Spyware, viruses, & security forum: NEWS - February 13, 2012

Mozilla closes critical security hole in Firefox, Thunderbird and Seamonkey

Mozilla has released Firefox 10.0.1, Firefox ESR 10.0.1, Thunderbird 10.0.1, Thunderbird ESR 10.0.1 and SeaMonkey 2.7.1 to fix a single critical security hole in the browsers and mail clients which appeared in version 10. The security advisory says that versions previous to Firefox 10, Thunderbird 10 and Seamonkey 2.7 are unaffected by the use after free problem.

The problem was discovered by Mozilla developers and causes a "potentially exploitable" crash in nsXBLDocumentInfo::ReadPrototypeBindings. Updates are available through Firefox, Thunderbird and SeaMonkey's automatic update system and can be made to install by bringing up the "About" dialogue for the relevant application and selecting the "Apply Upgrade" button when it appears. Firefox and Thunderbird 10 were released at the end of January.

The updates are also available for the new ESR (Extended Support Release) versions of the browser and email client, Firefox ESR and Thunderbird ESR which are currently in their "qualification" phase.

http://www.h-online.com/security/news/item/Mozilla-closes-critical-security-hole-in-Firefox-Thunderbird-and-Seamonkey-1433248.html

See Vulnerabilities / Fixes: Mozilla Firefox / Thunderbird / SeaMonkey XBL Binding Use-After-Free Vulnerability

"Microsoft said it has already contacted customers of the store to suggest immediate action"

Microsoft is investigating a "limited compromise" of the company's online store in India, the company said Monday.

"The store customers have already been sent guidance on the issue and suggested immediate actions," the company said in a statement.

The user names and passwords of some customers may have been leaked, and users are being advised to change their passwords, said a person close to the situation, who declined to be named. Financial information of customers has not been exposed, the person said.

The store was defaced over the weekend by hackers who claimed to be Chinese. The hackers also released images of what appeared to be lists of users' names and passwords.

The Microsoft website is managed by a third-party service provider and was still down on Monday. Microsoft said on the site that it is working to restore access as quickly as possible.

The relatively unknown hacker group, called EvilShadow Team, wrote in Mandarin in a blog post that it had changed the main page of the store, and placed an image of China's flag on it because it wanted Microsoft to pay attention. "We are not famous, we know that there are other experts among us, people who are even better," the group said.

Continued : http://www.networkworld.com/news/2012/021312-microsoft-india-store-hacked-user-256018.html

Also:
Microsoft Store India hacked, username and password database leaked (update)
Chinese "Evil Shadow" Hackers Breach and Deface Microsoft Store

From the TrendLabs Malware Blog:

News of Whitney Houston's sudden demise spread like wildfire in the Internet. Countless tweets, Facebook wall posts, and news items circulated regarding the singer's death at age 48. Given the massive attention that Houston's death generated, cybercriminals are naturally out there taking advantage of this unfortunate incident.

We have uncovered two web threats shortly after the news broke out. One was a clickjacking attack found on Facebook, while the other one was a link circulating on Twitter.

RIP "Whitney Houston" leads to Clickjacking

A fake video was seen spreading via the social networking site Facebook was found by my colleague, Karla Agregado. The posts, which have the subject "I Cried watching this video. RIP Whitney Houston", come in the form of a wall post with a link to the supposed video. Once users click on the video, it leads them to a Facebook page that contains a link to the video. However, clicking the said link only leads to several other redirections until users are lead to the usual survey scam site. [Screenshot: Clickjacking attack diagram]

Upon further investigation on the domains involved, we also found 101 more survey scam domains registered on the same IP where the domains are hosted.

RIP Whitney Tweets May Lead To Web Threat

We have also found tweets with malicious links that also took advantage of the tag RIP Whitney Houston, which was trending worldwide on Twitter.

Continued : http://blog.trendmicro.com/cybercriminals-leverage-whitney-houstons-death/

Abine released Do Not Track Plus (DNT+), a tool that makes it easy for anyone to see when they're being tracked online and stop being profiled by social networks, large advertisers, and data collection companies, including Google and Facebook.

Once installed, DNT+ blocks hundreds of trackers that collect, use, and sell consumers' personal information. The tool works seamlessly with all major browsers, including Internet Explorer, Firefox, Chrome, and Safari. It blocks tracking across hundreds of websites, including those with whom consumers share most of their personal information.

