Curse

Tramp · Dec 04, 2009, 05:33 PM // 17:33

ok... after reading this thread, Martin, Chthon, and others have me scared. i still have an unused copy of nf lying around somewhere. going to install it, put all my junk on it that is worth anything, and NOT register it with plaync. What is the PR spin on all this Regina? Regina, can you get someone with technical knowledge to give a response to the concerns here?

Martin Alvito · Dec 04, 2009, 05:52 PM // 17:52

Quote:

Originally Posted by Hengis Stone

This is a interesting idea Martin, but I think my particular experience falls between both. My account was not hacked through a password reset, but what was taken and what was left on my characters exactly fits your "clean out bot" scenario.

How recent was this? Were your characters left in Great Temple of Balthazar?

The first automated hack with the bot that I heard about was going around in February and March, and left characters in GToB. It didn't change passwords at NCSoft, and we chalked it up to a keylogger at the end of the day. It bagged hundreds of people that spoke out, so you have to figure it probably scored at least in the low thousands. But if I remember right, if that one got you it got all accounts almost without exception. And that smelled of keylogger.

That's not consistent with only the one account of yours getting hit, but it does sound like the older mechanism to me. From what I understand, the new bot doesn't leave characters in GToB and it leaves calling cards.

Quote:

Originally Posted by Tramp

i still have an unused copy of nf lying around somewhere. going to install it, put all my junk on it that is worth anything, and NOT register it with plaync.

Why the hell didn't I think of that? Brilliant.

Oh, and I remembered the brute force approach. The password reset mechanism has a maximum number of allotted attempts, but it only punishes you with a time delay. That'd be fine if the number of authentication combinations were sufficiently large, but it's not.

Suppose your security question is your birthday. If we assume that almost every player is aged 11-40 (and I'd say that's 95% true), that's only 10,958 possible combinations. But I can do better than that naive estimate. I can safely assume that most of the people I want to rob are aged 16-25. That's only 3653 possible combinations. At five entries a day, I can get every single one of you in that age range that I can get a username for in two years. I am currently in the process of testing how quickly I can get a new set of attempts, but my guess would be daily.

Better yet, if something's not a username, the stupid thing TELLS me. I get an error message if I found a legit username and fail to crack it, and I get a clean refresh if the username is bogus. So I can have one bot generating legit usernames and another bot testing legit usernames...

Best of all, if I can back out your age from other sources (eg: if my age were posted here and if my NCSoft login were MartinAlvito), I can get you in two and a half months tops. Instantly if I can match a date of birth to your login. So it looks like unsecured data is the problem because people that are dumb about unsecured data are disproportionately hit initially, when in reality I can hack anyone given time or luck and a bot!

Gaile can claim it'll take a bot 278 years to hack a strong password at one entry per second, but she's dead wrong. The strength of your password does not matter. It is not the point of vulnerability. If I can match your login e-mail to your NCSoft username, you're done.

You should be very afraid.

EDIT: Easily implementable solution concept:

Quote:

Originally Posted by jray14

Yeah, it wouldn't take 7 months to add a safeguard to the NCSOFT game password change mechanism to make the user enter the previous password first. That would have been the obvious first step if they were sincerely working on security.

That would make the NCSoft website useless as a means of getting entry, given the restrictions on changing the associated e-mail.

EDIT2: As for why - since it appears that the update didn't fix this issue, I'm not sure what the update functionally did.

Sir Cusfreak · Dec 04, 2009, 08:21 PM // 20:21

On one hand, I feel like the lack of official response speaks volumes in and of itself.

On the other hand, I have some different fingers.

no, no, what i MEANT to say was - on the other hand, if they did find a URL security breach, and fix it, and intend to remain quiet about it, then why list it at all? Why say 'We fixed a crash bug and we fixed the URL' instead of 'we fixed a crash bug'?

that makes no sense.

jray14 · Dec 04, 2009, 08:57 PM // 20:57

(Copied over from the XTH thread, which I realized I was sorta hijacking):

Quote:

Originally Posted by Martin Alvito

I was under the impression that the system sends an e-mail with the temp password? That's what the FAQ claims. Or is that only for a reset?

That must be only for a reset. I was talking about how you can *change* a game password right on the NCSOFT site. You just click on the game account you want to change, and it gives you 2 boxes, "New Password:" and "Confirm Password:". Then as soon as you hit Submit, the game password is changed. At no point does it ever ask you for your old/current password, and you don't even have to know the game logins because it lists them all right there for you.

Martin Alvito · Dec 04, 2009, 09:00 PM // 21:00

Does it ever display the account's associated e-mail address? Can that be forced via automated correspondence, or is it visible in the account settings?

If so, you could get everything you need via a realistic brute force solution. Hunting social networks and fansites would speed up the rate at which you can crack accounts, but you could get anybody irrespective of personal security eventually.

jray14 · Dec 04, 2009, 09:10 PM // 21:10

Quote:

Originally Posted by Martin Alvito

Does it ever display the account's associated e-mail address?

Yes, that's what I meant when I said "game logins." As soon as you login to an NCSOFT account, all your linked game accounts' associated e-mail addresses are listed right there on the main page.

So there would have to be a vulnerability with the NCSOFT logins and passwords for this to be a problem. Maybe I'm reading something wrong in this thread, but I don't remember there being any particular vulnerability pointed out with these. I thought the password reset mechanism being discussed was just for a game account password.

Bristlebane · Dec 04, 2009, 09:12 PM // 21:12

Quote:

Originally Posted by Martin Alvito

... I can safely assume that most of the people I want to rob are aged 16-25. That's only 3653 possible combinations. At five entries a day, ...

For even better results, fish at popular websites for age/name/details. For example, if you figure out someone's Facebook account (ie. searching by email), you can usually find out their age as well.

If you create a bogus site or a big forum, you can start fishing details as well. (ie. maybe builds, contests, or just a mere guild/alliance forum). Then just collect the data for 6-12 months so nobody makes the connection between hacked accounts and your website. Even better, make sure at registration the website asks security questions in case you lost your password with identical questions asked by NCSOFT.

- - -
I DO hope Anet/NCSOFT reads this and realize that their security system is indeed flawed and should be updated.

Martin Alvito · Dec 04, 2009, 09:28 PM // 21:28

Quote:

Originally Posted by jray14

Yes, that's what I meant when I said "game logins." As soon as you login to an NCSOFT account, all your linked game accounts' associated e-mail addresses are listed right there on the main page.

Then this is how it's being done.

Here's the problem - it would be a very easy piece of programming to get a bot to generate valid NCSoft usernames. Once someone has that piece of the puzzle, the point of vulnerability is the NCSoft security question for resetting that password. Birthdays are easy.

Once past that authentication, the hacker has the keys to the kingdom. The hacker has your in-game login and can make your in-game password whatever is desired. So the hacker never needs either of those pieces of information. The hacker can back out valid NCSoft usernames and then bots crack them via the weak password reset system.

The following needs to change yesterday:

- The security question is unacceptable. Birthdays are tremendously insecure and vulnerable to brute force even when properly secured. The number of valid combinations is too small. A birthday is about half as good as a 40 digit combination lock. And you won't see 40 digit combination locks guarding important data.
- E-mail addresses used as logons need to be concealed, and you need to enter the present e-mail to change them.
- The passwords need to be protected with the existing password for changes, and resets MUST generate an e-mail to the undisclosed game login address with the new password.

Doing those things will result in fewer unauthorized access problems and no value for gaining unauthorized access. Do those three things, and the present rash of hacks via the NCSoft site should die down.

A fourth thing would be nice:

- Take some ownership! If I'm right, this is your fault. You (ANet) may not have designed it, but you forced us to use this wholly insecure system. I'm no data security expert. I study human conflict. Yet even my rudimentary computer design capabilities can beat the system you're using to guard the security of your players' accounts in a feasible time frame.

Quote:

Originally Posted by Bristlebane

For even better results, fish at popular websites for age/name/details. For example, if you figure out someone's Facebook account (ie. searching by email), you can usually find out their age as well.

Yup, and this is why the issue appears at first blush to be an issue with unsecured personal data. But the problem is that brute force can get all of us in the end. I suppose you might want to leave some customers if you're reselling the ill-gotten gains for cash.

Bob Slydell · Dec 04, 2009, 09:40 PM // 21:40

Quote:

Originally Posted by jray14

Yes, that's what I meant when I said "game logins." As soon as you login to an NCSOFT account, all your linked game accounts' associated e-mail addresses are listed right there on the main page.

And of course the ability to change them requires no knowledge of the current GW password. So all a hacker needs to do at this point is concentrate on your NC account password. Once he finally gets into your NC account, basically... "all your GW account are belong to him".

He sees them, resets their password to something he knows, cops+pastes the email name of the account into GW account name box and types in password and there you go.

Martin Alvito · Dec 04, 2009, 09:54 PM // 21:54

Quote:

Originally Posted by Chrisworld

And of course the ability to change them requires no knowledge of the current GW password. So all a hacker needs to do at this point is concentrate on your NC account password. Once he finally gets into your NC account, basically... "all your GW account are belong to him".

He sees them, resets their password to something he knows, cops+pastes the email name of the account into GW account name box and types in password and there you go.

If he's automating the thefts themselves, it stands to reason that he's automating the process of breaking security as well.

All you need is three computers sharing data and some fairly simple programs:

- One to generate valid account names
- One to test birthdates and steal information
- One to clean accounts

Then you just add computers wherever the production bottleneck is (probably testing birthdates) as your budget allows. Simple.

Of course, a fourth computer to search the Internet for personal data once you identify a valid username would improve efficiency. Or you might attack the problem the other way around and start with a dictionary of probable username/birthdate combinations derived from fansites, then move on to brute force.

Bob Slydell · Dec 04, 2009, 09:59 PM // 21:59

Quote:

Originally Posted by Martin Alvito

If he's automating the thefts themselves, it stands to reason that he's automating the process of breaking security as well.

All you need is three computers sharing data and some fairly simple programs:

- One to generate valid account names
- One to test birthdates and steal information
- One to clean accounts

Then you just add computers wherever the production bottleneck is (probably testing birthdates) as your budget allows. Simple.

Of course, a fourth computer to search the Internet for personal data once you identify a valid username would improve efficiency. Or you might attack the problem the other way around and start with a dictionary of probable username/birthdate combinations derived from fansites, then move on to brute force.

And In the end the prison sentence really isn't worth it for a q9 Volatic Spear.

Martin Alvito · Dec 04, 2009, 10:00 PM // 22:00

Quote:

Originally Posted by Chrisworld

And In the end the prison sentence really isn't worth it for a q9 Volatic Spear.

But if he's in a foreign country without extradition, who's going to prosecute?

However, there's a reason that we're discussing it rather than doing it, now isn't there?

The forth fly · Dec 04, 2009, 10:05 PM // 22:05

last time i changed my Ncsoft password 2 seconds later i got a email from ncsoft saying some 1 at IP so and so changed your password if it was'nt you plz click this link and report it to us immediately

Bob Slydell · Dec 04, 2009, 10:06 PM // 22:06

Quote:

Originally Posted by The forth fly

last time i changed my Ncsoft password 2 seconds later i got a email from ncsoft saying some 1 at IP so and so changed your password if it was'nt you plz click this link and report it to us immediately

It says it when you change your own password too. Go to google, type in "whats my ip" and go to the first or second site, it'll tell you what YOUR IP is, than go to the email, if it matches you are fine, it's you. If it dosen't, than there is a problem but 2 seconds later is almost 100% your own IP changing your own password.

Martin Alvito · Dec 04, 2009, 10:08 PM // 22:08

A lot of the recent hacks have resulted in that e-mail.

The IP isn't as helpful at tracing the perpetrator as you might think. If the hacker's any good, the hacker is using various tricks to hide the IP.

And once the hacker has changed that password, it's too late. The hacker is faster than Support.

jray14 · Dec 04, 2009, 10:09 PM // 22:09

Quote:

Originally Posted by Martin Alvito

Once someone has that piece of the puzzle, the point of vulnerability is the NCSoft security question for resetting that password. Birthdays are easy.

Where is the mechanism where you can reset your password by merely entering a birthday? I've never happened upon that, and I think maybe we're talking about two different things here.

When I login to my NCSOFT account and click on the link to change my NCSOFT password, here's what I see:

"You will need to choose two hint questions which will be asked should you need to reset a forgotten password. You will need to provide the exact hint answers which you enter below in order to reset your password."

Then there's a picklist of 10 hint questions of which you select 2 and provide answers. Some of them are actually decent ones such as "What was your childhood nickname?" instead of the typical "mother's maiden name" bs.

I assume that you would need to specify those 2 answers after you click on NCSOFT's "Forgot your password?" link, but I'm too scared to try that right now to verify

.

Hengis · Dec 04, 2009, 10:13 PM // 22:13

I posted an idea while ago on one of the previous hacking threads that got locked and assigned to the ether.

Beefing up account security would be one way of helping to prevent the current outbreak of hacking, but I was trying to think of a resolution to the underlying problem.

The underlying problem in my opinion is Real Money Traders. These are the people responsible for the vast majority of hacks. They hack accounts to steal the in game gold and items and then sell the gold for real money.

If they were prevented from selling their gold in game then their reason for existing would cease to exist.

I believe that Anet already has some kind of system in place that monitors transactions looking for unbalanced trades. If this system could be enhanced, it could be possible to stop these RMTs from selling their gold.

Gold buyers and sellers usually deal in multiples of 100K.

The idea would be that all high value transactions are analysed for balance on both sides of the trade.

A gold seller trying to pass over 100K for nothing of similar value in return would trigger the system and the trade could be blocked.

A gold seller handing over a stack of ectos for nothing in return of similar value could be blocked.

A series of lower value trades totalling a high value within a short time frame to or from one account could be blocked.

This would need some kind of rough value table being coded into the system to give base values for high end items, or stacks of items that are regularly traded for a high value but the number of these items is limited, so this should be possible. For example the game already knows a rough (merchant buy/sell) value for all crafting materials, so they should be easy to work out.

A set of exemptions could be made for example, trades between chars on the same account, or chars from accounts on the same NCSoft Master Account would be allowed no matter what the value.

Trades between people in the same guild could be allowed no matter what the value after both parties have been in the guild for a week (for example).

There could also be a popup message for example saying that the trade has been blocked because it is unbalanced perhaps with a “click here to have the transaction verified”. This could fire off a support ticket and the trade could then be suspended pending investigation or allowed to proceed after a week perhaps.

If enough doubt could be introduced into the mind of the gold buyer that they will not get the gold that they have paid real cash for, then they will stop buying.

If the gold sellers can be for the most part prevented from handing over the gold they have been paid for, then they will not be able to continue to trade.

A bonus from this would be that if an account was hacked, the gold seller would be unable to transfer the stolen gold and items to their mules/bots/harvesters as the trades would be unbalanced and so be blocked.

This is only a rough and ready idea, and probably has a load of flaws, but if somehow Anet/NCSoft could hit the RMTs with a double blow of increased account security and make it much more difficult, time consuming and risky for them to go about their illegal business, then just perhaps they can be driven from the game.

Wow.. just previewed this.. sorry for the "Wall'o'Text"! I didnt realise how much I had written!

Martin Alvito · Dec 04, 2009, 10:20 PM // 22:20

Quote:

Originally Posted by jray14

Where is the mechanism where you can reset your password by merely entering a birthday? I've never happened upon that, and I think maybe we're talking about two different things here.

The only security question I've seen is the birthday on the "Forgot your password?" link.

I didn't luck into anyone's birthday when figuring out how to identify a valid username, so I haven't managed to verify the existence of additional security questions. (I haven't exactly tried very hard.) Like you, I'm unwilling to test any of my own accounts since there are other suspected vulnerabilities on the site.

If I'm mistaken, that changes things quite a bit. That would rule out brute force and make Chthon's explanation the more likely one. It doesn't change the fact that there's a glaring security vulnerability should someone gain unauthorized access to your PlayNC account that permits immediate forced entry to your game accounts.

Martin Alvito · Dec 04, 2009, 10:25 PM // 22:25

Quote:

Originally Posted by Hengis Stone

The underlying problem in my opinion is Real Money Traders. These are the people responsible for the vast majority of hacks. They hack accounts to steal the in game gold and items and then sell the gold for real money.

If people want to engage in the transaction, all making the transaction illegal does is increase the transaction cost. That'll reduce the problem. It will never eliminate it. Unless ANet has infinite monitoring resources or comes up with an innovative and clever solution to that problem, we're stuck with what we have.

I forget which of Posner's books makes that argument, but it was the best expression of the concept I've seen.

Quote:

Originally Posted by Hengis Stone

I believe that Anet already has some kind of system in place that monitors transactions looking for unbalanced trades. If this system could be enhanced, it could be possible to stop these RMTs from selling their gold.

But there are legitimate reasons to move this stuff around. I don't like having all of my eggs in one basket due to security concerns. This means that I periodically need to move stuff around to complete a trade. I like being able to do that without getting banned.

Separating out legit transactions from illegitimate ones is harder than you think.

MisterB · Dec 04, 2009, 10:34 PM // 22:34

Quote:

Originally Posted by Martin Alvito

The only security question I've seen is the birthday on the "Change password" link.

I didn't luck into anyone's birthday when figuring out how to identify a valid username, so I haven't managed to verify the existence of additional security questions. (I haven't exactly tried very hard.) Like you, I'm unwilling to test any of my own accounts since there are other suspected vulnerabilities on the site.

If I'm mistaken, that changes things quite a bit. That would rule out brute force and make Chthon's explanation the more likely one. It doesn't change the fact that there's a glaring security vulnerability should someone gain unauthorized access to your PlayNC account that permits immediate forced entry to your game accounts.

When NCSoft added the free Xunlai promotion, I had to use my NCSoft account again, but their website and certain log in mechanics had changed. They changed my password without notice, but that's not relevant. I do recall setting up 2 security questions for password retrieval, and neither one was birth date. I don't know if that was one of the options. My answers to the security questions have nothing whatsoever to do with the questions. I have not tested the password reset feature with the questions.