Plenty Of Fish Hacked – Chris Russo explains what happened

UPDATE 2: Chris Russo (aka ch russo) mentioned that he would be pleased to reply any questions about the incident on plenty of fish dot com, so if any of my readers is interested, feel free to ask him.
You can follow Chris Russo on Twitter @chrusso99
Or send him a message on Facebook at http://www.facebook.com/chrisrusso99.

UPDATE: Chris Russo asked anyone that wanted to hear his story to contact him, so I did and here is the full interview in Spanish.
You will find in this interview Chris gives a very detailed description of how he managed to hack Plenty Of Fish and what led to Marcus getting so upset.
Here is the Interview:

Audio clip: Adobe Flash Player (version 9 or above) is required to play this audio clip. Download the latest version here. You also need to have JavaScript enabled in your browser.

More on this interview HERE.

I just got in contact with Chris Russo who managed to hack into the largest dating site on the world PlentyOfFish.com.
Marcus Frind, Founder of POF wrote an article accussing Chris of hacking /extorting POF and harassing his wife.

From Marcus personal blog:

This is not a statement from Plentyoffish, i’ll post something in the morning. This is a personal post about what it feels like to be hacked /extorted and the intense pressure and stress you are put under. Not to mention how annoying it is to have someone constantly harassing and trying to scare your wife at all hours of the day. I think a slept a total of 2 hours a night for a week….. Plentyoffish was hacked last week and we believe emails usernames and passwords were downloaded. We have reset all users passwords and closed the security hole that allowed them to enter.

Chris wrote this document explaining exactly what happened in his opinion:

30,000,000 users exposed on www.plentyoffish.com and a death threat from Mr. Markus Frind; please help.

Hi, I'm a security researcher from Buenos Aires, Argentina.

The Last Friday 21 of Januray, we discovered a vulnerability in www.plentyoffish.com exposing users details, including usernames, addresses, phone numbers, real names, email addresses, passwords in plain text, and in most of cases, paypal accounts, of more than 28,000,000 (twenty eight million users). This vulnerability was under active explotation by hackers.

My team decided to notify about this circunstances to Mr. Markus Frind, the founder and CEO of PlentyOfFish Inc. as soon as possible in order to stop any potential damage wich could be done, by the explotation of this vulnerability.

The flaw was reported the same night to Annie Kanciar, his wife, who was very thankfull with us, and contacted one of their developers in order to inform about this flaw.

The vulnerability was fixed and they remain in contact with us, since they were interested in hiring us as security professionals in order to make an analysis of the plataforms.

While we were creating the legal documents in order to proceed, Markus Frind got progressively more aggressive and unresposive with us, and told us to speak with their employees, Kate and Jay, because there was a serial killer, murdering people from the website.

We arrange to send the documents about the vulnerability we had found, a business plan, and the CVs of the personal working with us by Monday 31 of January.

The vulnerability, was properly documented by our team, without exposing any confidential user information. This was an error based MSSQL injection, that could allow any attacker to make a full backup of the databases used by the websever, and or gain direct access into the site.

By the nightfall of Sunday 30, Mr. Markus Frind sent me an email accussing us to steal his whole user database without a single proof, based on supposed information that "20 employees of him told him", and a weblink from www.freelancers.com asking for users information of POF. Here's is the mail itself:

http://www.freelancer.com/projects/zeesales_929663.html?utm_source=web&utm_medium=twitter

If this data goes public I am going to email every single effected
user on Plentyoffish your phone number, email address and picture.
And tell them you hacked into their accounts.

Then i'm going to sue you In Canada, US and UK and argintina. I am
going to completely destroy your life, no one is ever going to hire
you for anything again, this isn't piratebay and we definately aren't
fooling around.

Markus.

On Sun, Jan 30, 2011 at 3:19 PM, Kate Bilenki wrote:
> > Kate
> >
> > ---------- Forwarded message ----------
> > From: "chris"
> > Date: 2011-01-30 3:02 PM
> > Subject: Re: Following up
> > To: "Kate Bilenki"
> >
> > Hi Kate, how are you?
> > The documents are almost ready, would you like to speak by phone? I'm
> > feeling a bit insecure and nervous, the work to be done will take time,
> > cooperation and perhaps, physical presence, you may want to come to our
> > offices, or i could go there as well...
> >
> > I'll send the documents tomorrow, around 3pm Vancouver time. is there any
> > phone number we call you guys?
> >
> > Thanks in advance
> > sincerely yours;
> > chris russo
> >
> >
> > On 28/01/2011 05:12 p.m., Kate Bilenki wrote:
> >
> > OK thanks Chris, I'll watch out for your email. You have a great weekend as
> > well.
> >
> > Kate
> >
> > On Fri, Jan 28, 2011 at 11:59 AM, chris wrote:
>> >>
>> >> Hi Kate, yes, I'm doing a PDF with a plan of action (what should be done
>> >> in first instance, how we would work around it, what should be done once the
>> >> incident is totally controlled, and some other additional information, all
>> >> including times and prices), and gathering all my people CV's as well. I'll
>> >> email all this information to you this Monday, or before if it's possible.
>> >>
>> >> Have a great weekend,
>> >> sincerely yours;
>> >> chris
>> >>
>> >> On 28/01/2011 04:00 p.m., Kate Bilenki wrote:
>>> >>>
>>> >>> Hi Chris!
>>> >>>
>>> >>> Just thought I'd follow up on the proposal we discussed, please let me
>>> >>> know if you're still sending it
>>> >>>
>>> >>> Thank you very much,
>>> >>>
>>> >>> Kate
>>> >>> Plentyoffish.com

As we can see in the email, it textually says:

If this data goes public I am going to email every single effected user on Plentyoffish your phone number, email address and picture. And tell them you hacked into their accounts.
Then i'm going to sue you In Canada, US and UK and argintina. I am going to completely destroy your life, no one is ever going to hire you for anything again, this isn't piratebay and we definately aren't fooling around.

Right after that, There was 3 phone calls, which the local police are trying to recover, where he clearly said several times, that my people stole his user database, and he also mentioned that there was organized crime or mafias behind sites like the one he runs.

I explained to him several times that we were only reporting an error, but he refused to understand and kept accusing us, over the telephone communication he clearly threatened me again, saying that he was going to do something, just before mentioning his connection to criminal organizations.

In conclusion:

Plentyoffish.com exposes 30,000,000 users information, we reported that, and get nothing but trouble and are threatened, directly by the founder Mr. Markus Frind.

There's a video recorded showing the vulnerability itself, and the new's reporter Brian Krebs verified this vulnerability the last week himself (www.krebsonsecurity.com). All the communications by mail are also recorded and stored, in case it's needed.

In addition, there's a big chance that there was a real attack over the website, wich may put in risk usernames, passwords, full names, email addresses, and financial related information such as paypal account, credit cards, and others, of millions of users, wich Mr. Markus Frind refused to advice to their users.

Sincerely yours;
chris russo.
from insilence

for more information:
skype: ########
email: #############

http://plentyoffish.wordpress.com/2011/01/31/plentyoffish-hacked/#comment-119006