AFF/Penthouse has been hacked, 400 millions accounts, largest hack in 2016 - GoFuckYourself.com

Why · 11-13-2016, 09:57 AM

All customer data has been liiberated, as per:
https://www.leakedsource.com/blog/friendfinder

400 million accounts, even 'closed' accounts are still in their database, and apparently the passwords were mostly stored insecurely.

better go download them lists and get to mailing :x

Bladewire · 11-13-2016, 10:05 AM

Wow! Thanks for the heads up

Barry-xlovecam · 11-13-2016, 11:02 AM

The bigger issue are the emailers that 'save' your mail list -- their compromising hacks are rarely reported -- ever notice how you get sudden bursts of Spam emails?

Brian mike · 11-13-2016, 11:32 AM

Thanks for the heads up

Smack dat · 11-13-2016, 11:44 AM

Not surprised.

Feng-PD · 11-13-2016, 11:45 AM

how to get that list lol dont see it on the site!

j3rkules · 11-13-2016, 11:58 AM

Wow, it is really big...

Why · 11-13-2016, 12:09 PM

Quote:

Originally Posted by Feng-PD

how to get that list lol dont see it on the site!

its in the wild, just have to know the right people or the right places to look.

NemesisEnforcer · 11-13-2016, 12:11 PM

Quote:

Originally Posted by Why

400 million accounts, even 'closed' accounts are still in their database, and apparently the passwords were mostly stored insecurely.

Nice piece of nugget

NemesisEnforcer · 11-13-2016, 12:14 PM

Quote:

Originally Posted by Feng-PD

how to get that list lol dont see it on the site!

Try the dark web.

NewNick · 11-13-2016, 12:21 PM

Old news.

Why · 11-13-2016, 12:24 PM

Quote:

Originally Posted by Barry-xlovecam

The bigger issue are the emailers that 'save' your mail list -- their compromising hacks are rarely reported -- ever notice how you get sudden bursts of Spam emails?

or they just sell the older ones for a cash infusion.

Why · 11-13-2016, 12:25 PM

Quote:

Originally Posted by NewNick

Old news.

not so much, this happened just a few weeks ago.

i think the old news you refer to was the last time they were hacked.

Why · 11-13-2016, 12:26 PM

the sad part to me is how inept AFFs tech talent appears to be. they were storing passwords in plain text and/or SHA1. its not hard to reverse SHA1 passwords, then take the whole lot and properly secure them.

anyone still doing this deserves any bad press they get.

poncabare · 11-13-2016, 03:38 PM

Uh oh...

RyuLion · 11-13-2016, 04:18 PM

Quote:

Originally Posted by jerkules

Wow, it is really big...

That's what she said..

TeenCat · 11-13-2016, 04:50 PM

year ago they have been hacked and now year later they still have passwords in plain and nobody have found that someone is downloading whole db? that is not like you download whole db every day, and one of first things is to limit any db operations for ips

400millions is 39x times more than all people in my country, and they have security like that?

babeterminal · 11-13-2016, 05:57 PM

Quote:

Originally Posted by TeenCat

year ago they have been hacked and now year later they still have passwords in plain and nobody have found that someone is downloading whole db? that is not like you download whole db every day, and one of first things is to limit any db operations for ips

400millions is 39x times more than all people in my country, and they have security like that?

teencat is 6bot finished now, no update for nearly 2 years?

password changed, on doing so there was some new tos i had to agree with before i could enter program, never read it anyone know the summary of the changes?

HairyChick · 11-13-2016, 07:10 PM

Another story said iCams and cams.com were hit as well. Fifteen million accounts on AFF were old customers who didn't renew. One organization unencoded 99% of passwords. Hacked a year ago and then again. I'd not trust them with my info.

the Shemp · 11-13-2016, 07:43 PM

I used to be on a 35% payout for life, but aff hacked me down to 20%...

freecartoonporn · 11-13-2016, 08:12 PM

400 mil emails wowza.

st0ned · 11-13-2016, 11:13 PM

Surprising that these individuals and/or groups even release the data unless they have already hit it and want to further hide themselves in the additional flood of emails.

I guess it is for fame outside of that? They could make a killing with that many emails that's for sure.

NALEM · 11-13-2016, 11:30 PM

Quote:

Originally Posted by Why

the sad part to me is how inept AFFs tech talent appears to be. they were storing passwords in plain text and/or SHA1. its not hard to reverse SHA1 passwords, then take the whole lot and properly secure them.

anyone still doing this deserves any bad press they get.

We use SHA512, not SHA1, to hash our passwords. It's still not ideal. Any of you cyber experts wan't to chime in and make some suggestions.

