Can we also ask, HOW did they hack Ashley Madison?
Not a complete answer, but:
"MOTHERBOARD: How did you hack Avid Life Media? Was it hard?
The Impact Team: We worked hard to make fully undetectable attack, then got in and found nothing to bypass.
MOTHERBOARD: What was their security like?
The Impact Team: Bad. Nobody was watching. No security. Only thing was segmented network. You could use Pass1234 from the internet to VPN to root on all servers."
Sounds like AM's computing was all f__ked up! In US Army terminology, FUBAR. Or SNAFU. Gads.
Wonder how AM paid, maybe I should say, compensated, their server farm system administration staff? Their server farm security was wide open?
Should the users have expected something else?
2.) My read is that, instead of no security, (or else AM would be have been compromised instantly by script kiddies) they used manufacturer default passwords on internal firewall appliances.
Popular password resets:
password passme abcdefg pass1234 reset changeme late4work
I am sure there are others, once the password is changed to one of these easy passwords, someone who owns the account is support to change it to a harder password.
I used to work as a federal contractor and in IT departments and handled password resets.
One time as a federal contractor someone phoned in from Florida to pretend to be me or someone in my group to get our account password changed to one of the above. They used social engineering and might have been someone who worked there but retired.
When you have a weak password, people can easily break in.