DNT+ can speed up website loading by up to four times, and allows consumers to see who is tracking them on each website they visit with a simple numbered icon in the corner of their browser window.

Consumers can elect to block or allow the tracking at the individual website level. By doing so, consumers regain control of information while shopping, playing games, socializing, and more, and prevent real problems that can occur from profiling such as identity theft, reduced credit score ratings, and loss of employment.

Continued : http://www.net-security.org/secworld.php?id=12380

You be the guinea pig! (No offense)

I too thought of trying it. Due some issue's I've been experiencing with FF, I was hesitant to add anything else "to the mix".

Did you read "Do Not Track Plus add-on stops the tracking paparazzi" last week?

Let us know how it works for you...
Carol

That's brill, type chatting in real time.

Here's a transcript;

xxxx @ Abine.com: Welcome to our real-time support chat. How can I help you today?

Visitor: Hi.Problem installing DNT in Firefox 10.0.1, (FF upgraded from 10.0.0 last week).Mozilla Addons page reports;"The add-on from addons.mozilla.org could not be installed because it does not match the add-on Firefox expected"Any idea what the problem is? I have AdBlockPlus, should be compatible and also NoScript but I allowed all the scripts on the Mozilla web page.Thanks, Mark UK

xxxx @ Abine.com: Hi there. Sorry about that--it is compatible, but you'll have to re-install from this link: htt p : //donottrackplus.com/internal/dntp-giveaway-firefox.xpi

Visitor: Thanks for that link. I am concerned. FF has asked me for confirmation with the message "Install add-ons from authors you trust. Malicious software can damage your computer or violate your privacy". Do I trust you? if so, why did the recommended method fail?

xxxx @ Abine.com: Usually the mozilla browser store automatically updates, but we had a small issue with them. In the future, DNT+ should automatically update.
As for that scary message, FF gives that with all add-ons.
It has scared me in the past, too.

Visitor: Many thanks again, and I will trust you!

Signing off, Mark

Name changed to protect the helper, and I disabled the link from being clickable here.

I will try again.

Notice how trustworthy I am? It's got me into trouble before now.

Mark

Thanks for the info, Mark.

It's appreciated.

Signing off, Mark Carol

Did you ever consider hanging up your moderator badge and becoming a reviewer?

"Seems like" (so far) .. just what the doctor ordered.

Reading through the news this morning (EST, US), I came across the following:

From GFI Labs (formerly Sunbelt): Here's a Privacy Tool That Prevents You From Being Tracked

From TechRepublic: Do Not Track Plus: A tool to protect your online privacy

I have no doubt there's more, but I trust your first-hand account above all else. As you trusted who you chatted with at Abine ... I trust you!

Carol

First, I sent an e-mail to Abine concerning my use or attemt to use:

Windows XPSP3 with Internet Explorer 8

Default IE Toolbars: Menu, Favorite, Command and Status Bars. No other Toolbars have ever been installed on the first system. Toolbars are always "unlocked" - both computers.

1. There is no number in the DTN+ icon -- don't think one ever showed.
2. The DTN+ icon is on the left side of the Command Bar and is labeled "Home". Your video shows it on the top right side with a down-arrow.
3. Is there suppose to be a "down-arrow" on the right side of the DTN+ icon?
4. Uninstall instructions are given only for FireFox, Safari, and Chrome.
5. What do the red, yellow, and green toolbar icons mean? NEVER SEEN ONE.
6. In the installation instructions it give guidance after clicking on Tools and selecting Add-ons. Internet Explorer has Toolbars and Extensions. And, by the way, Do Not Track Plus is listed as an Add-on and it is Enabled.
7. During initial installation, if I remember correctly, there was some instructions about the Do Not Track Plus icon showing up at the top of the browser -- LEFT or RIGHT is a good question. I cannot find those instructions now without possibly uninstalling and reinstalling DNT+ but the instructions were "be sure the Command Bar was turned on and ensure the Toolbar is unlocked". The item that caught my eye was that you were to move a "Separator" in the Command Bar -- I guess so there is some space for the DNT+ icon. Good question and I wonder if anybody has ever figured out that "movement" if it is even possible.
8. When the DNT+ applet is open there appears to be several hyperlinks there on:
a. "How this works" in the title bar - does nothing but close DNT+
b. Abine.com - does nothing
c. How This Works - ditto
d. Say Hello - ditto
e. Get personalized privacy monitoring with DeleteMe > - ditto
9. For security the Microsoft Windows Firewall and the AVG Anti-Virus is the only two running programs on both systems.

By the way, it works on my first system and very well. Thank you.

My second system with the same operating system and updates simply will not display the DNT+ icon anywhere on the browser. Installed, uninstalled, installed again. Nothing. And, DNT+ is listed as an Add-on and is enabled but there is no "activity" -- Use count and blocked count are both zero. This system does have the "Google" toolbar installed - first system does not. The second has the Add-on for Skype - first does not. Yes, both systems have some other Add-ons but they are usually installed on every system and I don't think they were worth mentioning at the moment unless you want a complete listing for your information -- you must ask.

This is simply an informative writing for your information and possible use.

I'll add the Add-ons which are used by my two computers in case somebody is interested (sorry for the length:

Toolbars and Extensions:

Name Shockwave Flash Object
Publisher Adobe Systems Incorporated
Status Enabled
File date Sunday, November 20, 2011, 7:33 AM
Version 11.1.102.55

Name Adobe PDF Link Helper
Publisher Adobe Systems, Incorporated
Status Enabled
File date Monday, September 05, 2011, 11:04 AM
Version 10.1.1.33
Load time 0.00 s

Name AVG Safe Search
Publisher AVG Technologies
Status Enabled
File date Friday, November 11, 2011, 2:29 AM
Version 12.0.0.1870
Load time 0.01 s

Name Do Not Track Plus
Publisher Abine, Inc.
Status Enabled
File date Friday, February 10, 2012, 3:41 PM
Version 1.0.5330.210
Load time 0.01 s

Name JQSIEStartDetectorImpl Class
Publisher Sun Microsystems, Inc.
Status Enabled
File date Tuesday, October 18, 2011, 6:05 PM
Version 6.0.290.11
Load time 0.00 s

Name Java(tm) Plug-In 2 SSV Helper
Publisher Sun Microsystems, Inc.
Status Enabled
File date Tuesday, October 18, 2011, 6:05 PM
Version 6.0.290.11
Load time 0.29 s

Name Windows Messenger
Publisher Not Available
Status Disabled

Name Diagnose Connection Problems...
Publisher Not Available
Status Enabled

Name ieSpell Options
Publisher Not Available
Status Enabled

Name ieSpell
Publisher Not Available
Status Enabled

RUN WITHOUT PERMISSIONS:

Name Shockwave ActiveX Control
Publisher Adobe Systems Incorporated
Status Enabled
File date Monday, June 13, 2011, 2:50 AM
Version 11.6

Name Shockwave Flash Object
Publisher Adobe Systems Incorporated
Status Enabled
File date Sunday, November 20, 2011, 7:33 AM
Version 11.1.102.55

Name Adobe PDF Reader
Publisher Adobe Systems, Incorporated
Status Enabled
File date Monday, September 05, 2011, 11:04 AM
Version 10.1.1.33

Name InformationCardSigninHelper Class
Publisher Microsoft Corporation
Status Enabled
File date Sunday, March 08, 2009, 3:31 AM
Version 8.00.6001.18702

Name XML DOM Document
Publisher Microsoft Corporation
Status Enabled
File date Monday, June 14, 2010, 1:41 AM
Version 8.100.1052.0

Name XSL Template
Publisher Microsoft Corporation
Status Enabled
File date Monday, June 14, 2010, 1:41 AM
Version 8.100.1052.0

Name HtmlDlgSafeHelper Class
Publisher Microsoft Corporation
Status Enabled
File date Friday, November 04, 2011, 1:20 PM
Version 8.00.6001.19165

Name Tabular Data Control
Publisher Microsoft Corporation
Status Enabled
File date Sunday, March 08, 2009, 3:30 AM
Version 8.00.6001.18702

Name XML Schema Cache
Publisher Microsoft Corporation
Status Enabled
File date Monday, June 14, 2010, 1:41 AM
Version 8.100.1052.0

Name Microsoft Shell UI Helper
Publisher Microsoft Corporation
Status Enabled
File date Friday, November 04, 2011, 1:20 PM
Version 8.00.6001.19165

Name Windows Media Player
Publisher Microsoft Corporation
Status Enabled
File date Thursday, August 26, 2010, 4:16 PM
Version 9.00.00.4510

Name XML DOM Document 6.0
Publisher Microsoft Corporation
Status Enabled
File date Friday, July 31, 2009, 9:05 AM
Version 6.20.1103.0

Name Free Threaded XML DOM Document 6.0
Publisher Microsoft Corporation
Status Enabled
File date Friday, July 31, 2009, 9:05 AM
Version 6.20.1103.0

Name XML Schema Cache 6.0
Publisher Microsoft Corporation
Status Enabled
File date Friday, July 31, 2009, 9:05 AM
Version 6.20.1103.0

Name XSL Template 6.0
Publisher Microsoft Corporation
Status Enabled
File date Friday, July 31, 2009, 9:05 AM
Version 6.20.1103.0

Name XML HTTP 6.0
Publisher Microsoft Corporation
Status Enabled
File date Friday, July 31, 2009, 9:05 AM
Version 6.20.1103.0

Name Scripting.Dictionary
Publisher Microsoft Corporation
Status Enabled
File date Friday, May 09, 2008, 4:53 AM
Version 5.7.0.18066

Name XML DOM Document 3.0
Publisher Microsoft Corporation
Status Enabled
File date Monday, June 14, 2010, 1:41 AM
Version 8.100.1052.0

Name Free Threaded XML DOM Document 3.0
Publisher Microsoft Corporation
Status Enabled
File date Monday, June 14, 2010, 1:41 AM
Version 8.100.1052.0

Name XML Schema Cache 3.0
Publisher Microsoft Corporation
Status Enabled
File date Monday, June 14, 2010, 1:41 AM
Version 8.100.1052.0

Name XML HTTP 3.0
Publisher Microsoft Corporation
Status Enabled
File date Monday, June 14, 2010, 1:41 AM
Version 8.100.1052.0

Name XSL Template 3.0
Publisher Microsoft Corporation
Status Enabled
File date Monday, June 14, 2010, 1:41 AM
Version 8.100.1052.0

Name XML Data Source Object 3.0
Publisher Microsoft Corporation
Status Enabled
File date Monday, June 14, 2010, 1:41 AM
Version 8.100.1052.0

Name Free Threaded XML DOM Document
Publisher Microsoft Corporation
Status Enabled
File date Monday, June 14, 2010, 1:41 AM
Version 8.100.1052.0

Name XML Data Source Object
Publisher Microsoft Corporation
Status Enabled
File date Monday, June 14, 2010, 1:41 AM
Version 8.100.1052.0

Name isInstalled Class
Publisher Sun Microsystems, Inc.
Status Enabled
File date Monday, October 03, 2011, 5:06 AM
Version 6.0.290.11

Name Java Plug-in 1.6.0_29
Publisher Sun Microsystems, Inc.
Status Enabled
File date Monday, October 03, 2011, 5:06 AM
Version 1.6.0.29

Name Java Plug-in 1.6.0_17
Publisher Sun Microsystems, Inc.
Status Enabled
File date Monday, October 03, 2011, 5:06 AM
Version 6.0.290.11

Name Java Plug-in 1.6.0_17
Publisher Sun Microsystems, Inc.
Status Enabled
File date Monday, October 03, 2011, 5:06 AM
Version 6.0.290.11

Name Java Plug-in 1.6.0_17
Publisher Sun Microsystems, Inc.
Status Enabled
File date Monday, October 03, 2011, 5:06 AM
Version 6.0.290.11

Name Java Plug-in 1.6.0_29
Publisher Sun Microsystems, Inc.
Status Enabled
File date Monday, October 03, 2011, 5:06 AM
Version 1.6.0.29

Name Java Plug-in 1.6.0_29
Publisher Sun Microsystems, Inc.
Status Enabled
File date Monday, October 03, 2011, 5:06 AM
Version 6.0.290.11

Name Java Plug-in 1.6.0_29
Publisher Sun Microsystems, Inc.
Status Enabled
File date Monday, October 03, 2011, 5:06 AM
Version 6.0.290.11

Name Deployment Toolkit
Publisher Sun Microsystems, Inc.
Status Enabled
File date Monday, October 03, 2011, 5:06 AM
Version 6.0.290.11

DOWNLOADED CONTROLS:

Name Java Plug-in 1.6.0_29
Publisher Sun Microsystems, Inc.
Status Enabled
File date Monday, October 03, 2011, 5:06 AM
Version 1.6.0.29

Name Java Plug-in 1.6.0_29
Publisher Sun Microsystems, Inc.
Status Enabled
File date Monday, October 03, 2011, 5:06 AM
Version 1.6.0.29

Name Java Plug-in 1.6.0_29
Publisher Sun Microsystems, Inc.
Status Enabled
File date Monday, October 03, 2011, 5:06 AM
Version 1.6.0.29


ALL ADD-ONS:

Name Do Not Track Plus
Publisher Abine, Inc.
Status Enabled
File date Friday, February 10, 2012, 3:41 PM
Version 1.0.5330.210
Load time 0.01 s

Name Shockwave Flash Object
Publisher Adobe Systems Incorporated
Status Enabled
File date Sunday, November 20, 2011, 7:33 AM
Version 11.1.102.55

Name Shockwave ActiveX Control
Publisher Adobe Systems Incorporated
Status Enabled
File date Monday, June 13, 2011, 2:50 AM
Version 11.6

Name Adobe PDF Link Helper
Publisher Adobe Systems, Incorporated
Status Enabled
File date Monday, September 05, 2011, 11:04 AM
Version 10.1.1.33
Load time 0.00 s

Name Adobe PDF Reader
Publisher Adobe Systems, Incorporated
Status Enabled
File date Monday, September 05, 2011, 11:04 AM
Version 10.1.1.33

Name AVG Safe Search
Publisher AVG Technologies
Status Enabled
File date Friday, November 11, 2011, 2:29 AM
Version 12.0.0.1870
Load time 0.01 s

Name XML Data Source Object
Publisher Microsoft Corporation
Status Enabled
File date Monday, June 14, 2010, 1:41 AM
Version 8.100.1052.0

Name Free Threaded XML DOM Document
Publisher Microsoft Corporation
Status Enabled
File date Monday, June 14, 2010, 1:41 AM
Version 8.100.1052.0

Name XML HTTP 3.0
Publisher Microsoft Corporation
Status Enabled
File date Monday, June 14, 2010, 1:41 AM
Version 8.100.1052.0

Name XML DOM Document 3.0
Publisher Microsoft Corporation
Status Enabled
File date Monday, June 14, 2010, 1:41 AM
Version 8.100.1052.0

Name Scripting.Dictionary
Publisher Microsoft Corporation
Status Enabled
File date Friday, May 09, 2008, 4:53 AM
Version 5.7.0.18066

Name XML HTTP 6.0
Publisher Microsoft Corporation
Status Enabled
File date Friday, July 31, 2009, 9:05 AM
Version 6.20.1103.0

Name XML DOM Document 6.0
Publisher Microsoft Corporation
Status Enabled
File date Friday, July 31, 2009, 9:05 AM
Version 6.20.1103.0

Name Windows Media Player
Publisher Microsoft Corporation
Status Enabled
File date Thursday, August 26, 2010, 4:16 PM
Version 9.00.00.4510

Name Microsoft Shell UI Helper
Publisher Microsoft Corporation
Status Enabled
File date Friday, November 04, 2011, 1:20 PM
Version 8.00.6001.19165

Name XML Schema Cache
Publisher Microsoft Corporation
Status Enabled
File date Monday, June 14, 2010, 1:41 AM
Version 8.100.1052.0

Name Tabular Data Control
Publisher Microsoft Corporation
Status Enabled
File date Sunday, March 08, 2009, 3:30 AM
Version 8.00.6001.18702

Name HtmlDlgSafeHelper Class
Publisher Microsoft Corporation
Status Enabled
File date Friday, November 04, 2011, 1:20 PM
Version 8.00.6001.19165

Name XSL Template
Publisher Microsoft Corporation
Status Enabled
File date Monday, June 14, 2010, 1:41 AM
Version 8.100.1052.0

Name XML DOM Document
Publisher Microsoft Corporation
Status Enabled
File date Monday, June 14, 2010, 1:41 AM
Version 8.100.1052.0

Name Windows Messenger
Publisher Not Available
Status Disabled

Name Diagnose Connection Problems...
Publisher Not Available
Status Enabled

Name ieSpell Options
Publisher Not Available
Status Enabled

Name ieSpell
Publisher Not Available
Status Enabled

Name Java Plug-in 1.6.0_29
Publisher Sun Microsystems, Inc.
Status Enabled
File date Monday, October 03, 2011, 5:06 AM
Version 1.6.0.29

Name Java Plug-in 1.6.0_29
Publisher Sun Microsystems, Inc.
Status Enabled
File date Monday, October 03, 2011, 5:06 AM
Version 1.6.0.29

