The people who leaked more than 200,000 e-mails from the Ashley Madison dating service for cheaters left behind footprints that will almost certainly be of interest to police and company officials.
The BitTorrent file containing e-mail for Noel Biderman, the CEO of Ashley Madison parent company Avid Life Media, was originally uploaded by someone using a server operated by Ecatel Ltd., an ISP headquartered in the Netherlands. A Web interface for administering the BitTorrent server was left exposed to the Internet without a password, making it possible for outsiders to access. A few hours after the BitTorrent went live, the server went dark after an outsider accessed the wide-open interface and began making changes to the server configuration. The above screenshot, published by a Twitter user calling himself Mr. Green, is just one example of such an outside access.
"Somehow, the person(s) setting up the original uploading (=seeding) of the file forgot to password protect the Web interface, or turn the feature off," Per Thorsheim, an independent security researcher in Bergen, Norway, told Ars. "I suspect [the hackers] used the Web interface to administer the various uploads of the leaks using BitTorrent."
The box seeding the torrent was located at 94.102.63.121. Police and private investigators working feverishly to identify the people who hacked Ashley Madison and published user profiles, transactions, credit-card data, and a wide range of other sensitive data will almost certainly try to perform a forensic analysis of the physical server. They undoubtedly will want to know how the server was accessed. If the hackers didn't use Tor or a similar anonymity service, the investigators may be able to collect clues from the IP address used to log in to the box.
So far, almost everyone downloading the torrent has been able to recover only 93 percent of the file. That's because the original seeder went dark and only one person appears to have downloaded the entire thing. That lone downloader also left the BitTorrent pool, leaving everyone else with only the partial copy of the original. Despite the download problems, multiple researchers have been able to unpack the file, titled noe.biderman.mail.7z. According to security firm TrustedSec, the 7z archive file leads to a 30-gigabyte file called noel.biderman@avidlifemedia.com_[Gmail]_All Mail.mbox that contains more than 200,000 e-mails taken from the CEO's Gmail account. In all, the e-mail includes about 6,800 unique senders and 3,600 recipients. The torrent was originally published late Friday night or early Saturday morning, after the archive errors included in an earlier BitTorrent made it impossible to unpack the e-mail file.In the few statements Avid Life Media has made public since the breach, company officials have vowed to vigorously track down and prosecute the people responsible. Ecatel promises to fiercely guard customer privacy and accepts anonymous BitCoin payments, so it's not clear how much success investigators will have. Still, if the people who seeded the BitTorrent left a Web interface wide open, there's no telling what other evidence they left behind.
Listing image by Rosa-Maria Rinkl.
Listing image by Rosa-Maria Rinkl
reader comments
152