Security Researcher Brian Krebs Receives Legal Threat From Former Ashley Madison Exec Over Hacking Allegations

from the possibly-some-merit-in-the-threats-for-a-change dept

Ashley Madison's former CTO, Raja Bhatia, is toying with the idea of suing security researcher Brian Krebs for libel. Bhatia has problems with an earlier story by Krebs, which quoted emails obtained from the Ashley Madison hack that seemingly indicated the company's execs participated in the breach of a rival's customer database.

The original story made these claims (again, based on the content of exposed emails):

A review of those missives shows that on at least one occasion, a former company executive hacked another dating website, exfiltrating their entire user database. On Nov. 30, 2012, Raja Bhatia, the founding chief technology officer of AshleyMadison.com, sent a message to Biderman notifying his boss of a security hole discovered in nerve.com, an American online magazine dedicated to sexual topics, relationships and culture.

At the time, nerve.com was experimenting with its own adult dating section, and Bhatia said he’d uncovered a way to download and manipulate the nerve.com user database.

“They did a very lousy job building their platform. I got their entire user base,” Bhatia told Biderman via email, including in the message a link to a Github archive with a sample of the database. “Also, I can turn any non paying user into a paying user, vice versa, compose messages between users, check unread stats, etc.”

Bhatia's legal rep says Bhatia takes exception to being labelled a hacker in the headline and body of the post. Unlike countless other legal threats, this letter to Krebs takes the time to point out the specific claims Bhatia takes issue with, as well as offering up information that seemingly contradicts Krebs' assertions.

Contrary to the express statement in the article’s title and the suggestion in its body, Mr. Bhatia did not “hack” Nerve.com. Rather, he noticed a readily apparent security gap and remarked on it to Noel Biderman, Ashley Madison’s CEO, with whom he happened to speak shortly thereafter. At no time did Mr. Bhatia attempt to bypass Nerve.com’s security or to exploit its gap in any way. He did not bulk exfiltrate this data or attempt to alter it, as implied by the selective quotes from his emails included in your post. To the contrary, Mr. Bhatia expressly stated that he would not do so in the email sequence referred to in the article, a point omitted from your report.

Bhatia's lawyer has asked for a correction and retraction of the earlier post. Krebs has refused to do, standing by his earlier assertions and posting Bhatia's letter in full.

Unfortunately for Krebs, he has a much higher bar to reach to get this thrown out. The lawsuit, if it arrives, will be filed in Canada, where Ashley Madison's parent company (Avid Life Media) is located. Canadian law shifts much of the burden of proof to defendants in defamation cases and Canadian courts have been known to reach some very questionable conclusions when dealing with these sorts of lawsuits. That being said, the SPEECH Act would likely prevent a Canadian court from issuing an unenforceable order targeting a US site. But it still would mean Krebs would need to spend money and time fighting the lawsuit.

The other thing that might hurt Krebs is any discussion of the word "hacking." The way it's used in his original post brings an entirely negative connotation to a word that is also frequently used to describe the work done by Krebs himself. Any efforts to prove the truth of his hacking allegations against Bhatia are likely to do additional damage to a word that can also cover the "neutral" and "good" ends of the spectrum. Obviously, it's in Bhatia's interests to push for redefining "hacking" as purely a nefarious activity, seeing as the legal threat refers to the "implications" of Krebs' post almost as much as it refers to any "false and defamatory statements."

In a very colloquial sense, Bhatia's discovery of a security flaw is "hacking." Bhatia's legal team obviously views the use of "hacking" in this context to be wholly negative. Litigation over "hacking" allegations has the potential to further push "hacking" towards being synonymous with "evil." According to Krebs' own words, no real "hacking" was done, at least not in the criminal sense (where protective schemes are attacked and breached). This "hack" was no more inappropriately intrusive than uber-troll Weev's incremental alteration of user ID numbers to access AT&T user account info.

On the other hand, arguments in favor of a more colloquial definition of "hacking' could work in Krebs' favor, where "hacking" simply means using or accessing something in a way the general public wouldn't. In that sense, the headline and the quasi-accusation would be truthful, if not especially accurate. Krebs could argue his use of the word "hacking" wasn't meant to have negative connotation but was simply used as accessible shorthand for Bhatia's actions. Either way, colloquial use of a term that encompasses a wide variety of actions (good and bad) isn't really enough to rise to the level of defamation.

The larger issue may be the statement that Bhatia exfiltrated nerve.com's user database. As the letter states, other emails indicate he did no such thing (and indeed wouldn't) even though he had the opportunity.

At this point, it's Bhatia's move. Krebs is refusing to comply with the requests of Bhatia's attorney. Now that everyone's lining up to file a lawsuit against the company, it's probably a safe to assume a few lawsuits will be filed in the other direction, targeting those utilizing information obtained from the hack. Bhatia has a favorable venue and very little to lose by pursuing this, so I would expect an announcement of a lawsuit in the near future.

Filed Under: ashley madison hack, brian krebs, canada, defamation, hacking, raja bhatia, speech act, threats
Companies: ashley madison, avid life media, nerve.com

Anonymous Plaintiffs File Misguided Lawsuit Against Amazon, GoDaddy, Others Over Ashley Madison Hack

from the more-angry-than-right dept

Given the sensitive nature of the data obtained in the Ashley Madison hack, it was inevitable that lawsuits would follow. The company seemed less interested in protecting its users' privacy and more interested in selling them the "privilege" of deleting their accounts and the information contained therein, should they suddenly have a crisis of conscience. (And that information appears to not have actually been deleted, despite the company's promise to do so.)

And, given the sensitive nature of the data, it was inevitable that a lawsuit would be filed that focused less on coherent legal arguments than the plaintiffs' anger at being included in a data breach that would also expose their extramarital endeavors. Alexander J. Martin of The Register has obtained a filing from just such a lawsuit.

Three John Doe plaintiffs have filed a complaint (PDF) against Amazon Web Services, GoDaddy, and 20 John Roes (anonymous defendants), in the Arizona District Court, for "intentionally inflicting emotional distress upon Ashley Madison users."

The plaintiffs want not less than $3m in damages or losses, and a jury trial to boot, and complain that the hack has resulted in them becoming victims to threats and extortion.

The misguided arguments begin almost immediately. As noted above, the plaintiffs have named Amazon and GoDaddy as defendants (referring to them as "internet service providers"), solely because copies of the "stolen data" are hosted at sites serviced by both.

While at least one class action has been filed by users against Ashley Madison for its failure to property [sic] secure the hacked information, this action deals with a different injury inflicted upon Ashley Madison users by persons and entities who have obtained the stolen data, repurposed it such that it is more readily accessible and searchable by the media and curious Internet users, and actively distributed it for their own gain. While these persons and entities may labor under the belief that their actions are entrepreneurial rather than criminal, the fact remains that they are in willful possession of stolen property.

Section 230 should see both these parties dumped from the lawsuit shortly after their responses are filed. Neither can be held responsible for copies of Ashley Madison user data uploaded to websites/online storage by third parties, and no amount of indignation is going to change that.

This would leave the plaintiffs in the position of trying to unmask the following unknown entities, none of which are tied directly to the hacking, much less hosting the stolen data central to the plaintiffs' arguments.

John Roe 1, the owner/operator of ashleymadisonpowersearch.com and adulterysearch.com
John Roe 2 the owner/operator of ashleymadisoninvestigations.com
John Roe 3 the owner/operator of greyhatpro.com
John Roes 4-20 who "are unknown at this time, but are believed to be, among other persons or entities, additional Internet service providers and website operators trafficking in the Stolen Data"

As for the first Roe, the website notes (multiple times) that it doesn't host the data, nor has it requested any ISP host it on its behalf. Ashley Madison Investigations also points out that it hosts no copies of the hacked data, but rather pulls its information from "public databases." Greyhat Pro is the only site that offers no disclaimer about the location of the database it's using in its search.

Unless the plaintiffs and their lawyers have access to information proving otherwise, this claim is likely false:

Roe 1, Roe 2, and Roe 3 each own and/or operate a website within this cottage industry, wherein the Roe Defendant has copied a portion and/or all of the Stolen Data and made it searchable through the Roe Defendant’s website (collectively, the “Roe Websites”). As such, each of these Roe Defendants is in willful and knowing possession of stolen property—namely, the Stolen Data.

Screenshots of the websites are included in the filing, but notably none of them include snapshots of the statements pointing out that two of the Roe defendants are not in direct possession of the data.

Ashley Madison Power Search/AdulterySearch:


Ashley Madison Investigations:


So, the prognosis for this lawsuit isn't good. As if to buttress the likelihood of failure, the filing -- which relies heavily on California statutes -- cites a Canadian court decision in support of its overall argument.

Indeed, in recognition of the fact that Ashley Madison data contains confidential information and constitutes stolen property, a Canadian court, the Ontario Superior Court of Justice, issued a restraining order requiring several websites and Internet service providers to immediately disable the Ashley Madison data, deeming it “offence related property in respect of which order of forfeiture may be made under the [Ontario] Criminal Code.”

Canadian law has no Section 230 equivalent, which greatly assists in its courts coming to these sorts of conclusions. And, it must be noted, it cannot order US-based sites to comply with its directives.

Basically, the suit hopes to hold all of these parties accountable for the digital equivalent of receiving and selling stolen goods, plus additional damages for emotional distress. It also attempts to portray the reputation repair/protection services offered by these sites as a violation of the CFAA, citing the following sections of that law.

(7) with intent to extort from any person any money or other thing of value, transmits in interstate or foreign commerce any communication containing any—

[...]

(B) threat to obtain information from a protected computer without authorization or in excess of authorization or to impair the confidentiality of information obtained from a protected computer without authorization or by exceeding authorized access; or

(C) demand or request for money or other thing of value in relation to damage to a protected computer, where such damage was caused to facilitate the extortion

All of the sites mentioned offer people the (very dubious) opportunity to find out if their information is contained in the data, along with other details (whether it includes credit card data, etc.). The transaction is voluntary and none of the sites make any threats about publishing sensitive data if potential customers decide not to take advantage of the offered services. Considering the information is available elsewhere, these offers are generally worthless. They're unsavory and opportunistic, but they aren't extortion.

While I do have some sympathy for those whose lives have been negatively affected by the dissemination of this data, a lawsuit pursuing anyone but Ashley Madison or those behind the hacking is little more than casting about wildly in hopes that someone will recompense them for the wrongs they've suffered, while being willing to let any "someone" pay for the actions of others.

Filed Under: ashley madison hack, hack, lawsuit, section 230
Companies: amazon, ashley madison, avid life media, godaddy

Ashley Madison Continues To Use Dubious Legal Takedown Threats To Try To Disappear The Data It Failed To Protect

from the not-a-good-idea dept

We've written a few times now about how the parent company of Ashley Madison, Avid Life Media, has been committing perjury and issuing completely bogus copyright demands to try to hide the information that was leaked after its servers got hacked. Last month, that tactic (despite not complying with the law) apparently worked briefly, until the full data dump happened last week. But that hasn't stopped the company from continuing to try. EFF wrote a long blog post detailing how this was a clear abuse of the law, but Avid Life Media doesn't seem to care.

After the leak came out, a few sites sprung up quickly to help people search the database. Whether or not you think it's appropriate to set up such a site (or to use it) is a separate issue, but what hopefully everyone can agree on is that such a site should not be taken down for copyright reasons. There were two main sites that got the bulk of attention for setting up such a database, and one has already shut down and the other has received a takedown demand (though not a copyright one). I won't link to either site, but here's what's now posted on one of the sites: Meanwhile, the creator of the other main search engine has said on Twitter that he, too, has been hit with "a vexatious DMCA from lawyers acting on behalf of Avid Life Media" and reporters are similarly mistakenly calling it a DMCA, but according to the copy the guy posted to Pastebin, the letter sent by Avid Life Media's lawyers at giant law firm DLA Piper to CloudFlare is not actually a DMCA, but rather a weird "please, take this down because... vague reasons and terms of service violations." That is, there's no real legal threat (because there's no basis for one). It's just vaguely threatening hoping to scare off people:

Our firm is counsel to Avid Life Media, Inc. (“ALM”) with respect to its intellectual property and data privacy matters. As you may know, ALM is the parent company of the online dating and social networking service Ashley Madison. Because users entrust ALM with highly sensitive and intimate details (collectively the “Ashley Madison User Data”), the privacy of ALM’s users is of utmost importance. As a result, ALM proactively and arduously regulates any authorized (and unauthorized) use of Ashley Madison User Data.

