text: While Ashley Madison and its parent company grapple with fallout from the recent hack of its network, emails released in the latest hacking leak indicate that the company’s own former CTO may have hacked a competing dating site. 
   
   According to an email exchange in November 2012, Ashley Madison’s one-time CTO told colleagues, including the CEO of parent company Avid Life Media, that he had found a security hole in the web site of Nerve.com and used it to exfiltrate the competitor’s entire database. He also indicated that he had the ability to alter records in the database. 
   
   “They did a very lousy job building their platform. I got their entire user base,” Raja Bhatia wrote Noel Biderman, CEO of Avid Life Media, Ashley Madison’s parent company, and Rizwan Jiwan, the company's chief operating officer. "Also, I can turn any non paying user into a paying user, vice versa, compose messages between users, check unread stats, etc.” 
   
   Bhatia had been the founding CTO of Avid Life Media, but was no longer associated with the company at the time he sent the email to Biderman and Jiwan. According to his Angel List page, he was CTO for ALM from 2007 to 2010. 
   
   He noted in the email that he had posted a sample of the stolen database to a GitHub account and included a link to the GitHub site, although that post is no longer available online. 
   
   Six months later, in May 2013, Biderman discussed whether he should disclose the vulnerability to Nerve.com. 
   
   “Should I tell them of their security hole?” he wrote Bhatia. There is no apparent response among the leaked emails. 
   
   Although the emails discuss setting up a phone call with Nerve.com, it’s not clear if ALM did disclose the vulnerability. 
   
   Neither Avid Life Media nor Bhatia responded to a request for comment from WIRED. 
   
   If Bhatia did in fact hack Nerve.com and exfiltrate its database, he could be criminally charged with unauthorized access under the Computer Fraud and Abuse Act. There is also great irony in Bhatia discussing a vulnerability in Nerve.com's web site, since other emails show that he was aware that AshleyMadison.com had security problems of its own—issues that the Impact Team, which has taken credit for the company's recent hack, exploited. 
   
   “With what we inherited with Ashley[Madison.com], security was an obvious afterthought, and I didn't focus on it either,” Bhatia wrote in an email in early 2012, months before he disclosed finding the vulnerability in Nerve.com's web site. “I am pretty sure we stored passwords without any cryptography so a database leak would expose all account credentials. 
   
   In that email, Bhatia was responding to news of another hack that had recently targeted Grindr, a dating app aimed at gay and bisexual men. 
   
   Despite an awareness of ALM's own vulnerabilities, CEO Biderman saw the downfall of competitors as an opportunity to promote himself and his business. "It would be huge if we could get me on as a commentator on this," Biderman wrote after Snapchat was attacked in 2014. 
   
   In 2012, Nerve.com had a dating platform that ALM considered purchasing. Nerve's CEO was Sean Mills, who had previously been president of The Onion satirical news site and is currently head of original content for Snapchat. 
   
   From looking at the emails in the recent data dump, it's clear that ALM considered buying Nerve. The email chain indicates that ALM began considering the purchase after Rufus Grissom, a VP with Babble.com, sent Biderman an email in June 2012 suggesting it. 
   
   “Several years ago I spoke with Glenn Graff about his interest in buying Nerve on behalf of Avid Life,” Griscom wrote. “Not sure where you guys are today, but I think this could be pretty interesting for you to have a look at. Sean has created a very innovative dating platform, and leaving that aside the site has 1.4 million high value, organic uniques (about 50/50 men/women) and there is a lot brand loyalty out there.” 
   
   In April, someone else contacted Biderman, asking if he was interested in buying Nerve. He wrote back saying “They reached out to us a couple of times – not sure we are the best buyer for Nerve given what we focus on these days.” 
   
   A month later, however, Biderman and others were exchanging emails about Nerve.com and Flirts.com. 
   
   “Enclosed are the traffic and audience overviews for the second offering (Nerve.com)," Christian Kalled wrote in an email to Leonard Latchman of LDL. “As for Flirts.com, our working valuation for the URL and non-exclusive TM license is $300,000 USD.” 
   
   Latchman wrote back asking about setting up a meeting with “the insurance guys.” That email appeared in a thread in which Lachtman asked about setting up a video call, presumably with Nerve.com. Biderman sent Bhatia a separate email asking, “Should I tell them of their security hole?” 
   
   Mills, the former CEO of Nerve.com, did not respond to a request for comment from WIRED. ||||| Hacked online cheating service AshleyMadison.com is portraying itself as a victim of malicious cybercriminals, but leaked emails from the company’s CEO suggest that AshleyMadison’s top leadership hacked into a competing dating service in 2012. 
   
   Late last week, the Impact Team — the hacking group that has claimed responsibility for leaking personal data on more than 30 million AshleyMadison users — released a 30-gigabyte archive that it said were emails lifted from AshleyMadison CEO Noel Biderman. 
   
   A review of those missives shows that on at least one occasion, a former company executive hacked another dating website, exfiltrating their entire user database. On Nov. 30, 2012, Raja Bhatia, the founding chief technology officer of AshleyMadison.com, sent a message to Biderman notifying his boss of a security hole discovered in nerve.com, an American online magazine dedicated to sexual topics, relationships and culture. 
   
