4 ms·

Another month, another hack on Nintendo accounts... What is up with their security?!

by sk0g 6y ago

toyg 6y ago
Not unlike Apple and Sony, when a hardware company starts making web-apps, chances are it's not going to be very good.
- mschuster91 6y ago
  Sony ain't that good in embedded software in general, the Alpha series camera software is ... a hot mess.
- shasheene 6y ago
  It's strange, because Nintendo has such good first-party game development skills, develops entire operating systems for their internet-connected consoles (including security architectures spanning hardware/software). Even some of Nintendo's top brass have had strong software engineering skills: in the late 1990s, during the development of Pokemon Gold & Silver, the team was struggling so future Nintendo President Satoru Iwata developed and implemented a compression algorithm. The skills are certainly there.
  - godzillabrennus 6y ago
    Web security is not the same skill set. You’d think after this they would just buy Auth0.com and use their skills.
  - eswat 6y ago
    Developing software that fulfills functionial or gameplay requirements is going to require a very different skillset compared to fulfilling security requirements (user stories become abuser stories, and they aren't always easy to wrap your head around). Corporate Japan has also lagged behind western companies in this area. The book Business Management and Cybersecurity by Shinichi Yokohama dives into this.
- mcphage 6y ago
  Plenty of web apps have giant account breaches as well—late last year DoorDash had almost 5 million accounts get hacked. Over 15x as big as this one.
daveoc64 6y ago
In this case, nothing. The "attack" was a standard credential stuffing attack (https://en.wikipedia.org/wiki/Credential_stuffing https://en.wikipedia.org/wiki/Credential_stuffing). Attackers were just using credentials that were leaked in other data breaches to access Nintendo Accounts (Switch and mobile apps), by logging in via a linked Nintendo Network ID (3DS and Wii U). If the password for your NNID had not been breached in the past (and then reused for the NNID), you wouldn't have been vulnerable. Enabling 2FA would also have protected you against this attack. Nintendo has solved this by: a) Resetting NNID passwords when they think someone has been affected b) Disabling the option to log in to Nintendo Accounts using the NNID username/password.

Another month, another hack on Nintendo accounts... What is up with their security?!

by sk0g 6y ago

Another month, another hack on Nintendo accounts... What is up with their security?!

toyg 6y ago

Not unlike Apple and Sony, when a hardware company starts making web-apps, chances are it's not going to be very good.

mschuster91 6y ago
Sony ain't that good in embedded software in general, the Alpha series camera software is ... a hot mess.
shasheene 6y ago
It's strange, because Nintendo has such good first-party game development skills, develops entire operating systems for their internet-connected consoles (including security architectures spanning hardware/software). Even some of Nintendo's top brass have had strong software engineering skills: in the late 1990s, during the development of Pokemon Gold & Silver, the team was struggling so future Nintendo President Satoru Iwata developed and implemented a compression algorithm. The skills are certainly there.
- godzillabrennus 6y ago
  Web security is not the same skill set. You’d think after this they would just buy Auth0.com and use their skills.
- eswat 6y ago
  Developing software that fulfills functionial or gameplay requirements is going to require a very different skillset compared to fulfilling security requirements (user stories become abuser stories, and they aren't always easy to wrap your head around). Corporate Japan has also lagged behind western companies in this area. The book Business Management and Cybersecurity by Shinichi Yokohama dives into this.
mcphage 6y ago
Plenty of web apps have giant account breaches as well—late last year DoorDash had almost 5 million accounts get hacked. Over 15x as big as this one.

daveoc64 6y ago

In this case, nothing. The "attack" was a standard credential stuffing attack (https://en.wikipedia.org/wiki/Credential_stuffing https://en.wikipedia.org/wiki/Credential_stuffing). Attackers were just using credentials that were leaked in other data breaches to access Nintendo Accounts (Switch and mobile apps), by logging in via a linked Nintendo Network ID (3DS and Wii U). If the password for your NNID had not been breached in the past (and then reused for the NNID), you wouldn't have been vulnerable. Enabling 2FA would also have protected you against this attack. Nintendo has solved this by: a) Resetting NNID passwords when they think someone has been affected b) Disabling the option to log in to Nintendo Accounts using the NNID username/password.