Slashdot Mirror
Epic Games Forums Hacked, Again (betanews.com)
An anonymous reader writes: Epic Games, maker of popular games such as Unreal and Infinity Blade, announced today that its forums have been hacked. Now, if you don't reuse password that isn't a huge deal. But if you have used the same password on any service, perhaps even a variation of that password, you will want to ensure that you have changed password of all your accounts. In the meanwhile, here's Epic Games: "We believe a recent Unreal Engine and Unreal Tournament forum compromise revealed email addresses and other data entered into the forums, but no passwords in any form, neither salted, hashed, nor plaintext. While the data contained in the vBulletin account databases for these forums were leaked, the passwords for user accounts are stored elsewhere. These forums remain online and no passwords need to be reset", says Epic Games.ZDNet is reporting that thousands of passwords have been stolen.
Probably the "Russians".....................
Epic Games says passwords were not taken in any way. ZDNet says they were. Summary says to change your passwords elsewhere if they're the same or similar.
Are we assuming Epic Games is lying about the scope of the breach?
-=This sig has nothing to do with my comment. Move along now=-
likey more forums sql injection.
It seems like just about any forums site out there is open to that.
Question 1: Who the hell reuses passwords, and why? Anyone left not using password managers?
Question 2: If passwords were not compromised, why should anyone worry even if they used the same password elsewhere?
Question 3: If passwords were stored using any common sense method like salting and hashing, why would anyone care, even if they were compromised?
There games are not compatible with Windows 7 with unreal tournament 99 and ut2004 has issues with Windows 10.
I just bought them on steam and disappointed. Was about to register an account on epic forums and glad I didn't
http://saveie6.com/
I'll get this in now before it gets buried in comments: Use a password manager. The internet is too risky to be re-using passwords. Although there are various free ones out there, I went and bought 1password. It runs on Windows, OSX, iOS and Android. It has a read-only version that works in Linux. (I wish they'd make a Linux version, but as of yet, they haven't) It also has plugins for every major browser out there. It can also sync your passwords between multiple devices.
You can use it to keep track of all your passwords, and will even generate random passwords for you.
Nowdays, the risk of password re-use is just too high, and you're basically playing russian roulette with someone from a far off country just itching to steal your identity info, or cause havoc in some other way.
You have to log into an Epic account if you do any work with UE. Thanks a lot Epic, you're really inspiring me to choose you over CryEngine or Unity.
My Slashdot password is
is my Epic Games password XOR'd with a randomly-generated password, then XOR'd with my Epic Games password again (twice is better than once!).
All of my other important passwords follow the same pattern, but with a different randomly-generated password.
I guess I'll have to go change them all now.
I know our govt is epic and all but.. ;)
Did I just get whooshed?
The only whoosh you should get is when you put your trust in big government.
This is more tying in of your various accounts for their databases. They seem to think they should hack every large user base "anything" then push the story out. People who have no problems with old passwords don't ever change them and they don't get associated with "everything else" in that person's life unless they pull a stunt.
The same goes with "2 factor" account security. It just ties your account to government databases on you that already exist. Your phone is generally your real name as is your bank card.
Sounds like this is the third vBulletin hack of a gaming forum in 2 weeks. Moral of the story: if you use an older version of the vBulletin software and are running a forum that relates to gaming, either prepare to upgrade or prepare an announcement that you've been hacked.
Looks like some mod's sarcasm detector is broken.
If this hack will talked about for many years to come, this hack of Epic should be hereto forthwith be referred to as "The epic hack of Epic."
This is why you DO NOT STORE a plaintext password.
Mozilla has their own password manager as part of their sync service.
And if you don't trust them, you can even sync using your own home server (I think I remember that you need WebDAV for that.)
And that one works *also* on Linux.
And in addition to a password manager, you should enable 2 factors on anything critical: Your banks, e-mail address that you use for password recovery, OAuth and OpenID providers that you use to log elsewehere (like Google or Facebook), etc.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]