Last month, a group calling itself the âImpact Teamâ announced that it had hacked Avid Life Media, the parent company of infidelity dating site Ashley Madison, and stolen the companyâs financial and membership records. But by the time security blogger Brian Krebs broke the news of the hack, the documents that had been leaked had already been removed from the web â thanks, it seems, to Ashley Madison making copyright claims on the information.But last week, all of the hacked documents came gushing back onto the web. This time, the hackers were smarter. They shared their haul onpeer-to-peer torrent networks rather than on a central website, meaning that Ashley Madison couldnât use a legal process (or anything, really) to stop their spread.The size of the Ashley Madison leak â nearly 30 gigabytes, in two parts â and the need to download it from a torrent network made it unwieldy for the average internet user to access. But that didnât matter, because almost immediately after the leak, programmers who likely had no relation to the original hackers had built tools to make the data easily searchable. These tools â including a torrent-pointing onion site, and two search engines called ashley.cynic.al and checkashleymadison.comâ were what allowed the general public to search through the secrets of millions of Ashley Madison users, looking for their spouses, co-workers, or friends.The key players in making the Ashley Madison leak accessible to the masses have thus far remained anonymous because of the legal dangers around being involved in making stolen corporate data easier to access. But they were willing to speak to me pseudonymously. This is an explanation of how the raw data from Ashley Madisonâs servers wound up at the worldâs fingertips.On July 12, âThe Impact Teamâ announced that it had hacked Avid Life Mediaâs servers and stolen massive amounts of information. The hackers demanded that the company shut down two of its dating sites: Ashley Madison, which caters to married people seeking affairs, and Established Men, which aims at rich men seeking young, beautiful women. âShutting down AM and EM will cost you, but non-compliance will cost you more,â said the hackers in a message left on company computers. In an interview with Vice, a group representative declined to say how the infidelity dating site was breached, saying only that the hackers âworked hard to make fully undetectable attack, then got in and found nothing to bypass,â and that the hack started âa long time ago.âOnce the companyâs information was siphoned off its network, and after the company refused to take its sites down, the hackers wanted to make good on their threat. On July 19, according to police, they posted the information of two Ashley Madison users online, but Ashley Madison was able to get the information taken down using a DMCA (Digital Millennium Copyright Act) notice.So, more than a week ago, by the accounts of those who first saw it, the hackers uploaded (or âseededâ) the documents on a torrent network, so that documents could be shared between and downloaded from other peopleâs computers without the risk of a DMCA takedown.At the beginning of last week, the torrent of leaked documents appeared for the first time on a site accessible only to users of Tor, the anonymous web browser. The site identified itself as belonging to âQuantum Magazine.â It included a âTimeâs Upâ message from the hackers and a direct link to the torrent file that allowed people to start downloading Ashley Madisonâs member files from a peer-to-peer network.âWe are not Impact Team, in case that wasnât clear,â said a note on the site. âPlease use this data responsibly.âI sent an encrypted email to the person running the Quantum Magazine site, who goes by Quantum7765.âI came across the Ashley Madison data over the weekend through some paste-bins on Tor,â the administrator said by email. âThere have been a few fakes floating around so I took the time to look it over and saw that it had a proper PGP signature on it. When i started downloading the raw data from the torrent i saw there were about 1 person seeding (someone who has 100% of the torrent) and about 3 people downloading so it was pretty close to the initial release as you can get.âThat one person who was âseeding,â or uploading, the Ashley Madison documents for others to download, may well have been The Impact Team.Quantum decided to make sure other people could get access to Ashley Madisonâs data. He said he hoped they would learn a lesson from it: âto protect their privacy and their data and not to trust someone else with it blindly.â
The message didnât include the key and the torrent file was base64 encoded, so i put together a little page on my website that had all of this in an easy to read and access format. Then i put out a few notices on some tor sites and waited. Had some light traffic from it but nothing really major. I was surprised after a day or two that it had not hit the news at all but eventually someone took notice (8chanâs /pol/ board i think) and posted the find and the address on twitter. From there it just exploded.
Taking advantage of the influx of visitors, Quantum published the first issue of the promised âQuantum Magazineâ a day after the hack. It was a page of text, with articles about cryptography and how Stingrays track phones. The magazine has no apparent history. A science and math magazine that went under the name Quantum was published from 1990 to 2001, but the two appear unrelated.Quantumâs administrator said that the magazine is intended to teach people about security so they can protect themselves. âIts shocking how many people donât take their privacy seriously and are willing to trust almost anyone or any company without really checking to see or using tools to further protect themselves,â wrote the administrator by email.âIronically, the leaked data is the perfect example of what Iâm talking about.âThanks to Quantum Magazine, it was now much easier to get access to the Ashley Madison data. But you still had to use a Tor browser to get to the hidden services site, and then use a torrent client in order to download the documents. Then, once youâd downloaded the monster data dump, you had to sort through thousands of individual files full of membership records to find the name, or names, you were looking for. Thatâs not easy for the casual user. (âI have downloaded the data but I canât really make any sense of it, or in fact canât even open some of it up as its too large,â complained one user.)Thatâs where a man who goes by âRufoâ on Twitter came in. On Tuesday morning, Eastern time, a friend sent Rufo a link to Quantum Magazineâs site, and he downloaded the torrent. At the time there were 15 other people downloading it, he said. Later that afternoon, the number exploded as the link circulated on Twitter and news media got wind of the existence, with Wiredâs Kim Zetter breaking the story of the informationâs availability that evening.âThe file with the Ashley Madison account information is in a SQL database export,â Rufo told me in a Twitter DM. âRather than importing this data directly, I searched the file for things that looked like email addresses â an @ sign with a run of plausible characters on either side â and saved the results to a separate file.âThere were 35 million email addresses in the Ashley Madison file, which was far more than a text editorâs âfindâ function can cope with. But two years earlier, Rufo had written a program to process a massive list of email addresses after the Adobe password breach, and he had created a site to allow people to check to see whether theyâd been part of that breach.âSo I used the same processing method this time, and was able to reuse some of the old search code I wrote,â he said. âThis is how I was able to get the site up so quickly.âHe explains:I converted the list of emails into a data structure called a bloom filter, which allows you to search its contents very efficiently (bloom filters have a very low false-positive rate vs the amount of memory they occupy). This process required turning each email address in the list into a series of cryptographic hashes. When someone types their email address into the website, it is these hashes that are searched.He then hosted his program at ashley.cynic.al. And people started visiting in droves to check email addresses. As of Friday, two days after his site went live, it has been visited by over 1.3 million people who have performed nearly 8 million searches.
hi @Ethan I can not Pm delete inbox have - Empornium 20⏠Ok ? PP