Vulnerability found in dark web market Alphabay

The popular darkweb marketplace paid a Reddit user after when a critical bug was found that exposed sensitive data.

A bug on AlphaBay, the largest active dark web marketplace, allowed outsiders to read 30 days worth of private messages on the site. A total of 218,000 messages were obtained, according to the market’s administrators, giving an attacker the ability to view messages between vendors and buyers selling everything from illicit drugs to stolen digital data.

The bug was made public on Saturday with a post to reddit. The technical specifics of this latest bug were not revealed.

The user posted five screenshots of private messages for proof, showing where AlphaBay users openly exchanged names, addresses and tracking numbers without encryption.

The reddit user said that AlphaBay administrators initially ignored three tickets reporting the critical bug.

AlphaBay administrators paid a hacker for finding the bug, a reward reminiscent of bug bounty programs above-the-board technology organizations are employing with increasing frequency.  AlphaBay administrators did not respond to a request for comment asking how much they paid out for the bug bounty

Four hours after the reddit user went public, AlphaBay administrators confirmed the problem and said it had been fixed.

“The attacker was paid for his findings, and agreed to tell us the methods used to extract such information,” the user alphabaysupport wrote on reddit. “Our developers immediately closed the loophole in order to protect the security of our users.”.

The market’s owners also issued advice to their users, saying “no action is required” but “we remind everyone to ALWAYS ENCRYPT SENSITIVE INFORMATION such as addresses, BTC addresses, tracking numbers, etc.”

AlphaBay was officially launched in December 2014 in the wake of two major Silk Road FBI busts. It became the most popular market on the dark web in 2015.

This is the second time within a year that a bug exposed private messages on the market.

Private messages are often used to communicate extremely sensitive data like addresses, postal tracking numbers and real names where illicit products have to be delivered. If law enforcement or other criminals came into possession of these messages, it could pose a grave risk to AlphaBay’s massive customer base.

Like every dark web market, AlphaBay’s documentation advises users to always encrypt sensitive data so that even if messages are intercepted, they cannot be read. Previous studies on Silk Road, the first widely popular dark web market, showed that most users rarely encrypted sensitive data.

The idea that law enforcement or other criminals may find this sensitive information is not hypothetical. Wired reported in 2015 how the Department of Homeland Security delivered a subpoena to Reddit demanding a load of personal data on users of the dark net markets forum. On the other hand, dark web denizens hack one another as well, probing for weaknesses and advantages in a highly competitive environment.

Senate set to debate package of bills on privacy, AI and kids safety 

Headlined by the Kids Online Safety Act, a key committee will look to clear major legislation governing how minors interact with the internet.

With each cloud outage, calls for government action grow louder 

European authorities disrupt top drug marketplace, arrest leader

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure