Curse

HawkofStorms · Jan 24, 2010, 03:16 AM // 03:16

Quote:

Originally Posted by Alesa

Besides the wall of text here, that's a very nice response. Thank you Regina!

True. Regina did a good job trying to patch up the problem. Really, the best solution for A.net CR's to this mess is to distance themselves from NCSoft like she did with that statement by directly contradicting it.

Nerel · Jan 24, 2010, 06:30 AM // 06:30

Late breaking news from NCsoft.... WAR IS PEACE, FREEDOM IS SLAVERY, and IGNORANCE IS STRENGTH

Poor Regina, no doubt earning her paycheck the hard way as of late...

Improvavel · Jan 24, 2010, 07:53 AM // 07:53

Quote:

Originally Posted by Chthon

This.

The clear implication of the highlighted words is that those people who went out of their way to help NCSoft by finding and compiling the security problems with their website must be liars or fools or both. That's simply not true. The problems exist. Many of us have seen them with our own eyes. To deny the self-evident truth insults our intelligence. To call us liars insults our honor. And you wonder why "Scott's post did not go over well with [us]"?

I realize that Scott did not write that letter, or at least not in its entirety. The contents of Flubber's link on page 4 make that pretty clear. Still, someone at NCSoft was responsible for it, and that someone seems to be remarkably talented at pissing off NCSoft's s (soon-to-be-former-)customers.

No kidding. Martin Alvito and I had an ongoing discussion about the defamatory nature of this statement earlier in the thread, but we curtailed it because it was heading off-topic. Anywho, my take is that there's no way a halfway-competent lawyer wrote this for Scott; it must have been a corporate type.

So are you saying that you were actually able to just randomly access a NCSOFT Master account by just logging into your own account?

Fril Estelin · Jan 24, 2010, 09:44 AM // 09:44

One of the things I got from the GSU's email is a pointer to a good Password Manager (I'm currently using PasswordSafe) and I think that's something everyone should now start to consider seriously:

with all the hacking happening around, it's safer to have specific emails/login/passwords for each websites/accounts and thus a Password Manager greatly eases this; they list in one place all your security info and protect them with strong cryptography, can create strong passwords for you, and they're now implemented so that you can run them from a USB or a mobile phone; furthermore it's quite easy to change information (in fact once you're used to use them everyday, you don't have to know account info any more...so don't forget to back up this application's files)

pumpkin pie · Jan 24, 2010, 10:30 AM // 10:30

I r use OpenPim.

Remember to NOT store your database on your computer

lol.

Longasc · Jan 24, 2010, 10:34 AM // 10:34

I thought they hired Scott Jennings to improve their anti-botting etc. efforts.

And I am really disappointed by him, all he said has been said ages ago countless of times. And of course he mentions nothing about the security flaws that are NCsofts responsibility. Because against those the players can do nothing at all.

Improvavel · Jan 24, 2010, 11:49 AM // 11:49

Quote:

Originally Posted by Longasc

I thought they hired Scott Jennings to improve their anti-botting etc. efforts.

And I am really disappointed by him, all he said has been said ages ago countless of times. And of course he mentions nothing about the security flaws that are NCsofts responsibility. Because against those the players can do nothing at all.

Well of course people will only feel happy if Anet/NCSoft say its their fault for all the hacks that occurred and not some user mistake.

Anet claimed 50% of the account hacked weren't connect to a NCSoft master account.

At worse 50% of all hacks were due to NCSoft vulnerabilities.

If then you consider that people that are most likely to buy gold/ectos from gold sellers and/or installing bots/3rd party programs are probably more likely to have a NCSMA that 50% figure due to security flaws on NCSOFT site are likely to go down.

I'm not saying that aren't vulnerabilities there - I'm just saying unless Anet/NCSoft says its their absolute fault, people will complain.

After all how the hell can be the user fault?

We all have our PCs completely secure and never make any mistakes.

Nerel · Jan 24, 2010, 12:10 PM // 12:10

Quote:

Originally Posted by Improvavel

Anet claimed 50% of the account hacked weren't connect to a NCSoft master account.

Meaningless data unless paired with the percentage of accounts (not just those that were hacked) which have been linked to the NCSoft Master Account.

Simply put, if only 20% of all game accounts are linked to the NCMA, and yet they represent 50%+ of the compromised accounts... then clearly the NCMA means you're far more likely to be hacked...

