5 ms·

League of Legends compromised – North American accounts and transactions

67 points by CrazedGeek 13y ago

josh2600 13y ago
Sigh. My office plays League of Legends regularly. It's quite a fun game. This, however, isn't fun at all. Is it just a fact of doing business in the modern internet age that everyone can and will eventually be pwned? The best part of this is that it's obviously some legacy system that wasn't properly decommissioned. Think about it, the records haven't been in use for 2+ years? Sounds weird, right? Remember, if it's on the network somebody can get to it and just because you don't use it anymore doesn't mean you can just stop patching the boxen :(.
- GuiA 13y ago
  > Think about it, the records haven't been in use for 2+ years? If I read it correctly, only the payments part have been inactive for 2 years- probably because they switched to another system and just left the old records there. The rest of the database is likely to be a current production system though. > Is it just a fact of doing business in the modern internet age that everyone can and will eventually be pwned? Unless a company spends decent money on security auditing, pentesting, etc, then yes. It's ridiculous for a software company to be spending tens/hundreds of thousands of dollars a year on security for their physical offices, but to not have routine security audits for their digital property.
  - smtddr 13y ago
    I don't think it matters how much money a company spends on security, it'll get hacked if there's strong incentive for that event to occur. Basically, if you're popular... just assume you'll be hacked one day. I think there are only really 2 things you can do. 1. Just make sure the hack isn't something embarrassingly easy like SQL injection in the username/password field. If you get hacked, make sure the hacker had to do something really clever that any developer would go "whoa, that's not an exploit I see everyday..." 2. Assume a hacker got a bash shell to your system and apply the next level of security there. Salted hashes, PGP encryption on any sensitive data. Make sure the salt isn't sitting there in plain view and if pub/priv key, make sure the private-key isn't just sitting there on the same system without a passphrase.
    - GuiA 13y ago
      I agree with you, but spending some money on security auditing is a pre-requisite for 1) to happen :)
    - adrr 13y ago
      Good advice. I'll add one more thing. If you're dealing with credit cards, the private key should be on a hardware security device with the only backups stored on a couple USB sticks sitting in a safety deposit box at a bank.
      - GuiA 13y ago
        If you're dealing with credit cards, you have much more to do than that: http://en.wikipedia.org/wiki/Payment_Card_Industry_Data_Security_Standard http://en.wikipedia.org/wiki/Payment_Card_Industry_Data_Secu...
        adrr 13y ago
        Well thats a given since your merchant bank and processor will force you to be PCI compliant including annual reviews. PCI compliance doesn't specify where your private key is stored just that your data is in a "unreadable" state and that you have certain key management procedures in places. For example, hashing your credit cards is acceptable though it can easily be brute forced since its just 16 digit number and the six digit prefix set(BIN) is already known.
- rartichoke 13y ago
  Pretty much. Look at company's like Blizzard who are even bigger. - Their passwords aren't case sensitive. - Their login form's GET request isn't using https. - Within 20 minutes of informing a security specialist not affiliated to blizzard he was able to write a script that compromised every single battle.net e-mail address. * This information is based from about June 2012, I'm not sure if their security measures changed since then but I remember the thread on the bnet forums and it being confirmed by an official moderator-like person saying blizzard was aware of the problem for the longest time but didn't care about fixing it. I never understood how game companies could be so lazy when it comes to security. They obviously have the talent to do things right and rake in silly amounts of $. Why jeopardize the integrity of their name.
  - Steko 13y ago
    "- Their passwords aren't case sensitive." Not a huge deal. "- Within 20 minutes of informing a security specialist not affiliated to blizzard he was able to write a script that compromised every single battle.net e-mail address." I don't remember this ever happening.
    - Karunamon 13y ago
      >Not a huge deal. Wouldn't cutting your key search space roughly in half reduce your cracking time greatly, though? According to Wolfram, for a 12 character password: password type | total number | example digits 0 through 9 | ~~ 2^40~~1 trillion | 287088364476 case-insensitive alphabetic | ~~ 2^56~~95.43 quadrillion | ycwcgndabspw case-insensitive alphanumeric | ~~ 2^62~~4.738×10^18 | okcm5tfe8odr case-sensitive alphabetic | ~~ 2^68~~3.909×10^20 | SgilPtNTKmuQ case-sensitive alphanumeric | ~~ 2^71~~3.226×10^21 | xhWuSN5HBETz printable ASCII characters | ~~ 2^79~~4.759×10^23 | [i{}I"2Bz9sN The difference comes out to be 6.7 bits of entropy for a 12 chraracter, case sensitive and case insensitive alphanumeric with symbols. 81.38 vs 88.08. (Note that this "bits of entropy" number is mostly beyond my comprehension.. could anyone elaborate a bit? I'd assume more==better)
      - qnr 13y ago
- criley2 13y ago
