble as possible. The world doesn't need that filth.

    Besides, it would be payback for taking over all of the home computers in their attempt to sell their crap.

    • Re: (Score:3, Insightful)

      by Archon-X ( 264195 )
      Your post is a scary reflection of presumably intelligent people who actually believe this FUD.
      #1 - If you consider porn and sex filth, that's a problem in itself.
      #2 - Making a blanket statement that the adult industry is reponsible for your spam is about as intelligent as blaming yourself for stock spam.

      • Not to try to get moral or anything, but pornographic websites at least were among the least pleasant to stumble across on the Web. Frequently it would be necessary to quit the browser or disable Javascript to get away, and they lurked on URLs that would likely be hit by accident. I presume that there were a lot of well-behaved sites out there, with names like pr0n-r-us, that I'm unlikely to stumble across by accident, but my impressions are mostly from the obnoxious ones.

        So, despite sympathy for those

      • You know, I'm inclined to stick up for you, because there's some douche tax nutjob badmouthing you.

        At the same time, honestly, dude, come the fuck on, if you're going to pretend that porn isn't one of the biggest sources of spam? You've got a little credibility management to do yourself, here. Look at what places like the dating sites do - there are six really bad ones, and I bet you could count them off one by one if you tried, taking over yahoo groups, craigslist, and so on. Sure, it's a really small f

    • Re: (Score:2)

      by Bigbutt ( 65939 )
      Pretty funny. While I don't look over spams that I receive, a quick grep of the past month shows that the one site I did go to isn't there.

      The only time I've ever seen the site listed was here on Slashdot a few years back. I visited and liked what I saw. When they locked it down a bit further so all I could see were blurred out images, I paid my couple of bucks for a few months and downloaded all I could ever use. It's been a year and I haven't "used up" any of the downloads.

      Heck, I may be good until I die

  • "Tens of thousands -- or maybe more -- ...."
    Does that mean elevens of thousands?

Slashdot Top Deals

Reality must take precedence over public relations, for Mother Nature cannot be fooled. -- R.P. Feynman

Close