Second Life Database Intrusion via Web

Jim writes "A major security exploit has been discovered by Linden Labs, the company that operates Second Life. It turn out that on September 6th, an intruder gained access to the Second Life database. They have since closed the exploit. Today, September 8th, they finally announced this to residents and have cancelled all passwords. They have asked everyone to use the reset password form to make a password. This has resulted in mass confusion amongst residents on the forums who cannot remember their security question. Many more details below. Calls to Linden Labs offices in California are directed to a message telling residents to change their password via secondlife.com/password.

According to the Second Life Blog:

"On September 6 we discovered evidence that an intruder was able to access the Second Life database through the web servers. The exploit was shut down on the afternoon of September 6 when we discovered it.

Detailed investigation over the last two days confirmed that some of the unencrypted customer information stored in the database was compromised, potentially including Second Life account names, real life names and contact information, along with encrypted account passwords.

No credit card information is stored on the database in question, and that information has not been compromised.

As a precaution we have invalidated all Second Life account passwords. In order to log-in to Second Life you will have to create a new password. Please access the log-in page at https://secondlife.com/password, and click on the "Forgot Password" link. An email will be sent to the email address you have registered with us. (Don't forget to check your spam filter!) Please click through the link in that email, answer the security question, and create a new password."

Comments

Ack

[GigsVT]

Don't slashdot their servers before I can change my password.

Yes, the fact that the blog runs on the same MySQL cluster as the main account passwords has more than one side effect. :)

It took two days to cancel passwords

[jstrauser]

This means users were vulnerable without notice of a breach during that time.

Re:Does anyone else see a problem with this?

[xtracto]

Herein lies an additional problem with security questions. I

Ya, security questions are stupid. I remember going into several chicks account on the ICQ times. The recipe was:

1. Search for interesting (age, city, status of profile) girl with ICQ search option.
2. Get into email page (preferably hotmail or yahoo mail or any other webmail) and go through the "forgot my password"
3. Bypass the "whats your age and other general info" filter, looking of courrse in their profile, it was so funny to look how they filled their profile with everything i needed.
4. Answer their stupid password (I liked how some sites had and still have 3 or 4 compulsory "questions" to be answered, and I loved more how people *really* answered them).
5. Profit (with the best thing is when this webmail pages would let you in the mail after doing that, or better yet just gave you the password in plain).

Nowadays is a bit more difficult (of course, if you dont have the general informaiton). But, as they say Google is your friend. And I am sure it might be possible (if you live for example in the same country of the "victim") to use other means to get more informaiton (white pages, etc etc).

What I usually do, is write something completely unrelated as the answer to the security question. It is in some way another password for me.