Did NCSoft/Anet/Regina/Gaile mention that relevant piece of data? I didn't see it, and without it their 50% figure is just blowing smoke up your ass... honesty is the last thing we expect from NCSoft lately, and we're not being disappointed in the least.

Turbo Ginsu · Jan 24, 2010, 12:19 PM // 12:19

Quote:

Originally Posted by Improvavel

We all have our PCs completely secure and never make any mistakes.

Speaking for myself, you better believe it buddy. I haven't had a virus or anything else of a less than kosher nature even come close to finding it's way into my pute for over 10 years.

Does a snide little comment like that explain exactly why it was that action was taken(bandaid) so promptly by both anet and ncsoft when we made enough noise, do you think? I don't think so, and I'll wager that 99.99999999% of the people posting in this thread agree with me.

Sure, there's plenty of net n00bs about, but most of them aren't gamers. Most net n00bs are far too busy saying hello/goodbye/hello/goodbye in chat rooms, or dicking about with their pox-ridden facebook
(buhhhh) pages.

Improvavel · Jan 24, 2010, 12:29 PM // 12:29

Quote:

Originally Posted by Nerel

Meaningless data unless paired with the percentage of accounts (not just those that were hacked) which have been linked to the NCSoft Master Account.

Simply put, if only 20% of all game accounts are linked to the NCMA, and yet they represent 50%+ of the compromised accounts... then clearly the NCMA means you're far more likely to be hacked...

Did NCSoft/Anet/Regina/Gaile mention that relevant piece of data? I didn't see it, and without it their 50% figure is just blowing smoke up your ass... honesty is the last thing we expect from NCSoft lately, and we're not being disappointed in the least.

That is of course true.

It is also true that most likely the people that are still playing have linked their accounts to get the pane.

Who in here didn't linked the account?

I did - actually I already had.

So while the linked accounts might only be 20% of the total accounts it can be 80% of the accounts being played, can't it?

And people that are playing are more likely to report the hack, more likely to install 3rd party programs, more likely to post on forums, more likely to deal with money traders, etc.

More interesting was the fact they said the majority of accounts hacked hadn't suffered a password change, which rules out the report random log into a different account problem.

Can NCSoft/Anet be lying? Surely.

But on the other hand why should I just take the word of people I don't know either?

In all this, other than the person that reported this specific problem, I only read of one guy claiming he logged into someone else account after some 60 tries and pheonix saying he logged into someone else account in the AION FORUMS and not in the NCSOFT web page.

At least after this has been exposed I expected people to just report it in this forum, safely hidden behind the anonymous status the internet confer.

And is the problem solved now? Was it really just logging in the first place?

Now some dude will come and post "Hey they changed stuff so that is clear evidence that there was a problem!"

Of course that same dude would be screaming "Anet does nothing! NCSOFT doesn't care! They are SHIT!" if no changes were made.

So it is just the word of someone against the word of others. People believe what they want to believe,

I asked Chton if actually logged in someone else account. Lets see what he says.

For myself I logged in some 10000 times using a script and never seen someone else account.

Does it prove anything? Nope.

Quote:

Originally Posted by Turbo Ginsu

Speaking for myself, you better believe it buddy. I haven't had a virus or anything else of a less than kosher nature even come close to finding it's way into my pute for over 10 years.

Does a snide little comment like that explain exactly why it was that action was taken(bandaid) so promptly by both anet and ncsoft when we made enough noise, do you think? I don't think so, and I'll wager that 99.99999999% of the people posting in this thread agree with me.

Sure, there's plenty of net n00bs about, but most of them aren't gamers. Most net n00bs are far too busy saying hello/goodbye/hello/goodbye in chat rooms, or dicking about with their pox-ridden facebook
(buhhhh) pages.

As I said above you would be screaming rage if Anet/NCSoft didn't do a thing.

You chose to believe the hacks are NCSoft responsibility.

If they do nothing they are arses.

If they do something it is clear evidence that they are covering up their mistakes.

There is simply no way you can phantom them not being guilty.

And if you didn't have a virus in the last 10 years I bet its because they are there undetected.

I just format my HDD every couple of months and try not to keep relevant information on it.

Nerel · Jan 24, 2010, 12:43 PM // 12:43

Quote:

Originally Posted by Improvavel

That is of course true.

It is also true that most likely the people that are still playing have linked their accounts to get the pane.

Who in here didn't linked the account?

In here? You're right of course... I totally forgot that the posters on Guru are in any way representative of the full scope of gamers still playing Guild Wars... I really should ask the dozen or so people in my Guild who DIDN'T get the free storage pane to uninstall Guild Wars, they're obviously not REAL people.

