Hacker News Reader

Blizzard is _literally_ under _constant_ attack and has an incredible security team in place. Obviously the only acceptable result is 100% attack deflection, but the idea that this could be or could have been anything short of an absolute top priority for the company is a ridiculous assertion that I'd expect on any other site, but not HN.

I'm a former Blizzard employee with knowledge of the situation and internal workings. EDIT: I am, of course, not remotely qualified to speak for Blizzard or the security team.

Security has nothing to do with preventing the attack, it's more so protecting the data much like a bank protects it's assets. It's pretty easy to break into a bank (they're merely glass and brick after all), but there is no way you're getting into that vault once inside and even so, if you get into the vault there are secondary security procedures in place to ensure that nothing is easily taken.

So regardless of whether or not Blizzard is under constant attack, just because someone can get in doesn't mean they should be able to take anything.. I really do hope Blizzard don't go into the banking industry because everyone will be lining up to steal what they can from the easily penetrable building and vault inside. There is no excuse.

If Blizzard is under constant attack, you'd think they'd be smarter about how data is stored and just what an attacker could see if they gained access to a database of any kind. So once again, my point was not about deflecting attacks because that's impossible, it's about making it almost impossible for the hacker to use any of the information he can access.

Did you really just insinuate that banks never get robbed?

I didn't say that at all. I said it's easy to break into a bank but getting into a vault in this day and age is impossible. And if you somehow by luck or knowledge get into the vault there are secondary, third, etc security procedures in place such as alarms, self-locking doors, cameras and heat/movement detectors.

A database is a vault. It's for storing things you don't want anyone to be able to access and even if a hacker can access it, they shouldn't be able to do anything with the data that they can see.

Banks get robbed all of the time, but the damage is minimal because the cash available over a counter is a write-down for a bank that keeps most of it's wealth in a vault onsite or offsite.

This metaphor seems compelling, but it breaks down when you consider that in a digital break in, nothing physical must be moved. Were vault breaches like database breaches, one would merely have to look at the money to have a personal copy of it. This is a very different security scenario.

Bank vaults versus databases are entirely different.

A bank vault can be locked down. It's only accessible for a small set of hours per day and access is only given to a small number of people. People also don't need random access to a bank vault.

Website databases are more like cash registers. They need to be accessible 24/7 and nearly every transaction requires accessing it. Any person off the street is allowed into the store and you also have to trust the person at the register to know what they're doing. Even if you cover the case in lead, it still needs to open when a customer comes in.

It's also important to note that Blizzard did have the digital equivalent of "alarms, self-locking doors, cameras and heat/movement detectors". Many other data breaches haven't been noticed for months, if at all. Blizzard have responded in a timely manner, likely due to internal digital tripwires.

There is a far closer digital example to a bank vault and that's a Bitcoin wallet[1]. You have a hot wallet that's accessible via the server with enough money in it for most transactions and then a cold wallet that requires a person to interact with it (i.e. decrypt) for it to be of use. In the spate of Bitcoin server breaches, those implementing hot/cold wallets only lost the "cash available over [the] counter".

[1]: https://en.bitcoin.it/wiki/Securing_online_services#Server_h...

Brainstorm:

A major site storing authentication data should store it in a separate physical server, isolate that machine so that administrative access is not possible from the net (NO path from the net through to ssh or console server access to the auth server should be possible... that includes internet -> internal employee machine -> auth storage server). NAT and firewalls are irrelevant, because they do not protect against incoming attacks through tunnels initiated inside.

That may mean physical console only login access, if the general internal network has internet access. That's a necessary usability trade-off something as serious as an authentication database for ten million paying customers.

The authentication protocol to talk to the auth server should only allow simple (easily parsed) requests; they should be rate-limited, there should be no provision to check multiple hashes at a time, and it should be impossible to export hashes out of the auth server without administrative (console) access.

Similarly prudent precautions can be taken for backups of the auth data. The backup server encrypts the auth database, before writing it to an attached disk or whatever the scheme is. Several high-level employees then have usb keys with asymmetric keys, any of which (or any n of which) will decrypt the backups.

You can't air gap the auth server, but you can limit the attack surface so dramatically that you have a high degree of assurance that it's secure against network attacks aimed at authentication data disclosure.

Someone can own the webservers and collect passwords and one time auth tokens, and can compromise 2-factor seeds for users who are just setting up 2-factor, but that's far more limited than gaining access to hashes or seeds from auth servers.

