Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Blizzard Network Breached; Change Your Battle.Net Passwords

kotaku.com

Post reply on HN
Print view View original

91–100 of 164 posts

Re: Blizzard Network Breached; Change Your Battle.Net Passwords

#91

Post by Steko »

Digitalxero wrote: post #66

So I went to update my password for my World of Warcraft account after I saw this. And guess what I discovered, my current password is more secure than their current password policy will allow. So I filled out a support ticket with the following question (which all Blizzard account holders should ask them) I was wondering why even after you discovered a security breach you have not updated your password policy to act…

You can't brute force Blizzard passwords because they have server side limits.

Re: Blizzard Network Breached; Change Your Battle.Net Passwords

#92

Post by lwat »

Steko wrote: post #91
Digitalxero wrote: post #66

So I went to update my password for my World of Warcraft account after I saw this. And guess what I discovered, my current password is more secure than their current password policy will allow. So I filled out a support ticket with the following question (which all Blizzard account holders should ask them) I was wondering why even after you discovered a security breach you have not updated your password policy to act…

You can't brute force Blizzard passwords because they have server side limits.

But in this case the server was compromised, so they can sit at home and brute force the hashes all day long.

Re: Blizzard Network Breached; Change Your Battle.Net Passwords

#93

Post by DrStalker »

Steko wrote: post #27
zheng wrote: post #22

Earlier quoted context omitted.

Blizzard operates in a free market. Average consumers don't care that much about security until something happens, then they forget. Therefore, security isn't a priority to Blizzard. It is really as simple as that.

Security seems like a priority at Blizzard based on everything I know. Priority =/= invulnerability.

I was able to get an authenticator from Blizzrd years before my bank made it possible to do the same.

They care about security if only because they lose a lot of money spending time to fix up hacked accounts, and this will be even worse now they have a real-money auction house. In WoW they can just rollback items and if they duplicate some that were sold off by attackers it's no big deal. If they start duplicating real money then they need to pay out on it.

Re: Blizzard Network Breached; Change Your Battle.Net Passwords

#94

Post by zaroth »

SRP is great at many things, but terrible at securing the server-side password database from brute force attacks.

A quick look at http://srp.stanford.edu/design.html and http://srp.stanford.edu/demo/demo.html and you can see that SRP uses simple SHA1 plus a Salt to store the hashed passwords.

With the hashes and salts stolen, please assume your password has been brute forced by the attacker (1 billion hashes per second with SHA1 is not expensive). This is LinkedIn all over again.

If Blizzard customized their SRP algorithm to use a more expensive hash than SHA1, they should come out and say it.

Otherwise, we should assume their statement that using SRP "means that each password would have to be deciphered individually" is nothing more than a salted SHA1. Combined with their reduced entropy password policy, all stored passwords are likely brute forced already.

Re: Blizzard Network Breached; Change Your Battle.Net Passwords

#95

Post by zaroth »

SRP is great at many things, but terrible at securing the server-side password database from brute force attacks.

A quick look at http://srp.stanford.edu/design.html and http://srp.stanford.edu/demo/demo.html and you can see that SRP uses simple SHA1 plus a Salt to store the hashed passwords.

With the hashes and salts stolen, please assume your password has been brute forced by the attacker (1 billion hashes per second with SHA1 not expensive). This is LinkedIn all over again.

If Blizzard customized their SRP algorithm to use a more expensive hash than SHA1, they should come out and say it.

Otherwise, we should assume their statement that using SRP "means that each password would have to be deciphered individually" is nothing more than a salted SHA1. Combined with their reduced entropy password policy, all stored passwords are likely brute forced already.

