League of Legends compromised – North American accounts and transactions
beta.na.leagueoflegends.com
League of Legends compromised – North American accounts and transactions
1–10 of 32 posts
Re: League of Legends compromised – North American accounts and transactions
#2Sigh.
My office plays League of Legends regularly. It's quite a fun game. This, however, isn't fun at all.
Is it just a fact of doing business in the modern internet age that everyone can and will eventually be pwned?
The best part of this is that it's obviously some legacy system that wasn't properly decommissioned. Think about it, the records haven't been in use for 2+ years? Sounds weird, right?
Remember, if it's on the network somebody can get to it and just because you don't use it anymore doesn't mean you can just stop patching the boxen :(.
Re: League of Legends compromised – North American accounts and transactions
#3Riot should be a case study on how to handle leaks. Immediately releasing all that they know and forcing password resets. Good on them!
Re: League of Legends compromised – North American accounts and transactions
#4Sigh. My office plays League of Legends regularly. It's quite a fun game. This, however, isn't fun at all. Is it just a fact of doing business in the modern internet age that everyone can and will eventually be pwned? The best part of this is that it's obviously some legacy system that wasn't properly decommissioned. Think about it, the records haven't been in use for 2+ years? Sounds weird, right? Remember, if it's…
> Think about it, the records haven't been in use for 2+ years?
If I read it correctly, only the payments part have been inactive for 2 years- probably because they switched to another system and just left the old records there. The rest of the database is likely to be a current production system though.
> Is it just a fact of doing business in the modern internet age that everyone can and will eventually be pwned?
Unless a company spends decent money on security auditing, pentesting, etc, then yes. It's ridiculous for a software company to be spending tens/hundreds of thousands of dollars a year on security for their physical offices, but to not have routine security audits for their digital property.
Re: League of Legends compromised – North American accounts and transactions
#5Sigh. My office plays League of Legends regularly. It's quite a fun game. This, however, isn't fun at all. Is it just a fact of doing business in the modern internet age that everyone can and will eventually be pwned? The best part of this is that it's obviously some legacy system that wasn't properly decommissioned. Think about it, the records haven't been in use for 2+ years? Sounds weird, right? Remember, if it's…
Pretty much. Look at company's like Blizzard who are even bigger.
- Their passwords aren't case sensitive.
- Their login form's GET request isn't using https.
- Within 20 minutes of informing a security specialist not affiliated to blizzard he was able to write a script that compromised every single battle.net e-mail address.
* This information is based from about June 2012, I'm not sure if their security measures changed since then but I remember the thread on the bnet forums and it being confirmed by an official moderator-like person saying blizzard was aware of the problem for the longest time but didn't care about fixing it.
I never understood how game companies could be so lazy when it comes to security. They obviously have the talent to do things right and rake in silly amounts of $. Why jeopardize the integrity of their name.
Re: League of Legends compromised – North American accounts and transactions
#6Riot should be a case study on how to handle leaks. Immediately releasing all that they know and forcing password resets. Good on them!
Also a case study on how not to store passwords. They enforce a maximum length on the user's password. It's something short, like 12 chars. The only reason they would enforce a maximum length is if they were storing the plaintext password in a database somewhere.
Re: League of Legends compromised – North American accounts and transactions
#7Not really related but just read a few days ago:
In the Activision/Blizzard buyback from Vivendi one of the investors was Tencent, owner of Riot. Meanwhile Blizzard is also developing a Dota-clone, Blizzard All-Stars.
Unfortunately I can't add anything more but I found that interesting.
Re: League of Legends compromised – North American accounts and transactions
#8Sigh. My office plays League of Legends regularly. It's quite a fun game. This, however, isn't fun at all. Is it just a fact of doing business in the modern internet age that everyone can and will eventually be pwned? The best part of this is that it's obviously some legacy system that wasn't properly decommissioned. Think about it, the records haven't been in use for 2+ years? Sounds weird, right? Remember, if it's…
> Think about it, the records haven't been in use for 2+ years? If I read it correctly, only the payments part have been inactive for 2 years- probably because they switched to another system and just left the old records there. The rest of the database is likely to be a current production system though. > Is it just a fact of doing business in the modern internet age that everyone can and will eventually be pwned? U…
I don't think it matters how much money a company spends on security, it'll get hacked if there's strong incentive for that event to occur. Basically, if you're popular... just assume you'll be hacked one day. I think there are only really 2 things you can do.
1. Just make sure the hack isn't something embarrassingly easy like SQL injection in the username/password field. If you get hacked, make sure the hacker had to do something really clever that any developer would go "whoa, that's not an exploit I see everyday..."
2. Assume a hacker got a bash shell to your system and apply the next level of security there. Salted hashes, PGP encryption on any sensitive data. Make sure the salt isn't sitting there in plain view and if pub/priv key, make sure the private-key isn't just sitting there on the same system without a passphrase.
Re: League of Legends compromised – North American accounts and transactions
#9Sigh. My office plays League of Legends regularly. It's quite a fun game. This, however, isn't fun at all. Is it just a fact of doing business in the modern internet age that everyone can and will eventually be pwned? The best part of this is that it's obviously some legacy system that wasn't properly decommissioned. Think about it, the records haven't been in use for 2+ years? Sounds weird, right? Remember, if it's…
I do assume that almost all online services will be pwned. I have a small amount of faith that my Google account, Amazon account, and (major) bank account won't be compromised except by my government. Maybe a few other services are this trustworthy to me, but not many, and I can't think of them off the top of my head.
We just need to get used to using throw away credit card numbers from our credit card's website. Or buy game currency/points/time in stores, in the form of cards, to prevent giving out the info that will be pwned sooner or later, on one service or another.
And get used to using throwaway passwords. If your password being compromised on one service makes you worry about other services, you've already done it wrong.
I assume my passwords will be stolen. I even have a generic password I use for many sites that I do not and will never trust.
It could be stolen -- and hell probably has, knowing how many services have been pwned, and how many don't even realize it. But it won't give you anything close to access to any email, bank, or merchant website connected to my debit card, as they're all using unique passwords and 2-factor auth where available.
Startup Idea: Debit/Credit card services that provide not "throwaway" numbers, but separate numbers/info for every major subscription or service you use. Generate an Amazon number, an Xbox live number, a number for your cellphone payment. If any one number is compromised, it can be disabled and handled without any interruption or issue to other numbers and services.
In the age of constant pwning, a debit card that isolated the damage to that one service without any hassle or disruption to any other service would be brilliant. I know I'd pay for that. In fact, how easy would fraud monitoring be when the only charges to a specific number would be allowed from that 1 service. It makes the numbers useless outside of that 1 service you're using it for, even when stolen.
Re: League of Legends compromised – North American accounts and transactions
#10What types of attacks are commonly used to compromise information like this?
Is this simply a lack of SQL injection protection or is it the result of an attacker gaining access to the web/database servers?