CoD: Ghosts
CoD: Ghosts
promo!
We are all we’ve got. Watch the full trailer for Call of Duty: Ghosts.
Pre-order Now!
last hopes
We take Naughty Dog's latest graphical masterpiece for a gameplay spin to see if it handles as well as it looks and sounds. Click here for our full hands-on preview!
fade to black
Ahead of the Xbox One reveal, AusGamers had a chance to see Call of Duty: Ghosts up close and in person. We also spoke with CoD VP of product Daniel Suarez. Click here!
Injustice Reviewed!
We take NetherRealm's Injustice: Gods Among Us for the review spin and walk away very happy with what the MK creators have built here. Click for the review!
Post by Eorl @ 09:10am 10/08/12 | 29 Comments
Blizzard has issued a security warning detailing "an unauthorized and illegal access" of their internal network, urging customers to change their passwords for the battle.net service, even if they haven't fallen victim.

The announcement explains that the data accessed includes "the answer to the personal security question" and a list of email address for players on North American servers, as well as "information relating to Mobile and Dial-In Authenticators", but goes further to explain that none of this information by itself would be enough for someone to gain access to an account, and that to their knowledge no credit card details or other financial information was compromised.
Even when you are in the business of fun, not every week ends up being fun. This week, our security team found an unauthorized and illegal access into our internal network here at Blizzard. We quickly took steps to close off this access and began working with law enforcement and security experts to investigate what happened.

At this time, we’ve found no evidence that financial information such as credit cards, billing addresses, or real names were compromised. Our investigation is ongoing, but so far nothing suggests that these pieces of information have been accessed.
Blizzard also detail in the announcement that "cryptographically scrambled versions of Battle.net passwords (not actual passwords) for players on North American servers were taken".

You can read the full statement over here, and ensure you change your battle.net password as soon as possible.












Latest Comments
Twisted
Posted 09:58am 10/8/12
So I take it 2-factor authentication is not going to keep your account safe in this instance as they mention "information relating to Mobile and Dial-In Authenticators"?
scuzzy
Posted 10:02am 10/8/12
So I take it 2-factor authentication is not going to keep your account safe in this instance as they mention "information relating to Mobile and Dial-In Authenticators"?
The serial number would be stored against your account, from that I think the restore code is derived?
csirac
Posted 10:05am 10/8/12
1 min to change pw. next.
Reverend Evil™
Posted 10:41am 10/8/12
Changed it. That hacker will never get my loot.
Mosfx
Posted 10:44am 10/8/12
fuck changing now, i got a password change notification last night at midnight which I thought was odd, I assume after watching the Korean streams last night someone tried to get into my account based on my email.

Didn't realise it was this bad
funky
Posted 11:00am 10/8/12
i reckon tihs is how fuckers got into my gmail account and spammed everyone. i foolishly had the same password for my gmail account (randomly changed my gmail password about a week or so ago, and moved it to another of my usual passwords, that just so happened to be my battlenet account password) and boom, everyone got spammed from my gmail account last night.

eXemplar
Posted 11:10am 10/8/12
North American-based accounts, including players from Latin America, Australia, New Zealand, and Southeast Asia

Email addresses
Answers to secret security questions
Cryptographically scrambled versions of passwords (not actual passwords)
Information associated with the Mobile Authenticator
Information associated with the Dial-in Authenticator
Information associated with Phone Lock, a security system associated with Taiwan accounts only

http://us.battle.net/support/en/article/important-security-update-faq#q-2

It's worth noting their passwords were stored using
Cryptographically scrambled versions of passwords for North American players were accessed, protected by Secure Remote Password (SRP) protocol.

Which you have to give them props for, it's highly unlikely nigh impossible for anyone to get their hands on your password. It is however still incredibly damaging that peoples secret questions and answers weren't encrypted, this along with names and emails spells bad news for a lot of peoples accounts with other services. It's also bad that they have keys for mobile authenticators which a significant amount of people are using on their bnet accounts, however,
In the coming days we will implement an automated process for all users to change their secret questions and answers, as a precautionary measure. We'll also prompt mobile authenticator users to update their authenticator software.


last edited by eXemplar at 11:10:39 10/Aug/12
d^
Posted 11:39am 10/8/12
changed my password.
Reverend Evil™
Posted 12:36pm 10/8/12
I think I've looked under every option and I can't find how to change your secret question thingy. Passwerd is fine though. hmm
d^
Posted 12:40pm 10/8/12
I think I've looked under every option and I can't find how to change your secret question thingy. Passwerd is fine though. hmm


"In the coming days we will implement an automated process for all users to change their secret questions and answers, as a precautionary measure. We'll also prompt mobile authenticator users to update their authenticator software."
Jim
Posted 12:42pm 10/8/12
what's the point of quoting that in response to what rev said?
lots of sites lets you change your security question type, and like rev, I wanted to change mine now rather than wait for their 'automated process'
Reverend Evil™
Posted 12:42pm 10/8/12
Oh, lol. Didn't realise it was never an option. hehe
Jim
Posted 12:51pm 10/8/12
me neither, and I don't think the wording of that release implies that either. I took it to mean that they're going to implement something that prompts people to change it because they said 'automated process' combined with 'as a precautionary security measure' - ie. to ensure people actually do change it. if not, then... wow

there's nothing precautionary about *not* prompting for a security question/answer change when it's something that's able to be used to gain control of an account and has been leaked in plain text
Dan
Posted 01:04pm 10/8/12
I really dislike the concept of security questions. Often the only choices that you get for questions are all things that someone might be able to find out with minimal digging. And in the facebook/twitter era where people are blogging and logging everything meal they eat and place they visit, that's only going to become easier.
Dazhel
Posted 01:14pm 10/8/12
Dan
Posted 02:05pm 10/8/12
Yeah, I never do. I usually just spam gibberish into them, with the intention of never having to use them as a verification option.

The shitty thing is though, when you've done that, and then realise the system actually requires their use every now and then -- like one of my financial institutions, who make you authenticate with them every time you access their site from a new computer (or clear your browser cache).
Randy Cambell
Posted 03:45pm 10/8/12
Its a joke i got hacked big time about 2 weeks ago on my diablo 3 a/c ,thay had a good old time selling my shit! what ever happend to just wackin a cd in ya drive and not worrying about dick heads fuckin with ya shit!
Superform
Posted 04:32pm 10/8/12
good security questions are things like

what colour is the sky

how many pets do i have

etc

then just make up an answer that you only know

like

tangerine

12345
Jayman
Posted 04:59pm 10/8/12
Probably best to have a standard answer to security questions no matter what it is. Like another complex password of phrase.
Khel
Posted 05:21pm 10/8/12
12345? Sounds like the combination an idiot would have on their luggage
dais
Posted 06:00pm 10/8/12
That's amazing. I've got the same combination on my luggage.
Superform
Posted 06:19pm 10/8/12
Stop hacking my luggage khel
parabol
Posted 07:14pm 10/8/12
I think "What is your password?" would be a good enough question.
Mordecai
Posted 07:20pm 10/8/12
Changed my password. No one will guess it is 12345!
trog
Posted 07:58pm 10/8/12
Changed my password. No one will guess it is 12345!
That's the kind of combination an IDIOT would put on his luggage!
WirlWind
Posted 10:52pm 10/8/12
I don't bother trying to phish for luggage passwords.

I just brute force with an axe.
Mosfx
Posted 07:11am 11/8/12
Speaking of Blizzard, Battle.net blah blah blah the SC2 SEA Championships started last night!
http://www.twitch.tv/aclprosc2
if anyone is interested in watching the stream
Jim
Posted 12:32pm 16/8/12
just noticed the security Q/A change thing was finally implemented, along with a thing to renew your authenticator serial/code as well
skythra
Posted 01:57pm 16/8/12
Here's my blizzard woe story.

The other week my phone was decomissioned and so before it left my posession I flashed it completely new, removed all traces of my backup on it and let it go.

Then, a few days ago, i went to log into starcraft and it asked for a bnet authenticator, something i had installed on my old phone. Well, i couldn't do anything about that so then i checked the web form, which asked me for a photograph of a government ID. I said "fuck that, considering their other information on me, i'm not giving some callcentre/t1 person enough documentation to take out a loan in my name".

I called blizzard up and they on the phone asked me:
1) My name
2) My address
3) My secret question

After answering all three correctly, they then asked me for my CD key for Diablo 3
"I bought it online, i can't check that physically, I bought it through blizzard"

They then said "Can you tell me your last 4 credit card numbers"
I reply: "I paid through paypal, direct debit".

They then said "Well do you know your starcraft2 key?"
I didn't have my cd's anymore, i installed it at a friends, registered it on battlenet, along side my warcraft 3 key. "No, sorry, but i still have my warcraft 3 cd key" I grabbed it off the shelf but before i could read it out the lady replies
"I'm sorry, we can't use that to authenticate you".
"Well, how many other people could recount a 20 alpha numeric number which is attached to an account"
"It's not in the list"

I had an idea "Oh well, if you don't believe i'm me, you have my mobile phone number on the system, call that number, and when i pick up you'll be guaranteed it's me. It was associated months if not years ago".
"I'm sorry, it's not on the list"
"Well, what can i say that is on the list"
"Diablo 3, World of Warcraft or Starcraft 2, or alternatively, if you submit a ticket with a photo of your government ID on it, like a passport or drivers license, then we can authenticate you".

I replied back "My name is John Clark. My passport has no details on it that would match any other detail on your system. It would just some passport. It doesn't have my address, it doesn't have my secret answer and it doesn't have any relation to blizzard or my methods of payment to you. But you're telling me, if someone, anyone else with the same name as me, JOHN SMITH, called up with his ID then you'd give him my whole account? Is there someone I can talk about this to?"

At which point i couldn't go any further and so I ended the call.

There's more boring stuff to that story, but i did get my account back later, by following their proceedure. I was half tempted to just buy a new game, but i don't have my war3 cd anymore, just my key so i'd also lose that if i lost my account :(
Commenting has been locked for this item.
29 Comments
Show
 
Log In
User:  
Pass:  

Advertise with Us | Download Media Kit | Privacy Policy | Contact Us
© Copyright 2001-2013 AusGamers™ Pty Ltd. ACN 093 772 242.
A Mammoth Media web development, hosted by Mammoth VPS.