Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

League of Legends compromised – North American accounts and transactions

beta.na.leagueoflegends.com

Post reply on HN
Print view View original

11–20 of 32 posts

Re: League of Legends compromised – North American accounts and transactions

#11

Post by GuiA »

smtddr wrote: post #8
GuiA wrote: post #4

Earlier quoted context omitted.

> Think about it, the records haven't been in use for 2+ years? If I read it correctly, only the payments part have been inactive for 2 years- probably because they switched to another system and just left the old records there. The rest of the database is likely to be a current production system though. > Is it just a fact of doing business in the modern internet age that everyone can and will eventually be pwned? U…

I don't think it matters how much money a company spends on security, it'll get hacked if there's strong incentive for that event to occur. Basically, if you're popular... just assume you'll be hacked one day. I think there are only really 2 things you can do. 1. Just make sure the hack isn't something embarrassingly easy like SQL injection in the username/password field. If you get hacked, make sure the hacker had t…

I agree with you, but spending some money on security auditing is a pre-requisite for 1) to happen :)

Re: League of Legends compromised – North American accounts and transactions

#12

Post by Steko »

rartichoke wrote: post #5
josh2600 wrote: post #2

Sigh. My office plays League of Legends regularly. It's quite a fun game. This, however, isn't fun at all. Is it just a fact of doing business in the modern internet age that everyone can and will eventually be pwned? The best part of this is that it's obviously some legacy system that wasn't properly decommissioned. Think about it, the records haven't been in use for 2+ years? Sounds weird, right? Remember, if it's…

Pretty much. Look at company's like Blizzard who are even bigger. - Their passwords aren't case sensitive. - Their login form's GET request isn't using https. - Within 20 minutes of informing a security specialist not affiliated to blizzard he was able to write a script that compromised every single battle.net e-mail address. * This information is based from about June 2012, I'm not sure if their security measures ch…

"- Their passwords aren't case sensitive."

Not a huge deal.

"- Within 20 minutes of informing a security specialist not affiliated to blizzard he was able to write a script that compromised every single battle.net e-mail address."

I don't remember this ever happening.

Re: League of Legends compromised – North American accounts and transactions

#13

Post by adrr »

smtddr wrote: post #8
GuiA wrote: post #4

Earlier quoted context omitted.

> Think about it, the records haven't been in use for 2+ years? If I read it correctly, only the payments part have been inactive for 2 years- probably because they switched to another system and just left the old records there. The rest of the database is likely to be a current production system though. > Is it just a fact of doing business in the modern internet age that everyone can and will eventually be pwned? U…

I don't think it matters how much money a company spends on security, it'll get hacked if there's strong incentive for that event to occur. Basically, if you're popular... just assume you'll be hacked one day. I think there are only really 2 things you can do. 1. Just make sure the hack isn't something embarrassingly easy like SQL injection in the username/password field. If you get hacked, make sure the hacker had t…

Good advice. I'll add one more thing. If you're dealing with credit cards, the private key should be on a hardware security device with the only backups stored on a couple USB sticks sitting in a safety deposit box at a bank.

Re: League of Legends compromised – North American accounts and transactions

#14

Post by Casseres »

criley2 wrote: post #9
josh2600 wrote: post #2

Sigh. My office plays League of Legends regularly. It's quite a fun game. This, however, isn't fun at all. Is it just a fact of doing business in the modern internet age that everyone can and will eventually be pwned? The best part of this is that it's obviously some legacy system that wasn't properly decommissioned. Think about it, the records haven't been in use for 2+ years? Sounds weird, right? Remember, if it's…

I do assume that almost all online services will be pwned. I have a small amount of faith that my Google account, Amazon account, and (major) bank account won't be compromised except by my government. Maybe a few other services are this trustworthy to me, but not many, and I can't think of them off the top of my head. We just need to get used to using throw away credit card numbers from our credit card's website. Or…

https://www.truelinkcard.com/

If I understand the service correctly, you can pre-approve companies before you are charged. I think this type of service can be useful outside of their target audience of the elderly.

Re: League of Legends compromised – North American accounts and transactions

#16

Post by GuiA »

adrr wrote: post #13
smtddr wrote: post #8

Earlier quoted context omitted.

