Hacked Accounts

"

Thrombo wrote:

"

MonstaMunch wrote:

"

Mark_GGG wrote:

This is mostly for peace of mind because there's no way to do a practical brute force with one attempt per 10 seconds.

Thanks Mark. I fully agree that it's clear brute force attacks aren't the cause of the recent issues.

Just for a bit of extra peace of mind, would it be possible to get some sort of clarification regarding the possibility of session hijacking? More specifically, whether under the current setup a hacker would even need a password to impersonate an account if they were able to intercept the session ID.

To be clear - you don't need a user's password to log in as that user. You can do that with their password hash itself by copy/pasting it in to your own ini file and treating it as a saved password. In that respect GGG may as well be storing the password in the clear locally.

Additionally, it appears that the password hash is stored in memory throughout the execution of the program and not just during the challenge/login process. As such, you'd need only an exploit to gather information about the process in-memory (easier than a rootkit or general remote code execution). With such an exploit, a hacker would effectively only need to paste in the user's hash into his/her own client with the account name for access.

It's not hard to believe in a beta client such exploits exist as bugs and have been overlooked. Hopefully GGG will either directly address these, if they exist, soon, or come out with authenticators or a similar rotating key-based auth mechanism.

"

People have asked us why we don't restore accounts when they are hacked. The reason is that the outcome of this would be far, far worse for the game. I understand it's hard to see that perspective when you're staring at an empty stash where your items were, but please consider what would happen to the economy if players could request their items to be restored due to theft. It would be very easy to fake an account theft - just ask a friend from elsewhere to log in and take your items before contacting support and asking for a restoration.

"

Okay. I am very glad we caught this fast. Thank you very much for posting this thread with info.

Someone impersonating the account owner persuaded one of our support workers to change the email address on the account. This has only happened to this one account and this will never happen again. We have clear policies on this to keep accounts safe and we will not tolerate the policies being broken by our staff.

Our policy is to never trust incoming email as a source of proof of account ownership. In this one case a spoofed email was trusted by a customer support agent. We have talked to customer support and they now fully understand about spoofed emails.

My initial reaction that the account was sold/stolen was based on the email address being changed (which requires the owner of the account to do so).

We have restored the account, characters and its items. Thankfully there was no economic impact. We will restore his character's hardcore ladder position but this may take several days. In this case it is 100% our fault that it was compromised and I am deeply sorry.

On a happier note, the work on the new security measures we're implementing is going very well and the "one week" estimate that I posted about here may be just 1-2 days. As I explained in that post, almost all "hacked accounts" are due to people losing passwords because the passwords are used with other online services (or because there's malware installed). This case here with Prozon's account is very different than normal hardcore deaths and/or password theft because it was directly due to our customer support member making a mistake.

"

Thrombo wrote:

To be clear - you don't need a user's password to log in as that user. You can do that with their password hash itself by copy/pasting it in to your own ini file and treating it as a saved password. In that respect GGG may as well be storing the password in the clear locally.

Additionally, it appears that the password hash is stored in memory throughout the execution of the program and not just during the challenge/login process. As such, you'd need only an exploit to gather information about the process in-memory (easier than a rootkit or general remote code execution). With such an exploit, a hacker would effectively only need to paste in the user's hash into his/her own client with the account name for access.

It's not hard to believe in a beta client such exploits exist as bugs and have been overlooked. Hopefully GGG will either directly address these, if they exist, soon, or come out with authenticators or a similar rotating key-based auth mechanism.

"

darkro90 wrote:

GGG just hit another rock bottom today.

"

People have asked us why we don't restore accounts when they are hacked. The reason is that the outcome of this would be far, far worse for the game. I understand it's hard to see that perspective when you're staring at an empty stash where your items were, but please consider what would happen to the economy if players could request their items to be restored due to theft. It would be very easy to fake an account theft - just ask a friend from elsewhere to log in and take your items before contacting support and asking for a restoration.

And then...

When a famous streamer got hit...

"

Okay. I am very glad we caught this fast. Thank you very much for posting this thread with info.

Someone impersonating the account owner persuaded one of our support workers to change the email address on the account. This has only happened to this one account and this will never happen again. We have clear policies on this to keep accounts safe and we will not tolerate the policies being broken by our staff.

Our policy is to never trust incoming email as a source of proof of account ownership. In this one case a spoofed email was trusted by a customer support agent. We have talked to customer support and they now fully understand about spoofed emails.