I'm rolling my eyes... on the inside.

As for Turbo Ginsu's claim, it's not that unreasonable... but seriously after 10 years, it's time to just let it go and get a new 'pute'. Yes, I'm just kidding.

greenthumb · Jan 24, 2010, 01:04 PM // 13:04

Because those 50% figures are being thrown out, here are a couple of the original source quotes from ANet:

Quote:

Originally Posted by Gaile Gray

I've noticed a number of comments about NCsoft Master Accounts and hacked game accounts. It appears that some players are assuming that there is a connection, that if you have an NCsoft Master Account (NCMA) you may be at increased risk of account theft. We have conducted extensive research on this factor, and I have data as current as this morning that shows that this does not appear to be true. Of a cross-sampling of accounts, nearly half did not have an NCMA at all. I hope that this information puts your mind at ease on any perceived "risk factor" regarding whether a game account is tied to an NCMA or not, for that truly does not seem to be an element in the current situation.

Quote:

Originally Posted by Regina Buenaobra

I would like to reiterate one point again, because people continue to ignore this fact: The account hacks are not likely related to the NCsoft Master Account security concerns. Roughly half of the hacked acounts do NOT have an NCsoft Master Account, and very few account thefts involved a password change at all. The hacker(s) knew the account credentials, and they did not access the hacked accounts through NCsoft Master Accounts. The hackers had a list of passwords, which they used to steal accounts.

It's unclear to me why a nearly half figure (based on perhaps a small sample - "cross-section" and also possibly a biased sample) alleviated the concerns of ANet or should alleviate player concerns, but those "very few" account thefts which involved a password change would seem to be very much associated with the NCMA.

Turbo Ginsu · Jan 24, 2010, 03:36 PM // 15:36

Quote:

Originally Posted by Improvavel

And if you didn't have a virus in the last 10 years I bet its because they are there undetected.

That's a bet you would most assuredly lose.

I might also point out, I never said that anet or ncsoft were responsible. Not like they're going to hack their own site is it?

What I said, was that if there was nothing wrong, you know, no faults, no vulnerabilities, no gremlins etc, then why was there such action over nothing?

I love how ppl of your ilk like to try to look down on other posters as if you knew them, you knew the limits of their net savvy, and you know what they think and how they'd react to various threats of one type or another.

You format your HDD every couple months eh? I haven't had to do that since I actually was a noob. What's your excuse?

Improvavel · Jan 24, 2010, 03:51 PM // 15:51

Quote:

Originally Posted by Nerel

In here? You're right of course... I totally forgot that the posters on Guru are in any way representative of the full scope of gamers still playing Guild Wars... I really should ask the dozen or so people in my Guild who DIDN'T get the free storage pane to uninstall Guild Wars, they're obviously not REAL people.

I'm rolling my eyes... on the inside.

And I should ask why half the dozens of my guildies that got the panes why the RED ENGINE GORED ENGINE GORED ENGINE GORED ENGINE GO they haven't been hacked.

Why actually none have them has been hacked.

If it really is random then at least some or a couple should just say they have been hacked or know someone who has been hacked.

I actually only know a person that has been hacked but he was using bots.

Again the "thousands of hacks" that are being reported over forums mean has much has the "50%-50%" numbers of Anet.

As I said, you believe what you want to believe.

I didn't see any proof in favour or against the "random account login" only claims and I've no means to confirm or deny those claims.

As I told you I did use a script to login 10000 times in the PlayNC account - other than some "database error" I didn't log into any account other than my own. Since it was negative, it was inconclusive.

Basically there is no "real data" other than someone claiming there exists that problem.

And I'm not talking of other web site vulnerabilities - only the "random account login".

Other than that, all my requests of assistance with NCSoft were promptly attended.

I don't like many of the changes Anet did to GW, but the so far the costumer service has been quite good in my experience.

Reading these forums it seems I belong to the lucky minority.

Quote:

Originally Posted by Turbo Ginsu

That's a bet you would most assuredly lose.

I might also point out, I never said that anet or ncsoft were responsible. Not like they're going to hack their own site is it?

What I said, was that if there was nothing wrong, you know, no faults, no vulnerabilities, no gremlins etc, then why was there such action over nothing?

What were the actions? And should people just wait for something to happen to improve?

Quote:

I love how ppl of your ilk like to try to look down on other posters as if you knew them, you knew the limits of their net savvy, and you know what they think and how they'd react to various threats of one type or another.

