Beta

×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Symantec Finds Server Containing 44 Million Stolen Gaming Credentials

Soulskill posted more than 4 years ago | from the who-wants-to-buy-a-level-80-paladin dept.

Botnet 146

A Symantec blog post reports that the company recently stumbled upon a server hosting the stolen credentials for 44 million game accounts. It goes on to explain how the owners of the server made use of a botnet to process that mountain of data: "Now it's time to turn those gaming credentials into hard cash. But how do you find out which credentials are valid and thus worth some money? Three options come to mind: 1) Log on to gaming websites 44 million times! 2) Write a program to log in to the websites and check for you (this would take months). 3) Write a program that checks the login details and then distribute the program to multiple computers. Option one naturally seems next to impossible. Option two is also not very feasible, since websites typically block IP addresses after multiple failed login attempts. By taking advantage of the distributed processing that the third option offers, you can complete the task more quickly and help mitigate the multiple-login failure problems by spreading the task over more IP addresses. This is what Trojan.Loginck's creators have done."

cancel ×

146 comments

Sorry! There are no comments related to the filter you selected.

Symantec stumbled (0)

Anonymous Coward | more than 4 years ago | (#32365106)

Symantec stumbled upon a server hosting the stolen credentials for 44 million game accounts. On their own LAN!

Games and security... (1, Informative)

TrisexualPuppy (976893) | more than 4 years ago | (#32365376)

There are lots of holes in games since the last thing that programmers or gamers really want to think about is account security. (Cheating security frequently is the first thing that comes to mind.)

One of my buds ran a long thread here [incgamers.com] a while back. Several of his accounts were taken...don't remember how they got his WoW account. But it ended up that he eventually figured out that a server admin had poisoned a Web-downloadable .exe map pack file with a trojan that scraped some account info off files while running a keylogger to get anything that the scraper missed. These hackers are usually on top of their game (no pun intended).

Mod parent up! (0)

Anonymous Coward | more than 4 years ago | (#32365882)

Uppity, I say!

Re:Mod parent up! (0)

Anonymous Coward | more than 4 years ago | (#32366386)

Mod AC Down, down boy down

Re:Symantec stumbled (1)

KovaaK (1347019) | more than 4 years ago | (#32366032)

Although a little outdated, mmogchart [mmogchart.com] had the total number of active MMO subscriptions at less than 20 million in 2008. Makes you wonder 1) what % of those 44 million are inactive accounts, and 2) what do they do when they find an inactive account - scrap it, save it, or purchase an untraceable game-time card to reactivate?

If their methods for stealing logins are that advanced, do you think they have some sort of organization of those inactive accounts by likelihood of them containing enough loot to be worth it?

I must be new here (2, Interesting)

jeffmeden (135043) | more than 4 years ago | (#32365166)

I an a little naive to the criminal enterprise that is stolen gaming credentials, but I have to wonder: why does it matter, if you are selling a stolen credential, if it's good or not? Is the buyer really going to come back and demand a refund when it doesn't work? And what real benefit are these, anyway? Don't tell me that people buy stolen creds and log into them just to take all their e-loot (worth thousands of e-dollars)? Oh for the love of humanity the things people will do in the name of wasting time.

Re:I must be new here (4, Informative)

Monkeedude1212 (1560403) | more than 4 years ago | (#32365234)

Don't tell me that people buy stolen creds and log into them just to take all their e-loot (worth thousands of e-dollars)? Oh for the love of humanity the things people will do in the name of wasting time.

No, this is often the people who STOLE the creds, log in, and sell the E-loot for REAL money. If you've never played WoW, Eve, or Runescape for more than a Month, I wouldn't expect you to understand. But this is a problem that does occur regularly.

Re:I must be new here (-1, Troll)

jeffmeden (135043) | more than 4 years ago | (#32365404)

Sweet mother of god the things I would do if I had 10+ hours a day to waste for a WHOLE MONTH STRAIGHT (as is the time frequently related by the people I know who do such things).

I will go ahead and tell you now, spending time in a MMORPG wouldn't be what I would do. Trolling on slashdot might be slightly higher on the list, even.

Re:I must be new here (1)

royallthefourth (1564389) | more than 4 years ago | (#32365632)

You'd find something else to do, just like anyone with a normal psyche. This stuff does hold the potential for addiction, which for most of these people is the only explanation for their obsessive behavior.

Think about it: nobody really wants his life to be sitting in a chair wasting time and just waiting for death to come a little closer. Nonetheless, this is the behavior of folks with addictions.

Actually, that description sounds like having a (white collar) job. I produce nothing of value, but here I am, helping my employer to shuffle piles of dollars into his pocket while I get enough to pay the rent. Nobody else gets a useful product or service out of it. I do it most days, but it feels like in a sane world I would be doing something that actually has tangible benefit or is personally enriching.

Re:I must be new here (0)

Anonymous Coward | more than 4 years ago | (#32365698)

Actually, that description sounds like having a (white collar) job. I produce nothing of value, but here I am, helping my employer to shuffle piles of dollars into his pocket while I get enough to pay the rent. Nobody else gets a useful product or service out of it. I do it most days, but it feels like in a sane world I would be doing something that actually has tangible benefit or is personally enriching.

You work on wall street? Boy, I feel for ya!

wink

Re:I must be new here (0)

Anonymous Coward | more than 4 years ago | (#32365840)

I must agree with you - I came to this realization a number of years ago after I was laid off. Thanks to the fantastic EI system in Canada, I was able to go back to school for 8 months and reconsider my life.

What was I really creating that benefits the world (different than benefitting humanity/people)? I came to the conclusion: not much.

I checked out geekcorps (http://www.geekcorps.org/) and got in touch with them. Unfortunately they didn't have anything for me until nearly a year later, but by then I had met a great woman (now my wife), and she wasn't ready to live in Cote d'Ivoire or Mongolia for 6-10 months, and I have had to push out my plans for going back to school to teach.

I realized that teaching is one way I could bring a benefit to the world and humanity, but lack the education to do so, and from seeing friends and family struggle as teachers in a country (at least in my home province, BC) bent on destroying any glimmer of hope of having a decent education system.

Anyway, this ended up being quite the rant, but I wholeheartedly agree. I feel that I'm well paid, but well paid for doing what? Making sure someone else is well paid, basically. :)

Re:I must be new here (0, Troll)

BobMcD (601576) | more than 4 years ago | (#32365914)

You'd find something else to do, just like anyone with a normal psyche. This stuff does hold the potential for addiction, which for most of these people is the only explanation for their obsessive behavior.

You have no idea. MMO's are new, and new things tend to get noticed, but hobbies that waste zillions of hours and dollars are anything but new. Look at the cost and time involved in, say, rebuilding an old car. Finding all the parts, tearing down, cleaning, rebuilding, tuning, paint and polish. All for what, a car worth at most $10k? For what cost of labor and materials?

Look also at the cost of raising a family. Much, much, much more expensive to have spawns running around than it would be just to rent a lot of porno.

Think about it: nobody really wants his life to be sitting in a chair wasting time and just waiting for death to come a little closer. Nonetheless, this is the behavior of folks with addictions.

Actually, that description sounds like having a (white collar) job. I produce nothing of value, but here I am, helping my employer to shuffle piles of dollars into his pocket while I get enough to pay the rent. Nobody else gets a useful product or service out of it. I do it most days, but it feels like in a sane world I would be doing something that actually has tangible benefit or is personally enriching.

The key difference, for me anyway, in what you're describing and the virtual world is choice. I get to decide who I work with in that world - not so much in this one. I can say and do as I please. I can unplug whenever I want. I can even fire up a completely different game at a moment's notice, and come back to this one without any hard feelings. Even within the one game I can level a new character, explore a new facet of the game itself, or invent things to do out of thin air. I never need to buy special equipment, never need to replace anything, and can have an amazing variety of activities involving literally fifty different people (at a minimum), all from that same comfortable spot on the couch.

Re:I must be new here (0)

Anonymous Coward | more than 4 years ago | (#32366088)

You have no idea. MMO's are new, and new things tend to get noticed, but hobbies that waste zillions of hours and dollars are anything but new. Look at the cost and time involved in, say, rebuilding an old car. Finding all the parts, tearing down, cleaning, rebuilding, tuning, paint and polish. All for what, a car worth at most $10k? For what cost of labor and materials?

Look also at the cost of raising a family. Much, much, much more expensive to have spawns running around than it would be just to rent a lot of porno.