Barry-xlovecam · 11-14-2016, 12:05 AM

Use some variable, other than the user name, to salt the password before you hash it.

Emails are a big problem. Not only are they of great marketing value -- email and user data is an extortion bonanza. If you value your businesses reputation and brand goodwill you need to actively secure this data.

The email marketing is problematic. For a medium sized business, doing high volume mail outs, the Spam server rules create security gaps that you have to trust to others (mailers).

The other point is network, database server and script security -- how did the hackers breach the system's security?

itx · 11-14-2016, 12:56 AM

If we are FFN affiliates we dont need spread this info, my

.

PornDiscounts-V · 11-14-2016, 02:02 AM

First off... AFF has been hackable since the beginning. And many individuals and hacking groups have been having their way with them.

It is common knowledge in hacking back channels that it is very easy to signup as an affiliate, and then fake, crap traffic, then go into the database and find whales, now swap the affiliate id for your own. Now you too can live in mother Russia like a czar with all of your ill gotten gains.

I would posit that this is going on with almost all affiliate programs dealing with dating and cams.

Btw, doesn't matter if you lock down mysql by ip since the hacker has full control of a white listed box.

CAHEK · 11-14-2016, 02:09 AM

400 million is huge base

TeenCat · 11-14-2016, 03:11 AM

Quote:

Originally Posted by st0ned

Surprising that these individuals and/or groups even release the data unless they have already hit it and want to further hide themselves in the additional flood of emails.

I guess it is for fame outside of that? They could make a killing with that many emails that's for sure.

it is easy, if you are original hacker, you will no release, if you are someone lucky and dumb, you will release, but mostly it is because the hole have been already filled, so no reason to keep the datas somewhere on local

TeenCat · 11-14-2016, 03:17 AM

Quote:

Originally Posted by vvvvv

Btw, doesn't matter if you lock down mysql by ip since the hacker has full control of a white listed box.

hm, not sure about this one, because if the db operations are active only for one or two ips, i mean ip of billing or script which is writing into the db, you cannot do anything except from those two ips, and if someone change the settins, then some warning systems have to be activated. but, i am not good in those redneck things but looks like aff security guys have also a bit to learn ... another thing is that every big target will always be under attack, so have luck everyone

itx · 11-14-2016, 03:21 AM

If FFN is under attack we need this thing get unnoticed, we can as a Webmasters, they dont give a fuck if trump wins and they dont use it as excuse. We need be the MAFIA.

TeenCat · 11-14-2016, 08:49 AM

Quote:

Originally Posted by babeterminal

teencat is 6bot finished now, no update for nearly 2 years?

password changed, on doing so there was some new tos i had to agree with before i could enter program, never read it anyone know the summary of the changes?

yes man two years is a nice holidays, 6bot will be back at work very soon

Adnium_Ivana · 11-14-2016, 11:18 AM

It's approx 412 million user details (like passwords & account info) that have leaked. A) that is one massive and envy inducing user base and B) Any site with such a huge list needs top anti-hacking and anti-pirating security. I mean get more people on your Dev & Ops team and invest in top notch software, you've got the $$

Brian mike · 11-14-2016, 11:31 AM

Quote:

Originally Posted by Adnium_Ivana

you've got the $$

Do they really have it or they get in the TINDER FREE APP storm too ?

I heard from many client of the Dating world that; they all have lose big at the arrival of the type of Tinder FREE APP Models .

Someone can put some intel on that ?

Why · 11-14-2016, 11:54 AM

Quote:

Originally Posted by TeenCat

hm, not sure about this one, because if the db operations are active only for one or two ips, i mean ip of billing or script which is writing into the db, you cannot do anything except from those two ips, and if someone change the settins, then some warning systems have to be activated. but, i am not good in those redneck things but looks like aff security guys have also a bit to learn ... another thing is that every big target will always be under attack, so have luck everyone

his point was if you have access to the one of the servers owning the whitelisted IPs in the database server, there is no way to keep the data safe. Ip protecting your database when your code is insecure doesn't do much for you.

TeenCat · 11-14-2016, 12:10 PM

Quote:

Originally Posted by Why

his point was if you have access to the one of the servers owning the whitelisted IPs in the database server, there is no way to keep the data safe. Ip protecting your database when your code is insecure doesn't do much for you.

ok man got it, thanks for the explanation

Adnium_Ivana · 11-14-2016, 12:21 PM

Quote:

Originally Posted by Brian mike

Do they really have it or they get in the TINDER FREE APP storm too ?

I heard from many client of the Dating world that; they all have lose big at the arrival of the type of Tinder FREE APP Models .