"I didn't say that at all. I said it's easy to break into a bank but getting into a vault in this day and age is impossible."

Robbing bank vaults may be rare but it still happens.

Just curious, are you actually a data security professional? Because while you have a very nice metaphor with the whole bank vault thing, you haven't offered any actual examples, or any specific criticisms of Blizzard's setup (not that we know what it was), or even examples of what you're talking about.

I know nothing about data security myself, but I'm not exactly learning anything about it from your posts. Sorry to be rudely blunt, but I've seen a lot of people who have no idea what Blizzard is up against, the difficulty/feasibility of protecting digital data, what Blizzard has in place, or even what Blizzard could/should have in place really criticizing Blizzard for incompetence here, and that's odd to me.

I may or may not be a data security professional, but I hardly see how that would make anything I've said more or less credible. Without knowing how Blizzard have set up their infrastructure, I can't really give any examples because each environment is different and requires different forms of security and protocols in place.

While Blizzard were apparently using SRP and while I can't say for sure I am guessing Blizzard are using the SRP authentication algorithm out-of-the-box which is bad for a number of reasons, but the main one being SRP by default is an over-glorified way of SHA1 encrypted and salting a password and by the sounds of it the hackers were able to access those salts and could theoretically brute force the passwords which by todays hardware capabilities is not very hard at all, this is LinkedIn all over again.

Take a look at the SRP design specification: http://srp.stanford.edu/design.html - if Blizzard didn't modify the algorithm, I think we've yet to see the full effects of this breach. LinkedIn learned the hard way and now one of the worlds largest multiplayer gaming companies is about to find out what a simple mistake like this can do. I hope for their sakes they customised SRP and if they didn't, I think we have the right to know.

As a Battle.net account holder, I have the right to voice my concerns about this. I paid money for the privilege of playing Blizzard's games - fortunately my Battle.net password is separate to that of any other account I have, but I feel sorry for the millions who re-use their password for their email accounts, Internet banking and other various accounts that could have all kinds of effects.

Would you mind stating what weaknesses you see in the unmodified SRP? Against a server compromise it's equivalent to salted hash storage, but it's impossible, in general, to do better without losing the ability to authenticate using the password (only).

Edit: do you mean the weakness of salted SHA-1? SRP is not defined for SHA-1 only.

Not speaking for the security team, how likely would it be that this was an attack using reused passwords from another website?

How likely, specifically, is it that someone got into one or multiple employee accounts, found the admin console password lying around (or in an onboarding email that wasn't deleted, or in chat logs), and then accessed the internal admin site? The list of what was taken looks like it's straight from what a Support Rep would need to deal with password resets, OTPs, etc.

I imagine something like you describe would have resulted in a different subset of information being compromised.

You are pointing your anger in the wrong direction. The reality is that security is a hard problem, much too hard for Blizzard, much too hard for RSA, much too hard for banks, and much too hard for governments.

Major companies being hacked is not a new phenomenon. What's new is them (a) detecting the hacks and (b) disclosing them. It's unfortunate but true; you should be happy that they are telling you.

You misunderstood my entire comment, but I can see why you would think I was angry. I'm disappointed, not angry. Disappointed that in this day and age, companies like Blizzard are making record profits and fall prey to attacks that are sometimes as simple as an SQL injection attack. While I am grateful they have told us about the attack, I'd much prefer the situation went like this: "We've been attacked, our database was compromised but because everything important is encrypted all they have is your email address"

Well, they're using SRP for authentication, which I didn't know about (and I don't consider myself especially illiterate when it comes to security), so it doesn't sound like they don't care about it.

Blizzard operates in a free market. Average consumers don't care that much about security until something happens, then they forget. Therefore, security isn't a priority to Blizzard. It is really as simple as that.

Security seems like a priority at Blizzard based on everything I know.

Priority =/= invulnerability.

I was able to get an authenticator from Blizzrd years before my bank made it possible to do the same.

They care about security if only because they lose a lot of money spending time to fix up hacked accounts, and this will be even worse now they have a real-money auction house. In WoW they can just rollback items and if they duplicate some that were sold off by attackers it's no big deal. If they start duplicating real money then they need to pay out on it.

Blizzard doesn't exactly target "average consumers". Many WoW players are very serious gamers, and StarCraft is played for $$$.