Name JQSIEStartDetectorImpl Class
Publisher Sun Microsystems, Inc.
Status Enabled
File date Tuesday, October 18, 2011, 6:05 PM
Version 6.0.290.11
Load time 0.00 s

Name Java(tm) Plug-In 2 SSV Helper
Publisher Sun Microsystems, Inc.
Status Enabled
File date Tuesday, October 18, 2011, 6:05 PM
Version 6.0.290.11
Load time 0.29 s

Name Deployment Toolkit
Publisher Sun Microsystems, Inc.
Status Enabled
File date Monday, October 03, 2011, 5:06 AM
Version 6.0.290.11

http://home.mindspring.com/~bgaston2/_images/DNTPlus.jpg

The Favorite bar is busy and more to come if those double chevrons are anything to go by, but I don't see that they should be a problem.

However, look at my IE9 here; http://img21.imageshack.us/img21/6011/ie9adt.jpg

I don't have ADT installed on my IE. The green button you see is WOT, despite what I typed in my image,

IE9 and IE8 are very similar but your IE8 looks entirely different. I wonder if that is because you are using XP and IE8 reverts to the older style because of that.

With that style of IE you should still be able to drag the Home toolbar up to the top, inline with the menu toolbar.

And, you should also be able to move icons from that toolbar around, even if it means returning them to the Customize dialog then calling them back again.

Interestingly it's a bit hit and miss on mine. For example I just displayed the Command toolbar, (from which right click I get the "Add/Remove commands" dialog box), and it was underneath the menu bar, but I couldn't move it. However I could move the WOT icon I have from the right back towards the Help menu icon, or move it up or down above or below the other toolbars, but it was hit and miss.

It's strange you have "Home" next to it, and "Home" twice. Is that because you have set the toolbars to display text as well as icons? If ADT doesn't have an alternative text name then I wonder if it has defaulted to a generic "Home".

One more thing. Font size. It's difficult to say if the image of your IE8 I am seeing on my system is full sized or not, but I wonder if the icon is too small to show characters inside it.

Like I said, ADT needed to test this with all browsers, all OSes, in all conditions screen resolution, font sizes, colors etc. Seems they didn't.

But your ADT pull down list seems fine.

Mark

Valve Software has confirmed that the unknown intruders that gained access to the database for its Steam game distribution platform in an attack late last year may have obtained a copy of a backup file of customer transactions.

In a news post, Valve co-founder and managing director Gabe Newell says that the backup file included transactions from between 2004 and 2008, adding that it contained user names and email addresses, as well as encrypted billing addresses and credit card information. However, this data did not include Steam account passwords, which were reportedly not accessed.

Newell goes on to note that Valve has no evidence that the credit card numbers and billing details have been compromised, but again advises users to carefully watch their credit card activity and statements as a precaution. The company is still investigating the intrusion and is working with law enforcement authorities.

http://www.h-online.com/security/news/item/Valve-hackers-may-have-gained-access-to-Steam-transactions-1433423.html

Also: Hackers Probably Stole Steam Transaction Data, Valve Says

Just in time for Valentine's Day, the privacy watchdogs over at the Electronic Frontier Foundation have put together a guide for those tempted to dance the algorithm electric. Their findings: online dating services may be getting around with your personal data.

Leading online dating sites hold onto customers' data, including profiles and photos, even after those customers have deleted them, EFF found. The report is just the latest to raise alarms about the data retention and privacy policies employed by burgeoning social networks, including Facebook.

Dating sites may hold onto profiles after a user believes he or she has deleted it to make it easier for users who have second thoughts to reactivate their account. Its harder to explain away the sites' poor data security, EFF said. Dating sites reviewed by EFF had failed to implement HTTPS - or secure HTTP- leaving users vulnerable to man in the middle attacks, especially on insecure WiFi hotspots. Worse still, many of the sites have been shown to be riddled with security holes. In a recent incident, the Web site Grindr was compromised, allowing attackers to impersonate other users on the network, which connects gay men with potential partners. The Web site for PlentyOfFish, was also rumored to be the target of an attack that compromised the personal information of its 30 million users, according to published reports.

Continued : http://threatpost.com/en_us/blogs/online-dating-sites-getting-around-customers-data-021312

Also:
Online Dating Sites: Seek Love, Find Privacy Violations
Privacy pitfalls of online dating