Slashdot Mirror
Blizzard Says Battle.Net Has Been Hacked
An anonymous reader writes "Blizzard announced today that its Battle.net service was compromised. The company is urging users to change their login information immediately. Blizzard is stressing that payment information was not compromised. 'The unauthorized access included email addresses associated with Battle.net accounts in all regions, outside of China. Additional information from accounts associated with the North American servers (which generally includes players from North America, Latin America, Australia, New Zealand, and Southeast Asia) was also accessed, including cryptographically scrambled versions of passwords (not actual passwords), the answer to a personal security question, and information relating to Mobile and Dial-In Authenticators. It's important to note that at this time, Blizzard does not believe this information alone is enough to gain access to Battle.net accounts.'"
Thanks for your always-online requirement for Diablo 3! So very useful if I want to play alone.
Can I please have my single player offline games back?
_ _ _ Go for the eyes Boo! GO FOR THE EYES!
I'm going to go out on a glass-half-empty limb here and say that means encrypted, not salted and hashed. "Cryptographically Scrambled" is too obviously ambiguous. I hope I'm wrong!
Since I''m over 25 and work for a living, this does not effect me.
If you want news from today, you have to come back tomorrow.
Found it. http://us.blizzard.com/en-us/securityupdate.html URL in the article is wrong.
"Have you ever thought about just turning off the TV, sitting down with your kids, and hitting them?"
My account keeps being hacked*, despite the fact I don't login, have no real interest in playing the games, change it to random passwords even I don't remember, run linux day to day, and have it associated to a gmail account which hasn't had any suspicious activity. I've tried to reason with them, but they refuse to listen. I've come to the conlusion that Blizzard are incompetant in this area.
* I've never seen any proof of my account being hacked besides their e-mails telling me and locking my account. I managed to get them unlocked the first few times, my characters still has all items and gold I remember. Now they want me to fax a passport or some 'real identification'. I honestly don't want the games that bad, I'm just annoyed they're taking them off me.
Technically I'm working from home today, but I guess good security dictates I log into WoW to change my password and check for any foul play.
Once a Battle.net account is created, the first name, last name and security question can not be changed. Since these questions are now compromised, everyone is SOL.
"Have you ever thought about just turning off the TV, sitting down with your kids, and hitting them?"
I seem to recall reading in the Security Question comments how Battle.net's system was excellent. That portion of it may have been, and they seem to be responding well to this, but the timing is interesting.
You are not the customer.
That's actually pretty common when people do get hacked. If you have gold they immediately mail it off and sell it, and then try and bot farm whatever the best gold/hour is. That might be tradeskilling, that might be cash runs through bosses, sort of depended.
My lingering suspicions is that WoW was vulnerable to a session spoof attack at some point, or the usual exploit of a flash vulnerability to get your password, but their systems became overall pretty robust with authenticators added in.
In your case I'd guess a flash vulnerability, possibly a 0 day one, those are much less of a problem today than they were 2 or 3 years ago when browsers weren't well sandboxed etc. etc. But those sorts of things always got a few people.
Using scrambling rather than cryptography gets around cryptographic export and import restrictions. This is why it was possible to decypt a lot of Windows and Microsoft Word scrambled content, and why Windows NT password recovery tools existed.
Unless you want to lock yourself out of most Asian countries where videogaming comes close to a religion, and is therefore worth gobs of money, you will not build something which violates their import restrictions. See also:
http://en.wikipedia.org/wiki/Restrictions_on_the_import_of_cryptography#Status_by_country
Store password hashes in the database, but the answer to a security question, which enables resetting the password, in plain text. Cool story Blizzard
CLI paste? paste.pr0.tips!
My account keeps being hacked*, despite the fact I don't login, have no real interest in playing the games, change it to random passwords even I don't remember, run linux day to day, and have it associated to a gmail account which hasn't had any suspicious activity. I've tried to reason with them, but they refuse to listen. I've come to the conlusion that Blizzard are incompetant in this area.
* I've never seen any proof of my account being hacked besides their e-mails telling me and locking my account. I managed to get them unlocked the first few times, my characters still has all items and gold I remember. Now they want me to fax a passport or some 'real identification'. I honestly don't want the games that bad, I'm just annoyed they're taking them off me.
If I had mod points I'd vote this up.
My battle.net / wow account was fine for years. Never had a problem. Then I installed StarCraft2 and its updates. A day later I get a legitimate e-mail from Blizzard telling me my account had been used to spam the chat channels on wow. Changed my password, and started using their iPhone authenticator app. Nothing from any of my characters was missing. Not a single thing.
When it comes to security I don't think Blizzard knows what it is doing.
Real links here: http://us.blizzard.com/en-us/securityupdate.html
http://sea.battle.net/support/en/article/important-security-update-faq
The important thing to note is that the passwords were encrypted with Secure Remote Password protocol, meaning that Rainbow Tables are ineffective since each password is individually encrypted instead of using a common hash. Also, the process is CPU expensive so brute forcing is highly unfeasiable for reasonably length passwords.
I know I am replying to a troll, though I am not actually expecting any kind of sane reply from him, I'm rather replying to his post so that other users would notice the obvious flaw here.
The thing is, if the hack does not actually use any of the OS-specific features to gain access to privileged data then the OS is wholly irrelevant. All the hacks and attacks mentioned by the troll have been because of faults on the Internet-facing software that runs on top of the OS and would've happened just the same if the software was running on *BSD, OSX or Windows. Operating systems simply cannot protect against stupid people or faulty software, that is merely a pipedream. As an example if there is a bug in your latest Windows-based MMORPG that lets attackers gain access to your data do you blame Windows or do you blame the MMORPG for the failure? I sure would opt for the latter. With that in mind the troll in question here is simply trying to associate bugs in 3rd-party software with the OS, shifting blame from one party to another.
How many paying customers see other people getting it for free and decide they also no longer want to pay?
Proof of this behavior? Walking through a red light, once one person does it, others follow.
Guarding against theft is not just to stop active thiefs, it is also a way to keep non-thieves from turning to thieving.
Proof with regards to copyright infringement?
Whenever a story runs in the main stream media on thepiratebay or napster or whatever, every geek gets asked by non-geeks how they can get in on the action.
MMO Quests are like orgasms:
You may solo them, I prefer them in a group.
You know it's not a console game, right?
Right?
Blizzard have mulled over the possibility of a console release from time to time, but there's nothing announced. The game's not that different from its predecessors - as you yourself note.
In fact, the Diablo series is historically a PC/Mac series. There was a Playstation 1 version of the original, but it never got much traction. This series is as computery as a very computery thing that was just made even more computery by the injection of a big pile of computer.
I think you're using "console" as a shorthand for "shallow and repetitive". Well, I can certainly agree that Diablo games are shallow and repetitive. Absolutely. Definitely. With cherries on.
But then, I look at some of the console games I own and I don't necessarily see much in the way of shallowness or repetition in some of those. Valkyria Chronicles (PS3 exclusive) is absolutely brimming with depth and complexity, packaged beneath a highly accessible exterior. Dark Souls (360 and PS3, belated PC version due later this month) is more action oriented, but has one of the deepest and most precise combat systems I've come across. The Forza Motorsport (360 exclusive) games have depth coming out of their ears.
By all means criticise the Diablo series for its core gameplay - god knows it deserves a bit of a grilling as a counter-point to the fawning it got from some review sites. But if you're claiming it's a console game, you look ridiculous and if you're claiming that all console games are shallow, you look ignorant to boot.