This letter is to inform CloudFlare, Inc., and all related entities (collectively, “You”) that, upon information and belief, CloudFlare, Inc.’s client (“Your Client”), has posted a searchable database of the Ashley Madison User Data to a website hosted on a domain name hosted by You. Specifically, Your Client has posted the Ashley Madison User Data at the following URL: https://ashley.cynic.al/ (the “URL”). Your Client’s publication of the Ashley Madison User Data may constitute illegal disclosure of private personal information, and potentially expose millions of individuals around the world to identity theft.

Moreover, we believe that the website content hosted at the URL may violate the Your Terms of Use, located at: https://www.cloudflare.com/terms. Specifically, the website content hosted at the URL may violate the Terms of Use in that it likely infringes upon the privacy and personal data rights of the Ashley Madison users. Accordingly, ALM requests that You take action to remove and/or disable access to all content at the URL.

Please note that this letter is made without prejudice to any other rights or remedies that may be available to ALM. Nothing contained herein should be deemed a waiver, admission, or license by ALM, and ALM expressly reserves the right to assert any other factual or legal positions as additional facts come to light or as the circumstances warrant.

CloudFlare, in response, told the guy that it had forwarded the name of the actual hosting provider (a non-US company) to the lawyers at DLA Piper, and at last check, the guy claims that his hosting company, ColoCall out of Ukraine, has not done anything about it. That may change, but it's not clear what legal basis ALM has for the demand. It's nice to see that ALM is no longer making totally bullshit copyright claims, but these weird "privacy and personal data rights" claims don't have much legal basis either.

Filed Under: dmca, leaks, privacy, takedowns
Companies: ashley madison, avid life media, cloudflare

The Day Someone Signed Me Up For An Ashley Madison Account (That Day Would Be Yesterday)

from the so-creative dept

We've written a few times now about the leak of data from Ashley Madison, the "dating site for people who want to cheat on their spouses," mostly discussing the company's bizarre infatuation with abusing copyright law to try to take down anyone posting content from the leak. We haven't taken part in any of the stories about naming and shaming individuals who have been found in the database (or just where they might work). As a lot of people have been noting (thankfully) in their stories, for no clear reason, Avid Life Media (the company that owns Ashley Madison) doesn't do email verification. That means anyone can create an account using anyone else's email address. In fact, last month, reporter Farai Chideya noted that someone had created an account using her email.

And, apparently, someone thought it would be funny to do the same to me. Yesterday afternoon, I got a message telling me "Welcome to Day 1 of your Ashley Madison Experience." Someone using my email signed me up, using the rather creative account name "masnicator." I'm kinda surprised that Ashley Madison is still even allowing online signups (let alone not using an email verification system, or for that matter even keeping the site up at all). But, perhaps even more ridiculous is that in the "welcome" email, it highlights how the service is "100% Secure." Perhaps even more amusing is that just three minutes after this fake registration, I also got a fake message from someone. And, no, I'm not going to see what the message is, nor even let the image show up (not even for journalistic curiosity). But this certainly adds that much more support to the theory that the site regularly used fake profiles and fake come ons to get men to pay up. As if anyone is (1) still using the site at all and (2) going to respond to an obviously bogus account three minutes after it's created.

As if to hammer home just how bogus the whole thing is, the site sent me another email just a few hours later, claiming that it was showing me new people who had just signed up near me. Of course, if anyone is actually "signing up" now, I'm guessing it's for the same reason that someone signed me up: to mess with people or to joke around.

Not sure why whoever did this did this, though, I guess thanks for the story?

Filed Under: email verification, trolls
Companies: ashley madison

Ashley Madison Still Trying To Abuse The DMCA To Hide Leak

from the cat's-out-the-bag,-folks dept

So just a few hours ago, we were mocking the company behind the "dating site for cheating on your spouse" site Ashley Madison for abusing the DMCA in the false belief it would somehow stop the full leak of the data. And... now that the full leak of data has actually happened, apparently the geniuses at Avid Life Media (said parent company) are still abusing the DCMA to try to get those horses back in the barnyard. From Vice's Motherboard's Joseph Cox:

A few hours ago I received a notice under the Digital Millennium Copyright Act (DMCA) relating to three of my tweets.

“Hello,” the email from Twitter starts. “The following material has been removed from your account in response to the DMCA takedown notice copied at the bottom of this email.”

