TechCentralTechCentral
    Facebook Twitter YouTube LinkedIn
    Facebook Twitter LinkedIn YouTube
    TechCentral TechCentral
    NEWSLETTER
    • News

      Eskom warns recovery from strike chaos could take weeks

      29 June 2022

      Eskom offers workers 7% increase: sources

      29 June 2022

      E-commerce is killing shopping malls – but, curiously, not in South Africa

      29 June 2022

      E.tv: ‘We know we must vacate broadband spectrum bands’

      29 June 2022

      Eskom employees returning to work

      29 June 2022
    • World

      Napster plots crypto comeback

      29 June 2022

      Pictures: Chinese spacecraft acquires images of entire planet of Mars

      29 June 2022

      Arm aims for leg-up in smartphone games with new chip tech

      29 June 2022

      Warnings of a final bitcoin ‘washout’

      29 June 2022

      Sony launches into PC gaming hardware

      29 June 2022
    • In-depth

      The great crypto crash: the fallout, and what happens next

      22 June 2022

      Goodbye, Internet Explorer – you really won’t be missed

      19 June 2022

      Oracle’s database dominance threatened by rise of cloud-first rivals

      13 June 2022

      Everything Apple announced at WWDC – in less than 500 words

      7 June 2022

      Sheryl Sandberg’s ad empire leaves a complicated legacy

      2 June 2022
    • Podcasts

      How your organisation can triage its information security risk

      22 June 2022

      Everything PC S01E06 – ‘Apple Silicon’

      15 June 2022

      The youth might just save us

      15 June 2022

      Everything PC S01E05 – ‘Nvidia: The Green Goblin’

      8 June 2022

      Everything PC S01E04 – ‘The story of Intel – part 2’

      1 June 2022
    • Opinion

      Has South Africa’s advertising industry lost its way?

      21 June 2022

      Rob Lith: What Icasa’s spectrum auction means for SA companies

      13 June 2022

      A proposed solution to crypto’s stablecoin problem

      19 May 2022

      From spectrum to roads, why fixing SA’s problems is an uphill battle

      19 April 2022

      How AI is being deployed in the fight against cybercriminals

      8 April 2022
    • Company Hubs
      • 1-grid
      • Altron Document Solutions
      • Amplitude
      • Atvance Intellect
      • Axiz
      • BOATech
      • CallMiner
      • Digital Generation
      • E4
      • ESET
      • Euphoria Telecom
      • IBM
      • Kyocera Document Solutions
      • Microsoft
      • Nutanix
      • One Trust
      • Pinnacle
      • Skybox Security
      • SkyWire
      • Tarsus on Demand
      • Videri Digital
      • Zendesk
    • Sections
      • Banking
      • Broadcasting and Media
      • Cloud computing
      • Consumer electronics
      • Cryptocurrencies
      • Education and skills
      • Energy
      • Fintech
      • Information security
      • Internet and connectivity
      • Internet of Things
      • Investment
      • IT services
      • Motoring and transport
      • Public sector
      • Science
      • Social media
      • Talent and leadership
      • Telecoms
    • Advertise
    TechCentralTechCentral
    Home»In-depth»Ashley Madison and the rise of the moralist hacker

    Ashley Madison and the rise of the moralist hacker

    In-depth By The Conversation22 July 2015
    Facebook Twitter LinkedIn WhatsApp Telegram Email

    ashley-madison-640

    There’s value in more than just credit card data, as Avid Life Media (ALM), parent company of the extramarital affair website Ashley Madison, has found out after being raided for millions of their customer’s details.

    All sorts of information that isn’t expressly financial is valuable — HR records including personal information and health information, such as those stolen from the US government, can be used to fraudulently gain access to other data, or for blackmail for financial gain or to further a political or moral agenda.

    The Ashley Madison hackers, calling themselves Impact Team, seem to have a moral agenda, adding another dimension to the factors that motivate cybercriminals, and therefore something else for overburdened security professionals to consider.

    There is a spectrum of sensitive information, from an e-mail address to private secrets. The theft of the Ashley Madison databases, essentially a list of 37m possible adulterers’ identifying details, must rank as one of the most “sensitive” troves of data ever acquired. While there will be credit card details too, it’s the potential for public (and private) embarrassment that many will be fearing.

    Reported by security research Brian Krebs and confirmed by ALM CEO Noel Biderman, Impact Team’s statement rails against the motivations not just of the supposed cheaters using the site, but the site itself for facilitating this behaviour, demanding that ALM close down Ashley Madison and another of its sites, Established Men, permanently or risk the details being published.

    Impact Team’s ire is directed particularly at ALM’s “full delete” service where, for US$19, all a user’s details will be deleted. They claim ALM made $1,7m from this service, yet leave the credit card details, obviously including real names and addresses, intact. Impact Team hint that the hack was made possible through an insider — embarrassing for a firm that had aimed to raise $200m this summer from an IPO.

