Catch up on stories from the past week (and beyond) at the Slashdot story archive

 


Forgot your password?
Close
typodupeerror
×

Massive Porn Buyer Info Leak 251

Posted by Zonk from the get-off-the-internet-this-is-a-sign dept.
Anonymous Guy wrote to mention a Wired article that covers the release of information for millions of customers onto the Internet. From the article: "The stolen data, examined by Wired News, includes names, phone numbers, addresses, e-mail addresses and internet IP addresses. Other fields in the compromised databases appear to be logins and passwords, credit-card types and purchase amounts, but credit-card numbers are not included. The breach has broad privacy implications for the victims. Until it was brought low by legal and financial difficulties, iBill was a top credit-card processor for adult entertainment websites."
This discussion has been archived. No new comments can be posted.

Massive Porn Buyer Info Leak More

Massive Porn Buyer Info Leak

Comments Filter:

  • Weakest Link (Score:4, Interesting)

    by nmccart ( 952969 ) on Thursday March 09, 2006 @03:57PM (#14885028) Homepage
    It's not surprising someone other than MasterCard actually had a list of card numbers stolen. I have customers all the time tell me how they don't like what they feel are draconian measures to protect the credit card numbers people have in their own systems. What they fail to understand is that Visa and Mastercard require us to do this, and the protections we have are customer service.

    But they still complain, because their customers and they themselves don't ever notice. Hell at one point I was told by a demanding customer to remove the protections because he said "I'll risk it." I was tempted to show him how insecure he was by remotely accessing his system, getting his list of customer phone numbers, and telling all his customers that he was careless with credit card numbers and their numbers could have easily been stolen from his system.

    People are pretty careless about credit card security. It's usually in the name of convenience and visible customer service. Credit card security is invisible service. Being able to purchase something conveniently flies right in the face of having security which just might prevent you from selling something to someone, so some people don't care, as long as they are selling. Owners care once they find out that they'll be issued chargebacks, but individual salesreps will write down every credit card number on a piece of paper if it means making money for them personally.

    Visa and Mastercard have the right idea, and in the press release I like how they said that they gave cardsystems a "limited amount of time" to basically get their act together so this doesn't happen again. Education and enforcement of regulations... nice to see an organization, especially one that is a corporation, actually give a damn.

    • Re:Weakest Link (Score:5, Informative)

      by frostyboy ( 221222 ) <benoc@[ ]m.mit.edu ['alu' in gap]> on Thursday March 09, 2006 @04:13PM (#14885166) Homepage

      Dude, RTFA. They didn't get the credit card numbers. Only personal information like name, phone number, address, email. Not that that's not a big deal, but this isn't a CC number security issue.

      Of course, this isn't made clear until way at the end of the article: "Because the information didn't include Social Security, credit-card or driver's-license numbers, no U.S. laws require iBill or the companies for which they provided billing to warn victims."

    • Re:Weakest Link (Score:5, Informative)

      by Alex P Keaton in da ( 882660 ) on Thursday March 09, 2006 @04:13PM (#14885170) Homepage
      Um, anytime I buy something "questionable" or from a questionable source, I use a one time credit card number. I know MBNA has this. You set a dollar amount for the number, as well an expiry date. It is great for sites with auto renewing subscriptions. I use them all the time for 3 day 1.99 trials. I set the card limit at 2.50, use the number, and then forget about it. When they try and charge me, they get nothing but an expired card.
      My understanding is that most identity theft is still done the old fashion way- with garbage diving etc. When I was in college, I bartended. I could have easily written down every credit card number that was handed to me....
      But clearly this is more of a privacy issue. Even if nothing is stolen from me, I would prefer that my name not be associated with porn purchases. But then again, who am I kidding, everyone that meets me just assumes I am into porn. I guess it is my vibe.
      • Um, anytime I buy something "questionable" or from a questionable source, I use a one time credit card number. I know MBNA has this. You set a dollar amount for the number, as well an expiry date.

        Some credit companies have even released the equivilent of a mobile phone top up card for credit cards. You purchace credit, which has a built in expiry date, and simply purchace online before it runs out. The card is reusable.

