Curse

Akaraxle · Jan 24, 2010, 08:25 PM // 20:25

I think it's about time gaming companies stopped treating their customers like they are retarded by default. Such assumptions are to be made by developers when designing software, not by employees in contact with their user base.

Improvavel · Jan 24, 2010, 09:18 PM // 21:18

Quote:

Originally Posted by Nerel

Really, unless NCsoft is going to give an accurate figure on the percentage of accounts actually compromised in the recent spate of 'hackings', and that figure is surprisingly high, then it is pretty unreasonable to suggest that a few dozen accounts belonging to your guildies SHOULD be amongst those hacked. Grasping at straws for any reason in particular? Or do you get confused easily by really small percentiles?

I agree with you and that is why I'm doubting the problem was/is an easy exploit.

On the other hand using the example of your particular guild to demonstrate that there are players that didn't get the pane without other data doesn'r prove anything.

Quote:

I haven't seen THOUSANDS of hacks being reported on the forums during this recent spate of compromised accounts... but even if that were so, it is thousands of accounts out of HUNDREDS OF THOUSANDS of accounts.

I haven't seen either.

Thousands of accounts compared to hundreds of thousands is a small percentage, so people can't just say "its impossible for so many to have security flaws or done some less licit activity or just got scammed".

We are in agreement here.

Quote:

And, it has NOTHING to do with Anet's 50%-50% figure, that figure was useless and misleading data used for spin doctoring as it was UTTERLY WORTHLESS without supporting data on the percentage of accounts linked to the NCSoft master accounts in the first place. You understand that?

I understand and it is parallel to the comments that say thousands of hacks must prove that there is a weakness in the NCSoft website, especially one so basic that any single person could be a hacker by just logging into their accounts.

Quote:

I don't need to believe that the 50%-50% figure was MEANINGLESS and USED IN A MISLEADING MANNER, without knowing the percentage of accounts linked or not linked to the NCMA it IS MEANINGLESS and MISLEADING. That's a fact, not a matter of faith.

Same argument and same answer.

I don't understand why everything that Anet/NCSoft says is false and misleading and why everything that the person(s) that brought up the "random logging exploit" is to be believed without a doubt and with no proof.

Unless you think THOUSANDS of accounts hacked represent something in a universe of HUNDREDS OF THOUSANDS accounts.

Martin Alvito · Jan 24, 2010, 09:37 PM // 21:37

Quote:

Originally Posted by Improvavel

The question I have to you is where did you obtain this information (on the volume of attacks) and can I see it?

Obviously, I don't have a conclusive number. The claims around November and December were +/- low hundreds. The earliest NCMA reports I recall seeing were around July.

If we deduce that some hacks went unreported because they were not discovered (dead accounts) and others went unreported because people didn't feel like signing up for this fansite, we can conclude that more accounts were hacked. At that point, brute force (even on the NCMA password reset mechanism) as an explanation for the expected number of "I have a secure password, no keylogger and don't share credentials" stories breaks down.

Quote:

Originally Posted by Improvavel

And then does in fact the measures taken by NCSoft tackle the real problem?

Well, if you cannot get into the account simply by getting unauthorized access to the NCMA, then any site vulnerabilities become irrelevant to claims of getting hacked. The intruder is then still short critical data necessary to gain access even if the game password is reset by the NCMA (and then throwing up barriers to actually resetting the GW/Aion password restricts things further).

In my view, this is why the hacks stopped and the phishing started once those barriers went up.

Improvavel · Jan 24, 2010, 11:10 PM // 23:10

Quote:

Originally Posted by Martin Alvito

Obviously, I don't have a conclusive number. The claims around November and December were +/- low hundreds. The earliest NCMA reports I recall seeing were around July.

If we deduce that some hacks went unreported because they were not discovered (dead accounts) and others went unreported because people didn't feel like signing up for this fansite, we can conclude that more accounts were hacked. At that point, brute force (even on the NCMA password reset mechanism) as an explanation for the expected number of "I have a secure password, no keylogger and don't share credentials" stories breaks down.

Well, if you cannot get into the account simply by getting unauthorized access to the NCMA, then any site vulnerabilities become irrelevant to claims of getting hacked. The intruder is then still short critical data necessary to gain access even if the game password is reset by the NCMA (and then throwing up barriers to actually resetting the GW/Aion password restricts things further).

In my view, this is why the hacks stopped and the phishing started once those barriers went up.

A few hundred is quite shorter than that massive panic I've seen.

Yeah, I would be very annoyed if it happened to me and a single account hacked to NCSoft vulnerabilities is very bad.

But unfortunately even much more important websites get hacked.

But short of "all of us are in eminent risk!" and short of explaining all single hack.

YunSooJin · Jan 24, 2010, 11:15 PM // 23:15

I pretty much spent my GW career only knowing a couple people hacked. The number of people I knew that got hacked easily quintipled around the late summer to early winter, though.

Chthon · Jan 25, 2010, 02:59 AM // 02:59

Improvavel, I was going to respond to you, but as I continued reading your posts over the last couple pages, it became clear to me that you're trolling.

So this is all the answer you're going to get: Since the moment I became convinced that the NCSoft site was vulnerable, I've stayed the hell away from it. My account there is already as secure as I can possibly make it, so going there only increases my risk. I believe the reports of the wrong-account-log-in bug are true because (1) certain people who have a reputation for honesty in my eyes have confirmed it, (2) too many people have confirmed it for them all to be trolls/attention trollops, (3) several people who have confirmed it have something to lose if caught lying -- good reputations on this forum built up over a substantial period of time, and, in one case, a modship, (4) no one has anything to gain by falsely confirming, (5) this sort of bug is concordant with the level of crappy design evidenced by the various brute force vulnerabilities, and (6) there is obviously something wrong with the NCSoft site -- everything in NCSoft and a-net's behavior, except their official statements, points towards that conclusion; as does the amazing coincidence that, as soon as they added third login credential and requirement of knowing the old password to change the password, reports of account theft went way down, and reports of phishing attempts went way up.

[edit: apparently "RED ENGINE GORED ENGINE GORED ENGINE GORED ENGINE GORED ENGINE GO" is a censored word.]

Improvavel · Jan 25, 2010, 04:44 AM // 04:44

Quote:

Originally Posted by Chthon

Improvavel, I was going to respond to you, but as I continued reading your posts over the last couple pages, it became clear to me that you're trolling.

So this is all the answer you're going to get: Since the moment I became convinced that the NCSoft site was vulnerable, I've stayed the hell away from it. My account there is already as secure as I can possibly make it, so going there only increases my risk. I believe the reports of the wrong-account-log-in bug are true because (1) certain people who have a reputation for honesty in my eyes have confirmed it, (2) too many people have confirmed it for them all to be trolls/attention trollops, (3) several people who have confirmed it have something to lose if caught lying -- good reputations on this forum built up over a substantial period of time, and, in one case, a modship, (4) no one has anything to gain by falsely confirming, (5) this sort of bug is concordant with the level of crappy design evidenced by the various brute force vulnerabilities, and (6) there is obviously something wrong with the NCSoft site -- everything in NCSoft and a-net's behavior, except their official statements, points towards that conclusion; as does the amazing coincidence that, as soon as they added third login credential and requirement of knowing the old password to change the password, reports of account theft went way down, and reports of phishing attempts went way up.

[edit: apparently "RED ENGINE GORED ENGINE GORED ENGINE GORED ENGINE GORED ENGINE GO" is a censored word.]

No I'm not trolling.

Basically what I've seen in these forums was that massive thread around the new year.

I don't know the original poster and basically I've only seen another person backing it up.

If I'm wrong please be kind (no irony) to point where it was confirmed by other people - about the log bug.

Maybe you are in possession of information that I don't have, but I haven't seen that information disclosed in these forums - and I mean specifically about the log bug.

All was said was "when you log you might randomly access other people accounts".

Damn, if it is just that simple hackers can simply throw computational power and make thousands/millions of loggings - a simple script will do that. Getting it to change the password previous to the old password requirement and nabbing the email address doesn't seem particularly harder.

Had you answered that you actually seen that bug happen I would be more inclined to believe so, although I would still take it with a grain of salt as I only know you as a forum poster.

As why would people spread false information or what motivation would they have for that, I've no clue, but just because I can't imagine it, it doesn't mean that it doesn't exist - and again I don't know any of the people, either personally or just trough the game/forums.

Where do you get your numbers of reported hacks/phishings/etc? Are you just basing them on the forum reports? Or do you have better numbers? If do you have are they publicly accessible or can you share them?

What I've seen, and I admit I might not have looked exhaustively, was loads of rage against Anet but actually not that many people supporting the log bug claim.

And my reservations about this log bug claim, isn't because I don't believe NCSoft website can be hacked - it is because that bug seems so simple that any half assed programmer could take advantage of it.

Had the claim been "NCSoft website has been hacked and some information was stolen" I wouldn't have so many reservations.

Additionally if the bug existed is it solved now? Or did they just add the old password requirement? Were any other changes made to the website?

People make claim there was (still is?) a log bug, people claim there were never so many GW hacks, etc.

But is there any evidence that I or any other simple forum poster in here can see? Any numbers on hacking? Even any "before there was like 5 threads per time period about hacking on guru and now its 15" data?

If you want to believe I'm a troll it is up to you, but it seems it is "Either you take the OP poster and a few other posters word or you take Anet word".

And I can't even take your word on the bug claim, as you have not experienced it and neither did I, which doesn't prove anything.

