Ashley Madison breach reveals the rise of the moralist hacker

July 22, 2015 by Bill Buchanan, The Conversation
Tell no one… that we’ve just lost all your data. Credit: ALM

There's value in more than just credit card data, as Avid Life Media (ALM), parent company of the extramarital affair website Ashley Madison, has found out after being raided for millions of their customer's details.

All sorts of information that isn't expressly financial is valuable – HR records including and health information, such as those stolen from the US government, can be used to fraudulently gain access to other data, of for blackmail for financial gain or to further a political or moral agenda.

The Ashley Madison hackers, calling themselves Impact Team, seem to have a moral agenda, adding another dimension to the factors that motivate cybercriminals, and therefore something else for overburdened security professionals to consider.

It doesn't get more sensitive than this

There is a spectrum of sensitive information, from an email address to private secrets. The theft of the Ashley Madison databases, essentially a list of 37m possible adulterers' identifying details, must rank as one of the most "sensitive" troves of data ever acquired. While there will be credit card details too, it's the potential for public (and private) embarrassment that many will be fearing.

Reported by security research Brian Krebs and confirmed by Noel Biderman, CEO of Avid Life Media (ALM), Impact Team's statement rails against the motivations not just of the supposed cheaters using the site, but the site itself for facilitating this behaviour, demanding that ALM close down Ashley Madison and another of its sites, Established Men, permanently or risk the details being published.

Impact Team's ire is directed particularly at ALM's "full delete" service where, for US$19, all a user's details will be deleted. They claim ALM made US$1.7m from this service, yet leave the , obviously including real names and addresses, intact. Impact Team hint that the hack was made possible through an insider – embarrassing for a firm that had aimed to raise US$200m this summer from an IPO .

Encrypt! Encrypt! Encrypt!

According to a recent survey by Thales, typically the most sensitive data that is encrypted is employee and HR data. It goes without saying that this is highly sensitive information that can bring repercussions both on the individuals and the firm in question. As customers, we may not be pleased to note that customer details are some way down the list. Really, all these aspects should be closer to 100%.

The message left by Impact Team hackers. Credit: ImpactTeam/Krebs on Security

Intellectual property is certainly a target for cyberattacks, with the loss of source code and secret product information potentially disastrous for companies. Hacking Team recently found the internal code of their commercial hacking tools posted all over the internet, for example.

When university researchers analysed 300 discarded hard disk drives they found that a third contained personal data including health and banking information (including a €50 billion euro currency exchange service), and even details for a missile defence system. The lack of planning and care in how this information was dealt with is astonishing.

Poking the hornet's nest

The catastrophic raid on Sony's corporate network last year was blamed on North Korea, but Sony has battled Anonymous, Lulzsec and Lizard Squad over the years, often over their stance on breaches of copyright. Again, a disgruntled insider within Sony is the most likely source of the breach. The hack led to all manner of documents appearing online – such as embarrassing emails from senior executives.

Sony's trouble with hacking organisations can be traced to its court case against George Holtz, who Sony sued after he published root encryption keys for the PlayStation console. Sony demanded identifying details of visitors to his website and social media pages, and was given access to Holtz's PayPal account. The case judge eventually granted Sony permission to view IP addresses of everyone who visited Holtz's site, geohot.com. In April 2011, Sony settled the lawsuit out of court, but have since faced many further attacks.

The rise of moral and political hacktivism

The fact is hackers are increasingly pursuing a variety of agendas. In protest at St Louis County Police involvement in the death of unarmed teenager Michael Brown in Ferguson, Missouri, the police department's website was attacked, knocking it offline for several days. The group responsible declared they had gained access to dispatch tapes related to the day of the shooting, which they then uploaded to YouTube.

Regularity with which certain types of company data are encrypted. Credit: Thales

In political actions worldwide, from the Arab Spring uprising, to Russia's suspected cyberattacks on Estonian government websites, or the Syrian Electronic Army, the internet is increasingly a new vector of attack. The internet as battleground is not in the future, it is already here, and as attack on the French channel TV5Monde should remind us, it may escalate to include control of news outlets too.

Organisations need to understand that there are new risks and new ways to distribute messages, especially from those skillful enough to disrupt traditional methods. It's important to note that the viewpoint of the hacktivist will often be reflected in the political landscape of the time, and that this is subject to change. The hacktivist, a cybercriminal to some, can be a freedom fighter to others.

Be pure in thought and word and deed

The internet provides a voice for all, and there are many examples where corporations, organisations or governments have outraged groups around the world who have successfully staged an uprising or retaliation against them. Someone may be small on the internet, but can still have a massive impact. Sony lost billions of dollars from its share price, and forfeited a great deal of customer confidence.

Hacktivism, where cybercriminals can also be freedom fighters. Credit: Bill Buchanan, Author provided

A strong defence is the starting point, but if there is trusted internal access then it is possible to circumvent the locks. With digital media cards now supporting hundreds of gigabytes of data it's not too difficult to take huge amounts of data off-site – and this is why encryption is so vital. In short:

Encrypt sensitive dataControl and limit access to sensitive dataMake sure those controls workCheck who has access to the dataIntegrate multi-factor authentication for the access to sensitive informationWatch where you back up your data and protect that tooDon't use the same encryption keys for everything

And finally, try not to upset people. Ashley Madison rashly boasted of its superior security, while flaunting what many would describe as unethical behaviour. Such things are red rags to a bull. Companies need to understand that their insecurity today is as much to do with their behaviour and the reactions or political and social aims of others in response as it is the straightforward quest for financial gain.

Explore further: Ashley Madison adultery website hacked for user data

Related Stories

Ashley Madison adultery website hacked for user data

July 20, 2015

The adultery website Ashley Madison said Monday that customers' data had been stolen by hackers and said the breach had been fixed, though media reports said users' information had been briefly posted online.

Two more former Sony workers sue over data breach

December 18, 2014

Two more former employees of Sony Pictures Entertainment are suing the company over the massive data breach in which their personal and financial information was stolen and posted online.

Sony faces 4th ex-employee lawsuit over hack

December 20, 2014

A former director of technology for Sony Pictures Entertainment has sued the company over the data breach that resulted in the online posting of his private financial and personal information.

Recommended for you

Uber filed paperwork for IPO: report

December 8, 2018

Ride-share company Uber quietly filed paperwork this week for its initial public offering, the Wall Street Journal reported late Friday.

3 comments

Adjust slider to filter visible comments by rank

Display comments: newest first

Blakut
5 / 5 (1) Jul 23, 2015
"Moralist" - they asked for money in return for not releasing the data.
Whydening Gyre
not rated yet Jul 25, 2015
"Moralist" - they asked for money in return for not releasing the data.

You're right. Nothing "moral" about this at all...
Zzzzzzzz
5 / 5 (1) Jul 26, 2015
Psychos that require belief systems..... always have a desperate need to control the behaviour of others, calling it "moral"...... and then reveal that true morality has nothing to do with it

Please sign in to add a comment. Registration is free, and takes less than a minute. Read more

Click here to reset your password.
Sign in to get notified via email when new comments are made.