Someone can put some intel on that ?

If' they've got servers to run and support 400 mill user base + plus traffic in the 100+ millions I'm assuming such a company has got the dough for security

romeo22 · 11-14-2016, 01:01 PM

Wohoo nice !!!!

rhon23 · 11-14-2016, 03:05 PM

In light of recent Friend Finder events we would like to share our statement from Penthouse.

“Prior to February 19th, 2016 Penthouse was a subsidiary of FriendFinder Networks, Inc. and subject to their controls and procedures. As of the close of the sale, Penthouse now operates independent of FriendFinder Networks, Inc.
We are aware of the data hack and we are waiting on FriendFinder to give us a detailed account of the scope of the breach and their remedial actions in regard to our data. Penthouse.com is a content site and does not collect data regarding our members sexual preferences. We take our members’ data and site security seriously. We assumed full control of Penthouse.com in May of 2016 and immediately adopted a blanket policy requiring all of our members to change their passcodes. At the time our members weren’t thrilled with the inconvenience but we remain committed to “best practices” in regard to keeping our members’ data secure.”

Why · 11-14-2016, 03:13 PM

Quote:

Originally Posted by rhon23

In light of recent Friend Finder events we would like to share our statement from Penthouse.

?Prior to February 19th, 2016 Penthouse was a subsidiary of FriendFinder Networks, Inc. and subject to their controls and procedures. As of the close of the sale, Penthouse now operates independent of FriendFinder Networks, Inc.
We are aware of the data hack and we are waiting on FriendFinder to give us a detailed account of the scope of the breach and their remedial actions in regard to our data. Penthouse.com is a content site and does not collect data regarding our members sexual preferences. We take our members? data and site security seriously. We assumed full control of Penthouse.com in May of 2016 and immediately adopted a blanket policy requiring all of our members to change their passcodes. At the time our members weren?t thrilled with the inconvenience but we remain committed to ?best practices? in regard to keeping our members? data secure.?

which begs the question, if the acquiring party noticed this huge issue with how passwords were being stored, why did AFF not, and/or why did they not fix at least that part of the situation long before this all happened?

incompetence or apathy?

rhon23 · 11-14-2016, 03:16 PM

Quote:

Originally Posted by Why

which begs the question, if the acquiring party noticed this huge issue with how passwords were being stored, why did AFF not, and/or why did they not fix at least that part of the situation long before this all happened?

incompetence or apathy?

That is a friend finder question. We are now divorced from them.

money biz · 11-14-2016, 04:17 PM

I bet 65% are from api dating db's that didn't really sign up cough cough

itx · 11-15-2016, 01:02 AM

TheDA · 11-15-2016, 03:47 AM

Vendot · 11-15-2016, 04:06 AM

Quote:

Originally Posted by Why

incompetence or apathy?

They look asleep at the wheel as anyone trying to get a response from affiliate support will tell you.

marcop · 11-15-2016, 07:21 AM

Quote:

Originally Posted by Why

the sad part to me is how inept AFFs tech talent appears to be. they were storing passwords in plain text and/or SHA1. its not hard to reverse SHA1 passwords, then take the whole lot and properly secure them.

anyone still doing this deserves any bad press they get.

This....

PornDiscounts-V · 11-15-2016, 09:14 AM

Quote:

Originally Posted by TeenCat

hm, not sure about this one, because if the db operations are active only for one or two ips, i mean ip of billing or script which is writing into the db, you cannot do anything except from those two ips, and if someone change the settins, then some warning systems have to be activated. but, i am not good in those redneck things but looks like aff security guys have also a bit to learn ... another thing is that every big target will always be under attack, so have luck everyone

True, except that you cannot process anything directly in your own database? You always have to use some billing tool to do it? Not!

JFK · 11-15-2016, 10:15 AM

Quote:

Originally Posted by RyuLion

That's what she said..

You wish !

romeo22 · 11-15-2016, 10:21 AM

Me gusta much

11-13-2016, 09:57 AM	#1
Why MFBA Industry Role: Join Date: Mar 2003 Location: PNW Posts: 7,230	AFF/Penthouse has been hacked, 400 millions accounts, largest hack in 2016 All customer data has been liiberated, as per: https://www.leakedsource.com/blog/friendfinder 400 million accounts, even 'closed' accounts are still in their database, and apparently the passwords were mostly stored insecurely. better go download them lists and get to mailing :x

11-13-2016, 10:05 AM	#2
Bladewire StraightBro Industry Role: Join Date: Aug 2003 Location: Monarch Beach, CA USA Posts: 56,229	Wow! Thanks for the heads up __________________ Skype: CallTomNow