        They are designed primarily for online purchaces, but personally I feel this method will

      • Re:Weakest Link (Score:5, Funny)

        by dusik ( 239139 ) on Thursday March 09, 2006 @05:54PM (#14886130) Homepage
        >> "But then again, who am I kidding, everyone that meets me just assumes I am into porn. I guess it is my vibe."

        It's because you say things like "I use them all the time for 3 day 1.99 trials". ;-)
      • You're into porn and compulsively click links in sigs?

    • I don't think it was stolen. (Score:5, Interesting)

      by eldavojohn ( 898314 ) * <eldavojohn@noSpAM.gmail.com> on Thursday March 09, 2006 @04:15PM (#14885182) Journal
      After all, the article said that no pieces of information were stolen that required them (by law) to inform their customers. Pretty convenient, eh?

      I also noticed that they're from Deerfield Beach, Florida. Now, something odd about Deerfield Beach is its location [google.com]. It's on the coast of Florida there. That unmarked island on the east side of the map? That would be Grand Bahama. Care to take a guess at what country it lies in?

      So my guess is that the company did this legally and by choice. They probably found some bum on the street who didn't ask questions and would like to recieve a paycheck. He's probably also the president of the company with very limited responsibilities and capabilities. They're also probably prepared to give him a briefcase full of $100,000 and a boat to take to Freeport. And also some cute documents for him to sign that might as well say that he shot JFK.

      Meanwhile, all the workers and people profiting off the deal claim they had no knowledge.

    • Re:Weakest Link (Score:3, Insightful)

      by wkk2 ( 808881 )
      The theft of card data won't stop until both the merchants and card issuers incur sufficient liability to wake up and make changes. 1. It should be illegal for merchants to store card numbers after an approval code is received. Buyers should be required to resubmit their card number for new transactions and refunds. It's not that big of an inconvenience to reenter numbers. 2. Reoccurring transactions should be process by submitting the card number to the merchant. The merchant should in turn apply for a

      • Re:Weakest Link (Score:3, Informative)

        by monkeydo ( 173558 )
        In the US, the merchant and the issuer incur all of the liability for stolen card numbers. As long as the card holder reports unauthorized charges to the issuer within a reasonable time of becoming aware of it, his liability is zero. Credit card fraud costs the issuers abotu $10 Billion annually. Sure, they'd like to reduce that number, but they know that ever dollar of fraud they prevent costs them $/x. When they reach a point of diminishing returns, there will still be some fraud.

  • Quite Humorous (Score:5, Interesting)

    by eldavojohn ( 898314 ) * <eldavojohn@noSpAM.gmail.com> on Thursday March 09, 2006 @03:57PM (#14885029) Journal
    From the frontpage of iBill [ibill.com], they have their most recent news as:
    Internet Billing Company, LLC (iBill) announced that the relocation of their corporate headquarters to more cost-efficient facilities has been completed.
    Even after looking around, I can't determine where this move was to. Their contact info on the site lists Deerfield Beach, Florida as their location. Is it possible they moved all their transaction servers to a different country to avoid possible legal implications?

    If you care to read more about iBill, you can check out their blog on G Spot [xbiz.com]. I didn't link the blog because it's not about the company; it's about trading buyers across all of its customer sites.

    I wonder if this is a case of the company selling anything they could to escape dire financial straights or if it is the case of a disgruntled underpaid employee indulging.

    Am I surprised such a shady company had its user's credit card info traded on the black market? Gosh, not really.

    • Re:Quite Humorous (Score:5, Funny)

      by SleepyHappyDoc ( 813919 ) on Thursday March 09, 2006 @04:30PM (#14885317)
      "More cost-efficient facilities"? Did they just skip all the steps and set up their headquarters in a federal prison?
      • That comment isn't so funny when you think about it.

        Prisons provide cheap work programs to businesses so that they can keep the prisoners busy. Some of these programs involves things like processing credit card orders and doing data entry.

