Hack alert: Playboy!

[MaxDepth]

Well all,
it looks like somebody broke through at Playboy.com.

The funny thing that I am thinking is how many people have this website in their charge accounts and hide it from significant others or business partners? Are they going to go to the police, their loved ones or others and say, "Oh yes officer, I've noticed some extra charges to my CC after I subscribed to Playboy.com."

Although its not like they signed up for mexicandonkeyshow.com...












BTW - the link doesn't go to playboy.com but to a cnn webpage describing the event.

 

[Viper GTS]

Can you grab the text of the article? My proxy will block the link because it contains the word "Playboy."

Viper GTS

 

[wyvrn]

No way I am opening that link at work. Make a screenshot!

 

[N8Magic]

What Viper said.

I enjoy my job.

 

[khtm]

"NEW YORK (CNN/Money) - Hackers broke into Playboy.com last weekend and sent threatening e-mail to the site's customers, apparently containing sensitive credit card information.

Playboy Enterprises spokeswoman Laura Sigman said Tuesday a breach in the site was detected last weekend, before customers began alerting the company to the problem Sunday evening.

In the e-mail message, obtained by CNNfn, the group identified the name, credit card number and expiration date of the customer.

The group, operating under the name "ingreslock 1524," also said it "did have some very big plans" to use the information so that it would result in "over 10 million dollars worth of fraud claims" made to credit card and insurance companies.

But the group appeared to be alerting customers to the fraud in advance of any theft and later in the message implies it meant to "test" computer systems to determine their security. The group added it plans to test Playboy.com again.

In response, Playboy (PLA: down $0.17 to $13.91, Research, Estimates) sent letters to customers advising them to check for unauthorized charges on their credit cards. The company said the FBI is investigating the incident and Playboy also hired investigative agency Kroll Associates.

Playboy, which has firewalls in place, also is conducting an internal check of its logs and servers.

Sigman said the company is trying to determine what percentage of its customers have been affected and the company does not know whether customers' credit cards have been compromised. "

 

[woodly6]

Thats funny, no the hackers subscribed me then, used my CC number at dudeswithboobs.com I swear

 

[MaxDepth]

<< Thats funny, no the hackers subscribed me then, used my CC number at dudeswithboobs.com I swear >>



Yeah, and you can "wake me up before you go, go" with another one of those lame excuses! Move!!!

-your computer repair guy

 

[lsman]

Here is a text from theinquirer.net


Playboy confirms INQUIRER tale

Watch out. Hackers about
By Adamson Rust , 21/11/2001 01:39:51 BST


THIS, BELOW, IS HOW THE INQUIRER once again broke the story. But the details of the email we received suggested that the breaches of security were much greater than just Playboy. We fear we will have to return to this story later today. [Do you have to Adamson? Ed.] µ
-----Original Message-----
Subject: Potential breach of security
Date : 11/19/01 10:21 AM
Hi

Perhaps you could refer this to your press officer.

I am Mike Magee, editor in chief of online publication www.theinquirer.net, which covers the IT business.

I have received an email this afternoon from a reader who alleges that he in turn has had an email, claiming your site security has been breached.

Here is part of that email.

------------------------------------ Hi Mike, I have been an avid reader of 'the inquirer' since it's inception. I think the following story may of interest to your readers. A couple of months ago my wife bought me these hip shirts (I think they are hip...) from Playboy's online store @ www.playboy.com, like with most online transactions she used her Visa card. When I checked my email this morning I received this email from 'martyn luther ping minister of information ingreslock 1524'

The credit card number I removed below was my wife's actual Visa number, not a good thing ! I tried emailing Playboy's customer service and the email bounced back as 'undeliverable' (see attached email).

-----Original Message----- From: hef@playboy.com [mailto:hef@playboy.com] Sent: Sunday, November 18, 2001 11:50 PM To: undisclosed-recipients: Subject: ---------------------------------------------------------------------

The email he attached claimed that your online database has been breached along with names, addresses and credit card numbers.

A comment from Playboy would be appropriate, I believe.

Sincerely

Mike Magee
The INQUIRER
http://www.theinquirer.net/

FROM PLAYBOY
To Our Customers
We have discovered that an unauthorized entry was made to a portion of some of our web site computer systems and to our customer lists. At this point we believe that the hacker was able to access the credit card information of some of our e-commerce customers, many of whom the hacker has already contacted by e-mail.

Even if you haven't received such a message, we encourage you to contact your credit card issuer to determine if there are any unauthorized charges. As a precaution, we have already contacted the credit card companies with whom we work to notify them of the situation.

We are taking a number of other immediate measures to address this situation. We have hired a leading computer security firm to audit our security measures and analyze this particular incident. In addition, we are working with law enforcement authorities on a criminal investigation.

Unfortunately, Playboy is only one of a number of high-profile companies who have been subjected to this kind of malicious hacking. We recognize the value that you place on privacy and security and want to assure you that we are doing everything possible to rectify the situation.

We thank you for your understanding and we will be sure to keep you informed of our efforts to address this matter. For additional information, you can contact our customer service department at 800-993-6339.

Sincerely,

Larry Lux

President and Chief Executive Officer

Playboy.com

 

[lsman]

and the email the hacker send to those that has been hacked is also posted in theinquirer.net:


THIS IS THE MESSAGE that our reader, Andre in Toronto, received and which spurred Playboy to admit customer security was breached.
See Playboy confirms INQUIRER tale".

dear user,

since the summer of 1998, a shady hacker group known as 'ingreslock 1524' have maintained full access to the playboy enterprises inc. (pei) corporate network.

even when the pei websites were defaced by BoW/H4G1S and were 'secured', we retained our full access (no, installing ssh doesn't make you secure).

we did have some very big plans to use the hundreds of thousands of customer details (names, addresses, order history & credit card information) harvested to automatically purchase hundreds of different products from different online companies (amazon, barnesandnoble, qvc, yahoo, even playboy) to be sent to each playboy customer, thus resulting in over 10 million dollars worth of fraud claims being made to credit card and in turn, insurance companies globally.

incase you think this is some kind of hoax, we have included your personal details below -

Name - [REMOVED]

Credit Card Number & Expiry [REMOVED]

your details are currently circulating the underworld of anarchists and credit card fraudsters, so we highly recommend that you contact your bank before much fraud is committed. we have also distributed over a million e-mail addresses to marketing and 'spam' organisations, so you will certainly have a lot of fun deleting unwanted e-mail into the future!

online companies can learn many lessons from this compromise -

1. do not use the same root or administrative (oracle, webserv, etc.) user passwords across different hosts on the same network.

2. never assume that by installing the latest security patches and installing ssh, that you are secure.

3. do not use insecure authentication methods, including nis, nis+ or ..rhosts.

4. do not protect your passwords with des in your shadow files, use md5.

end users can learn an important lesson from this compromise -

do not trust companies with your details online.

its been emotional.

its been emotional. we'd like to thank the playboy systems team for providing us with an interesting and challenging target. i'm sure that a big security company will make easy money auditing their systems and hopefully deploying a more secure network - although we'll be back to test it again.

- m4rty

martyn luther ping

minister of information

ingreslock 1524 µ

 

[Mookow]

HAHAHA. Dude... thats just hilarious.