11-13-2016, 11:32 AM	#4
Brian mike #Alberta51 Industry Role: Join Date: Oct 2014 Location: USA Territory (Alberta) Posts: 8,688	Thanks for the heads up __________________ Tube - Cam - Escorts - Top List Menu Tab - Banner - Header Link - Blog Post DM me

11-13-2016, 11:45 AM	#6
Feng-PD www.PornDeals.com Industry Role: Join Date: Jul 2011 Location: Netherlands Posts: 3,964	how to get that list lol dont see it on the site! __________________ PornDeals.com - WebcamDeals.com - GayDeals.com - PornCoupons.comnew! Skype : fengwu83 Email : feng{atter}porndeals{dotter}com

11-13-2016, 11:58 AM	#7
j3rkules VIP Industry Role: Join Date: Jul 2013 Posts: 22,111	Wow, it is really big... __________________ How To Build A Porn Site And Make Money \| My Best $$$ Cam Sponsor \| New Webcam Script 3 Top Adult Hosting Providers

11-13-2016, 11:02 AM	#3
Barry-xlovecam It's 42 Industry Role: Join Date: Jun 2010 Location: Global Posts: 18,083	The bigger issue are the emailers that 'save' your mail list -- their compromising hacks are rarely reported -- ever notice how you get sudden bursts of Spam emails?

11-13-2016, 11:44 AM	#5
Smack dat So Fucking Banned Industry Role: Join Date: Jul 2016 Posts: 4,613	Not surprised.

11-13-2016, 12:21 PM	#11
NewNick Confirmed User Join Date: Mar 2009 Posts: 7,063	Old news. __________________ "Americas Hitler" JD Vance. “There isn’t really an upside to Trump.” Tucker Carlson. “a convicted felon rapist is now your president” OneHungLow, gfy.com

11-13-2016, 12:26 PM	#14
Why MFBA Industry Role: Join Date: Mar 2003 Location: PNW Posts: 7,230	the sad part to me is how inept AFFs tech talent appears to be. they were storing passwords in plain text and/or SHA1. its not hard to reverse SHA1 passwords, then take the whole lot and properly secure them. anyone still doing this deserves any bad press they get.

11-13-2016, 03:38 PM	#15
poncabare Confirmed User Industry Role: Join Date: Jul 2007 Location: carmel Posts: 2,552	Uh oh...

11-13-2016, 04:50 PM	#17
TeenCat Too lazy to set a koala Industry Role: Join Date: Jan 2007 Location: CZ/EU forever! Posts: 16,139	year ago they have been hacked and now year later they still have passwords in plain and nobody have found that someone is downloading whole db? that is not like you download whole db every day, and one of first things is to limit any db operations for ips 400millions is 39x times more than all people in my country, and they have security like that? __________________ 6bot / Coming again very soon! Svit Zlin Radio 24/7!

11-13-2016, 07:10 PM	#19
HairyChick Slowly dying Industry Role: Join Date: Sep 2012 Location: Padanaram Posts: 3,091	Another story said iCams and cams.com were hit as well. Fifteen million accounts on AFF were old customers who didn't renew. One organization unencoded 99% of passwords. Hacked a year ago and then again. I'd not trust them with my info. __________________ ***************************************** Anti-Semites have Small Penis Syndrome. The only known treatment is electroshock therapy combined with cerebellum removal. Fortunately, it’s a tiny procedure. *****************************************

11-13-2016, 07:43 PM	#20
the Shemp congrats to the winners Industry Role: Join Date: Nov 2001 Location: Echo Beach Posts: 10,891	I used to be on a 35% payout for life, but aff hacked me down to 20%... __________________ i use Vacares...so should you Submit your picture galleries to my site...Outlaw TGP

11-13-2016, 08:12 PM	#21
freecartoonporn Confirmed User Industry Role: Join Date: Jan 2012 Location: NC Posts: 7,683	400 mil emails wowza. __________________ SSD Cloud Server, VPS Server, Simple Cloud Hosting \| DigitalOcean

11-13-2016, 11:13 PM	#22
st0ned Confirmed User Industry Role: Join Date: Mar 2007 Location: Arizona Posts: 8,437	Surprising that these individuals and/or groups even release the data unless they have already hit it and want to further hide themselves in the additional flood of emails. I guess it is for fame outside of that? They could make a killing with that many emails that's for sure. __________________ Conversion Sharks - 1,000+ adult dating offers, traffic management, and consistently high payouts. We will guarantee and beat your current EPC to win your dating traffic! Skype: ConversionSharks \|\| Email: info /@/ conversionsharks.com

11-14-2016, 12:05 AM	#24
Barry-xlovecam It's 42 Industry Role: Join Date: Jun 2010 Location: Global Posts: 18,083	Use some variable, other than the user name, to salt the password before you hash it. Emails are a big problem. Not only are they of great marketing value -- email and user data is an extortion bonanza. If you value your businesses reputation and brand goodwill you need to actively secure this data. The email marketing is problematic. For a medium sized business, doing high volume mail outs, the Spam server rules create security gaps that you have to trust to others (mailers). The other point is network, database server and script security -- how did the hackers breach the system's security?

