Curse

Shasgaliel · Dec 09, 2009, 09:16 PM // 21:16

Quote:

Originally Posted by craigrs84

Listen...

The only way they could get your password without it being your fault is if they hacked directly into A-Net's database... Which I very highly doubt.

Even if they did manage to get past the firewall and into the database, the passwords are still going to be hashed using either a MD5 or SSHA salted algorithm. Even with a set of Rainbow tables these are going to be very difficult to crack if you use a reliably strong password. In short it would take a lot of time and energy to crack one password, probably much more time than it was worth.

Now... the other much more likely possibility is that you messed up.

I'm thinking of a number between 1 and 100? Can you guess it? No.

Guess what. That's basically the same concept as a password. Just use a little logic and there's your proof.

They could just use NCSOFT website. Hacking website is actually not that hard if it is not properly protected. You do not need to care about anything in ANETS dba whatsoever since you can access gw account via playing around with NCsoft master account. You know you can clear your GW password from there? You need just to "sniff" a login to NCSoft master account and all the rest you will get sooner or later on a silver plate. Password to NCsoft account does not matter much. The fault of people can be just that they purchased something from NCsoft store or just went there to link their account... Xunlai pane promotion anyone? Will you blame people for doing that?

Even better they do not need to hack NCsoft website. They can just use random IGNs from sales or gw auction sites. You will hit some logins to NCsoft easily. You can say people are stupid but even if they realized their mistake they cant easily correct it. Try to change login to NCsoft account.

Since you are not penalized for incorrect tries you can use botnet and just run password query for every confirmed login. Matter of days even for strong ones I would say...

@OP. I will sign everything which will increase security in this game. I hope something will be done.

I like Martin Alvito suggestions. I will add that for 3 subsequent incorrect tries IP gets blocked. It will not prevent botnets but will hit smaller hackers.

Aleta · Dec 09, 2009, 09:31 PM // 21:31

Quote:

Originally Posted by craigrs84

Obviously those people that got their accounts hacked have made mistakes... Whether they realize it or not.

I say don't change game play / mechanics for this reason. It won't stop the hacking and another thread will pop up when someone gets something else valuable stolen.

I don't know what sort of security Guild Wars implements but I would hope that they lock your account after 5 or so failed login attempts (to stop brute force hacking). This is really the only security measure you would need.

Other than that, if you get your account hacked it is 99% likely it's YOUR OWN FAULT.

I don't even care right now if I get banned or not but up yours and kiss off. So many of us have been hacked. Most of us used the stinking store and got hacked after that. I checked with IT here at work and they said inside job. So shut up. my fault pfft joke

AtomicMew · Dec 09, 2009, 09:36 PM // 21:36

Quote:

Originally Posted by Axeman002

or dont make ecto's tradable = end of hacking

Also armbraces and zkeys.

/Win

snowman relic · Dec 09, 2009, 10:22 PM // 22:22

heres what anet should do make it so you either need a waiting period of one week and at any time during said week if u log on you can end it making said hacker have to restart or make u have to confirm it from your email address

Reverend Dr · Dec 09, 2009, 11:23 PM // 23:23

Ban all Chinese IP

hurf derf

carnage-runner · Dec 09, 2009, 11:50 PM // 23:50

4 Years no hack. People who get "hacked" are mostly people who accidentaly give out tidbits of information. If anyone gets anything of your account info, you just gave them an account. So before you go about spouting "HACKED HACKED!!!" understand sometimes it's your own doing. It's usually just carelessness. Stay away from 3rd party programs in general. Texmod included. Don't give out any information, don't use your email for GW on other websites. Keep your GW password and account name private from all things. If you trust someone with account info, you're asking to lose your things.

4 years of playing a lot.. Pissing a lot of people off.. No 3rd party programs.. No altering of GW at all.. Never using my GW email anywhere else.. Passwords don't have to be too strong either. If they don't have the username you are more or less fine... Also, if someone who knows anything about hacking a computer wants your GW account then they will take it. Not a whole lot you can do to stop someone determined and educated.