  I do assume that almost all online services will be pwned. I have a small amount of faith that my Google account, Amazon account, and (major) bank account won't be compromised except by my government. Maybe a few other services are this trustworthy to me, but not many, and I can't think of them off the top of my head. We just need to get used to using throw away credit card numbers from our credit card's website. Or buy game currency/points/time in stores, in the form of cards, to prevent giving out the info that will be pwned sooner or later, on one service or another. And get used to using throwaway passwords. If your password being compromised on one service makes you worry about other services, you've already done it wrong. I assume my passwords will be stolen. I even have a generic password I use for many sites that I do not and will never trust. It could be stolen -- and hell probably has, knowing how many services have been pwned, and how many don't even realize it. But it won't give you anything close to access to any email, bank, or merchant website connected to my debit card, as they're all using unique passwords and 2-factor auth where available. Startup Idea: Debit/Credit card services that provide not "throwaway" numbers, but separate numbers/info for every major subscription or service you use. Generate an Amazon number, an Xbox live number, a number for your cellphone payment. If any one number is compromised, it can be disabled and handled without any interruption or issue to other numbers and services. In the age of constant pwning, a debit card that isolated the damage to that one service without any hassle or disruption to any other service would be brilliant. I know I'd pay for that. In fact, how easy would fraud monitoring be when the only charges to a specific number would be allowed from that 1 service. It makes the numbers useless outside of that 1 service you're using it for, even when stolen.
  - Casseres 13y ago
    https://www.truelinkcard.com/ https://www.truelinkcard.com/ If I understand the service correctly, you can pre-approve companies before you are charged. I think this type of service can be useful outside of their target audience of the elderly.
  - dtparr 13y ago
    That's actually how the Discover Card Secure Online number work, although apparently some merchants can't use them. From their FAQ, https://www.discover.com/credit-cards/help-center/faqs/soan.html#q1 https://www.discover.com/credit-cards/help-center/faqs/soan.... : Secure online account numbers is a free online service offering you added security by protecting your account number while shopping online. When you make a purchase with a merchant using a secure online account number, the number is assigned only to that particular merchant. Once a secure online account number is assigned, the merchant can use it for your future purchases with them unless you specify otherwise. Some merchants, such as Facebook, Amazon, and PayPal, will not be able to use the same secure online account number multiple times. When shopping with those merchants, you will need to use a new secure online account number each time.
Oculus 13y ago
Riot should be a case study on how to handle leaks. Immediately releasing all that they know and forcing password resets. Good on them!
- sillysaurus 13y ago
  Also a case study on how not to store passwords. They enforce a maximum length on the user's password. It's something short, like 12 chars. The only reason they would enforce a maximum length is if they were storing the plaintext password in a database somewhere.
- Pengwin 13y ago
  This has happened numerous times this year. The same response to me both these times. Crytek: http://www.eurogamer.net/articles/2013-08-05-crytek-pulls-websites-after-suspicious-activity-detected http://www.eurogamer.net/articles/2013-08-05-crytek-pulls-we... Ubisoft: http://forums.ubi.com/showthread.php/779040-Security-update-regarding-your-Ubisoft-account-please-create-a-new-password http://forums.ubi.com/showthread.php/779040-Security-update-... And even the PSN outage in 2011. I for one am sick and tired of these account breaches. Not only do account details get disclosed, but I am forced to create these accounts to access games which I play. I have a perfectly accessible steam account with an authentication API available that only a handful of games decide to not use. If you want me to have another account, fine. But promise these two things: 1 - It is worth my time and effort to create the account (I think League of Legends is fine here,they have a large ecosystem, however my two examples above are not.) 2 - You take care of my details. (Which they have all failed.)
bdz 13y ago
Not really related but just read a few days ago: In the Activision/Blizzard buyback from Vivendi one of the investors was Tencent, owner of Riot. Meanwhile Blizzard is also developing a Dota-clone, Blizzard All-Stars. Unfortunately I can't add anything more but I found that interesting.
antiglacier 13y ago
What types of attacks are commonly used to compromise information like this? Is this simply a lack of SQL injection protection or is it the result of an attacker gaining access to the web/database servers?
- ihsw 13y ago
  Some variety of exploits probably lead to this, for example communication to their internal servers from their public servers may not have been isolated well enough from the outside world (providing a proverbial window into their internal system of services, databases, and APIs). I'd imagine that Riot Games operates a plethora of servers with one, central, very large database containing all customer billing information. Large-scale attacks are usually coordinated with a collection of exploits, for example SQL injection can provide a means to utilize XSS for exploiting administrative interfaces leading to session hijacking. This can be useful for reconnaissance and analysis.
polemic 13y ago
> "approximately 120,000 transaction records from 2011 that contained hashed and salted credit card numbers have been accessed" Why oh why would you store the number. Utterly unnecessary for recurring billing.
- Ardren 13y ago
  The only thing that comes to mind is fraud prevention? But that only works if it's a global salt, rather than a per user/card salt.
  - polemic 13y ago
    I don't buy it. You're exposing your users to massive risk in order to detect fraud on a product that effectively costs $0 for you to provide. I might understand it for a retailer that gets chargebacks for physical items shipped, but that doesn't make sense here.
- coldarchon 13y ago
  Why would it be online accessible?
gosukiwi 13y ago
I just pray they dont use sha1 salted passwords or I'm pretty f*cked...

