Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

League of Legends compromised – North American accounts and transactions

beta.na.leagueoflegends.com

Post reply on HN
Print view View original

21–30 of 32 posts

Re: League of Legends compromised – North American accounts and transactions

#21

Post by jared314 »

dtparr wrote: post #17
criley2 wrote: post #9

Earlier quoted context omitted.

I do assume that almost all online services will be pwned. I have a small amount of faith that my Google account, Amazon account, and (major) bank account won't be compromised except by my government. Maybe a few other services are this trustworthy to me, but not many, and I can't think of them off the top of my head. We just need to get used to using throw away credit card numbers from our credit card's website. Or…

That's actually how the Discover Card Secure Online number work, although apparently some merchants can't use them. From their FAQ, https://www.discover.com/credit-cards/help-center/faqs/soan.... : Secure online account numbers is a free online service offering you added security by protecting your account number while shopping online. When you make a purchase with a merchant using a secure online account number, the…

Just make sure you keep track of the number you used, or be able to find it in your statements, because some customer validation systems require parts of the CC number. I've had to stall customer service reps several times because I had forgotten.

Re: League of Legends compromised – North American accounts and transactions

#23

Post by Karunamon »

Steko wrote: post #12
rartichoke wrote: post #5

Earlier quoted context omitted.

Pretty much. Look at company's like Blizzard who are even bigger. - Their passwords aren't case sensitive. - Their login form's GET request isn't using https. - Within 20 minutes of informing a security specialist not affiliated to blizzard he was able to write a script that compromised every single battle.net e-mail address. * This information is based from about June 2012, I'm not sure if their security measures ch…

"- Their passwords aren't case sensitive." Not a huge deal. "- Within 20 minutes of informing a security specialist not affiliated to blizzard he was able to write a script that compromised every single battle.net e-mail address." I don't remember this ever happening.

>Not a huge deal.

Wouldn't cutting your key search space roughly in half reduce your cracking time greatly, though?

According to Wolfram, for a 12 character password:

    password type | total number | example
    digits 0 through 9 | ~~ 2^40~~1 trillion | 287088364476
    case-insensitive alphabetic | ~~ 2^56~~95.43 quadrillion | ycwcgndabspw
    case-insensitive alphanumeric | ~~ 2^62~~4.738×10^18 | okcm5tfe8odr
    case-sensitive alphabetic | ~~ 2^68~~3.909×10^20 | SgilPtNTKmuQ
    case-sensitive alphanumeric | ~~ 2^71~~3.226×10^21 | xhWuSN5HBETz
    printable ASCII characters | ~~ 2^79~~4.759×10^23 | [i{}I"2Bz9sN
The difference comes out to be 6.7 bits of entropy for a 12 chraracter, case sensitive and case insensitive alphanumeric with symbols. 81.38 vs 88.08. (Note that this "bits of entropy" number is mostly beyond my comprehension.. could anyone elaborate a bit? I'd assume more==better)

Re: League of Legends compromised – North American accounts and transactions

#24

Post by enraged_camel »

Steko wrote: post #12
rartichoke wrote: post #5

Earlier quoted context omitted.

Pretty much. Look at company's like Blizzard who are even bigger. - Their passwords aren't case sensitive. - Their login form's GET request isn't using https. - Within 20 minutes of informing a security specialist not affiliated to blizzard he was able to write a script that compromised every single battle.net e-mail address. * This information is based from about June 2012, I'm not sure if their security measures ch…

"- Their passwords aren't case sensitive." Not a huge deal. "- Within 20 minutes of informing a security specialist not affiliated to blizzard he was able to write a script that compromised every single battle.net e-mail address." I don't remember this ever happening.

>>I don't remember this ever happening.

Then it clearly must have not happened.

Re: League of Legends compromised – North American accounts and transactions

#25

Post by ihsw »

antiglacier wrote: post #10

What types of attacks are commonly used to compromise information like this? Is this simply a lack of SQL injection protection or is it the result of an attacker gaining access to the web/database servers?

Some variety of exploits probably lead to this, for example communication to their internal servers from their public servers may not have been isolated well enough from the outside world (providing a proverbial window into their internal system of services, databases, and APIs).

I'd imagine that Riot Games operates a plethora of servers with one, central, very large database containing all customer billing information.