Without evidence I can't take either Anet word or the posters word.

What I have is 10 GW accounts under my responsibility or someone really close, as in real life close, all linked and not hacked, which again proves nothing.

shoyon456 · Jan 25, 2010, 09:42 AM // 09:42

Quote:

Originally Posted by Martin Alvito

Well, if you cannot get into the account simply by getting unauthorized access to the NCMA, then any site vulnerabilities become irrelevant to claims of getting hacked. The intruder is then still short critical data necessary to gain access even if the game password is reset by the NCMA (and then throwing up barriers to actually resetting the GW/Aion password restricts things further).

In my view, this is why the hacks stopped and the phishing started once those barriers went up.

Aha, that makes alot of sense. Wow, I should have been able to connect those dots. Any idea on how they get those emails for phishing though? I mean they're trying to phish one of my emails not associated with any gaming OR forums at all, which I just laugh like hell over.

TheRemedy · Jan 25, 2010, 05:20 PM // 17:20

Quote:

Originally Posted by Akaraxle

I think it's about time gaming companies stopped treating their customers like they are retarded by default. Such assumptions are to be made by developers when designing software, not by employees in contact with their user base.

They sell an addicting product, they can do whatever they want and people will still play. Tons of people cry and say they will quit about the SF nerf, they won't quit, they will just start on the next ecto farm build.

A great example of this is smokers, no matter how high cigarette prices go, people still smoke. The time for client respect is gone, it's a take it or leave it situation.

Chthon · Jan 25, 2010, 05:38 PM // 17:38

Quote:

Originally Posted by Improvavel

If I'm wrong please be kind (no irony) to point where it was confirmed by other people - about the log bug.

Are you sure you read that thread closely? Here's posts fro mthat thread by Guru members confirming:

Firebaall (link)
niek2004 (post deleted, quoted)
fenix (mod, link)
Sierraa (mod, link)
Theocrat (mod, link)
Friends of Theocrat who do not want their identities disclosed (same link)
HellScreamS (link)

You can sort through wiki and AionSource for yourself to find more.

Quote:

Where do you get your numbers of reported hacks/phishings/etc? Are you just basing them on the forum reports? Or do you have better numbers? If do you have are they publicly accessible or can you share them?

I keep tabs on forum reports of "I got hacked." Sure, not a representative sample, but representative enough to reliably indicate huge shifts -- of which we've seen two, thefts going way up from late summer until early Jan., then thefts going way down (and phishing going way up) in early Jan.

Quote:

And my reservations about this log bug claim, isn't because I don't believe NCSoft website can be hacked - it is because that bug seems so simple that any half assed programmer could take advantage of it.

1. They were.
2. By all indications, the bug is fickle. Neither your nor NCSoft's attempts could reproduce it. Others claim to have reproduced it within less than 1000 tries.Surely whatever impeded you and NCSoft also impeded the thieves.
3. While the Chinese government may have top-notch hackers on payroll, most gold sellers do not.
4. While the log-into-somone-else's-account bug is dramatic and damning, it's not the worst problem with the NCSoft site by a longshot. The file mirroring and SQL injection vulnerabilities reported by Mung on AionSource are far, far worse. A sophisticated attacker could do much more damage than we've seen so far.

Quote:

Additionally if the bug existed is it solved now? Or did they just add the old password requirement? Were any other changes made to the website?

We have no way of knowing. Perhaps they fixed it and lied when they said they couldn't reproduce it. Perhaps it remains unfixed. The requirements of knowing a character name and the old password make it impossible to steal a GW account simply by compromising the NCSoft account without more.

Quote:

Without evidence I can't take either Anet word or the posters word.

You present it as a pure "he said/she said" when you have more information available than that. Ask qui bono if they successfully deceive you? Who has the stronger incentive to be dishonest?

Quote:

Originally Posted by shoyon456

Aha, that makes alot of sense. Wow, I should have been able to connect those dots. Any idea on how they get those emails for phishing though? I mean they're trying to phish one of my emails not associated with any gaming OR forums at all, which I just laugh like hell over.

I suspect they just buy them from the usual purveyors of spam e-mail lists.

maxxfury · Jan 25, 2010, 05:50 PM // 17:50

Quote:

Originally Posted by Chthon

Are you sure you read that thread closely? Here's posts fro mthat thread by Guru members confirming:

The ones regarding the aion site, i thought i read that they were ONLY cosmetic? with the name of another account..but your own details?
So no way to manipulate or change anyone elses data?