Hate to break it to you, but if someone wants to hack your computer, and knows how to, the strongest password you can think of doesn't stand a chance.

Chthon · Dec 10, 2009, 12:08 AM // 00:08

1. A number of suggestions that would significantly improve security have been floating around for a long while now. The fundamental problem is that a-net/NCSoft (I have a feeling it's more NCSoft in this case) just don't seem willing to admit to themselves (much less to us) that THEY have a security problem and it needs to be fixed. Until they accept that security needs to be upgraded, no amount of insightful ideas about how to upgrade security are going to make a difference.

2. I am consistently amazed at how people here are utterly unable to grasp the possibility that accounts are being stolen in multiple ways. Yes, there is a certain baseline of people who get accounts stolen because they did something dumb. Always has been. Always will be. However, IN ADDITION to that, there appears to be a number of accounts being stolen without any interaction between the thief and the user -- account thefts perpetrated solely using a vulnerability in a-net/NCSoft's systems.

Shanaeri Rynale · Dec 10, 2009, 09:15 AM // 09:15

NCsoft may well be unwilling to do anything about it. BUT it's ANets game. There are things they can do within their own game that can reduce or negate the effects of being hacked.

Yes people screw up sometimes, thats why we put air bags, crumple zones and ABS on cars. So that when we do the effects are greatly reduced.

What Anet seem unwilling to do, because it's been one of those hidden unspoken issues for 4 years is to fit the car they made with anything other than a fender to protect their occupants.

I am really starting to think they don't give a <insert word> about their customers who have spent so much time, money and effort on their game.

if they did they would say 'so what if GW2 is a delayed a month, we want to better protect our customers' and do something about it.

And don't give me it's not possible blah blah. Thats what we were told about re-connects, hairdressers and the like. Of course it's possible it's just that they are unwilling to do anything about it.

I don't want stupid new hats, dumb ass bosses what I do want better protection for my account and a demonstration that Anet actually do more than pay lip service to valuing a customer.

Enough really is enough.

karlik · Dec 10, 2009, 01:16 PM // 13:16

Quote:

Originally Posted by craigrs84

Listen...

I'm thinking of a number between 1 and 100? Can you guess it?

1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65, 66, 67, 68, 69, 70, 71, 72, 73, 74, 75, 76, 77, 78, 79, 80, 81, 82, 83, 84, 85, 86, 87, 88, 89, 90, 91, 92, 93, 94, 95, 96, 97, 98, 99, 100

There - I guessed it. Now give all your gold, and anything worth salvaging. Oh yeah - delete that Sin with 28 maxed titles.

Aussie Boy · Dec 10, 2009, 02:57 PM // 14:57

My idea about more security on anets side
They could just send an email to your email account with a Link to click to confirm
you actually want the password changed and not just
"someone from ip yada yada yada changed the passwrord if not contact us after the fact you just been hacked and we willget back to you oh say in 3 days time.
Also put in place a 3 times your out for trying to enter a password and it locks you out for say 1 hour or something
with an email to your account so you have an idea someone IS trying to get in.
These suggestions have been around for a while by many people.
I hope GW2 will have better way of dealing with account security.

zwei2stein · Dec 10, 2009, 03:14 PM // 15:14

Quote:

Originally Posted by Chrisworld

This is what firewall programmers don't want you to know about, the utilities of your very own computer that work just as good, without even using a firewall.

You DO realize that this only works when site does use it domain address and not ip address, right? And its not like it is very hard to get new and new domain names if you really want to get past address based blocking.

This only works when program asks operating system for DNS resolve, like most browsers. No software is under obligation to do this i am afraid.

Not to mention that decent firewall does more than just deny certain hostnames. Like blocking incomming/outgoing traffic and managing application ability to access network. Incoming traffic gets you wormed & compromised.

hosts file abused like this is just another abblock.

