Robert Siciliano, a cybersecurity expert, discusses the Ashley Madison hack that exposed 9.7 GB of user data including profiles and payment information. The breach revealed intimate details about millions of users and raised questions about the site's encryption practices.
Chapters
After months of warning, Ashley Madison hackers made their threat solid and posted all of the site's secret user data. As we've been talking about, names, addresses, credit card numbers. So in total, 9.7 gigabytes of stolen data dumped on the so-called dark web. Cybersecurity expert Robert Siciliano with me now. He says several of his clients were involved. Robert, welcome. What are your clients— what is their reaction to this?
So, uh, not necessarily clients. I've been hearing from people on the web, people who have showed up after some of my presentations saying that they believe that their information is part of the breach. Phone, email, uh, in person. People that are obviously alarmed by this, wondering what the repercussions might be, wondering what direction they should take and the likelihood of their information being, you know, pulled out and exposed. And the reality of it is, at this point, more than likely you have others out there that are creating databases that are searchable so that any name, address, phone, even email and credit card number might be searchable at this point.
So is there anything from you, what you know, Robert, given that this threat was made a few months ago about the type of encryption, the type of security that Ashley Madison and the parent company were using? Do you have any reason to believe that the company should have stepped up? Its security?
Yeah, you know, there's always room for more security. Uh, there has been reports that, uh, the levels of encryption on the card numbers and other, uh, points of data was up to speed, but then it's also capable of being cracked. Uh, the reality of it is that, uh, the, the personal information, the private information that's being leaked, the profile information that might be related to the person's name and/or their email address, uh, that was like fetish type data, you know, what their interests are sexually. And that's really alarming to some people that that type of information that was only meant for certain people is now exposed to the world. And if that's actually connected to a person's real name and their real address, that could spell disaster for any relationships they may have.
And it seemed as if this Team Impact, which is the group of hackers, and I'm going to read right here saying, find yourself in here, the company failed you, lied to you, prosecute them. It's kind of a call to arms, almost almost like a civil suit here and claim damages, then move on with your life, learn your lesson and make amends. Embarrassing now, but you'll get over it. Apparently that is a message from this Impact team.
Yeah, and I don't really think that that message itself is, um, gonna console anybody whose information is being compromised, you know. And really, who are they to dispel that kind of advice? Uh, you know, they, they're talking about, uh, you know, the, the big bad company when in fact, you know, this is a criminal act and a lot of people are going to suffer as a result.
Well, to your point, the company did come out with a statement and say this is not a hacktivist event. It is, as you say, Robert, an aspect, or rather an event, of criminality. Robert Siciliano joining us there. He is the Hotspot Shield security expert.