    According to a recent survey by Thales, typically the most sensitive data that is encrypted is employee and HR data. It goes without saying that this is highly sensitive information that can bring repercussions both on the individuals and the firm in question. As customers, we may not be pleased to note that customer details are some way down the list. Really, all these aspects should be closer to 100%.

    Intellectual property is certainly a target for cyberattacks, with the loss of source code and secret product information potentially disastrous for companies. Hacking Team recently found the internal code of their commercial hacking tools posted all over the Internet, for example.

    When university researchers analysed 300 discarded hard disk drives they found that a third contained personal data including health and banking information (including a €50bn currency exchange service), and even details for a missile defence system. The lack of planning and care in how this information was dealt with is astonishing.

    Poking the hornet’s nest
    The catastrophic raid on Sony’s corporate network last year was blamed on North Korea, but Sony has battled Anonymous, Lulzsec and Lizard Squad over the years, often over their stance on breaches of copyright. Again, a disgruntled insider within Sony is the most likely source of the breach. The hack led to all manner of documents appearing online — such as embarrassing e-mails from senior executives.

    Sony’s trouble with hacking organisations can be traced to its court case against George Holtz, who Sony sued after he published root encryption keys for the PlayStation console. Sony demanded identifying details of visitors to his website and social media pages, and was given access to Holtz’s PayPal account. The case judge eventually granted Sony permission to view IP addresses of everyone who visited Holtz’s site, geohot.com. In April 2011, Sony settled the lawsuit out of court, but have since faced many further attacks.

    The fact is hackers are increasingly pursuing a variety of agendas. In protest at St Louis County Police involvement in the death of unarmed teenager Michael Brown in Ferguson, Missouri, the police department’s website was attacked, knocking it offline for several days. The group responsible declared they had gained access to dispatch tapes related to the day of the shooting, which they then uploaded to YouTube.

    The message left by Hacking Team
    The message left by Impact Team

    In political actions worldwide, from the Arab Spring uprising, to Russia’s suspected cyberattacks on Estonian government websites, or the Syrian Electronic Army, the Internet is increasingly a new vector of attack. The Internet as battleground is not in the future, it is already here, and as attack on the French channel TV5Monde should remind us, it may escalate to include control of news outlets, too.

    Organisations need to understand that there are new risks and new ways to distribute messages, especially from those skilful enough to disrupt traditional methods. It’s important to note that the viewpoint of the hacktivist will often be reflected in the political landscape of the time, and that this is subject to change. The hacktivist, a cybercriminal to some, can be a freedom fighter to others.

    The Internet provides a voice for all, and there are many examples where corporations, organisations or governments have outraged groups around the world who have successfully staged an uprising or retaliation against them. Someone may be small on the Internet, but can still have a massive impact. Sony lost billions of dollars from its share price, and forfeited a great deal of customer confidence.

    A strong defence is the starting point, but if there is trusted internal access then it is possible to circumvent the locks. With digital media cards now supporting hundreds of gigabytes of data it’s not too difficult to take huge amounts of data off-site — and this is why encryption is so vital. In short:

    • Encrypt sensitive data
    • Control and limit access to sensitive data
    • Make sure those controls work
    • Check who has access to the data
    • Integrate multi-factor authentication for the access to sensitive information
    • Watch where you back up your data and protect that, too
    • Don’t use the same encryption keys for everything

    And finally, try not to upset people. Ashley Madison rashly boasted of its superior security, while flaunting what many would describe as unethical behaviour. Such things are red rags to a bull. Companies need to understand that their insecurity today is as much to do with their behaviour and the reactions or political and social aims of others in response as it is the straightforward quest for financial gain.The Conversation

    • Bill Buchanan is head, Centre for Distributed Computing, Networks and Security at Edinburgh Napier University
    • This article was originally published on The Conversation
    ALM Ashley Madison Bill Buchanan
    Share. Facebook Twitter LinkedIn WhatsApp Telegram Email
    Previous ArticleAdvtech rejects Curro’s advances
    Next Article How crooks steal your identity

    Related Posts

    The great crypto crash: the fallout, and what happens next

    22 June 2022

    Goodbye, Internet Explorer – you really won’t be missed

    19 June 2022

    Oracle’s database dominance threatened by rise of cloud-first rivals

    13 June 2022
    Add A Comment

    Comments are closed.

    Promoted

    Think herding cats is tricky? Try herding a cloud

    29 June 2022

    How your business can help hybrid workers effectively

    28 June 2022

    Hands off our satellite spectrum!

    27 June 2022
    Opinion

    Has South Africa’s advertising industry lost its way?

    21 June 2022

    Rob Lith: What Icasa’s spectrum auction means for SA companies

    13 June 2022

    A proposed solution to crypto’s stablecoin problem

    19 May 2022

    Subscribe to Updates

    Get the best South African technology news and analysis delivered to your e-mail inbox every morning.

    © 2009 - 2022 NewsCentral Media

    Type above and press Enter to search. Press Esc to cancel.