I don't think it matters how much money a company spends on security, it'll get hacked if there's strong incentive for that event to occur. Basically, if you're popular... just assume you'll be hacked one day. I think there are only really 2 things you can do. 1. Just make sure the hack isn't something embarrassingly easy like SQL injection in the username/password field. If you get hacked, make sure the hacker had t…

Good advice. I'll add one more thing. If you're dealing with credit cards, the private key should be on a hardware security device with the only backups stored on a couple USB sticks sitting in a safety deposit box at a bank.

If you're dealing with credit cards, you have much more to do than that:

http://en.wikipedia.org/wiki/Payment_Card_Industry_Data_Secu...

Re: League of Legends compromised – North American accounts and transactions

#17

Post by dtparr »

criley2 wrote: post #9
josh2600 wrote: post #2

Sigh. My office plays League of Legends regularly. It's quite a fun game. This, however, isn't fun at all. Is it just a fact of doing business in the modern internet age that everyone can and will eventually be pwned? The best part of this is that it's obviously some legacy system that wasn't properly decommissioned. Think about it, the records haven't been in use for 2+ years? Sounds weird, right? Remember, if it's…

I do assume that almost all online services will be pwned. I have a small amount of faith that my Google account, Amazon account, and (major) bank account won't be compromised except by my government. Maybe a few other services are this trustworthy to me, but not many, and I can't think of them off the top of my head. We just need to get used to using throw away credit card numbers from our credit card's website. Or…

That's actually how the Discover Card Secure Online number work, although apparently some merchants can't use them. From their FAQ, https://www.discover.com/credit-cards/help-center/faqs/soan.... :

Secure online account numbers is a free online service offering you added security by protecting your account number while shopping online. When you make a purchase with a merchant using a secure online account number, the number is assigned only to that particular merchant. Once a secure online account number is assigned, the merchant can use it for your future purchases with them unless you specify otherwise. Some merchants, such as Facebook, Amazon, and PayPal, will not be able to use the same secure online account number multiple times. When shopping with those merchants, you will need to use a new secure online account number each time.

Re: League of Legends compromised – North American accounts and transactions

#18

Post by adrr »

GuiA wrote: post #16
adrr wrote: post #13

Earlier quoted context omitted.

Good advice. I'll add one more thing. If you're dealing with credit cards, the private key should be on a hardware security device with the only backups stored on a couple USB sticks sitting in a safety deposit box at a bank.

If you're dealing with credit cards, you have much more to do than that: http://en.wikipedia.org/wiki/Payment_Card_Industry_Data_Secu...

Well thats a given since your merchant bank and processor will force you to be PCI compliant including annual reviews. PCI compliance doesn't specify where your private key is stored just that your data is in a "unreadable" state and that you have certain key management procedures in places. For example, hashing your credit cards is acceptable though it can easily be brute forced since its just 16 digit number and the six digit prefix set(BIN) is already known.

Re: League of Legends compromised – North American accounts and transactions

#19

Post by Ardren »

polemic wrote: post #15

> "approximately 120,000 transaction records from 2011 that contained hashed and salted credit card numbers have been accessed" Why oh why would you store the number. Utterly unnecessary for recurring billing.

The only thing that comes to mind is fraud prevention? But that only works if it's a global salt, rather than a per user/card salt.

Re: League of Legends compromised – North American accounts and transactions

#20

Post by Pengwin »

Oculus wrote: post #3

Riot should be a case study on how to handle leaks. Immediately releasing all that they know and forcing password resets. Good on them!

This has happened numerous times this year. The same response to me both these times.

Crytek: http://www.eurogamer.net/articles/2013-08-05-crytek-pulls-we...

Ubisoft: http://forums.ubi.com/showthread.php/779040-Security-update-...

And even the PSN outage in 2011.

I for one am sick and tired of these account breaches. Not only do account details get disclosed, but I am forced to create these accounts to access games which I play. I have a perfectly accessible steam account with an authentication API available that only a handful of games decide to not use.

If you want me to have another account, fine. But promise these two things: 1 - It is worth my time and effort to create the account (I think League of Legends is fine here,they have a large ecosystem, however my two examples above are not.) 2 - You take care of my details. (Which they have all failed.)

Post reply on HN