Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Entire cities dead on some World of Warcraft realms

wow.joystiq.com

Post reply on HN
Print view View original

81–90 of 179 posts

Re: Entire cities dead on some World of Warcraft realms

#81

Post by keithpeter »

klodolph wrote: post #60
patio11 wrote: post #24

Admin consoles: the soft underbelly of billion dollar software operations since... Seriously, though: you almost certainly have one if you run a software business. Client side SSH certificates are your friend. If you're not able to do that, because it is really annoying, separate it from the main app and lock it down as much as possible. (Separate authentication from the main site/app's authentication scheme. Lock do…

There are a few scenarios in which client-side certificates just aren't good enough by themselves. So you have folks administering the servers. A certain percentage of them need root access. One of them gets his certificate revoked and then laid off -- in that order -- but he already installed a back door account. Okay, so you're a good admin and you check the logs and make everyone use "sudo" for everything. * But m…

"Maybe he was editing a file in sudo with vi and ran ":! bash""

Ah, yes, works on a default Ubuntu desktop install provided you have vim installed (not the usual tiny-vim package that uses nano for visudo editing).

Re: Entire cities dead on some World of Warcraft realms

#82

Post by eli »

patio11 wrote: post #24

Admin consoles: the soft underbelly of billion dollar software operations since... Seriously, though: you almost certainly have one if you run a software business. Client side SSH certificates are your friend. If you're not able to do that, because it is really annoying, separate it from the main app and lock it down as much as possible. (Separate authentication from the main site/app's authentication scheme. Lock do…

Good advice, but I think you're underestimating the sort of attackers going after WoW. It's not going to be some drive-by script kiddies looking for an easy target... it's people specifically targeting this game. I'd be more worried about spearphishing and social engineering.

Re: Entire cities dead on some World of Warcraft realms

#83

Post by saraid216 »

JoeAltmaier wrote: post #66
njharman wrote: post #57

Earlier quoted context omitted.

> How many will pick up a book, or go for a walk, now that they no longer have their go-to fix of virtual reality. Statistically, Zero. Trust me, they are all madly typing on forums, mashing refresh, trying to find out / talking about what happened. > How many WOW addicts will have time to think "never again" and follow through. A few.

They are not all blogging. Very few do. Millions of WoW players are lazy slobs, who are tweeting their friends "bummer man" and maybe, just maybe, going out for a movie or a walk or something actually, concretely social for a change.

I challenge you to find ten.

Re: Entire cities dead on some World of Warcraft realms

#84

Post by willvarfar »

saraid216 wrote: post #77
pooriaazimi wrote: post #43

Earlier quoted context omitted.

Can someone explain what EVE is? And explain it like I don't know anything about it (and I don't). Wikipedia, etc. don't cut it and I still don't understand what EVE is and why people like it. Thanks a lot!

Let's slingshot you into the future, where empires span hundreds of solar systems, spaceships abound everywhere, cloning technology is available to an elite class called capsuleers, and human beings still act human. You're a capsuleer. A capsuleer is someone who can pilot certain specially designed ships. As someone who has ascended into virtual godhood by the benefit of effective immortality, you have entered a new…

suddenly I understand http://0x10c.com/ :)

Re: Entire cities dead on some World of Warcraft realms

#85

Post by danielweber »

klodolph wrote: post #60
patio11 wrote: post #24

Admin consoles: the soft underbelly of billion dollar software operations since... Seriously, though: you almost certainly have one if you run a software business. Client side SSH certificates are your friend. If you're not able to do that, because it is really annoying, separate it from the main app and lock it down as much as possible. (Separate authentication from the main site/app's authentication scheme. Lock do…

There are a few scenarios in which client-side certificates just aren't good enough by themselves. So you have folks administering the servers. A certain percentage of them need root access. One of them gets his certificate revoked and then laid off -- in that order -- but he already installed a back door account. Okay, so you're a good admin and you check the logs and make everyone use "sudo" for everything. * But m…

I once wrote a tool to automatically connect to all the company boxes. I became actually frightened by it, because in the wrong hands the tool could destroy the company in a matter of minutes. I eventually just deleted it and discouraged anyone from building another.

