MyFreeCams hack: Time To Change Passwords!

Last Updated October 04, 2023

As reported widely in the security news this weekend there was a confirmation of a security breach at Myfreecams.com. The so-called Myfreecams hack involved a security breach that occurred in Dec 2020, but the information was only confirmed recently by Cybernews after the hacker started to sell the information.

This means that MFC joins the long list of adult sites that have had data breaches. It almost seems to be a thing; hacking adult related sites to get user information. Whether it be adult hardware or adult websites, perhaps hackers think they will be an easy target.

What happened?

A hacker used a security hole, an SQL Injection attack, in the myfreecams.com web site to steal a database. it isn’t clear if it is the entire database of users but the “2 million premium and diamond members” sounds like a lot, and possibly the whole thing. I don’t think MFC has ever said how many members they have but it 2 mil could be a reasonable number to be “all” of them.

Having stolen this database the hacker then advertised it for sale on a “popular hacker forum” which I won’t name for obvious reasons (you can ask me privately in my very-not-hacker-forum if you really need to know).

The sale price was quoted as $1,500 for 10,000 user records.

The payment was requested in Bitcoins, and tracking on the Bitcoin payment address shows that 49 sales were made. As the seller indicated each sale would be for a unique list that means 49 times 10,000 or almost half a million records are involved.

The seller thought that people would buy these records and then resell the individual accounts that had tokens, and hence value, on the black market to make a profit. There is no evidence that this has actually happened.

There are a lot of other reasons that people might want to have the username and emails of people who are premium users of Myfreecams. Cyber-blackmail or phishing scams as well as targetted spear-phishing scams seem likely reasons for spending this amount of money to buy a list of adult cam site users.

What was stolen?

A list of Premium MyFreecams user accounts, including the user name, email address, and plain-text unencrypted password as well as the number of tokens the accounts had at the time.

That doesn’t include member accounts that are not premium. The basic accounts, which are members who have not purchased any tokens ever, are not included.

What should you do now?

If you have a premium account at Myfreecams then now would be a good time to change your password, and also to remember that your email address may be known to hackers, who not only know your email address but also that you are a user of MFC.

Changing your email address and even abandoning the one you used before would be nice, but probably isn’t practical for most people, but if it is for you then go ahead and do it. On MFC the only way to change your primary email address is to contact support, there is no interface to do it yourself.

Any password that you used there and have also used elsewhere, well you know you shouldn’t have but if you have then go ahead and get that changed at the other sites as soon as you can.

Any lessons to learn from this?

Hacking is a fact of life, if you want to stay more secure then use different passwords for different sites and preferably different email addresses. At least have a distinct email address for your adult camming needs and do not use it for other things.

Lastly, if you are a programmer or work behind the scenes, you really should freak out any time you see a database with passwords in clear-text. Why does anybody do this? 🤦

Also, SQL Injection? Really? What happened to prepared queries with bound variables. Or at least mysql_real_escape_string(). Have we learned nothing?

@misc{Tsoi_2021,
  title={MyFreeCams hack: Time To Change Passwords!},
  url={https://www.adult-webcam-faq.com/2021/01/25/myfreecams-hack-time-to-change-passwords/},
  publisher={Adult Webcam FAQ},
  author={Hony Tsoi},
  year={2021},
  month={Jan.}
}