League of Legends compromised – North American accounts and transactions
beta.na.leagueoflegends.com
beta.na.leagueoflegends.com
My office plays League of Legends regularly. It's quite a fun game. This, however, isn't fun at all.
Is it just a fact of doing business in the modern internet age that everyone can and will eventually be pwned?
The best part of this is that it's obviously some legacy system that wasn't properly decommissioned. Think about it, the records haven't been in use for 2+ years? Sounds weird, right?
Remember, if it's on the network somebody can get to it and just because you don't use it anymore doesn't mean you can just stop patching the boxen :(.
If I read it correctly, only the payments part have been inactive for 2 years- probably because they switched to another system and just left the old records there. The rest of the database is likely to be a current production system though.
> Is it just a fact of doing business in the modern internet age that everyone can and will eventually be pwned?
Unless a company spends decent money on security auditing, pentesting, etc, then yes. It's ridiculous for a software company to be spending tens/hundreds of thousands of dollars a year on security for their physical offices, but to not have routine security audits for their digital property.
1. Just make sure the hack isn't something embarrassingly easy like SQL injection in the username/password field. If you get hacked, make sure the hacker had to do something really clever that any developer would go "whoa, that's not an exploit I see everyday..."
2. Assume a hacker got a bash shell to your system and apply the next level of security there. Salted hashes, PGP encryption on any sensitive data. Make sure the salt isn't sitting there in plain view and if pub/priv key, make sure the private-key isn't just sitting there on the same system without a passphrase.
http://en.wikipedia.org/wiki/Payment_Card_Industry_Data_Secu...
- Their passwords aren't case sensitive.
- Their login form's GET request isn't using https.
- Within 20 minutes of informing a security specialist not affiliated to blizzard he was able to write a script that compromised every single battle.net e-mail address.
* This information is based from about June 2012, I'm not sure if their security measures changed since then but I remember the thread on the bnet forums and it being confirmed by an official moderator-like person saying blizzard was aware of the problem for the longest time but didn't care about fixing it.
I never understood how game companies could be so lazy when it comes to security. They obviously have the talent to do things right and rake in silly amounts of $. Why jeopardize the integrity of their name.
Not a huge deal.
"- Within 20 minutes of informing a security specialist not affiliated to blizzard he was able to write a script that compromised every single battle.net e-mail address."
I don't remember this ever happening.
Wouldn't cutting your key search space roughly in half reduce your cracking time greatly, though?
According to Wolfram, for a 12 character password:
password type | total number | example
digits 0 through 9 | ~~ 2^40~~1 trillion | 287088364476
case-insensitive alphabetic | ~~ 2^56~~95.43 quadrillion | ycwcgndabspw
case-insensitive alphanumeric | ~~ 2^62~~4.738×10^18 | okcm5tfe8odr
case-sensitive alphabetic | ~~ 2^68~~3.909×10^20 | SgilPtNTKmuQ
case-sensitive alphanumeric | ~~ 2^71~~3.226×10^21 | xhWuSN5HBETz
printable ASCII characters | ~~ 2^79~~4.759×10^23 | [i{}I"2Bz9sN
On the other hand, if users choose their passwords themselves... Well I made a quick script to analyze the RockYou leak of 32 million plaintext passwords:
91% of passwords are lowercase
5% are uppercase
3% are lowercase but begin with a capital letter
In other words, you can crack 99% of case sensitive passwords just by trying these 3 possibilities!
More characters is always numerically better... but better, as they say, is the enemy of good enough.
And "more ornerous" is the enemy of a paying casual userbase and doesn't help you at all vs the most common attack vectors (keyloggers and social).
Because of blizzard server limits you're not going to brute force login to my battlenet account even if I tell you my username and half of my password.
If you steal the hashes you're probably not going to be able to do anything with it because of work factor key lengthening and the fact that you have to attack each account one at a time.
Even then let's say you've managed to steal blizzards user/salt/hash databases and put a small country's GDP worth of GPU resources into breaking all the passwords. Now you come up against the fact that the vast majority of the accounts, including prohibitively all of the best ones, have 2 factor authentication.
Get past those 3 mission impossibles and you run into even more server side limits on IP logins. And logging in and doing anything on accounts takes time and blizzard's going to quickly figure out something is going on and put the whole thing on lockdown.
So yeah, not a huge deal imho.
...
"bits of entropy" is just the binary log of the character space, 81 bits -> 2^81.
Then it clearly must have not happened.
It's on the bnet forums somewhere.
We just need to get used to using throw away credit card numbers from our credit card's website. Or buy game currency/points/time in stores, in the form of cards, to prevent giving out the info that will be pwned sooner or later, on one service or another.
And get used to using throwaway passwords. If your password being compromised on one service makes you worry about other services, you've already done it wrong.
I assume my passwords will be stolen. I even have a generic password I use for many sites that I do not and will never trust.
It could be stolen -- and hell probably has, knowing how many services have been pwned, and how many don't even realize it. But it won't give you anything close to access to any email, bank, or merchant website connected to my debit card, as they're all using unique passwords and 2-factor auth where available.
Startup Idea: Debit/Credit card services that provide not "throwaway" numbers, but separate numbers/info for every major subscription or service you use. Generate an Amazon number, an Xbox live number, a number for your cellphone payment. If any one number is compromised, it can be disabled and handled without any interruption or issue to other numbers and services.
In the age of constant pwning, a debit card that isolated the damage to that one service without any hassle or disruption to any other service would be brilliant. I know I'd pay for that. In fact, how easy would fraud monitoring be when the only charges to a specific number would be allowed from that 1 service. It makes the numbers useless outside of that 1 service you're using it for, even when stolen.
If I understand the service correctly, you can pre-approve companies before you are charged. I think this type of service can be useful outside of their target audience of the elderly.
Secure online account numbers is a free online service offering you added security by protecting your account number while shopping online. When you make a purchase with a merchant using a secure online account number, the number is assigned only to that particular merchant. Once a secure online account number is assigned, the merchant can use it for your future purchases with them unless you specify otherwise. Some merchants, such as Facebook, Amazon, and PayPal, will not be able to use the same secure online account number multiple times. When shopping with those merchants, you will need to use a new secure online account number each time.
Crytek: http://www.eurogamer.net/articles/2013-08-05-crytek-pulls-we...
Ubisoft: http://forums.ubi.com/showthread.php/779040-Security-update-...
And even the PSN outage in 2011.
I for one am sick and tired of these account breaches. Not only do account details get disclosed, but I am forced to create these accounts to access games which I play. I have a perfectly accessible steam account with an authentication API available that only a handful of games decide to not use.
If you want me to have another account, fine. But promise these two things: 1 - It is worth my time and effort to create the account (I think League of Legends is fine here,they have a large ecosystem, however my two examples above are not.) 2 - You take care of my details. (Which they have all failed.)
Is this simply a lack of SQL injection protection or is it the result of an attacker gaining access to the web/database servers?
I'd imagine that Riot Games operates a plethora of servers with one, central, very large database containing all customer billing information.
Large-scale attacks are usually coordinated with a collection of exploits, for example SQL injection can provide a means to utilize XSS for exploiting administrative interfaces leading to session hijacking. This can be useful for reconnaissance and analysis.
In the Activision/Blizzard buyback from Vivendi one of the investors was Tencent, owner of Riot. Meanwhile Blizzard is also developing a Dota-clone, Blizzard All-Stars.
Unfortunately I can't add anything more but I found that interesting.
Why oh why would you store the number. Utterly unnecessary for recurring billing.