11-14-2016, 12:56 AM	#25
itx Confirmed User Join Date: Aug 2007 Posts: 978	If we are FFN affiliates we dont need spread this info, my .

11-14-2016, 02:02 AM	#26
PornDiscounts-V Confirmed User Industry Role: Join Date: Oct 2003 Location: L.A. Posts: 5,744	First off... AFF has been hackable since the beginning. And many individuals and hacking groups have been having their way with them. It is common knowledge in hacking back channels that it is very easy to signup as an affiliate, and then fake, crap traffic, then go into the database and find whales, now swap the affiliate id for your own. Now you too can live in mother Russia like a czar with all of your ill gotten gains. I would posit that this is going on with almost all affiliate programs dealing with dating and cams. Btw, doesn't matter if you lock down mysql by ip since the hacker has full control of a white listed box. __________________ Blog Posts - Contextual Links - Hardlinks on 600+ Blog Network * Handwritten * 180 C Class IPs * Permanent! * Many Niches! * Bulk Discounts! GFYPosts /at/ J2Media.net

11-14-2016, 02:09 AM	#27
CAHEK C.C.C.P. Industry Role: Join Date: Aug 2003 Location: Novorossiya Posts: 7,088	400 million is huge base __________________ Pharma from True-Meds. High converting shop in Europe and USA, fast payouts via BTC !!!

11-14-2016, 03:21 AM	#30
itx Confirmed User Join Date: Aug 2007 Posts: 978	If FFN is under attack we need this thing get unnoticed, we can as a Webmasters, they dont give a fuck if trump wins and they dont use it as excuse. We need be the MAFIA.

11-14-2016, 11:18 AM	#32
Adnium_Ivana Confirmed User Industry Role: Join Date: Jun 2016 Location: Toronto Posts: 1,094	It's approx 412 million user details (like passwords & account info) that have leaked. A) that is one massive and envy inducing user base and B) Any site with such a huge list needs top anti-hacking and anti-pirating security. I mean get more people on your Dev & Ops team and invest in top notch software, you've got the $$ __________________ Skype - ivana.gsmi Email - [email protected] [URL="https://adnium.com/ref/3168"]

11-14-2016, 01:01 PM	#37
romeo22 你自己去他媽的 Industry Role: Join Date: Mar 2008 Posts: 23,347	Wohoo nice !!!!

11-14-2016, 03:05 PM	#38
rhon23 Rebel Girl Industry Role: Join Date: Jun 2003 Location: The Island Of Misfit Toys Posts: 3,270	In light of recent Friend Finder events we would like to share our statement from Penthouse. “Prior to February 19th, 2016 Penthouse was a subsidiary of FriendFinder Networks, Inc. and subject to their controls and procedures. As of the close of the sale, Penthouse now operates independent of FriendFinder Networks, Inc. We are aware of the data hack and we are waiting on FriendFinder to give us a detailed account of the scope of the breach and their remedial actions in regard to our data. Penthouse.com is a content site and does not collect data regarding our members sexual preferences. We take our members’ data and site security seriously. We assumed full control of Penthouse.com in May of 2016 and immediately adopted a blanket policy requiring all of our members to change their passcodes. At the time our members weren’t thrilled with the inconvenience but we remain committed to “best practices” in regard to keeping our members’ data secure.”

11-14-2016, 04:17 PM	#41
money biz Confirmed User Join Date: Jan 2003 Posts: 985	I bet 65% are from api dating db's that didn't really sign up cough cough

11-15-2016, 01:02 AM	#42
itx Confirmed User Join Date: Aug 2007 Posts: 978

11-15-2016, 03:47 AM	#43
TheDA Confirmed User Industry Role: Join Date: May 2006 Posts: 4,665	__________________ Sharleen Spiteri - 1989 - In The Ass

11-15-2016, 10:21 AM	#48
romeo22 你自己去他媽的 Industry Role: Join Date: Mar 2008 Posts: 23,347	Me gusta much