Nerel · Dec 10, 2009, 03:20 PM // 15:20

Quote:

Originally Posted by karlik

1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65, 66, 67, 68, 69, 70, 71, 72, 73, 74, 75, 76, 77, 78, 79, 80, 81, 82, 83, 84, 85, 86, 87, 88, 89, 90, 91, 92, 93, 94, 95, 96, 97, 98, 99, 100

There - I guessed it. Now give all your gold, and anything worth salvaging. Oh yeah - delete that Sin with 28 maxed titles.

lol, you brute forced his magic number, how dare you!

isildorbiafra · Dec 10, 2009, 07:01 PM // 19:01

Speaking of hackers. Lately I have recieved many of these. As you can see my e-mail filter program has no porblem weeding them out. I never leave home without it. By the way; never have I nor will I ever play WoW.

The Drunkard · Dec 10, 2009, 09:09 PM // 21:09

/notsigned

It's only going to help the people that have FoW armor and high-end minis; I doubt gold sellers ignore the people who don't have hundreds of platinum.. Crafting mats, gold, and Miscellaneous items are still up for grabs. It also doesn't help if they delete your characters that you've spend thousands of hours on/

Trinity Fire Angel · Dec 10, 2009, 09:48 PM // 21:48

my domain host has better security than NCSoft. basically i could brute force any GW;s client. anyone could do it, i could write a program in 30 seconds to do it. all ou need is a [email protected] and just start aaaaaaaa, baaaaaaa, caaaaaaa etc etc.

what ANet and NCSoft should do is write some security code into their website and game client that detects this kind of shit.

apart from that, i am sure any smart kid can hack into your account. they just need to get all the saved passwords and auto-fills from forms from your webbrowser. maybe just put a backdoor trojan on your computer like backorifice. how do i get your IP? easy, you been playing HA or teaming up on a free Vent channel... easy to get your IP now.

shit man, i could even get your ip from any website that i set up. i can view the last 50 ip addresses that have hit my website if i want. its easy to script.

even tho its a game and i don;t really care if i lost everythiung tomorrow, i still sign for better security. after all, even tho i don;lt really care if i lost everyting (got nothing to lose really), i woiuld prefer not to.

Namaste! Trin

EDIT: Speaking of which, i just checked how much info i could get just by looking at this forum. I eventually found out my ABN number and from that all my past postcodes from the last 10 years where my business was located as well as previous business names. i am sure i could peice together more history if i then linked my real name (from my ABN) to facebook.... i am sure its easy enuff for someone to hack you if they want...

Malician · Dec 11, 2009, 02:58 AM // 02:58

The way I'm reading posters here, there's no ratelimit on login attempts?

Assuming you can only attempt to login 5 times a minute and (say) 30 times a day, bruteforcing would seem impossible.

dan daze · Dec 11, 2009, 05:13 AM // 05:13

Link each guildwars account to the owner's ip. If your ip changes, require a cd key to reset the address.

No more hacking.

craigrs84 · Dec 11, 2009, 05:15 AM // 05:15

Quote:

Originally Posted by Nerel

lol, you brute forced his magic number, how dare you!

Funny, but if it were a good password using special characters, upper case lower case, and numbers, you increase your range to 94 different characters.
If you have a 10 digit password that's 53 qunitrillion combinations. If you had 10 powerful computers working together to crack this single 10 digit password it could take up to 6,531,568 days. I really doubt these Chinese hackers are using super computers.

P.S. It does suck that GW has no limit on the # of failed passwords attempts. I think that would be ok to program in. I don't really like the idea of making armor not salvageable though. Anyways just make your password a few digits longer, cause it will make it exponentially harder to crack.

bhavv · Dec 11, 2009, 08:34 AM // 08:34

I use the same Email address, user name, and a variation of 4 memorable passwords all over the internet and Ive never been hacked.

I used the same password everywhere too for over two years, then with all the account safety boo hoos going around I added a single number, symbol and second word and swap them around from time to time.

If I get hacked, you will know about it. I never open emails that I werent expecting or that are not from a known secure website registration. I never download any junk programs or applications that I dont need (only thing I tried for this game was GWX2).

If you are worried about security, change your password regularly.

Mokeiro · Dec 11, 2009, 12:47 PM // 12:47

Quote:

Originally Posted by Axeman002

or dont make ecto's tradable = end of hacking

GW "rich" people if that comes to reality: