Plenty Of Fish Hacked – Chris Russo’s explains how he did it

http://grumomedia.com/plenty-of-fish-hacked-chris-russos-explains-how-he-did-it/

by domino • 15 years ago

144 99 15 years ago

nailer7• 15 years ago

This guy still sounds like a scumbag. He's complaining they responded to someone threatening to post people's private info by saying they'd post info on the person doing it? Boo-hoo.

If Chris wasn't going to post the info publically (ie, extort POF), then he had nothing to worry about.

As an observer this certainly doesn't make Mr Russo seem any better.

Edit: per below, removed work extortion as posting people's private data might be done for other reasons rather than to make money.

Tichy7• 15 years ago

I don't read anything about an extortion attempt (in this account), what am I missing?

I guess it is normal for a security firm to hope to gain some business by exposing security flaws (hey, we found a hole in your site, hire us to fix it). As this incident shows, it is not an easy business to be in...

nailer7• 15 years ago

That's true, the guy might just post the data to be an asshole, rather than asking for money.

Either way, the guy who was cracked is saying if the cracker posts the stolen data, he will post the cracker's contact details to every account. Which is completely reasonable.

bad_user4• 15 years ago

     If Chris wasn't going to post the info publically (ie, extort POF), 
     then he had nothing to worry about.

Considering that anybody can post that info anonymously and that the vulnerability used was there all along, if Chris is in fact innocent then he had plenty to worry about.

nailer7• 15 years ago

My understanding from reading the post is that the site owner would only publish Chris' private details if Chris published the private data, not someone else.

alnayyir• 15 years ago

Sorta what I asked for the original thread, but not any great details. More or less what I expected though.

I guess that'll have to sate my curiosity for now.

dekz• 15 years ago

because there was a serial killer, murdering people from the website.

err what?

Tichy7• 15 years ago

I have to say, from the writing alone Chris Russo sounds a lot more confidence inspiring than the POF people. That long rambling blog post by POF did not come across as very professional.

leppie2• 15 years ago

Both posts are rather comical and infantile. Drama all the way, serial killers and Russians. Techno soap.

babo• 15 years ago

http://www.gather.com/viewArticle.action?articleId=281474976...

tyng• 15 years ago

I wonder where the discussion of "murderer" or "Russian mafia" first came up, seems totally unrelated to the incidence and random for anybody to bring it up first. Could be some kind of pronunciation miscommunication like "member" -> "murderer"

d0mine• 15 years ago

To discover a security vulnerability (Chris Russo's POV) in a site and to hack a site (POF's POV) are different things.

  POV - point of view

grumo2• 15 years ago

You are right and I changed the title of the post to "Plenty Of Fish Hacked - Chris Russo explains what happened" instead.

cheeky• 15 years ago

I'm pretty amazed that in this day and age companies still store sensitive information like user passwords and credit card numbers in plain text.

coenhyde• 15 years ago

IMO storing this kind of information in plain text was never acceptable. It requires the right combination of arrogance and incompetence for this to happen.

mgkimsal• 15 years ago

In some ways it's no wonder POF was able to bootstrap and run this amazingly large system all written by one guy with limited hardware. Dunno what their stats (or headcount) are now, but years ago POF was heralded as some genius site because it was all put together by one guy and running on a few load balanced servers.

I'm not saying it takes multiple people to make something secure, but if one person either doesn't have the experience or knowledge to make something secure, and there's only that one person, there's no one else to even determine there's a problem.

getsat• 15 years ago

This appears, unfortunately, to be the norm and not the exception. It comes to mind every time I sign up on a new service.

Obligatory: http://codahale.com/how-to-safely-store-a-password/

smokinn• 15 years ago

Not only does POF store it in plaintext but they email it to you every few days when they send you their "new matches" email. So basically they're sending probably about 1/4 of their member base's passwords in the clear over the internet every day through those emails.

rmc2• 15 years ago

I know how and why you should store hashed passwords, but surely you'd have to store credit card numbers in plain text? If you store a hashed credit card number, you'll be unable to charge it again? How do you use a hashed credit card number?

aeontech• 15 years ago

Ideally, you don't store credit card numbers at all. If you need to do recurring billing, there are platforms that will do it for you, otherwise, process the transaction and remove the number from your system. Storing this kind of info securely and in PCI compliance is not trivial, and takes engineering resources that are better used on something that will distinguish your product from competition.

jcampbell13• 15 years ago

> By the nightfall of Sunday 30, Mr. Markus Frind sent me an email accussing us to steal his whole user database without a single proof, based on supposed information that "20 employees of him told him.

This fellow is either a fool or a terrible liar. If he didn't take the data then he would have said "I didn't steal the data". He instead accuses Markus of a lack of proof.

bad_user4• 15 years ago

Lack of proof == credible, since the burden of proof is on the accuser

"I didn't steal the data" == my word against yours

jcampbell13• 15 years ago

There is no burden of proof in the court of public opinion. There is no 5th Amendment either.