Large-scale attacks are usually coordinated with a collection of exploits, for example SQL injection can provide a means to utilize XSS for exploiting administrative interfaces leading to session hijacking. This can be useful for reconnaissance and analysis.

Re: League of Legends compromised – North American accounts and transactions

#26

Post by qnr »

Karunamon wrote: post #23
Steko wrote: post #12

Earlier quoted context omitted.

"- Their passwords aren't case sensitive." Not a huge deal. "- Within 20 minutes of informing a security specialist not affiliated to blizzard he was able to write a script that compromised every single battle.net e-mail address." I don't remember this ever happening.

>Not a huge deal. Wouldn't cutting your key search space roughly in half reduce your cracking time greatly, though? According to Wolfram, for a 12 character password: password type | total number | example digits 0 through 9 | ~~ 2^40~~1 trillion | 287088364476 case-insensitive alphabetic | ~~ 2^56~~95.43 quadrillion | ycwcgndabspw case-insensitive alphanumeric | ~~ 2^62~~4.738×10^18 | okcm5tfe8odr case-sensitive alp…

I agree with Steko that being case insensitive is not a big deal. If you force users to use randomly generated passwords, 12+ characters is safe whether case sensitive or not.

On the other hand, if users choose their passwords themselves... Well I made a quick script to analyze the RockYou leak of 32 million plaintext passwords:

91% of passwords are lowercase

5% are uppercase

3% are lowercase but begin with a capital letter

In other words, you can crack 99% of case sensitive passwords just by trying these 3 possibilities!

Re: League of Legends compromised – North American accounts and transactions

#27

Post by Lapsa »

rartichoke wrote: post #5
josh2600 wrote: post #2

Sigh. My office plays League of Legends regularly. It's quite a fun game. This, however, isn't fun at all. Is it just a fact of doing business in the modern internet age that everyone can and will eventually be pwned? The best part of this is that it's obviously some legacy system that wasn't properly decommissioned. Think about it, the records haven't been in use for 2+ years? Sounds weird, right? Remember, if it's…

Pretty much. Look at company's like Blizzard who are even bigger. - Their passwords aren't case sensitive. - Their login form's GET request isn't using https. - Within 20 minutes of informing a security specialist not affiliated to blizzard he was able to write a script that compromised every single battle.net e-mail address. * This information is based from about June 2012, I'm not sure if their security measures ch…

it's one of the reasons why i don't play Blizzard games anymore. it gets old when every time i want to play a game, i need to go through endless webpages to reactivate my account that has been blocked because of 'suspicious activities'.

Re: League of Legends compromised – North American accounts and transactions

#28

Post by polemic »

Ardren wrote: post #19
polemic wrote: post #15

> "approximately 120,000 transaction records from 2011 that contained hashed and salted credit card numbers have been accessed" Why oh why would you store the number. Utterly unnecessary for recurring billing.

The only thing that comes to mind is fraud prevention? But that only works if it's a global salt, rather than a per user/card salt.

I don't buy it. You're exposing your users to massive risk in order to detect fraud on a product that effectively costs $0 for you to provide. I might understand it for a retailer that gets chargebacks for physical items shipped, but that doesn't make sense here.

Re: League of Legends compromised – North American accounts and transactions

#29

Post by coldarchon »

polemic wrote: post #15

> "approximately 120,000 transaction records from 2011 that contained hashed and salted credit card numbers have been accessed" Why oh why would you store the number. Utterly unnecessary for recurring billing.

Why would it be online accessible?

Re: League of Legends compromised – North American accounts and transactions

#30

Post by rartichoke »

Steko wrote: post #12
rartichoke wrote: post #5

Earlier quoted context omitted.

Pretty much. Look at company's like Blizzard who are even bigger. - Their passwords aren't case sensitive. - Their login form's GET request isn't using https. - Within 20 minutes of informing a security specialist not affiliated to blizzard he was able to write a script that compromised every single battle.net e-mail address. * This information is based from about June 2012, I'm not sure if their security measures ch…

"- Their passwords aren't case sensitive." Not a huge deal. "- Within 20 minutes of informing a security specialist not affiliated to blizzard he was able to write a script that compromised every single battle.net e-mail address." I don't remember this ever happening.

It was during the time when a bunch of people claimed they were "hacked" a bit after Diablo 3 came out.

It's on the bnet forums somewhere.

Post reply on HN