        This particular link [ncl.ac.uk] is from 1991, but it was one of the first that popped up in Google. AFAIK, it still goes on in various prisons.
    • Is it possible they moved all their transaction servers to a different country to avoid possible legal implications?
      Unless their lawyers are total idiots (or graduates of the Ask Slashdot School), they'd know better. Having your servers offshore does you no good if you still have a local physical presence. And I can't see a company that has to deal with so many U.S. banks being located outside the U.S.
    • Actually they owe adult webmasters [from my understanding] several million dollars in held funds (they process CCs, then pay out to webmasters after X days.. well, they just didn't pay out). So now they keep bouncing around until they're finished. Steer clear.

  • Time for an Open Porn Movement (Score:5, Funny)

    by RedHatLinux ( 453603 ) on Thursday March 09, 2006 @03:58PM (#14885034) Homepage
    After all, free, as in beer, porn, means never have to worry having identity stolen or saying sorry to wife.

    Plus, given the bottoming out production costs, we can easily produce porn of the same quality as closed source porn.

    • Time for an Open Porn Movement (Score:5, Funny)

      by AnonymousPrick ( 956548 ) on Thursday March 09, 2006 @04:07PM (#14885115)
      I suggest that the open-porn should be stored on "Freshmeat".

      • Darn that name (Score:3, Informative)

        by phorm ( 591458 )
        As an admin at my previous job, I often searched SF.net and freshmeat for open-source/free solutions. At one point, our ISP's caching filter decided to regularly boink the freshmeat site, which resulted in the site autobanning one of the upstream routers.

        It was a really fun thing trying to explain to the ISP person why they should put in an caching exemption for a site called "freshmeat", and what the actual content of said site was.

    • That's what I don't get... (Score:4, Informative)

      by Anonymous Coward on Thursday March 09, 2006 @04:10PM (#14885148)
      What kind of moron buys porn? Hello? IT'S FREE ON TEH INTARWEBS, and especially on Usenet. There are people who literally get off on making and distributing porn of all varieties at no cost. They want you to watch.

      Unless your idea of hotness is overproduced Playboy-style photography with a combination of four different skin textures, three different lighting rigs, and sixteeen different gauze filters, you can get what you want on Usenet without risking your credit history.
      • I had an ex-girlfriend once, who I still kept in contact with for some reason, who broke up with her then fiance because he charged $500 of Pr0n onto her debit card. Not credit card, debit card! Besides the obvious "What a Tool!" At the time I remeber thinking "Wow, that is a lot of real money to spend on something I can find just laying around on the web". This was in the early days of P2P and bittorrent wasn't even on the scene yet and still you could bairly do a search on the web without some offer fo
      • What kind of moron buys porn?

        Same kind of moron who pays cash for some semi-naked woman to dance in front of him!

        I mean, you gotta make a chick work for sex!

    • Plus, given the bottoming out production costs, we can easily produce porn of the same quality as closed source porn.

      So: zlib Licence if you just want it known that "it really is my arse"; GPL for those who want it all kept out in the open; and BSD only if you're into that sort of thing?

    • Which means we would need free, as in beer, porn stars. Kickass!!

  • "Interesting" headline. (Score:5, Interesting)

    by XorNand ( 517466 ) * on Thursday March 09, 2006 @03:58PM (#14885036)
    "Massive Porn Buyer Info Leak?" What the hell does that even mean? Hats off to Zonk for managing to use "porn", "leak", and "massive" all in the same headline and posting it to one of the most widely read sites on the net. That sound you hear is thousands of RSS feed subscribers all scratching their heads.
  • A sudden surge in the filing of divorces is plaguing thousands of local communities...

  • Oh crap... (Score:5, Funny)

    by eln ( 21727 ) on Thursday March 09, 2006 @03:59PM (#14885049)
    They didn't do credit card processing for midget-granny-and-horse-porn.com did they?

    I mean, not that it would matter to me if they did...I'm just curious.

    • Re:Oh crap... (Score:5, Informative)

      by BenEnglishAtHome ( 449670 ) on Thursday March 09, 2006 @05:40PM (#14885982)

      They didn't do credit card processing for midget-granny-and-horse-porn.com did they?

      No, but they did do credit card processing for sites featuring under-18 models doing "non-nude" work. Within the past couple of weeks, a group of those sites got busted and the FBI has announced intentions to prosecute them for selling child porn even though the models were clothed. (It seems the clothes were too small and/or the poses too racy.) Note that I don't know if any of the recently busted sites were using iBill and the point may already be moot since iBill has been defunct or close to it for a while.

      However, according to TFA

      The stolen data, examined by Wired News, includes names, phone numbers, addresses, e-mail addresses and internet IP addresses. Other fields in the compromised databases appear to be logins and passwords, credit-card types and purchase amounts, but credit-card numbers are not included.

      I have to figure if logins and passwords are there, then the websites accessible via those logins might also be in the data. If so, I imagine that at this moment a whole bunch of guys are pretty worried.

      • Probably not. It sounds like a relational database, and what was leaked was the 'consumer' table. The actual details of the websites (the 'content provider' table, which was probably extensive, including principals, addresses, accounting information) were almost certainly a one-to-many relationship with the 'consumer' table

  • No Baby! I swear it wasn't me! (Score:5, Funny)

    by darth_MALL ( 657218 ) on Thursday March 09, 2006 @03:59PM (#14885052)
    It was the other Chester J. Winthrop-Montague III!

  • Whew, that was too close (Score:5, Funny)

    by LunaticTippy ( 872397 ) on Thursday March 09, 2006 @03:59PM (#14885055)
    I'm sure glad I've never paid for internet porn.

    Now if they leak the hardon pill database I'm screwed...

  • Internet IP addresses? (Score:4, Funny)

    by Anonymous Coward on Thursday March 09, 2006 @04:00PM (#14885058)
    Internet IP addresses?
    Well, as long as they didn't get their PIN numbers.

  • Wait a second... (Score:5, Funny)

    by ENIGMAwastaken ( 932558 ) on Thursday March 09, 2006 @04:00PM (#14885060)
    You can BUY porn? News to me.

  • This Could Be Quite Damaging! (Score:3, Funny)

    by Anonymous Coward on Thursday March 09, 2006 @04:03PM (#14885080)
    CUSTOMER
    --------
    Bill O'Reilly
    bill@billoreilly.com

    WEBSITES
    --------
    falafelpron.com
    hotfalafels.com
    teenfalafel.com
    • Just wait til they find all the high level Washington folks in there. One of the interesting things about groups like Hiedi Fliess and this, is that we will find that Liberals and Conservatives alike visit the same place and sadly in about the same number. Only one of them condemms it though.

  • Well thank God I never pay for porn... (Score:5, Funny)

    by R2.0 ( 532027 ) on Thursday March 09, 2006 @04:03PM (#14885086)
    Wait...did I just type that out loud?

  • If... (Score:3, Interesting)

    by Anonymous Coward on Thursday March 09, 2006 @04:05PM (#14885101)
    If we used a decentralized, anonymous digital cash system, these kinds of problems would be much less common. Furthermore, the responsibility would lie in your own hands rather than in the hands of thousands of unidentifiable people at some corporation.

    I suppose it's wishful thinking, though, because everybody wants to be the central financial gateway (Visa, Mastercard, Paypal, etc.) and governments prefer being able to track all transactions (toll booth transponders, bankers reporting all transactions over $10,000, etc.).
    • Hmm, I guess you're talking about something like Mondex [mondex.com]. Unfortunately, it hasn't seen much of any implementation in North America because it is simply way too expensive to deploy the terminals and electronic wallets to make these sorts of electronic cash transactions.

    • Anonymous digital transactons won't be allowed (Score:4, Interesting)

      by AHumbleOpinion ( 546848 ) on Thursday March 09, 2006 @04:40PM (#14885389) Homepage
      If we used a decentralized, anonymous digital cash system, these kinds of problems would be much less common ... I suppose it's wishful thinking ... governments prefer being able to track all transactions.

      Exactly. You are more likely to see secure computers and honest people than anonymous digital transactions. Governments won't allow it. And no you do not have a US Constitutional right, quite the contrary, the US government has the Constitutional power to create currency, collect taxes, define felonies (say money laundering) and pass enacting legislation, etc.