Let me answer you:
I love how ppl of your ilk like to try to look down on other posters as if you knew them, you knew the limits of their net savvy, and you know what they think and how they'd react to various threats of one type or another.

Most likely if my account was hacked it would be for some security vulnerability on my side (or Microsoft side), even though I probably take more measures than the average person.

Quote:

You format your HDD every couple months eh? I haven't had to do that since I actually was a noob. What's your excuse?

I do that for several reasons. generally not related to problem solving.

First security.

Second Windows like to create quite big folders where it saves all the old version of driver files, system files, etc, you know, winsxs folder that like to grow into GB sizes and SSD drives are still expensive and frigging dragon age takes 13+GB on its own.

Third I keep installing third party releases of the OS updated to that point and just ignore the automatic updates.

And yeah you see everywhere informatic noobs formatting their HDD left and right - that is just what people do.

Of course formatting and installing takes about 1-2 hours, which means its done while I'm asleep, so why not?

But in the end, you support your claim based "on my opinion".

I don't claim anything - I just want people to present hard reliable evidence one way or the other.

"My opinion" doesn't fall into that unless you are a internet security expert and then you still need to lay the evidence and I will still ask for the other side story.

Turbo Ginsu · Jan 24, 2010, 04:30 PM // 16:30

Quote:

Originally Posted by Improvavel

What were the actions?

What actions? Well, first the password change function was overhauled to remove a big fat security hole. i.e. Not asking for the old password. Secondly, the player name box on the GW login screen.

Quote:

Originally Posted by Improvavel

And should people just wait for something to happen to improve?

To answer a question with a question: Isn't waiting for something to happen before changing security features, exactly what NCSoft did?

I think that you are purposefully trolling this thread with your theories, which ultimately, are just theories. I don't see you laying down any more hard evidence than anyone else has here, all I see is you doing everything but outright accusing us of being full of shit.

One last thing. If you need to reformat to clean up windoze, well...lol

Improvavel · Jan 24, 2010, 05:11 PM // 17:11

Quote:

Originally Posted by Turbo Ginsu

What actions? Well, first the password change function was overhauled to remove a big fat security hole. i.e. Not asking for the old password. Secondly, the player name box on the GW login screen.

First they did the player name box.

That will boost the protection of even less security conscious players.

The asking for the password - well it is only a security hole if you can/could indeed log into another player account.

After all, it already asked for a password in the first place. If they even ask x number of passwords question, the security will be increased.

Quote:

To answer a question with a question: Isn't waiting for something to happen before changing security features, exactly what NCSoft did?

What you call reaction to a problem, I call covering their asses.

After all, if you need account name, password, character name and the old password to change the password on the NCSMA, it gets a bit difficult to believe that you were hacked because someone else logged randomly into your account.

So it can be reacting to a real threat, covering their asses so no one can accuse them of a non-existent threat or both.

Quote:

I think that you are purposefully trolling this thread with your theories, which ultimately, are just theories. I don't see you laying down any more hard evidence than anyone else has here, all I see is you doing everything but outright accusing us of being full of shit.

I'm not trolling anything and I have no theories. I only have the desire to know the situation.

After all you keep hearing people that Anet/NCSoft doesn't share the information and they are dumb for not doing so.

So I'm asking the other people to share the information.

Quote:

One last thing. If you need to reformat to clean up windoze, well...lol

I'm sorry if my questions are logical and the best you can do is calling me dumb.

I'll take your word then - you are so smart that the only conceivable way that you were hacked (were you hacked? is that what you mean by "Speaking for myself, you better believe it buddy") was due to the "random login in to other people account bug".

After all, if you didn't have a virus in 10 years it is impossible for someone to hack into your pc or emails or whatever...

Regulus X · Jan 24, 2010, 06:18 PM // 18:18

As long as our credit card numbers and all other personal information isn't compromised, I can care less about losing accounts; especially in a dead game. If our personal data does become compromised? Then Anet will have HELL to PAY! So, that best not be the case [ever].

Martin Alvito · Jan 24, 2010, 07:13 PM // 19:13

Quote:

Originally Posted by Improvavel

After all, if you need account name, password, character name and the old password to change the password on the NCSMA, it gets a bit difficult to believe that you were hacked because someone else logged randomly into your account.