Re: Blizzard Network Breached; Change Your Battle.Net Passwords

#96

Post by DigitalSea »

dagrz wrote: post #75
DigitalSea wrote: post #19

This is ridiculous. Maybe the world is ending, because it feels like every major website/provider of some popular service is getting hacked these days. A company of Blizzard's stature and wallet size has no excuse for this kind of thing happening, no excuse at all. If you're charging people exorbitant amounts of cash to buy your games and then charging some of your customers a fee for the privilege of using your so-c…

You are pointing your anger in the wrong direction. The reality is that security is a hard problem, much too hard for Blizzard, much too hard for RSA, much too hard for banks, and much too hard for governments. Major companies being hacked is not a new phenomenon. What's new is them (a) detecting the hacks and (b) disclosing them. It's unfortunate but true; you should be happy that they are telling you.

You misunderstood my entire comment, but I can see why you would think I was angry. I'm disappointed, not angry. Disappointed that in this day and age, companies like Blizzard are making record profits and fall prey to attacks that are sometimes as simple as an SQL injection attack. While I am grateful they have told us about the attack, I'd much prefer the situation went like this: "We've been attacked, our database was compromised but because everything important is encrypted all they have is your email address"

Re: Blizzard Network Breached; Change Your Battle.Net Passwords

#97

Post by Smerity »

DigitalSea wrote: post #79
Steko wrote: post #70

Earlier quoted context omitted.

Did you really just insinuate that banks never get robbed?

I didn't say that at all. I said it's easy to break into a bank but getting into a vault in this day and age is impossible. And if you somehow by luck or knowledge get into the vault there are secondary, third, etc security procedures in place such as alarms, self-locking doors, cameras and heat/movement detectors. A database is a vault. It's for storing things you don't want anyone to be able to access and even if a…

Bank vaults versus databases are entirely different.

A bank vault can be locked down. It's only accessible for a small set of hours per day and access is only given to a small number of people. People also don't need random access to a bank vault.

Website databases are more like cash registers. They need to be accessible 24/7 and nearly every transaction requires accessing it. Any person off the street is allowed into the store and you also have to trust the person at the register to know what they're doing. Even if you cover the case in lead, it still needs to open when a customer comes in.

It's also important to note that Blizzard did have the digital equivalent of "alarms, self-locking doors, cameras and heat/movement detectors". Many other data breaches haven't been noticed for months, if at all. Blizzard have responded in a timely manner, likely due to internal digital tripwires.

There is a far closer digital example to a bank vault and that's a Bitcoin wallet[1]. You have a hot wallet that's accessible via the server with enough money in it for most transactions and then a cold wallet that requires a person to interact with it (i.e. decrypt) for it to be of use. In the spate of Bitcoin server breaches, those implementing hot/cold wallets only lost the "cash available over [the] counter".

[1]: https://en.bitcoin.it/wiki/Securing_online_services#Server_h...

Re: Blizzard Network Breached; Change Your Battle.Net Passwords

#99

Post by thechut »

zaroth wrote: post #94

SRP is great at many things, but terrible at securing the server-side password database from brute force attacks. A quick look at http://srp.stanford.edu/design.html and http://srp.stanford.edu/demo/demo.html and you can see that SRP uses simple SHA1 plus a Salt to store the hashed passwords. With the hashes and salts stolen, please assume your password has been brute forced by the attacker (1 billion hashes per seco…

SRP is supposed to make use of multiple types of entropy to ensure the passwords are far more complicated that salted SHA1.

While I agree it's possible that the attackers also got this information but I don't think we can jump to conclusions about the overall security of the passwords until more information is known.

Re: Blizzard Network Breached; Change Your Battle.Net Passwords

#100

Post by Bloodwine »

swang wrote: post #4

"Some data was illegally accessed, including a list of email addresses for global Battle.net users, outside of China. For players on North American servers (which generally includes players from North America, Latin America, Australia, New Zealand, and Southeast Asia) the answer to the personal security question, and information relating to Mobile and Dial-In Authenticators were also accessed. Based on what we curren…

When storing data on my server I always treat secret questions and answers the same as passwords, because that is exactly what they are. What use is a strong password if a weak secret answer can unlock the account? I salt and hash the secret answers just as I would passwords themselves.
Post reply on HN