  • Where do I buy? (Score:5, Funny)

    by RobertB-DC ( 622190 ) * on Thursday March 09, 2006 @04:05PM (#14885103) Homepage Journal
    In January of last year, iBill was purchased by Interactive Brand Development for $23.5 million. On Monday, IBD's stock [yahoo.com] closed at 8 cents a share in over-the-counter trading.

    8 cents a share? Nowhere to go but up! Time to call my broker*.

    At the very least, their certificate will look good on the wall, next to the one from Enron. Maybe really good -- or really bad -- depending on which of their subsidiaries did the artwork. According to the Yahoo Finance link, "IBD also owns a library of original cartoon cel art (including He-Man, She-Ra, and Flash Gordon) [and] a 35% stake in Penthouse publisher Penthouse Media Group."

    *Disclaimer: I don't have a broker.

  • Freakin' Sweet (Score:5, Insightful)

    by GabrielF ( 636907 ) <GJFishman AT comcast DOT net> on Thursday March 09, 2006 @04:05PM (#14885105)
    Other fields in the compromised databases appear to be logins and passwords

    Woohoo! Free porn for everyone!

  • More material for late night talk shows (Score:3, Insightful)

    by ScooterBill ( 599835 ) * on Thursday March 09, 2006 @04:07PM (#14885114)
    I think it's kind of funny. My wife isn't really in on my porn habits but she isn't stupid and knows that sometimes her hubby isn't just "defragging the hard drive" in the basement.

    The funny part is when we get to see the "questionable" surfing habits of some famous self-righteous fundy preachers. I love it.

    Of course, it wouldn't be so funny if the entire credit card info got released...
  • I guess it's a good thing that sex-starved geeks don't look at porn, huh?
  • They have names, addresses and phone numbers but no credit card numbers or social security numbers. Isn't this basically the same information you can find in the phone book?

    About the only thing one can do with this information is crank calls and spam.

    Big deal.

  • Still Online? (Score:5, Interesting)

    by NoData ( 9132 ) <<moc.oohay> <ta> <_ataDoN_>> on Thursday March 09, 2006 @04:09PM (#14885137)
    FTFA:
    Last month, Sunbelt Software found an additional list of slightly over 1 million individual entries labeled Ibill_1m.txt on a spamming website. That list appeared to date from 2003.

    Hmm.

    http://www.google.com/search?q=Ibill_1m.txt [google.com]
    [TXT] Ibill_1m.txt 08-Jun-2003 03:49 214M
    Thaaaat doesn't look good.

  • I feel a great disturbance in the Force..... (Score:4, Funny)

    by 8127972 ( 73495 ) on Thursday March 09, 2006 @04:12PM (#14885159)
    .....as if millions of computer geeks had cried out, and then became silent.

  • Know Your Congress (Score:5, Funny)

    by Doc Ruby ( 173196 ) on Thursday March 09, 2006 @04:12PM (#14885161) Homepage Journal
    grep -i 'senator' iBill.dat; grep -i 'representative' iBill.dat ; grep -i 'congress' iBill.dat
  • Or, would anyone want to go through that kind of lawsuit?
  • A year after the FBI first learned of the larger leak, they have also failed to issue any public warnings.

    Yeah, because it's porn related. You can bet if this happened to Disney online they'd be maxim publicity.

  • What we need (Score:4, Interesting)

    by lildogie ( 54998 ) on Thursday March 09, 2006 @04:25PM (#14885270)
    What we need is for the name of some elected official(s) to be found in the data.

    Then we'll see swift lawmaking action to clamp down on leaks of personal information by merchants and money-handlers.
    • We need some of the anti-pr0n crusading wingnuts in congress to be caught with their own pr0nsite subscriptions...

      The first thing they'd probably do is hunt down the info-leaking merchants with a vengeance.... but it would also be nice to see how such things fit with their anti-pr0n crusading.

  • So even those who give a f*ck ... (Score:4, Funny)

    by AHumbleOpinion ( 546848 ) on Thursday March 09, 2006 @04:25PM (#14885273) Homepage
    So even those who give a f*ck, who bend over backwards for their customers, who do all that is humanly possible, don't get security right. ;-)
  • From TFA:

    The 41-year-old San Diego man says he allowed a "business partner" to use his credit card on an adult website dedicated to finding resources in Tijuana's red light district, with discussion groups and locations of prostitutes.

