Dating site and hacker in online spat over security breach
No love lost
Regcast training : Hyper-V 3.0, VM high availability and disaster recovery
The founder of Canadian dating website PlentyOfFish.com has become embroiled in an online spat with a white-hat hacker who found security bugs on the site and a reporter who began asking questions about the flaw.
Markus Frind, the founder and chief executive of Plenty of Fish, claims he was approached by someone who exported 345 users accounts from pof.com's database before trying to convince the site to hire his crew as a security team. If PlentyofFish.com didn't play ball, then the hacker threatened to go to the press, according to Frind, who said he interpreted the action as attempted extortion.
However, the Argentinian hacker who approached the site, Chris Russo, said he was only trying to warn PlentyofFish.com of a security vulnerability he had found. Russo created a proof of concept demo of the vulnerability, which he shared with former Washington Post staffer Brian Krebs, who runs the Krebs on Security blog, around a fortnight ago.
Krebs set up a free account on the site, details of which Russo was able to recite back to him thanks to a flaw that meant you could view account and login credentials on any of the 30 million registered members of the site. Convinced there was a potential problem, Krebs approached PlentyofFish.com for comment.
Frind reportedly stalled Krebs' questions for several days before posting a rambling blog post accusing Russo of spinning bizarre yarns about unearthing threats by the Russian mafia to blackmail PlentyofFish and other dating sites and supposedly claiming his life was in danger, all to support the attempted hacking and extortion of PlentyofFish.com. The same post indirectly accuses Krebs of participating in the extortion scam, before backtracking on that clearly unfounded claim.
PlentyOfFish.com admits there was a security hole on the site but said it was minor and had been resolved by a recently applied (precautionary) password reset. Krebs reckons the site got into problems because it stored user login credentials in plain text, a point PlentyofFish disputes.
The two conflicting versions of events can be found in a heavily commented upon blog post by Frind here and a rival retelling of events by Krebs here. ®
COMMENTS
fools
"Krebs reckons the site got into problems because it stored user login credentials in plain text, a point PlentyofFish disputes."
How can they dispute this? They email EVERY user their password in PLAIN TEXT on a weekly basis. Unsolicited. Turning that weekly email off is a chore.
Every week. Helpfully reminding you of your password. Not "some of it". Not "a hint". Not a masked version. All of it.
Plenty of Phish?
Yup, they send lots of plaintext passwords around the internet. The new reset password hit my inbox in plaintext earlier this week. It isn't like it is hard for someone with access to configure a router on a main trunk to store copies of any email containing the word "password" that hops through it! You can even machine-sort them by source address and then apply a simple filter to extract username and password into a table, ready for sale to the highest bidder.
WHAT?????
I have a shitfit whenever a site asks you to set a password and then e-mails it to you in plaintext.
If a site I used e-mailed it in plaintext every week I'd probably wind up driving to their HQ and smashing their e-mail servers!
IT infrastructure monitoring strategies
Agentless Backup is Not a Myth
Top 10 SIEM implementer’s checklist
Steps to Take Before Choosing a Business Continuity Partner
Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider
