Curse

Malice Black · Feb 25, 2009, 06:08 PM // 18:08

Quote:

Originally Posted by didis

First of all...

I would appreciate it, that some kind of assurance is given to us players by ArenaNet that the infrastucture of Guild Wars and all connection to other company parts (NCSoft) are thrustworthy.

Due to to SOX 404 i would like to have extra insurrance by a trusted thirth party to start an audit against the confidentiality, integrity and availability of the different systems (server, databases, application, network and middleware).
The report can give us players some assurance that at ArenaNet's all posible has been done to mitigate the risks of comprimisation of our accounts. I also know that IT is in scope of the audit reports for the financial results review by those auditors. What is their statement? If their is no audit report then i think this could also result in legal problems for Arenanet because they don't make transparant that they take security meassures serious. I mean taking preventive security meassures befor and not after occurance.

Also i want to mention the opportunity of implementing a challenge/respons system with a token just like Blizzard has implemented for those people who want more assurance that there hard work and labour in the game is extra protected. The level of security meassures should be increased by the value increasing over time. That means, to be answering another post, you by a car with a basic security level. You by all kind of nice expensive stuff resulting in the fact that the insurrance agencies wanting to add a higher alarm system. This is also the case with Guild Wars. I would like to pay for a challenge response system to know i am saver. It's like a life insurrance. To bad this is not implemented but investigated (see one of my posts on gaile gray's talk page on wiki).

I lol'd

Text book c&p no doubt.

Nemo the Capitalist · Feb 25, 2009, 06:31 PM // 18:31

Thats what happens when you use bot programs in Jade Quarry and For Older Hero Fast Faction Farm they are finally getting you back

Aint Karma a Bitch?

No in all seriousness srry to hear that happened..lets start a strike in Great Temple of Balthazar.

~Nemo

didis · Feb 25, 2009, 06:32 PM // 18:32

@Wubbies: you have offended me.

Maybe this clarrifies what i mean:
http://en.wikipedia.org/wiki/Informa...chnology_audit

Sir Skullcrasher · Feb 25, 2009, 06:35 PM // 18:35

this is me being sarcastic but....

A-Net should hire MC Hammer to do a commercial on public safety/awareness on account security!! lol

Imagine the dance moves that could go with the commercial?

the_jos · Feb 25, 2009, 06:57 PM // 18:57

Quote:

Originally Posted by Painbringer

One question I have is- If someone where to get your e-mail address how long would a hack program take on a 6 – 7 digit password

Depends.
When assuming brute forcing [a-Z][0-9] online at the rate of 1 second/ attempt, knowing it's either 6 or 7 you are talking over 1000 years for all options. (62^6 + 62^7 options).

However, the actual number of trials might be a lot less.
Let's assume we know the password is either 6 or 7 characters long.
Now I'm going to do some guessing.
The actual password has at least one numerical digit and at most two.
The position of those digits is either at the start or at the end of the password. And the password itself is in a dictionary.
That would limit the number of options enormously. We are talking about a 4-6 character word from the dictionary + one or two digits at start or end.

Still this would require some massive work, months to years.
But next we can compose a list of frequently used passwords and put those first. This would make an account with such a password crackable in minutes/hours/days.

On the other hand there is a list of encrypted /hashed passwords that is obtained somehow.
This is way faster to process, hashing can be done upfront when assuming it's plain MD5/SHA1 hashes.
Brute forcing dictionary is a matter of days when a known or no 'salt' is used.
But when the 'salt' changes on every password this effort will take ages when processing a list of accounts.

Attempting to hack an account online by trial and error (except a list of common passwords) is futile. The strongest attempt can be done offline but requires access to the password database. And is only worth the effort if each password is encrypted/hashed with the same mechanism and key.
An attempt with a 'known list' can be done when different keys are used. If that fails the passwords are useless. Not because they can't be cracked but because they take too much time to crack.
It's not NSA passwords or passwords to bank accounts. It's passwords to online accounts with a possible value of let's say $0.01 to $1000. With most accounts around the $0.01 range.

Winterclaw · Feb 25, 2009, 07:04 PM // 19:04

Jos, modern brute force password breakers can do up to 8 million attempts per second.

Nereyda Shoaal · Feb 25, 2009, 07:09 PM // 19:09

Ok this topic made me paranoid
I don't know whether it's people stupidity or a very serious threat
I hope there hasn't been a leak of any database (either Anet/wiki etc)
Since stealing credit card numbers is fairly easy why GW accounts should be more difficult?

An idea for the developers (in case any of them is reading). Not perfect but still... Why not implement an option which will narrow the range of IP addresses which are able to log onto the account?

Wubbies · Feb 25, 2009, 07:21 PM // 19:21

Quote:

Originally Posted by didis

@Wubbies: you have offended me.

Maybe this clarrifies what i mean:
http://en.wikipedia.org/wiki/Informa...chnology_audit

im offended what u wrote that i somehow offended you and then u say i offended you..no offense..but opinions you take as offense doesnt mean i was trying to offend you..just thought it was ridiculous (your post) imo. they say the best offense is defense ..so imo i was defending.

im sure i oofend alot of people but this thread is getting so ridiculous i cant help but check it out everday..it;s better than the comics in the newspaper section..no offense

p.s. no offense i dont clic on links.. u never know who is behind the link "hacking" away

zwei2stein · Feb 25, 2009, 07:48 PM // 19:48

Quote:

Originally Posted by Winterclaw

Jos, modern brute force password breakers can do up to 8 million attempts per second.

Hardly possible when trying to crack remote password considering that would be 62 MB/s of passwords sent alone; you have to double that since you need to send username too. Here, we exhaused capacity of gigabit network and none of overhead was accounted for yet. Not to mention that most routers would give up way, way before that because of amount of connections opening and closing.

Painbringer · Feb 25, 2009, 08:03 PM // 20:03

Quote:

Originally Posted by zwei2stein

Hardly possible when trying to crack remote password considering that would be 62 MB/s of passwords sent alone; you have to double that since you need to send username too. Here, we exhaused capacity of gigabit network and none of overhead was accounted for yet. Not to mention that most routers would give up way, way before that because of amount of connections opening and closing.

"I am making an assumption" If gold sellers are the motivation behind the hack. Would they not be able to download the client on a bot network and then run passwords on multiple units at the same time until they get a hit?

Xun Rama · Feb 25, 2009, 08:12 PM // 20:12

Quote:

Originally Posted by Painbringer

One question I have is- If someone where to get your e-mail address how long would a hack program take on a 6 – 7 digit password

A couple days ago, it told you specifically you should have an at least 8 digit password.

It depends on a few things:

1. The complexity and length of your password.
2. How many proxies/computing power said hacker has (or how big their botnet is).

If we're talking 6-7 digits with nothing special, just a word and a number or something like yippie7 or something, then not really all that long to be honest...

Check this and go here to check your password strength.

If you're truly worried, what I suggest you do is go here. Set it to 15 characters in length, Num + alpha + ALPHA. Generate a password.

Here's some examples: IKswAquMRmpx49Y
gMojLOz7w0k73Cy
szjTZ0VvbLHFloM
7Ro9MBnKr6EnBPH
rXYyPKhZ3LpT1vx
YtHW9TFaEOHt4ZL
XtKcERyi4svmSRz
(don't use those, generate yourself a fresh one)

Don't use those either. Edit it a little bit, add some special characters in there like !@#$%^&*()-=_ and such. Or if you want an even harder one, alt codes are good, alt+0191 ¿, ¤ alt+0164, alt+0137 ‰, alt+0134 †, et cetera. Just hold alt on your keyboard and hit a 4-5 key combination on your numpad and see what it comes up with. I'll give you an example:

3Liòw.Wóï5OöiH~

Something like the above would be much more difficult to crack.

Quote:

Hardly possible when trying to crack remote password considering that would be 62 MB/s of passwords sent alone; you have to double that since you need to send username too. Here, we exhaused capacity of gigabit network and none of overhead was accounted for yet. Not to mention that most routers would give up way, way before that because of amount of connections opening and closing.

You're overlooking zombies... 62 MB/sec would require ~620 compromised computers capable of upload speeds around ~100kb/sec which is pretty standard. Of course, they'd also probably have some with much faster/slower connections, so that would affect the number quite a bit.

The Dutch police found a 1.5 million node botnet and the Norwegian ISP Telenor disbanded a 10,000-node botnet.

Conflicker (aka DownUp, DownAndUp, DownAdUp, Kido) is assumed to have somewhere around a 15,000,000 botnet. And well, if you can do 62MB/sec with about average DSL connections with only 620 computers, just think about 15 million... That's what, 15GB/sec not accounting for faster connections?

