Slashdot Mirror
Symantec Finds Server Containing 44 Million Stolen Gaming Credentials
A Symantec blog post reports that the company recently stumbled upon a server hosting the stolen credentials for 44 million game accounts. It goes on to explain how the owners of the server made use of a botnet to process that mountain of data:
"Now it's time to turn those gaming credentials into hard cash. But how do you find out which credentials are valid and thus worth some money? Three options come to mind: 1) Log on to gaming websites 44 million times! 2) Write a program to log in to the websites and check for you (this would take months). 3) Write a program that checks the login details and then distribute the program to multiple computers. Option one naturally seems next to impossible. Option two is also not very feasible, since websites typically block IP addresses after multiple failed login attempts. By taking advantage of the distributed processing that the third option offers, you can complete the task more quickly and help mitigate the multiple-login failure problems by spreading the task over more IP addresses. This is what Trojan.Loginck's creators have done."
Symantec stumbled upon a server hosting the stolen credentials for 44 million game accounts. On their own LAN!
I an a little naive to the criminal enterprise that is stolen gaming credentials, but I have to wonder: why does it matter, if you are selling a stolen credential, if it's good or not? Is the buyer really going to come back and demand a refund when it doesn't work? And what real benefit are these, anyway? Don't tell me that people buy stolen creds and log into them just to take all their e-loot (worth thousands of e-dollars)? Oh for the love of humanity the things people will do in the name of wasting time.
As if a million gnome mages cried out in torment and were silenced at once.
You know Slashdot doesn't let you say your own password? Check it out:
*********
Also, Alt+F4 gets you instant Karma!
---
Had to get that out of me. So I didn't RTFA, but what I gather is that they used some kind of keylogger and now the server has 44 Million user credentials. At first I was like "Why didn't it just test the credentials when it recieved them, and then changed the password?" But that runs the risk of users detecting the virus, having it's spread shut down by Symantec, and the account being deemed worthless once the Game-Dev's shut it down and hand a new one to the original user.
So then I thought, "Why don't they have a system to report how often a keylog sends specific credentials to their server, so they know how recently certain credentials were used, to know which are still active?" Perhaps they didn't include that info when sending back keylogs though - sloppy programming, but I imagine they let this thing run for a while to see if it would even work and take off before putting in a ton of functionality.
So, I guess the issue I have is, how do you get a botnet to try out various logins without alerting the user? Could this have been how they were caught?
4) Sell them in bulk, untested.
Mom!!!! Symantec hacked my server again.
They could, as a service to the online community, go ahead and post the usernames that are compromised.
Hey, the original users got to keep their credentials - all that happened was the hacker got a spare set! (Until the password was changed...)
My first Journal Entry ever, in 8 years! http://slashdot.org/journal/365947/aphelion-scifi-fantasy-horror-poetry-webzine
OK, so Symantec "recently stumbled upon a server hosting...".
What, was it placed on their doorstep one night, and they didn't notice it when they went outside to get the morning paper?
So, they wrote a crawler that intrusively scanned servers that they didn't have permission to access, opening and analyzing files that they didn't have permission to read, then published what they found?
And the penalty if I did that is, what, 5 years in federal PMITA prison?
There is something wrong in this world.
And the worms ate into his brain.
Botnet does things botnets do! Data stolen, data processing distributed, Mayor surprised and outraged! Read all about it, only a nickle!
There are lots of holes in games since the last thing that programmers or gamers really want to think about is account security. (Cheating security frequently is the first thing that comes to mind.)
.exe map pack file with a trojan that scraped some account info off files while running a keylogger to get anything that the scraper missed. These hackers are usually on top of their game (no pun intended).
One of my buds ran a long thread here a while back. Several of his accounts were taken...don't remember how they got his WoW account. But it ended up that he eventually figured out that a server admin had poisoned a Web-downloadable
I like how a post full of nothing but pure assumptions somehow gets modded insightful. Maybe check the facts? How do you know they weren't tipped off to the server? Some other rival hacker might have found it and wanted to spite their competition. My assumption is just as valid as yours.
A Symantec blog post reports that the company recently stumbled upon a server hosting the stolen credentials for 44 million game accounts.
Symantec has reportedly bought up all the beer in the area and is planning raids into the deep mines.
Summary (and article) claims "44 million stolen gaming credentials", which sounds like a lot of us English-speaking and English-game-playing Slashdot readers.
However, in the article, they analyze "a particular sample", with about ~18.3 million accounts in it. Of those ~18.3 million, ~16 million of them were game accounts for "Wayi Entertainment", which is an Asian company. They have no English website, that I can tell, and I think it's a safe assumption there are no English counterpart to these games.