Imagine this scenario, your boss says to you: "20 of our employees are telling me you piss on the toilet seats."

You respond, "You have no proof".

Good luck with that.

chc• 15 years ago

So then you look at whose word seems more reliable. It would be very weird if all of Markus' employees plus one of his competitors made this crap up. It would be much less so if Russo were trying to avoid the repercussions of his actions.

lallysingh• 15 years ago

... unless "lack of proof" is a common phrase in his native language. He may of meant something closer to "has no basis" for all we know. Nuances shouldn't be analyzed with English this bad.

razzaj• 15 years ago

hmmm this really looks like a complicated matter to judge with the available information. Really there are several plausible scenarios where POF or Chris could be at fault. The information available to the public is not enough to make an informed judgement. Everything else is pure speculation or pure DH0 (as per Paul Graham's disagreement hierarchy).

For what we see now, it is clear that POF people were scared shitless from the report (obviously) and tried to limit the damage and gain time by manipulating Chris whom they thought has downloaded all their users data and is extorting them against the disclosure of this data. I think anyone in their shoes would think the same (at least primarily).

Now wether Chris really intended to extort them or not is another matter we cant judge from what we are seeing. He does seem like a nice guys from his emails, and kind of excited about the "opportunity" but really that is not enough. Nice people sound nice... so do most criminals.

One more thing that is unclear ! Was POF actually hacked (in the sense that data was leaked) or was it just that a vulnerability got exposed? I think this will tell us a lot as well about the real motivation of the "hacker".

latch3• 15 years ago

Wherever the truth lies, which in my mind is much closer to Frind's side, an SQL injection attack, in 2011, on an actively developed site, using modern day technology, is pathetic.

I've tried to come up with analogies that explain how people can write systems without actually knowing how to program. Something like, just because I know how to make nachos or pancakes doesn't mean I'm a cook. This is the type of stuff I'm talking about though. You can know about if statements, variables and even fancy classes...you can put it all together and build a system and be hugely popular, but it doesn't mean you are any good at programming.

Duct tape programmers indeed.

eli• 15 years ago

So... blame the victim? Really?

Kudos2• 15 years ago

Why not, when they are being completely irresponsible with millions of people's data?

law• 15 years ago

The victims are the users who mostly lack the technical fortitude to realize the perils of using a single user identifier/password combination across many different sites. The amount of identity theft that could occur by dint of PlentyOfFish's absolute carelessness renders them just as complicit in wrongdoing as the attackers who shed light on the problem. To call POF a 'victim' is absolutely wrong.

madaxe2• 15 years ago

They're not the victim - they're guiltier than anyone who grabs their customer data.

When you provide an online service that gathers consumer information - particularly sensitive consumer information (such as that which you might find on, say, a dating site), it's your responsibility to secure it. If you get hacked, it's your fuck-up, your responsibility, your culpability.

And no, that's not my opinion, it's objective fact - read, for instance, about PCI DSS, and the associated very steep penalties for information leakage.

latch3• 15 years ago

I find it interesting that my original comment started at -3 and is now +7..and that the "so blame the victim" went to +3 and is now at -1. Not sure why I find it interesting, but dang it'd be nice to see who up/down votes.

podperson• 15 years ago

"an SQL injection attack, in 2011, on an actively developed site, using modern day technology, is pathetic"

You left out -- stores passwords in plain text.

andrewvc3• 15 years ago

Pof has to store passwords in plaintext, sine they include it intentionally in a weekly email reminding you to login.. Yes. I know.

At any rate, anyone who has actually used pof can tell its been hacked together by substandard developers. No polish, a bizarre ui, and just general weirdness. This is the kind of shodiness I'd expect.

mdaniel2• 15 years ago

Hey, now ... I bet a lot of banks do it, so it must be okay. :-/

Between that, and mandating short passwords, which a LOT of banks do. :-(

iPadDeveloper2• 15 years ago

There are lots of programmers out there who do a fine job, they are just clueless about security.

For companies that have programmers that work great, but aren't security experts, it's time to hire security experts.

Suggesting that all the work the programmers did is worthless because they aren't security experts is seeing the world as black and white. It's gray my friend.

leon_2• 15 years ago

> There are lots of programmers out there who do a fine job, they are just clueless about security.

Yeah, there are lots of mechanics out there who do a fine job. They are just clueless about breaks ;)

Stupid analogy aside: If you as a programmer who develops stuff for production are not aware of rules like "NEVER EVER FUCKING TRUST ANY USER INPUT" then you're just wrong for the job.

T-hawk2• 15 years ago

There are also lots of programmers who are clueful about security, but work for clueless managers or organizations. I've had many a conversation that went like this:

"Okay I put together this prototype and it's working. I should check it over for SQL injection spots and---"

"StoptalkingnotimeforthatSHIPITNOW!"

raphar• 15 years ago

The problem now is that with all this noise, POF is certainly going to be hacked. Others will want to follow Chris path.

POF founder habilities are going to be tested in the media arena and in the technical arena at the same time. Also lets see how he manages the customers & the legal side. Hard!

dexen• 15 years ago

Calling author(s?) of POF `duct tape programmer(s)' does harm to jwz (http://www.joelonsoftware.com/items/2009/09/23.html)

They (people who don't actully know how to program) can build a large system on a shoestring budget exactly because they don't know how to build it properly, or how hard it is to. No distractions over those pesky little matters like ACID properties, security, accessibility, etc. etc..

Because those are a major part of what slows programs developed by professional developers.

No distractions, no slowdown, until a security consultant mails you a proposition you can't easily refuse. The hackers Mr Chris Russo alleges were exploiting the hole did it quietly (if at all), for obvious reasons. Nobody knew, nobody cared until now. Several years of good business, right? And free publicity now, isn't it?

_b8r0• 15 years ago

To call these people Duct tape programmers because of one SQL injection weakness is somewhat unfair. Writing code isn't hard. Writing code that works is harder. Writing code that's bug free is very hard. Writing code that is not only functionally bug free but non-functionally bug free (including security as a non-functional requirement) is ridiculously and ludicrously hard.

It's only because some frameworks do 90% of the heavy lifting (and parameterised queries for the 5 extra percent that's not covered) that we don't see SQL injection as much as we used to.

This week it was PoF. Previously it's been Twitter, Facebook, even HN. Are the people behind these Duct tape programmers?

I'm going to touch on how hard security can be in my talk at http://www.meetup.com/HNLondon/ - if there are any London-based HN readers that are going, I look forward to seeing you all there.

drstrangevibes• 15 years ago

in any case epic fail at damage limitation by all involved

markessien4• 15 years ago

Frankly, Marcus does not sound like he is very computer Saavy. He sounds like one of these people who knows how to write some PHP scripts, but does not really understand the details of what goes on behind it - so assumes that what this guy is doing is some terribly complicated hack.

I think the argentine guy probably searched the website for vulnerabilities as a way to get business. He found one and contacted Marcus. Marcus then freaked out and panicked, leading to this.

grumo2• 15 years ago

Marcus taught himself ASP.net http://plentyoffish.wordpress.com/2006/06/14/how-i-started-a... His story is pretty remarkable considering POF was a one man operation until recently.

markessien4• 15 years ago

ASP.net is just Visual Basic. It's not the most complicated language to learn, and you don't need to know much about computers to develop in ASP or VB.

burgerbrain• 15 years ago

I don't care if he taught a cat to fish for tuna, he fucked up big, and in a bad and trivial way.

dotBen• 15 years ago

POF is hardly a great example of superior software engineering. The whole point of POF is really affiliate lead generation for other off-network dating sites.

tptacek2• 15 years ago

Am I reading this right? Are both sides of this story intimating that the security guys found a vulnerability in the site, published it, and then pitched them a consulting gig? Go live with something or not, pitch a gig or not, but I'm not sure you can have it both ways without looking skeezy.

jbrennan• 15 years ago

I'm not surprised PlentyOfFish was hacked in the least. I signed up at one point and the password entry form wasn't even obscured. That was my first red flag. So I made sure to use a throwaway password.

But it got worse. Every few days, POF started sending me newsletters with my password in plaintext! "in case you forgot, your password is:...." in addition to whatever else the newetter said. So I knew they were storing passwords in plaintext.

Couple those things with the complete unusability of the site…well I deleted my account (which is unsurprisingly difficult to do as well).

leon_2• 15 years ago

Wow, I don't know whom to believe. But it's 1a drama. And I love drama :)

gbrindisi• 15 years ago

Maybe relevant: http://www.reddit.com/r/netsec/comments/f647p/i_found_a_seri...

PonyGumbo2• 15 years ago

Wow. I just read the Inc Magazine article about this guy from 2009: http://www.inc.com/magazine/20090101/and-the-money-comes-rol...

Highlights:

1. The site makes $10 million/year. 2. He has three employees, all customer service. He does everything else. 3. He pays himself $5 million/year.

This quote is particularly telling: "At other sites, when one thing goes slightly wrong, the reaction is to buy more servers or hire a Ph.D.," he says. "It's almost unbelievable -- it's like people are trying to justify their jobs by spending money. This isn't rocket science."

david_shaw• 15 years ago

Nothing, including all of the justifications for the terrible security practices, should excuse Marcus Frind for the death threats and sheer hatred being thrown at the messenger.

Chris mentioned that this was actively being exploited by malicious hackers. Taking your rage out on the guy trying to help is not appropriate by any means.

Plenty Of Fish Hacked – Chris Russo’s explains how he did it

Related Stories