67 points by CrazedGeek 13y ago

Sigh. My office plays League of Legends regularly. It's quite a fun game. This, however, isn't fun at all. Is it just a fact of doing business in the modern internet age that everyone can and will eventually be pwned? The best part of this is that it's obviously some legacy system that wasn't properly decommissioned. Think about it, the records haven't been in use for 2+ years? Sounds weird, right? Remember, if it's on the network somebody can get to it and just because you don't use it anymore doesn't mean you can just stop patching the boxen :(.

GuiA 13y ago
> Think about it, the records haven't been in use for 2+ years? If I read it correctly, only the payments part have been inactive for 2 years- probably because they switched to another system and just left the old records there. The rest of the database is likely to be a current production system though. > Is it just a fact of doing business in the modern internet age that everyone can and will eventually be pwned? Unless a company spends decent money on security auditing, pentesting, etc, then yes. It's ridiculous for a software company to be spending tens/hundreds of thousands of dollars a year on security for their physical offices, but to not have routine security audits for their digital property.
- smtddr 13y ago
  I don't think it matters how much money a company spends on security, it'll get hacked if there's strong incentive for that event to occur. Basically, if you're popular... just assume you'll be hacked one day. I think there are only really 2 things you can do. 1. Just make sure the hack isn't something embarrassingly easy like SQL injection in the username/password field. If you get hacked, make sure the hacker had to do something really clever that any developer would go "whoa, that's not an exploit I see everyday..." 2. Assume a hacker got a bash shell to your system and apply the next level of security there. Salted hashes, PGP encryption on any sensitive data. Make sure the salt isn't sitting there in plain view and if pub/priv key, make sure the private-key isn't just sitting there on the same system without a passphrase.
  - GuiA 13y ago
    I agree with you, but spending some money on security auditing is a pre-requisite for 1) to happen :)
  - adrr 13y ago
    Good advice. I'll add one more thing. If you're dealing with credit cards, the private key should be on a hardware security device with the only backups stored on a couple USB sticks sitting in a safety deposit box at a bank.
    - GuiA 13y ago
      If you're dealing with credit cards, you have much more to do than that: http://en.wikipedia.org/wiki/Payment_Card_Industry_Data_Security_Standard http://en.wikipedia.org/wiki/Payment_Card_Industry_Data_Secu...
      - adrr 13y ago
        Well thats a given since your merchant bank and processor will force you to be PCI compliant including annual reviews. PCI compliance doesn't specify where your private key is stored just that your data is in a "unreadable" state and that you have certain key management procedures in places. For example, hashing your credit cards is acceptable though it can easily be brute forced since its just 16 digit number and the six digit prefix set(BIN) is already known.
rartichoke 13y ago
Pretty much. Look at company's like Blizzard who are even bigger. - Their passwords aren't case sensitive. - Their login form's GET request isn't using https. - Within 20 minutes of informing a security specialist not affiliated to blizzard he was able to write a script that compromised every single battle.net e-mail address. * This information is based from about June 2012, I'm not sure if their security measures changed since then but I remember the thread on the bnet forums and it being confirmed by an official moderator-like person saying blizzard was aware of the problem for the longest time but didn't care about fixing it. I never understood how game companies could be so lazy when it comes to security. They obviously have the talent to do things right and rake in silly amounts of $. Why jeopardize the integrity of their name.
- Steko 13y ago
