In all, 10,613 websites — around a fifth of the world's entire dark web were replaced by a page, saying "Hello, Freedom Hosting II, you have been hacked" — and each site's hosting database was raided for personal information, which the hackers then "dumped" online. The method by which the hack was achieved was also subsequently shared on Twitter.
But but we need tor ohdays, costing gazillions. Or we just rely on fact infosec is hard. #pwnage pic.twitter.com/9uIEYEDgos
— Daniel Cuthbert (@dcuthbert) February 5, 2017
In response to the hack, Troy Hunt, curator of Have I Been Pwned? — an online service that allows individuals to check whether their data has been compromised by a data breach, said in a tweet the "dump" contained over 380,000 email addresses.
New sensitive breach: Freedom Hosting II had 381k email addresses exposed. 21% were already in @haveibeenpwned https://t.co/LGaAnj1hUA
— Have I been pwned? (@haveibeenpwned) February 5, 2017
It's estimated at least 50 percent of the sites involved in the hack contained illicit sexual content involving children, so it's likely many of the emails will be "burners" — disposable addresses.
10k Freedom Hosting II (dark web host) sites impacted, reportedly 20% of all hidden services. >50% were allegedly contained child porn. 2/8
— Troy Hunt (@troyhunt) February 5, 2017
However, Hunt also tweeted that almost 21 percent of them were in previous breaches registered in Have I Been Pwned?, suggesting many were legitimate day-to-day email addresses — and moreover, this clutch contained 'thousands' of official US government email addresses.
What sites these emails were used to access is uncertain, although the dumped data will undoubtedly be in the possession of law enforcement officials the world over. Given the "dark web" is used for a variety of illicit activities — including the sale of drugs, counterfeit passports and guns, the dissemination of child pornography, and hiring hitmen — coming weeks could see the doors of many users broken down by authorities.
A cybersecurity expert, who asked to not to be named, told Sputnik the hack was the result of experienced hackers looking for opportunities to do good.
Still, the expert says that while law enforcement may attempt to crack down on hackers as a result — but the individuals who end up getting caught won't be the big time players.
"Law enforcement will always do everything they can to limit attacks, and with evermore pressure on organizations to keep data safe, it only means bigger punishment for teenagers that get caught for running hacking scripts. Catching real hackers is incredibly difficult if they are well-versed in communications, privacy limitations, attribution and of course making it look like it was another country," the source added.
Growing concerns over public privacy have led to a growth in use of the 'dark web' with many opting to use the Tor browser for access. Tor has been repeatedly endorsed by Edward Snowden, and while one of the browser's primary developers has fled the US to escape FBI harassment, some critics have raised concerns over its origins. It was developed in the mid-90s by United States Naval Research Laboratory employees, and is still funded by the US government intelligence complex.
If the.gov email addresses included in the dump are real, it would not be the first time officials have been embarrassed by hackers. In 2015, the email addresses of extramarital affair website Ashley Madison users were hacked and released online, and over 15,000 ended in the.gov extension.