    Right... a business partner...

  • News for Nerds... (Score:5, Funny)

    by jon.wolf ( 938920 ) on Thursday March 09, 2006 @04:32PM (#14885337)
    If ever a story qualified as, "News for Nerds. Stuff that Matters." -- this is it.
  • Pete Townshend has applogized in advance for anything he may have been caught for ....
  • As long as they don't reveal my (rather embaressing) taste in porn.

  • This is also used by the Washington Post (Score:3, Informative)

    by kalidasa ( 577403 ) on Thursday March 09, 2006 @04:42PM (#14885409) Journal
    I know, I had a little scuffle with them last week because I couldn't change my CC# on my Washington Post Online subscription. So not all the names are pr0n buyers.
  • How about information of people whose credit card number was fetched from insecure software, like Microsoft IIS? Somehow I doubt that iBill would have removed those people from their database.

  • Heres the actual list.... (Score:5, Informative)

    by XMilkProject ( 935232 ) on Thursday March 09, 2006 @04:44PM (#14885435) Homepage
    You can actually download this 214mb list of information here:
    http://5sec.us/Ibill_1m.txt [5sec.us]
    I don't know why you'd want it, maybe you can use the passwords or something. But there it is anyway.

  • Everyone seems to be forgetting... (Score:5, Informative)

    by Psykosys ( 667390 ) on Thursday March 09, 2006 @04:46PM (#14885449)
    that an estimated 25% of the transactions weren't for porn. Unless the customer information is associated with the purchase information (it sounded to me like the account axx infomation was in separate, unlinked records), the leak has much fewer social implications than commenters here seem to be implying.

    Livejournal, for example, was offering payment through iBill [livejournal.com] during the time covered by the leak (run that link through Archive.org if you care to verify, /. filters the part following the asterisk).

    • And suddenly the number of people claiming to read LiveJournal climbs through the roof.

      "Each copy must be getting read by several thousand people, if that is the case", said the circulation manager of LiveJournal. "Perhaps we should put our membership list on the web next week ... hurry up, folks, you just have time to subscribe right now."

      And in the Congress lobby this week, the biggest topic in conversation was "Did you see that article in LiveJournal..? I read it all the time."
  • For a long time, I've been thinking that a centralized IP database would be extremely useful. You know the big retailers and sites like Google cherish this info. This list could be very helpful towards those ends. A name and address cross-referenced with an IP address? That's hot in the data mining business.

    I sure hope someone posts the list. They should put up a site where you can type in an IP and get a name and address. VERY, VERY useful in cases where you're getting spam from zombied PCs or someon

  • Well, that explains why I'm getting more spam... (Score:3, Informative)

    by sstamps ( 39313 ) on Thursday March 09, 2006 @05:39PM (#14885974) Homepage
    I was a subscriber to the MMORPG Horizons, which used to use iBill as their payment processor (they use iPay now; not much of a difference, really). I used new mail accounts I set up specifically for the game, and all of a sudden, about a month ago, I started getting tons of spam on them.

    I figured my email addresses had been sold by one of those sleazebag payment processors. Turns out they aren't evil, they're just STUPID.
    • I just did a search of my old, old emails, and it looks like usenet-access.com used iBill as well (back in the day, I downloaded DreamCast backups).

      In my case, every piece of information in the database entry is wrong (according to the email I found from the original purchase), since I've moved four time since I bought the account.

      Hmmph. I'm in the same boat as you. This sucks.

  • IP adresses? (Score:5, Funny)

    by JThundley ( 631154 ) on Thursday March 09, 2006 @07:08PM (#14886808)
    "The stolen data, examined by Wired News, includes names, phone numbers, addresses, e-mail addresses and internet IP addresses."

    So it included the internet internet protocol addresses? I keep my internet IP address next to my PIN number at the ATM machine.

Slashdot Top Deals

Understanding is always the understanding of a smaller problem in relation to a bigger problem. -- P.D. Ouspensky

Close