So we're mainly talking about accounts for crazy Asian freemium sprite-based "MMO's". There were only ~210,000 World of Warcraft accounts, most of which, I assume, are also for the Chinese version of the game.
So if you're reading this, I'm going to go out on a limb and say your account is probably safe.
For MMORPGs its fairly easy, so I've read. Sell off their items/gold to other players for RL cash
You can no longer sell in-game items on RuneScape for real life money. An update to the game in December 2007 prevented this practice.
The article glosses over the fact that *millions* of accounts are discovered.
That suggests the data is captured in massive quantities at one time. Specifically, 210,000 WoW accounts are hard to come by one-by-one. The computing effort might not be great, but the time to trawl compromised PC's would seem to be. Am I completely off-base with this assumption?
My point being, the bigger problem seems to be blocks of data that must come from the inside of these organizations pretends not to exist. Instead we have 'fun with large data sets' infotainment.
http://www.maxineudall.com/2010/02/should-economists-be-sued-for-malpractice.html
Uppity, I say!
They would split up the list and sell it as small lists. E.g. you could split it up into lists of 1000 accounts or less, wheras the newest accounts are the most likely to work, thus having the highest price or similar.
So, did Symantec do what they could to A) report the server and botnet; B) take it down; and C) prosecute the alleged criminals?
So, did Symantec do what they could to A) report the server and botnet; B) take it down; and C) prosecute the alleged criminals?
What gives Symantec the right to prosecute?
Just make it into a torrent and post it on the internet. It will all get sorted out eventually.
From TFA:
"So, picture this: you are a bad guy and have created or purchased a botnet"
My first thought when I read this...is that Symantec purchased THIS botnet for advertising, PR purposes. That's right. Is it really out of the ordinary for a criminal enterprise to 'anonymously' approach a security vendor and offer to sell their data (especially if the data maybe isn't worth much anymore"? This would seem pretty valuable to me from a vendor perspective.
"Hey there, what if I told you that you could be the first to 'stumble' upon 44 million stolen credentials and you can release blogs, releases, statements, quotes and all kinds of great things hailing yourself as a security pioneer who won one for the customer...would you be interested in that?"
For the benefit of the non-gamers amongst us, perhaps someone could explain exactly how one goes about converting game accounts into "hard cash".
Proud member of the Weirdo-American community.
First let me preface this by saying that I am a pretty dedicated ISK seller in EVE Online. My name here on slashdot is not linked to my EVE operation in any way, so I'm not shy about owning up to my actions.
I make about $300 a week selling ISK. Sometimes more, sometimes less. Now that I've got everything worked out my time investment for that $300/wk extra income is less then an hour per week. Nobody in their right mind would seriously sell currency in any MMO that they earned "honestly", since you'd be making pennies per hour. The workhorses of the RMT (real money trade) industry are botters like me. I run 10 accounts all hours of the day that do nothing but earn money. This is the "honest" way to run a RMT business.
The other side of RMT are the people that run keyloggers and are looking to steal accounts. These people are almost exclusively part of the chinese RMT machine, which dominates the industry in any game. They will take your money and send you stolen goods, and couldn't care less when you get banned for your account being linked with the hackers that stole the money in the first place. Also there are numerous stories of these RMT shops offering up keyloggers to their own customers to steal back what they just sold further down the line.
If you're interested in buying currency, but don't want to support the hacker/stolen side of RMT, take a few minutes and search out one of the American RMT shops. They generally don't spam/advertise in the games, so you have to go looking for them. This won't eliminate any possibility that what your buying isn't stolen, but it certainly does reduce it. As an added bonus you're supporting about the only remaining industry that specifically employs young game addict geeks.
The OP has it all wrong and actually missed the most direct least effort least detectable attack.
The credential is used to login, some game account personal information is collected, character names, last logon, time played.
A fully polished legit forged email is then sent to the last email on record. The email indicated the account eligible for a limited a special offer of 30 days free gaming.
These emails may or may not be discarded by active players, irrelevant.
Active and inactive players WHO CLICK and logon have forwarded the needed info for an enhanced spear phishing attack.
[optional] In game players give gold credits and provide effective twink support to guarantee the 30 day game card investment translates into a subscribed hacked account.
[note] This would only be done if the account tunes have assets or stats and are of sufficient sellable uber quality.
PROFIT. or Profit ++
The summary is just stupid. I mean when you use a botnet to collect all that credentials, wont you naturally use the same botnet to check them? All that blabber about options was just pointless on so many levels.
Who says they're stolen?
Could be the owner suffered from schizophrenia with multiple personalities and had 44 million separate personalities, all avid gamers... ;)
"For every complex problem, there is a solution that is simple, neat, and wrong." -- H.L. Mencken (1880-1956) --