Over 412 mn accounts on FriendFinder Networks hacked

LeakedSource, a popular breach notification website said more than 412 million accounts on dating and entertainment network FriendFinder Networks had been exposed, for the second time in two years.

The websites that had been breached included adultfriendfinder.com, described as the "world's largest sex and swinger community," accounting for more than 339.7 million of the 412 million accounts exposed, LeakedSource said yesterday.

Other network sites similarly affected included cams.com with 62.6 million exposed, penthouse.com with 7 million, stripshow.com with 1.4 million, icams.com with about 1 million. There was also an unidentified website which added 35,372 to the number of users whose accounts were exposed.

The hack occurred in October through a local file inclusion vulnerability on FriendFinder Networks which was reported around the same time by a researcher. Soon after the vulnerability was exposed, the researcher, who used the Twitter handle 1x0123 and who was also known as Revolver, stated on Twitter that the issue was resolved, and ''...no customer information ever left their site,'' according to www.csoonline.com's Salted Hash.

FriendFinder confirmed to ZDNet that it identified and fixed a vulnerability that ''was related to the ability to access source code through an injection vulnerability." 

LeakedSource reported that Friend Finder Network had stored their user passwords in plain visible format, or with Secure Hash algorithm 1 (SHA-1), which was not considered secure. ZDNet which had obtained a portion of the database and confirmed its legitimacy, the leaked information "does not appear to contain sexual preference data, unlike the 2015 breach." 

The site could however, see account usernames, e-mails, passwords, the last login, IP addresses, browser information and other information.

Friend Finders Network told ZDNet that it had been aware of vulnerabilities and had taken corrective action.