I think what you're missing is that the rash of hacks occurred prior to needing all of that information to change the password, and stopped once additional authentication requirements were added. The accidental login hypothesis suggested a vector of attack that could have explained the volume of hacks. Neither brute force of NCMAs, nor social engineering, nor keyloggers seemed to fully fit the data; there were inconsistencies even if all three were at work simultaneously.

Quote:

Originally Posted by Improvavel

Again the "thousands of hacks" that are being reported over forums mean has much has the "50%-50%" numbers of Anet.

The data the CRs cited clearly was misleading. The inferences they were drawing from that data just didn't follow. I don't blame them; they're only as good as what they're told. But the fact that they kept sticking to that story even when refuted suggested dishonesty or incompetence on the part of the people they were representing.

The volume of hack reports (and the repeated identification of the same vector by users claiming sophistication) suggested that something was up. Sure, they all could have been lying. But the volume of upset, articulate people claiming to be IT and computer professionals made this unlikely.

Nerel · Jan 24, 2010, 07:43 PM // 19:43

Quote:

Originally Posted by Improvavel

And I should ask why half the dozens of my guildies that got the panes why the RED ENGINE GORED ENGINE GORED ENGINE GORED ENGINE GO they haven't been hacked.

Why actually none have them has been hacked.

If it really is random then at least some or a couple should just say they have been hacked or know someone who has been hacked.

Really, unless NCsoft is going to give an accurate figure on the percentage of accounts actually compromised in the recent spate of 'hackings', and that figure is surprisingly high, then it is pretty unreasonable to suggest that a few dozen accounts belonging to your guildies SHOULD be amongst those hacked. Grasping at straws for any reason in particular? Or do you get confused easily by really small percentiles?

Quote:

Originally Posted by Improvavel

Again the "thousands of hacks" that are being reported over forums mean has much has the "50%-50%" numbers of Anet.

I haven't seen THOUSANDS of hacks being reported on the forums during this recent spate of compromised accounts... but even if that were so, it is thousands of accounts out of HUNDREDS OF THOUSANDS of accounts.

And, it has NOTHING to do with Anet's 50%-50% figure, that figure was useless and misleading data used for spin doctoring as it was UTTERLY WORTHLESS without supporting data on the percentage of accounts linked to the NCSoft master accounts in the first place. You understand that?

Quote:

Originally Posted by Improvavel

As I said, you believe what you want to believe.

I don't need to believe that the 50%-50% figure was MEANINGLESS and USED IN A MISLEADING MANNER, without knowing the percentage of accounts linked or not linked to the NCMA it IS MEANINGLESS and MISLEADING. That's a fact, not a matter of faith.

Improvavel · Jan 24, 2010, 08:20 PM // 20:20

Quote:

Originally Posted by Martin Alvito

I think what you're missing is that the rash of hacks occurred prior to needing all of that information to change the password, and stopped once additional authentication requirements were added. The accidental login hypothesis suggested a vector of attack that could have explained the volume of hacks. Neither brute force of NCMAs, nor social engineering, nor keyloggers seemed to fully fit the data; there were inconsistencies even if all three were at work simultaneously.

The question I have to you is where did you obtain this information (on the volume of attacks) and can I see it?

It seems people are basing the volume of attacks on a very simple exploit of the NCSoft web page - if you told me someone had hacked their website and obtained information I would find that quite plausible. But that wasn't the story present. Was/is it a real story or just a story designed to create panic and force a reaction?

And then does in fact the measures taken by NCSoft tackle the real problem?

Or is it the main fact behind the volume of hacks the release of Aion in the western market?

Quote:

The data the CRs cited clearly was misleading. The inferences they were drawing from that data just didn't follow. I don't blame them; they're only as good as what they're told. But the fact that they kept sticking to that story even when refuted suggested dishonesty or incompetence on the part of the people they were representing.

That is quite true - without raw data and the details on how the raw data was obtained any inferences can be misleading and/or used to show "a reality" that isn't.

Quote:

The volume of hack reports (and the repeated identification of the same vector by users claiming sophistication) suggested that something was up. Sure, they all could have been lying. But the volume of upset, articulate people claiming to be IT and computer professionals made this unlikely.

This is reasonable, but again my problem isn't with the claim the NCSoft website isn't secure - my problem is with the claim that website is so insecure that when you its doing basic operations like logging into a user account can be exploited apparently by the act of logging by anyone that isn't even trying to hack anything.

If you don't have to brute force anything and just need to wait for a logging bug, well you can just use loads of unsophisticated computational power.

Of course, they could just be exaggerating for the sake of creating a reaction.