  "- Their passwords aren't case sensitive." Not a huge deal. "- Within 20 minutes of informing a security specialist not affiliated to blizzard he was able to write a script that compromised every single battle.net e-mail address." I don't remember this ever happening.
  - Karunamon 13y ago
    >Not a huge deal. Wouldn't cutting your key search space roughly in half reduce your cracking time greatly, though? According to Wolfram, for a 12 character password: password type | total number | example digits 0 through 9 | ~~ 2^40~~1 trillion | 287088364476 case-insensitive alphabetic | ~~ 2^56~~95.43 quadrillion | ycwcgndabspw case-insensitive alphanumeric | ~~ 2^62~~4.738×10^18 | okcm5tfe8odr case-sensitive alphabetic | ~~ 2^68~~3.909×10^20 | SgilPtNTKmuQ case-sensitive alphanumeric | ~~ 2^71~~3.226×10^21 | xhWuSN5HBETz printable ASCII characters | ~~ 2^79~~4.759×10^23 | [i{}I"2Bz9sN The difference comes out to be 6.7 bits of entropy for a 12 chraracter, case sensitive and case insensitive alphanumeric with symbols. 81.38 vs 88.08. (Note that this "bits of entropy" number is mostly beyond my comprehension.. could anyone elaborate a bit? I'd assume more==better)
    - qnr 13y ago
criley2 13y ago
I do assume that almost all online services will be pwned. I have a small amount of faith that my Google account, Amazon account, and (major) bank account won't be compromised except by my government. Maybe a few other services are this trustworthy to me, but not many, and I can't think of them off the top of my head. We just need to get used to using throw away credit card numbers from our credit card's website. Or buy game currency/points/time in stores, in the form of cards, to prevent giving out the info that will be pwned sooner or later, on one service or another. And get used to using throwaway passwords. If your password being compromised on one service makes you worry about other services, you've already done it wrong. I assume my passwords will be stolen. I even have a generic password I use for many sites that I do not and will never trust. It could be stolen -- and hell probably has, knowing how many services have been pwned, and how many don't even realize it. But it won't give you anything close to access to any email, bank, or merchant website connected to my debit card, as they're all using unique passwords and 2-factor auth where available. Startup Idea: Debit/Credit card services that provide not "throwaway" numbers, but separate numbers/info for every major subscription or service you use. Generate an Amazon number, an Xbox live number, a number for your cellphone payment. If any one number is compromised, it can be disabled and handled without any interruption or issue to other numbers and services. In the age of constant pwning, a debit card that isolated the damage to that one service without any hassle or disruption to any other service would be brilliant. I know I'd pay for that. In fact, how easy would fraud monitoring be when the only charges to a specific number would be allowed from that 1 service. It makes the numbers useless outside of that 1 service you're using it for, even when stolen.
- Casseres 13y ago
  https://www.truelinkcard.com/ https://www.truelinkcard.com/ If I understand the service correctly, you can pre-approve companies before you are charged. I think this type of service can be useful outside of their target audience of the elderly.
- dtparr 13y ago
  That's actually how the Discover Card Secure Online number work, although apparently some merchants can't use them. From their FAQ, https://www.discover.com/credit-cards/help-center/faqs/soan.html#q1 https://www.discover.com/credit-cards/help-center/faqs/soan.... : Secure online account numbers is a free online service offering you added security by protecting your account number while shopping online. When you make a purchase with a merchant using a secure online account number, the number is assigned only to that particular merchant. Once a secure online account number is assigned, the merchant can use it for your future purchases with them unless you specify otherwise. Some merchants, such as Facebook, Amazon, and PayPal, will not be able to use the same secure online account number multiple times. When shopping with those merchants, you will need to use a new secure online account number each time.