To be honest here though, I'm pretty sure someone that has that kind of power wouldn't give a damn about GW money. Bank accounts would be very much within reach and much more profitable (not to mention other things).

Winterclaw · Feb 25, 2009, 08:13 PM // 20:13

Quote:

Originally Posted by zwei2stein

Hardly possible when trying to crack remote password considering that would be 62 MB/s of passwords sent alone; you have to double that since you need to send username too. Here, we exhaused capacity of gigabit network and none of overhead was accounted for yet. Not to mention that most routers would give up way, way before that because of amount of connections opening and closing.

Still, you could do a lot more than 1 per second. Plus I'm not entirely sure these hackers need your password and email yet.

zwei2stein · Feb 25, 2009, 08:15 PM // 20:15

Quote:

Originally Posted by Painbringer

"I am making an assumption" If gold sellers are the motivation behind the hack. Would they not be able to download the client on a bot network and then run passwords on multiple units at the same time until they get a hit?

Yes, but anets endpoint would be just as affected by amount of traffic. And login servers would be DOSed.

Very noticeable both for players and anet.

T1Cybernetic · Feb 25, 2009, 08:20 PM // 20:20

Quote:

Originally Posted by Malice Black

My account was accessed by someone too. Logged on couple of days ago, popped onto guild chat, and it said I had been online 5 hours ago which I hadn't. Nothing was taken as I have nothing worth stealing these days.

I had the same problems a few days ago

i loaded up and noticed my character secection screen was on a different character than when i left (I've only been on my warrior for the last few days) and my ranger loaded up which was pretty strange.

Then when i loaded a character i noticed my inventory had been slightly changed (i've had my inventory the same for 4 years) so i noticed it was different straight away.

I checked the guild screen it said i was last online 5 hours ago!! which i hadn't as i had been out all day, needless to say i have changed my password a couple of times since and scanned my pc with just about everything i can think of.

The odd thing is, i have not lost anything from my account, No gold/items/materials/weapons/characters or anything that i can see...

Wubbies · Feb 25, 2009, 08:30 PM // 20:30

Quote:

Originally Posted by Xun Rama

To be honest here though, I'm pretty sure someone that has that kind of power wouldn't give a damn about GW money. Bank accounts would be very much within reach and much more profitable (not to mention other things).

i agree 100% i said that same thing before and was suggested that people could make money by selling ectos ,gold for real $. i still think why go through all the trouble. they wouldnt waste the time.

Fril Estelin · Feb 25, 2009, 09:03 PM // 21:03

I've stopped reading posts at some point (mostly due to security mistakes in the posts), but thought I'd comment on the point of password cracking. These are reliable numbers:
http://www.lockdown.co.uk/?pg=combi

The advised alphabet is 96chars, and if you can manage a ClassE cracking-comp (good luck) you're going to spend 2,5years. Event a 52chars alphabet with ClassE will give you 6days (which is not a lot).

Now, if you want big numbers (of course, all these numbers are offline attacks, something that most people completely got wrong in this thread) look here:
http://hak5.org/forums/index.php?showtopic=11551

BTW, very speedy treatment of this case by Gaile and the support team. Hope the guys will get nailed and leave without pants.

To everyone: read this article, it's a good article on passwords: (although I'm not happy he doesn't mention obfuscation by transforming chars, e.g. e to 3, o to 0, a to 4, s to %, etc.)
http://www.schneier.com/essay-246.html

Quote:

Passwords Are Not Broken, but How We Choose them Sure Is

By Bruce Schneier
The Guardian
November 13, 2008

This essay also appeared in the The Hindu.

I've been reading a lot about how passwords are no longer good security. The reality is more complicated. Passwords are still secure enough for many applications, but you have to choose a good one. And that's hard. The best way to explain how to choose a good password is to describe how they're broken. The most serious attack is called offline password guessing. There are commercial programs that do this, sold primarily to police departments. There are also hacker tools that do the same thing.

As computers have become faster, the guessers have got better, sometimes being able to test hundreds of thousands of passwords per second. These guessers might run for months on many machines simultaneously.

They guess intelligently. They don't run through every eight-letter combination from "aaaaaaaa" to "zzzzzzzz" in order. That's 200bn possible passwords, most of them very unlikely. They try the most common password first: "password1". (Don't laugh; the most common password used to be "password".)