The tweet in question had been a "partial screenshot of an apparent floor plan of the Avid Life Media office." But the company asked for more too:

... the DMCA request also asked for another two to be removed. One was a heavily censored screenshot of a spreadsheet which details the shareholders of the company and the percentile of shares they own. The screenshot did not include any names, figures, or other data, but simply the headers of two columns. Another screenshot showed the column headers of a spreadsheet detailing the company's bank accounts. No actual bank data was included. Twitter apparently did not remove these two tweets.

It's worth noting, here, that the DMCA notices were not sent on the leaked customer data, but about things that are at least marginally more closely tied to the company -- though it's still unlikely that Avid Life Media has a legitimate copyright claim in any of them. It's possible that it holds the copyright in the floor plan, but such a tweet is pretty clearly fair use.

All this should make you wonder why Avid Life Media is running around filing bogus DMCA notices, rather than actually taking care of the damage from this leak?

Filed Under: censorship, copyright, dmca
Companies: ashley madison, avid life media

Remember How The DMCA 'Stopped' The Release Of Ashley Madison Cheaters Data? About That...

from the boom-goes-the-dynamite dept

Last month, you may recall, the news broke that the "dating site for people who want to cheat on their spouse," Ashley Madison, had its systems hacked, and all its data leaked. For rather obvious reasons, this had a lot of people rather worried about what would be revealed. However, the company insisted that there was no problem at all, because it had used the DMCA to take down all leaked copies. We pointed out how ridiculous this was on multiple levels. First, that's not what the DMCA is for, and as embarrassing as this was for Ashley Madison's parent company Avid Life Media, it does not hold the copyright in such data. Second, the idea that this would actually stop the data from reaching the public was ludicrous.

And... it took longer than expected, but less than a month later, the data file has leaked online, and you can bet that lots of people -- journalists, security researchers, blackmailers and just generally curious folks -- have been downloading it and checking it out.

Maybe, next time, rather than claiming copyright, the company will do a better job of protecting its systems.

Filed Under: cheating, copyright, dmca, infidelity, leak
Companies: ashley madison, avid life media

Shocking Revelation: Websites For Cheating On Your Spouse Are BSing You

from the a-few-good-men dept

I'll preface this post with a couple of admissions. First, I've never used a dating site, though not because I think there's anything wrong with the concept. Second, I am getting married in the next couple of days. Now that that's out of the way, it seems to me that dating sites are all about cheating. You can cheat by fudging your cleavage on your profile picture. You can cheat by yoinking someone else's dating profile for your own use.

And, if you're a married person looking to cheat, you can go to a dating site dedicated to cheaters, because surely that will work out well for everyone involved. But here's something you may have never expected: a skeevy site promising to help you cheat on your spouse might just be bullshitting their own profiles. Gasp! And, because life is full of stories that completely lack a good guy, we learn that one such site, Ashley Madison, is doing just that, thanks to a former employee suing over the carpel tunnel syndrome she says she attained while creating all those fake profiles the unhappily married have been "corresponding" with.

Doriana Silva is seeking $20 million from Ashley Madison for what she calls the company’s “unjust enrichment” at her expense, plus another $1 million in punitive and general damages.

In her statement of claim, Silva — a Brazilian immigrant living in Toronto — says she was hired to help launch a Portuguese-language version of the site and promised a starting salary of $34,000 plus benefits. She was soon asked to create 1,000 “fake female profiles” meant to lure men to the new Brazilian Ashley Madison site — and given only three weeks to complete the work, the document alleges.

Huh, I didn't realize we were still doing the whole "typing gave me carpel tunnels" thing in this day and age. It seems like a shaky bridge to build for getting all that sweet cash, given that studies haven't provided any causal link between typing and claw-hands. And it's worth noting that this is a cash-grab, not the work of an honest whistle-blower. In other words, it may be that the inclusion of the fake profiles story was to extract a settlement from Ashley Madison. Some might suggest that perhaps Silva is lying about creating fake profiles, but since we've seen that done by more mainstream dating sites, it's easy to believe her on that front. Given the opportunity to comment or respond with a statement of defense, the company has thus far been silent.

So, remember, when you're trolling the internet for someone to cheat on your spouse with, chances are you're not talking to a real human being. And if you're unhappy at home, there are much more fun ways to get sore hands than typing on your keyboard.

Filed Under: adultery, carpal tunnel, cheating, dating sites, doriana silva, fake profiles, spouses
Companies: ashley madison