Oculus 13y ago

Riot should be a case study on how to handle leaks. Immediately releasing all that they know and forcing password resets. Good on them!

sillysaurus 13y ago
Also a case study on how not to store passwords. They enforce a maximum length on the user's password. It's something short, like 12 chars. The only reason they would enforce a maximum length is if they were storing the plaintext password in a database somewhere.
Pengwin 13y ago
This has happened numerous times this year. The same response to me both these times. Crytek: http://www.eurogamer.net/articles/2013-08-05-crytek-pulls-websites-after-suspicious-activity-detected http://www.eurogamer.net/articles/2013-08-05-crytek-pulls-we... Ubisoft: http://forums.ubi.com/showthread.php/779040-Security-update-regarding-your-Ubisoft-account-please-create-a-new-password http://forums.ubi.com/showthread.php/779040-Security-update-... And even the PSN outage in 2011. I for one am sick and tired of these account breaches. Not only do account details get disclosed, but I am forced to create these accounts to access games which I play. I have a perfectly accessible steam account with an authentication API available that only a handful of games decide to not use. If you want me to have another account, fine. But promise these two things: 1 - It is worth my time and effort to create the account (I think League of Legends is fine here,they have a large ecosystem, however my two examples above are not.) 2 - You take care of my details. (Which they have all failed.)

bdz 13y ago

Not really related but just read a few days ago: In the Activision/Blizzard buyback from Vivendi one of the investors was Tencent, owner of Riot. Meanwhile Blizzard is also developing a Dota-clone, Blizzard All-Stars. Unfortunately I can't add anything more but I found that interesting.

antiglacier 13y ago

What types of attacks are commonly used to compromise information like this? Is this simply a lack of SQL injection protection or is it the result of an attacker gaining access to the web/database servers?

ihsw 13y ago
Some variety of exploits probably lead to this, for example communication to their internal servers from their public servers may not have been isolated well enough from the outside world (providing a proverbial window into their internal system of services, databases, and APIs). I'd imagine that Riot Games operates a plethora of servers with one, central, very large database containing all customer billing information. Large-scale attacks are usually coordinated with a collection of exploits, for example SQL injection can provide a means to utilize XSS for exploiting administrative interfaces leading to session hijacking. This can be useful for reconnaissance and analysis.

polemic 13y ago

> "approximately 120,000 transaction records from 2011 that contained hashed and salted credit card numbers have been accessed" Why oh why would you store the number. Utterly unnecessary for recurring billing.

Ardren 13y ago
The only thing that comes to mind is fraud prevention? But that only works if it's a global salt, rather than a per user/card salt.
- polemic 13y ago
  I don't buy it. You're exposing your users to massive risk in order to detect fraud on a product that effectively costs $0 for you to provide. I might understand it for a retailer that gets chargebacks for physical items shipped, but that doesn't make sense here.
coldarchon 13y ago
Why would it be online accessible?

gosukiwi 13y ago

I just pray they dont use sha1 salted passwords or I'm pretty f*cked...