My initial reaction that the account was sold/stolen was based on the email address being changed (which requires the owner of the account to do so).

We have restored the account, characters and its items. Thankfully there was no economic impact. We will restore his character's hardcore ladder position but this may take several days. In this case it is 100% our fault that it was compromised and I am deeply sorry.

On a happier note, the work on the new security measures we're implementing is going very well and the "one week" estimate that I posted about here may be just 1-2 days. As I explained in that post, almost all "hacked accounts" are due to people losing passwords because the passwords are used with other online services (or because there's malware installed). This case here with Prozon's account is very different than normal hardcore deaths and/or password theft because it was directly due to our customer support member making a mistake.

So, if a famous streamer get hacked, GGG will restore his/her account. Instead, if a random nobody gets hacked, they will say "We have this restore policy etc etc so no reroll."

Another rock bottom, guys. Another rock bottom.
Here's the link for the Chris's quote above.

"

ciknay wrote:

This was a totally different situation. The account wasn't hacked. GGG gave the information to someone completely different to the account. The account comprimised didn't manage to trade off taken items, so returning the items had no affect on the economy.

Support staff are now informed of people posing as account owners, and will not make the mistake again (hopefully).

"

ciknay wrote:

This was a totally different situation. The account wasn't hacked. GGG gave the information to someone completely different to the account. The account comprimised didn't manage to trade off taken items, so returning the items had no affect on the economy.

Support staff are now informed of people posing as account owners, and will not make the mistake again (hopefully).

"

Chris wrote:

Someone impersonating the account owner persuaded one of our support workers to change the email address on the account....

This case here with Prozon's account is very different than normal hardcore deaths and/or password theft because it was directly due to our customer support member making a mistake.

"

MonstaMunch wrote:

Given that it's entirely possible that a lot of the recent hijackings were no fault of the end user, it creates a bit of an awkward situation, don't you think?

"

ciknay wrote:

"

darkro90 wrote:

GGG just hit another rock bottom today.

"

People have asked us why we don't restore accounts when they are hacked. The reason is that the outcome of this would be far, far worse for the game. I understand it's hard to see that perspective when you're staring at an empty stash where your items were, but please consider what would happen to the economy if players could request their items to be restored due to theft. It would be very easy to fake an account theft - just ask a friend from elsewhere to log in and take your items before contacting support and asking for a restoration.

And then...

When a famous streamer got hit...

"

Okay. I am very glad we caught this fast. Thank you very much for posting this thread with info.

Someone impersonating the account owner persuaded one of our support workers to change the email address on the account. This has only happened to this one account and this will never happen again. We have clear policies on this to keep accounts safe and we will not tolerate the policies being broken by our staff.

Our policy is to never trust incoming email as a source of proof of account ownership. In this one case a spoofed email was trusted by a customer support agent. We have talked to customer support and they now fully understand about spoofed emails.

My initial reaction that the account was sold/stolen was based on the email address being changed (which requires the owner of the account to do so).

We have restored the account, characters and its items. Thankfully there was no economic impact. We will restore his character's hardcore ladder position but this may take several days. In this case it is 100% our fault that it was compromised and I am deeply sorry.

On a happier note, the work on the new security measures we're implementing is going very well and the "one week" estimate that I posted about here may be just 1-2 days. As I explained in that post, almost all "hacked accounts" are due to people losing passwords because the passwords are used with other online services (or because there's malware installed). This case here with Prozon's account is very different than normal hardcore deaths and/or password theft because it was directly due to our customer support member making a mistake.

So, if a famous streamer get hacked, GGG will restore his/her account. Instead, if a random nobody gets hacked, they will say "We have this restore policy etc etc so no reroll."

Another rock bottom, guys. Another rock bottom.
Here's the link for the Chris's quote above.

This was a totally different situation. The account wasn't hacked. GGG gave the information to someone completely different to the account. The account comprimised didn't manage to trade off taken items, so returning the items had no affect on the economy.

Support staff are now informed of people posing as account owners, and will not make the mistake again (hopefully).

"

MacantSaoir wrote:

You've not challenged a single point of anything I've said? They were told it would happen, there was a simple preemptive solution to prevent it happening which EVERYONE knows about (authentication) and it was not taken.
...
Complacency that's why. The only answer to it. So now they get to feel the rage of *insert number* gamers because of pure complacency. As I stated prior, I refuse to further support the game with more players or currency until this severe oversight is addressed.