Sorry ive not kept as upto date on this or looked very indepth as you have so im more than likley recalling it wrong xD

Improvavel · Jan 25, 2010, 06:13 PM // 18:13

Quote:

Originally Posted by Chthon

Are you sure you read that thread closely? Here's posts fro mthat thread by Guru members confirming:

Firebaall (link)
niek2004 (post deleted, quoted)
fenix (mod, link)
Sierraa (mod, link)
Theocrat (mod, link)
Friends of Theocrat who do not want their identities disclosed (same link)
HellScreamS (link)

You can sort through wiki and AionSource for yourself to find more.

Fenix there is talking about the Aion and not the NCSMA.

Quote:

I keep tabs on forum reports of "I got hacked." Sure, not a representative sample, but representative enough to reliably indicate huge shifts -- of which we've seen two, thefts going way up from late summer until early Jan., then thefts going way down (and phishing going way up) in early Jan.

Ok, but not really firm evidence/numbers - and summer and xmas seems to always see a surge of old players return to the game.

Quote:

1. They were.
2. By all indications, the bug is fickle. Neither your nor NCSoft's attempts could reproduce it. Others claim to have reproduced it within less than 1000 tries.Surely whatever impeded you and NCSoft also impeded the thieves.
3. While the Chinese government may have top-notch hackers on payroll, most gold sellers do not.
4. While the log-into-somone-else's-account bug is dramatic and damning, it's not the worst problem with the NCSoft site by a longshot. The file mirroring and SQL injection vulnerabilities reported by Mung on AionSource are far, far worse. A sophisticated attacker could do much more damage than we've seen so far.

With this bug, gold sellers wouldn't have to have top notch hackers.

Quote:

We have no way of knowing. Perhaps they fixed it and lied when they said they couldn't reproduce it. Perhaps it remains unfixed. The requirements of knowing a character name and the old password make it impossible to steal a GW account simply by compromising the NCSoft account without more.

True.

Quote:

You present it as a pure "he said/she said" when you have more information available than that. Ask qui bono if they successfully deceive you? Who has the stronger incentive to be dishonest?

This is all conjectural.

And only because you referred "he said/she said", I could say I find it funny that even if this subject started in Aion forums the NCSoft response clearly mentioned "a thread on a third-party Guild Wars forum this New Year's".

Considering that NCSoft in the past was quick to point that the most likely reasons for being hacked was dealing with RMT, user vulnerabilities/error and 3rd party websites, I could imagine some people being annoyed with NCsoft.

Which is interesting on the recent news of the attacks on the Guru.

But I'm out of this question now and not feeling worried.

Maybe silly me. Lets just hpe for the best.

Curiously had you said you have seen this bug, I would have believed you Chton - see you don't need to be a mod to have respect - even if I think you are a bit silly about discord. Dunno why I would take your word for it, but I would.

I'm dropping (or hopping to drop) this subject, although still interested in evidence should it appear.

Peace.

Chthon · Jan 25, 2010, 08:03 PM // 20:03

Quote:

Originally Posted by maxxfury

The ones regarding the aion site, i thought i read that they were ONLY cosmetic? with the name of another account..but your own details?
So no way to manipulate or change anyone elses data?

Sorry ive not kept as upto date on this or looked very indepth as you have so im more than likley recalling it wrong xD

Both sites suffer from a similar bug. The bug on the Aion site is cosmetic. The bug on the NCSoft Master Account site gives full-blown account access to a random individual. The initial response on the Aion forums confused the two. Perhaps fenix confused them as well. Plenty of people understand the difference and confirm the problem with the NCMA site.

lilDeath · Jan 25, 2010, 11:30 PM // 23:30

Well now, it has been said before, but this GSU (Giant Sample of Untruths) article is just a feeble attempt at trying to CTA (Cover Their Asses) and 'attempting' to fool the fools, but only making themselves look like fools in the process.

Simply ridiculous. FTL NCSoft and to a degree ANet too.

(See, I can use acronyms too!)

Martin Alvito · Jan 26, 2010, 02:54 AM // 02:54

Quote:

Originally Posted by shoyon456

Aha, that makes alot of sense. Wow, I should have been able to connect those dots. Any idea on how they get those emails for phishing though?

Not entirely sure. I figure there's a database of associated e-mails that gets resold. Why they would have my work account (which was not used for a game until recently) but not my home account is beyond me. I get WoW and Aion spam at the work account, and nada at the home account...which ironically was set up as the focal point for spam.

@ Improvavel: I know you're not a troll. You're asking reasonable questions that a newcomer to the discussion would ask. There was an active thread (ok, fine, locked but maintained) that Inde maintained with 100+ reports, plus all the deleted threads from July-November. I wasn't able to get an accurate count at the time, but there were literally in the low hundreds of reports of NCMA hacks without obvious causal attribution.

Induct from there to the number of hacks using the NCMA that didn't get posted, and you get the idea. Think about it this way - consider the number of people you know that would post if they got hacked, against the number that are not active/registered and would not do so. The only reasonable conclusion is that there were a lot of unreported hacks.