Massive hack last night Why it must be a bug

"

Tc662 wrote:

There are way more, Just check a few forum pages back.

There will be more and more complains coming in now to since Europe is starting to wake up.

I did and you are wrong.
The number is way lower than 100, more like as i said 10-20

"

overpowdered wrote:

"

Tc662 wrote:

There are way more, Just check a few forum pages back.

There will be more and more complains coming in now to since Europe is starting to wake up.

I did and you are wrong.
The number is way lower than 100, more like as i said 10-20

Sorry but I'm 100% sure that more then 1000 got hacked

"

Struyk wrote:

"

ionface wrote:

It sounds to me like a thieving group of poor sweatshop workers or mafia slaves got a list of logins from a a phishing script.

I don't see anything anywhere to indicate this was even automated.

It's not a phishing script bro why you keep thinking that? It's a simple security breach because GGG didnt bother spending money on security.

The Founder/CEO and Lead Developer has more experience in this than all of us. This game was literally built on security money, and it took six years of careful development to get into open beta, they aren't rushing this like some company with deadlines.

"

Chris Wilson - Producer, Lead Designer
Chris graduated from the University of Auckland in 2004, gaining Bachelor of Science (Computer Science, with First Class Honours) and Bachelor of Commerce (Finance) degrees. His work in the field of software security provided the financial liquidity required to cofound and invest in Grinding Gear Games.

"

overpowdered wrote:

"

Tc662 wrote:

There are way more, Just check a few forum pages back.

There will be more and more complains coming in now to since Europe is starting to wake up.

I did and you are wrong.
The number is way lower than 100, more like as i said 10-20

I've counted over 60 different threads with multiple comments, all these threads are created by different persons.

Sorry, but go check again, you're wrong.

"

ionface wrote:

"

Struyk wrote:

"

ionface wrote:

It sounds to me like a thieving group of poor sweatshop workers or mafia slaves got a list of logins from a a phishing script.

I don't see anything anywhere to indicate this was even automated.

It's not a phishing script bro why you keep thinking that? It's a simple security breach because GGG didnt bother spending money on security.

The Founder/CEO and Lead Developer has more experience in this than all of us. This game was literally built on security money, and it took six years of careful development to get into open beta, they aren't rushing this like some company with deadlines.

"

Chris Wilson - Producer, Lead Designer
Chris graduated from the University of Auckland in 2004, gaining Bachelor of Science (Computer Science, with First Class Honours) and Bachelor of Commerce (Finance) degrees. His work in the field of software security provided the financial liquidity required to cofound and invest in Grinding Gear Games.

Well then explain why there is no security at all? Blizz has authenciator and many other games will disable your account when you login from another computer,

Binding your IP address to your account isn't exactly foolproof, but they're writing that in now.

But seriously, did you just compare a small indie dev from new zealand to the largest online game company in the world? Right on GGG.

"

Struyk wrote:

Well then explain why there is no security at all? Blizz has authenciator and many other games will disable your account when you login from another computer,

Because it's still a BETA

"

Struyk wrote:

It's not a phishing script bro why you keep thinking that? It's a simple security breach because GGG didnt bother spending money on security.

The Founder/CEO and Lead Developer has more experience in this than all of us. This game was literally built on security money, and it took six years of careful development to get into open beta, they aren't rushing this like some company with deadlines.

"

Chris Wilson - Producer, Lead Designer
Chris graduated from the University of Auckland in 2004, gaining Bachelor of Science (Computer Science, with First Class Honours) and Bachelor of Commerce (Finance) degrees. His work in the field of software security provided the financial liquidity required to cofound and invest in Grinding Gear Games.

Well then explain why there is no security at all? Blizz has authenciator and many other games will disable your account when you login from another computer,

Because those companies has a lot more money to spend, GGG is a small company with few developers, they have to prioritize what to do (And yes security is important) They might not have had the development funds to actually develop authenticators, or a system to whitelist IP's and so on. They spend most of their funding on acutal game content. And personally i'm glad they did.

Common sense goes a long way to prevent you getting hacked, and if it really were that widespread a lot more people would be reporting they would have been hacked, especially they high profile ones.

People keep saying they haven't visited shady sites or anything, but you don't even need to visit shady sites to be targeted, banner ads can come from any site.

I still think that the amount of people complaining are reaching an alarming number, there still is very little to indicate that this is not the result of some successfull ad banner Attack/Phishing attack/Social Engineering attack and so on.

And they childish attitude of demanding items/rollbacks isn't or quiting aren't getting you anywhere.

"

ionface wrote:

I'm just gonna throw this out there, what if some unscrupulous orb farming company in some part of China got a list of credentials, then began to use them last night?

I think there's a point there. What if someone acquired login data over a few weeks' time and just decided to run his thieving script for the last few days?
The next question is: How could this data have been acquired? We can assume it was not a server hack as the amount of accounts hacked (and the subsequent forum shitstorm) would be much higher. Also, if this was the case, some of the top players/ streamers would have been hacked as well, and we would know about it by now. Because using a script implies an automated approach which would not distinguish between casual, hardcore or streaming players.
But where does the login data come from, if not from GGG? It must somehow have been phished, keylogged or whatever? Could it be some program that utilizes a browser backdoor to access our login data in some way? Could it be something "spying" on tools like PoE Helper?
I don't assume everyone who got hacked is a computer noob, so it has to be something that was engineered very carefully, like a really good phishing site.
Any thoughts on this?

"

ionface wrote:

Binding your IP address to your account isn't exactly foolproof, but they're writing that in now.

Yeah, that's exactly what we want. Release a game in OB and build up security a month after that, AFTER more and more people got hacked.