Re: Entire cities dead on some World of Warcraft realms

#86

Post by iso8859-1 »

keithpeter wrote: post #81
klodolph wrote: post #60

Earlier quoted context omitted.

There are a few scenarios in which client-side certificates just aren't good enough by themselves. So you have folks administering the servers. A certain percentage of them need root access. One of them gets his certificate revoked and then laid off -- in that order -- but he already installed a back door account. Okay, so you're a good admin and you check the logs and make everyone use "sudo" for everything. * But m…

"Maybe he was editing a file in sudo with vi and ran ":! bash"" Ah, yes, works on a default Ubuntu desktop install provided you have vim installed (not the usual tiny-vim package that uses nano for visudo editing).

why wouldn't it work? sudo -s works too. sudo su. sudo bash.

Re: Entire cities dead on some World of Warcraft realms

#87

Post by frostmatthew »

brador wrote: post #17

It's interesting to comprehend the amount of lives a hack like this will positively affect. How many will pick up a book, or go for a walk, now that they no longer have their go-to fix of virtual reality. How many WOW addicts will have time to think "never again" and follow through. Equivalent to all the cigarettes in the world vanishing for a few hours? Possibly. And equally as effective I say.

I'm not sure what they're doing but I bet none of them are posting disparaging comments about other people's hobbies. How people choose to entertain themselves in their free time is up to them (to the extent it doesn't cause harm to others). So let them enjoy their video game and you can enjoy whatever is you do when you're not knocking the hobbies of people you don't even know.

Re: Entire cities dead on some World of Warcraft realms

#88

Post by klodolph »

iso8859-1 wrote: post #86
keithpeter wrote: post #81

Earlier quoted context omitted.

"Maybe he was editing a file in sudo with vi and ran ":! bash"" Ah, yes, works on a default Ubuntu desktop install provided you have vim installed (not the usual tiny-vim package that uses nano for visudo editing).

why wouldn't it work? sudo -s works too. sudo su. sudo bash.

1) All sudo commands show up in the logs. You can put the logs on another server, possibly a server where only the head of IT has sudo privileges, possibly one that automatically replicates to other sites. Seeing a "sudo su", "sudo bash", or "sudo -s" in the logs could get you reprimanded, and if there's a security breach it could make you a suspect.

2) You can disable sudo -s, sudo su, and sudo bash. Maybe the people with root access only need to run a few commands and edit a few files as root, so you whitelist those. But as I mentioned, if they need to edit crontab you've probably given away the keys to the kingdom right there.

There are more attack vectors you can enable without knowing about it and you've got a business to run, so you make a cost/benefit analysis -- it's always a trade-off between efficiency and security.

Re: Entire cities dead on some World of Warcraft realms

#89

Post by [deleted] »

iso8859-1 wrote: post #86
keithpeter wrote: post #81

Earlier quoted context omitted.

"Maybe he was editing a file in sudo with vi and ran ":! bash"" Ah, yes, works on a default Ubuntu desktop install provided you have vim installed (not the usual tiny-vim package that uses nano for visudo editing).

why wouldn't it work? sudo -s works too. sudo su. sudo bash.

[deleted]

Re: Entire cities dead on some World of Warcraft realms

#90

Post by iso8859-1 »

aesopiate wrote: post #50
yozmsn wrote: post #41

Earlier quoted context omitted.

As it turns out there are a couple of guys publishing videos youtube of their, POV as the attacker/killer, so if the dot-pattern thing isn't a hoax then those guys are screwed... but from what I read it sounds like it's a bunch of guys who are annoyed that the hack exists and so they're abusing it until Blizzard fixes it.

The dot pattern only exists in in-game screenshots, and only if they're set to 9/10 quality or lower. They won't exist in a frapsesque video.

Source?
Post reply on HN