Hacked Accounts

"

altaccount wrote:

I am getting a little bit paranoid about my own security, since GGG is adamant that their security has no problems and I can't find anything either.

"

Thrombo wrote:

"

altaccount wrote:

I am getting a little bit paranoid about my own security, since GGG is adamant that their security has no problems and I can't find anything either.

Oracle was adamant that Java 7 had no sec problems either, and now people are getting compromised all over the place because of drive-by rooting. Software sucks, and it happens.

The most frustrating part of this all for me is that two very valid and relatively trivial changes have been proposed and GGG hasn't seemingly bothered to investigate or comment on either.

1) Don't store password hash in game memory during session
2) Don't store password hash in the clear in a text file (or anywhere) if that's all you need to log in to an account (which is currently the case).

A patch could be written for the above two within an hour or two and would at least break any exploits that rely on either of the two above mechanisms (more likely the first). It wouldn't necessarily patch whatever vulnerability, if any, is being used for information gathering, but it could reduce the value of that as an attack vector and band-aid any potential exploit issue.

"

altaccount wrote:

The latter is also easy to exploit. I wouldn't be surprised if some accounts are compromised that way.

Example given - the file is in a location that is shared by default on some Windows desktop versions, and many POE players might be running P2P gaming VPN solutions such as Tunngle or Hamachi, inadvertently exposing the file to outside of their LAN. Not to mention many browser components can access and read files in the directory.

"

altaccount wrote:

There is no such correlation - People have lost their primary accounts, people who are security-conscious, people who are closed beta players, people who have bought microtransactions. And like you said it yourself, there are exceptions to the "average stupid player".

"

TehHammer wrote:

"

VideoGeemer wrote:

Don't you see? They seem to be getting a little of everything.

I like Chris' quote, when he said why aren't they targeting people at the top of the ladders with ten thousand times the currency. They simply can't because the people at the top aren't doing stupid things getting their accounts hacked.

"

altaccount wrote:

"

VideoGeemer wrote:

Is it possible that hackers would program their little bots to deliberately wait a certain period of time before trying another password?

Probably...

You seem to be active in this discussion, but you have no absolutely expertise on the topic you're commenting on.

You would need to try millions of passwords per second to bruteforce a weak password within weeks. I'm sure you can figure out how long it'll take if you're limited to less than one try per second.

"

TehHammer wrote:

"

altaccount wrote:

There is no such correlation - People have lost their primary accounts, people who are security-conscious, people who are closed beta players, people who have bought microtransactions. And like you said it yourself, there are exceptions to the "average stupid player".

People absolutely did SOMETHING for this to happen. They're just too stupid to know what it was, most likely because they were tricked into it.

There's basically two types of people that got hacked, people that invited it and did something stupid like downloading a (fake) map hack program and people that didn't even realize they gave away their account information (aka, got phished or reused their email/password that they used somewhere else that got compromised). If you don't think you are one of these groups, you're absolutely in the 2nd group and you're ignorant of your mistake.

"

furryseedman wrote:

hahahahahahahaha all these -edit- dling obv hacks and playing it off by saying someone hijacked their account

"

Thrombo wrote:

TehHammer, you are mistaken here. While it is true that most username/password tuples are gleaned in this fashion, there are often software exploits that involve vulnerabilities in the software itself. Nobody gets a rootkit installed on their machine because they got their WoW password phished, for example. It's naive to think that these two methods are the only ways to compromise an account, and saying so is damaging in this context, because doing so attempts to discredit other valid points that GGG really needs to look into.

Edit: If there is a vulnerability, you may need only to log in to be exposed. I suppose you can argue that is "SOMETHING".