Slashdot Mirror
Second Life Database Intrusion via Web
Jim writes "A major security exploit has been discovered by Linden Labs, the company that operates Second Life. It turn out that on September 6th, an intruder gained access to the Second Life database. They have since closed the exploit. Today, September 8th, they finally announced this to residents and have cancelled all passwords. They have asked everyone to use the reset password form to make a password. This has resulted in mass confusion amongst residents on the forums who cannot remember their security question. Many more details below.
Calls to Linden Labs offices in California are directed to a message telling residents to change their password via secondlife.com/password.
According to the Second Life Blog:
"On September 6 we discovered evidence that an intruder was able to access the Second Life database through the web servers. The exploit was shut down on the afternoon of September 6 when we discovered it.
Detailed investigation over the last two days confirmed that some of the unencrypted customer information stored in the database was compromised, potentially including Second Life account names, real life names and contact information, along with encrypted account passwords.
No credit card information is stored on the database in question, and that information has not been compromised.
As a precaution we have invalidated all Second Life account passwords. In order to log-in to Second Life you will have to create a new password. Please access the log-in page at https://secondlife.com/password, and click on the "Forgot Password" link. An email will be sent to the email address you have registered with us. (Don't forget to check your spam filter!) Please click through the link in that email, answer the security question, and create a new password."
According to the Second Life Blog:
"On September 6 we discovered evidence that an intruder was able to access the Second Life database through the web servers. The exploit was shut down on the afternoon of September 6 when we discovered it.
Detailed investigation over the last two days confirmed that some of the unencrypted customer information stored in the database was compromised, potentially including Second Life account names, real life names and contact information, along with encrypted account passwords.
No credit card information is stored on the database in question, and that information has not been compromised.
As a precaution we have invalidated all Second Life account passwords. In order to log-in to Second Life you will have to create a new password. Please access the log-in page at https://secondlife.com/password, and click on the "Forgot Password" link. An email will be sent to the email address you have registered with us. (Don't forget to check your spam filter!) Please click through the link in that email, answer the security question, and create a new password."
Don't slashdot their servers before I can change my password.
:)
Yes, the fact that the blog runs on the same MySQL cluster as the main account passwords has more than one side effect.
I've had enough abrasive sigs. Kittens are cute and fuzzy.
An intruder gained access to the database . So they're resetting passwords. Good.
... which is also probally in the same database that was already compromised?
But they're using the "security question"
and how is this fixing the problem? What exactly prevents the intruder from using the security question out of the database they compromised?
da w00t. mtfnpy?
Too bad the clients are mostly as bright as the a match.... in a blizzard.... on Mt. Everest.
Cliff Claven
K.E.G. Party Chairman
Founding Leader of: Koncerned for Egalitarin Governance
There's goes the planet. Time for a third life...
Its already been slashdotted.
Just because an idea is popular doesn't make it right.
Finally, it's good to see a company taking security seriously!
That said, and this isn't their fault, I'm cynical about the claim that credit card data wasn't compromised...
Secret questions can be troubling.
Slashdot Burying Stories About Slashdot Media Owned
I'm sorry that's incorrect. That used to be the case, but not anymore. While the "input credit information" page still comes up, you can skip it.
This means users were vulnerable without notice of a breach during that time.
No CC or cell phone needed for a couple of months now.
Signups now on SL are only tied to a valid email address
Actually, that's no longer true. For a while now, it's been possible to make accounts without a card (you still need to put one in to get money, though).
I'm really impressed by the way Linden Lab has been handling this issue. Though the exploit seems to be not their fault, they are still humbly taking the blame. In addition, as soon as they figured the extent of the hack, they reported it to the users, and immediately changed all the account passwords in their systems. They didn't really need to do this, ie, they could have just issued a warning, but its shows that they care about the user's security more than their public image (no doubt this password change will negatively affect the community for weeks to months).
The way I see it, every one is going to be hacked. Its a fact. I just praise the way Linden Lab has handled the situation thus so far.
If that happened in the game I play (Silkroad Online) people would be pissed. No wait, TURBO PISSED! I think that alone could change South Korea into "the bad half" cuz that's where they made the game. Last time I tried to change my password, it wouldn't take my answer to my secret question even though I triple checked it when I made it.
now stop reading and go play Dance Dance Revolution!
Praise?
C'mon this has got to be a plant. Even a rabid Second Life fanboy wouldn't be praising this security breach. Of course it's Linden's fault for the breach.
nuclear iraq bioweapon encryption cocaine korea terrorist
Wake me when a samurai-sword-wielding pizza man starts spreading ancient Babylonian curses.
Second Life features very little G, and smatterings of RP based on individual players. It's no more of an RPG than the entire internet is...
Those security questions often annoy me... especially if you have to chose from a predefined set. Everybody who knows me knows my hometown, for example. What kind of security question is that? If possible (e.g., the answer box has enough text), I usually use the 40-digit serial number from the box the first CD-R I ever bought came in. Don't even ask why I know that number by memory :D
Back to Linden Labs, while they may have been at fault for not sufficiently securing the servers, the way they have handled it is commendable. Not many publishers of games like that would handle it like this. Hell, I'm sure MindArk (Project Entropia) wouldn't!