   At the time, nerve.com was experimenting with its own adult dating section, and Bhatia said he’d uncovered a way to download and manipulate the nerve.com user database. 
   
   “They did a very lousy job building their platform. I got their entire user base,” Bhatia told Biderman via email, including in the message a link to a Github archive with a sample of the database. “Also, I can turn any non paying user into a paying user, vice versa, compose messages between users, check unread stats, etc.” 
   
   Neither Bhatia nor Biderman could be immediately reached for comment. KrebsOnSecurity.com spoke with Bhatia last week after the Impact Team made good on its threat to release the Ashley Madison user database. At the time, Bhatia was downplaying the leak, saying that his team of investigators had found no signs that the dump of data was legitimate, and that it looked like a number of fake data dumps the company had seen in the weeks prior. Hours later, the leak had been roundly confirmed as legitimate by countless users on Twitter who were able to find their personal data in the cache of account information posted online. 
   
   The leaked Biderman emails show that a few months before Bhatia infiltrated Nerve.com, AshleyMadison’s parent firm — Avid Life Media — was approached with an offer to partner with and/or invest in the property. Email messages show that Bhatia initially was interested enough to offer at least $20 million for the company along with a second property called flirts.com, but that AshleyMadison ultimately declined to pursue a deal. 
   
   More than six months after Bhatia came to Biderman with revelations of the nerve.com security vulnerabilities, Biderman was set to meet with several representatives of the company. “Should I tell them of their security hole?” Biderman wrote to Bhatia, who doesn’t appear to have responded to that question via email. 
   
   The cache of emails leaked from Biderman run from January 2012 to July 7, 2015 — less than two weeks before the attackers publicized their break-in on July 19. According to a press conference held by the Toronto Police today, AshleyMadison employees actually discovered the breach on the morning of July 12, 2015, when they came to work and powered on their computers only to find their screens commandeered with the initial message from the Impact Team — a diatribe accompanied by the song “Thunderstruck” from rock band AC/DC playing in the background. 
   
   Interestingly, less than a month before that episode, AshleyMadison executives seemed very keen on completing a series of internal security assessments, audits and security awareness training exercises for employees. 
   
   “Given our open registration policy and recent high profile exploits, every security consultant and their extended family will be trying to trump up business,” wrote Ashley Madison Director of Security Mark Steele to Biderman in an email dated May 25, 2015. “Our codebase has many (riddled?) XSS/CRSF vulnerabilities which are relatively easy to find (for a security researcher), and somewhat difficult to exploit in the wild (requires phishing). Other vulnerabilities would be things like SQL injection/data leaks, which would be much more damaging” [links added]. 
   
   As bad as this breach has been for AshleyMadison and its millions of users, it’s likely nowhere near over: Hackers who have been combing through the company’s leaked email records have just released a “selected dox” archive — a collection of documents, images and other data from Biderman’s inbox, including a 100-page movie script co-written by Biderman called “In Bed With Ashley Madison.” Also included in the archive are dozens of other sensitive documents, including a scan of the CEO’s drivers license, copies of personal checks, bank account numbers, home address, and his income statements for the last four years. 
   
   Also, the Impact Team still have not released data from the other Avid Life Media property they claim to have hacked — Establishedmen.com, a “sugar daddy” site that claims to connect wealthy men with willing young women. 
   
   Earlier today, Toronto Police announced that Avid Life Media had offered a $500,000 reward for information leading to the arrest and prosecution of the hacker or hackers responsible for the breach. But many readers took to Twitter or to the comments section on this site to denounce the bounty as an overdue or cynical ploy, with some saying the company should have offered the reward weeks ago — before the Impact Team released the company’s entire user database and caused so much irreversible damage. 
   
   Leaving aside the proliferation of sites that now allow suspicious spouses to search for their significant other’s email address in the AshleyMadison data leak, some users are finding themselves on the receiving end of online extortion attacks. Worse still, Toronto Police told reporters this morning that they have two unconfirmed reports of suicides associated with the leak of AshleyMadison customer profiles. 
   
   Tags: Avid Life Media, Impact Team, Noel Biderman, Raja Bhatia
target: – "They did a very lousy job building their platform," former Ashley Madison chief technology officer Raja Bhatia allegedly wrote to CEO Noel Biderman in 2012. "I got their entire user base." Ironically—considering Ashley Madison is now dealing with its own stolen data being leaked by hackers—Bhatia was referring to a competitor site he allegedly hacked back in 2012, Krebs on Security reports. According to Biderman's leaked emails, Bhatia figured out how to download the user database of Nerve.com (which was starting its own dating site) and manipulate it in ways including changing non-paying users to paying users, sending messages from one user to another, and more. Krebs on Security reports that, per the leaked emails, Bhatia's hack came months after Nerve approached Avid Life Media, Ashley Madison's parent company, about a partnership. In fact, Bhatia offered $20 million to buy Nerve and another site, but Avid Life Media decided not to go through with the deal. Wired reports Bhatia was no longer working for Ashley Madison when he discovered Nerve's security problems, but additional leaked emails show he was also aware of similar security issues within Ashley Madison. Last week's release of stolen Ashley Madison data has already resulted in reports of online blackmailing and possibly two suicides, and more leaks may be on their way.