Slashdot Mirror
Second Life Database Intrusion via Web
Jim writes "A major security exploit has been discovered by Linden Labs, the company that operates Second Life. It turn out that on September 6th, an intruder gained access to the Second Life database. They have since closed the exploit. Today, September 8th, they finally announced this to residents and have cancelled all passwords. They have asked everyone to use the reset password form to make a password. This has resulted in mass confusion amongst residents on the forums who cannot remember their security question. Many more details below.
Calls to Linden Labs offices in California are directed to a message telling residents to change their password via secondlife.com/password.
According to the Second Life Blog:
"On September 6 we discovered evidence that an intruder was able to access the Second Life database through the web servers. The exploit was shut down on the afternoon of September 6 when we discovered it.
Detailed investigation over the last two days confirmed that some of the unencrypted customer information stored in the database was compromised, potentially including Second Life account names, real life names and contact information, along with encrypted account passwords.
No credit card information is stored on the database in question, and that information has not been compromised.
As a precaution we have invalidated all Second Life account passwords. In order to log-in to Second Life you will have to create a new password. Please access the log-in page at https://secondlife.com/password, and click on the "Forgot Password" link. An email will be sent to the email address you have registered with us. (Don't forget to check your spam filter!) Please click through the link in that email, answer the security question, and create a new password."
According to the Second Life Blog:
"On September 6 we discovered evidence that an intruder was able to access the Second Life database through the web servers. The exploit was shut down on the afternoon of September 6 when we discovered it.
Detailed investigation over the last two days confirmed that some of the unencrypted customer information stored in the database was compromised, potentially including Second Life account names, real life names and contact information, along with encrypted account passwords.
No credit card information is stored on the database in question, and that information has not been compromised.
As a precaution we have invalidated all Second Life account passwords. In order to log-in to Second Life you will have to create a new password. Please access the log-in page at https://secondlife.com/password, and click on the "Forgot Password" link. An email will be sent to the email address you have registered with us. (Don't forget to check your spam filter!) Please click through the link in that email, answer the security question, and create a new password."
You first have to click the link from the registered email address.
SO you'd have to have that randomly-generated link to make use of said security question.
Herein lies an additional problem with security questions. I don't answer them. I work for a nonprofit. The gentleman whose job it is (for lack of a better way to say it) to find rich people to donate money to us sits in the office next to mine. His data mining capabilities are beyond my comprehension, and I'M supposed to be "the computer guy" here. I sat down with him one day and with 15 minutes and $20 he had enough info about me to get into my bank account via the security questions feature.
The answer to my security questions on ALL websites is now something to the effect of 20-40 random characters.
ACs are modded -6. I don't read you, I don't mod you, I don't see you. Don't like it? Don't be a coward.
The summary says the passwords were stored in encrypted form. Usually one would hash the password, making it very difficult and time-consuming to decrypt the password.
I'm sorry that's incorrect. That used to be the case, but not anymore. While the "input credit information" page still comes up, you can skip it.
No CC or cell phone needed for a couple of months now.
Signups now on SL are only tied to a valid email address