Reports indicate that a hacker by name TheNeoBoss has been able to gain access to the administrative functions of Team Skeet, a porn website, and is selling a database that contains information about the users of the site. Allegedly, the database consists of email addresses, names, plain text passwords and physical as well as IP addresses of as many as 237,000 users. According to Motherboard, TheNeoBoss has posted an advertisement on the Dream Market, a dark web marketplace.
TheNeoBoss has also put up for sale on Dream Market a database that contains 50,000 login credentials belonging to other websites in the Paper Street Media, the broader porn network of Team Skeet. Other items advertised on Dream Market by the hacker include 426,000 failed login attempts and 468,000 Geo IP data of Members.
In an encrypted chat, TheNeoBoss informed Motherboard that the main reason behind hacking the website was to expose and publicly shame their poor practices. Last week, the hacker purportedly provided Motherboard with the data of 64 users as a sample. Fifty six of the 64 users seemingly had links with Team Skeet because when the names were reportedly tested, the message displayed by the site was “Sorry, the username is unavailable.” Subsequently, the hacker shared more data, as many as 8,000 credentials, with Motherboard. On checking, Motherboard found out that many of the names were linked to user accounts on the porn website. Additionally, a screenshot sent by TheNeoBoss indicated that he had the credentials of 237,000 users in his possession, but Motherboard was unable to confirm the same.
The usernames, advertised on Dream Market and purportedly linked to the accounts on Team Skeet website, seemed to work on a number of other websites that were part of the Paper Street Media network such as Exxxtra Small, Innocent High, Teen Pies, CFNM Teens and Teen Curves. According to Team Skeet’s website, members are given access to as many as 23 separate sites. Motherboard also observed that messages could not be sent to some of the email addresses and that the physical addresses of some of the users were not available in the sample data.
Though the legitimacy of the databases advertised on Dream Market has not been verified, TheNeoBoss is offering data for 0.962 bitcoins (about $400) on Dream Market. When contacted with sample user data, Jamal Hussain, Paper Street Media CTO, reportedly told Motherboard via email that the hackers breach is not a live one as the data belonged to the 2008 breach. According to him, the hacker demanded a ransom in 2008 which the site did not pay. Instead, the security updates were made and the site has not had any problems thereafter. He also noted that credit card information had not been stolen and that all of the accounts are not valid any longer for their members’ area.
According to Motherboard, Hussain also diverted all the comments to the company’s lawyer Steven Eisenberg who wrote in a mail addressed to Motherboard that Paper Street Media never blocks a username that is created on their site and that users cannot access the site once it expires. He also repeated what Hussain had said in his mail that the breach happened eight years ago and nothing came of it.
However, Motherboard confirmed that TheNeoBoss was able to deface the Team Skeet website for a short period of time on March 31. Reportedly, the hacker also sent several screenshots, which seemed to be that of the administrative panels of the porn network, to Motherboard. Motherboard also noted that the screenshots, which looked like customer support tickets, were for March 31, 2016, though Hussain said in another email to Motherboard that the website works with a high-quality security firm and has had no issues with any data breaches in the recent times.
TheNeoBoss said that he used an SQL injection, an established attack, to obtain part of the data advertised on Dream Market. He also noted that he sent warning messages to Paper Street Media as regards the security vulnerabilities of their websites and even enquired if they have run a bug bounty program. The hacker said that Paper Street Media didn’t reply to his mails at all.
The FBI has not provided any comments so far on the issue.