A typical password consists of a root plus an appendage. The root isn't necessarily a dictionary word, but it's something pronounceable. An appendage is either a suffix (90% of the time) or a prefix (10% of the time). One guesser I studied starts with a dictionary of about 1,000 common passwords, things like "letmein," "temp," "123456," and so on. Then it tests them each with about 100 common suffix appendages: "1", "4u", "69", "abc", "!" and so on. It recovers about 24% of all passwords with just these 100,000 combinations.

Then the guesser tries different dictionaries: English words, names, foreign words, phonetic patterns and so on for roots; two digits, dates, single symbols and so on for appendages. It runs the dictionaries with various capitalisations and common substitutions: "$" for "s", "@" for "a", "1" for "l" and so on. With a couple of weeks to a month's worth of time, this guessing strategy breaks about two-thirds of all passwords. But that assumes no biographical data. Any smart guesser collects whatever personal information it can on the subject before beginning. Postal codes are common appendages, so they're tested.

It also tests names and addresses from the address book, meaningful dates, and any other personal information. If it can, the guesser indexes the target hard drive and creates a dictionary out of every printable string, including deleted files. If you ever kept an email with your password, or saved it in an obscure file somewhere, or if your program ever stored it in memory, this process will grab it. And it will recover your password faster.

So if you want your password to be hard to guess, you should choose something that this process will miss. My advice is to take a sentence and turn it into a password. Something like "This little piggy went to market" might become "tlpWENT2m". That nine-character password won't be in anyone's dictionary. Of course, don't use this one, because I've written about it. Choose your own sentence - something personal.

Strong passwords can still fail because people are sloppy. They write them on Post-it notes stuck to their monitors, share them with friends, or choose the same passwords for multiple applications. (I don't care about low-security passwords here, only about ones that matter: your bank accounts, your credit cards, etc.) Websites are sloppy, too, allowing people to set up easy-to-guess "secret questions" as a backup password or email them to customers.

If you can't remember your passwords, write them down and put the paper in your wallet. But just write the sentence - or better yet - a hint that will help you remember your sentence. Or use a free program like Password Safe, which I designed to help people securely store all their passwords. Don't feel this is a failure; most of us have far too many passwords to be able to remember them all.

Passwords can still provide good authentication if used properly. The rise of alternate forms of authentication is more because people don't use passwords securely, and less because they don't work any more.

Kyosuki · Feb 26, 2009, 12:28 AM // 00:28

Quote:

Originally Posted by pansy malfoy

O_o Where did you download the client from, btw?

My own retail GuildWars: EoTn CD =/

I just remembered a show on TV about hacking,and there where talking about those really powerful worms like Storm,Blaster and Conflicker,maybe it isn't affecting just GW but other MMO's too?

Gigashadow · Feb 26, 2009, 01:16 AM // 01:16

http://www.adobe.com/support/securit...apsa09-01.html

WARNING, there is a critical buffer overflow bug in Adobe reader, dated Feb 19. There is currently NO FIX until March 11.

Excerpt:

"A critical vulnerability has been identified in Adobe Reader 9 and Acrobat 9 and earlier versions. This vulnerability would cause the application to crash and could potentially allow an attacker to take control of the affected system.

Adobe expects to make available an update for Adobe Reader 9 and Acrobat 9 by March 11th, 2009."

Coney · Feb 26, 2009, 01:31 AM // 01:31

Quote:

Originally Posted by Gigashadow

http://www.adobe.com/support/securit...apsa09-01.html

WARNING, there is a critical buffer overflow bug in Adobe reader, dated Feb 19. There is currently NO FIX until March 11.

For real?

Wonder what Fril has to say about this? <ducks>

EDIT: Don't do your taxes until after 3/11, I guess - if you use the IRS PDF files...

Perkunas · Feb 26, 2009, 03:21 AM // 03:21

Most times when I read posts like this, I think "Your fault, what did you do?"

I just spoke with my guild mate. He logged on tonight, Monk was in ToA, not the GH. I had told him about this thread when it was started. He immediately checked storage. Gone is 100+ elite tomes, 100k, 2 undedicated minis, Forgotten sword, Totem Axe, & 2 stacks candy canes.

His computer is less than a week old. It was bought purely for games. Not used for "surfing" the net.

So, now I wonder whats going on.