Ah, er, if you are comparing the endgame in having a family to that of a porno, either you are watching some messed up pornos or you are doing it all wrong.

Re:I must be new here (1)

BobMcD (601576) | more than 4 years ago | (#32366162)

Ah, er, if you are comparing the endgame in having a family to that of a porno, either you are watching some messed up pornos or you are doing it all wrong.

That'd be the point, wouldn't it?

I'm illustrating a cost-benefit vs the specific short-term need.

Re:I must be new here (0)

Anonymous Coward | more than 4 years ago | (#32365742)

Trolling on slashdot might be slightly higher on the list, even.

We can see that.

Re:I must be new here (1)

pellik (193063) | more than 4 years ago | (#32367318)

This is exactly why real money trade is so prevalent in MMORPGs. Typically the end-game material is the most enjoyable part of these games, where teamwork and friendship are really necessary to succeed and the multiplayer aspect really shines. However, getting to the endgame (really fun) part of these games takes more time then adults can generally commit. For the amount of money you earn in an hour or two at work you can buy the product of a day of labor in the game.

Re:I must be new here (1)

mlts (1038732) | more than 4 years ago | (#32365704)

This is very common in WoW. It usually goes like this:

1: Someone visits a website which is either legit but gets served up a fake ad via an ad-rotater, or the site is using exploits directly. Either way, a keylogger gets downloaded. It can be an add-on that just logs keys in the background and ends when the Web browser is closed and not even installed on the system.

2: The keylogger grabs the WoW password.

3: The account is grabbed, password and other info is changed.

4: The higher level characters have their gear sold for in game currency, and are used as mining bots, mailing the mined loot to another hacked account, and put on the auction house for people to buy. This continues until people notice the hacked accounts (characters running through walls, jumping below the ground level, or just warping) and the account gets banned.

5: The game currency is then sold for real life currency, or the accounts are sold to suckers.

Of course, Blizzard has a solid solution to protect against this: Plunk down $6.50 for a Blizzard Authenticator or download and use an app for the iPhone or Android. With two-factor authentication, a keylogger will not be able to seize a WoW account, although every other account on the system is at risk. Anyone who is serious about security should get secondary authentication.

Ultimately, banks and other MMO companies need to get on this bandwagon and offer a secondary authentication mechanism.

Re:I must be new here (0)

Anonymous Coward | more than 4 years ago | (#32366798)

So I can pay 30 EUR for the game, 20 for each expansion pack and if i want to actually keep all the stuff I i earned while i played i have to pay even more? What sort of horse shit is that? Why isnt the authenticator part of what I am paying for?

Re:I must be new here (1)

ch-chuck (9622) | more than 4 years ago | (#32365782)

I wonder if anyone has ever filed a police report for stole e-goods?

I can just see the officer's face taking a report about stolen gold as it slowly dawns on him it's from a video game.

Re:I must be new here (0)

Anonymous Coward | more than 4 years ago | (#32366106)

http://www.geek.com/articles/news/virtual-goods-theft-leads-to-3-years-in-jail-20090526/

First hit when using a fairly large search engine whose name begins with a 'g' with the keywords "Stolen virtual goods".

Re:I must be new here (not really!) (0)

Anonymous Coward | more than 4 years ago | (#32365800)

You can no longer sell in-game items on RuneScape for real life money. An update to the game in December 2007 prevented this practice.

Re:I must be new here (0)

Anonymous Coward | more than 4 years ago | (#32366158)

So these aren't the people wasting time.... these are the people who are stealing from the people who are wasting time.

Re:I must be new here (1)

rocket97 (565016) | more than 4 years ago | (#32365240)

I cant say for other games, but for World of Warcraft, they sell the in game items for in game currency, and then turn around and sell the in game currency for actual real currency. There are several websites set up that sell "X gold for $y".

Re:I must be new here (1)

Monkeedude1212 (1560403) | more than 4 years ago | (#32365300)

Not to mention the selling of characters, which does happen on occasion.

Re:I must be new here (0)

Anonymous Coward | more than 4 years ago | (#32365378)

I cant say for other games, but for World of Warcraft, they sell the in game items for in game currency, and then turn around and sell the in game currency for actual real currency. There are several websites set up that sell "X gold for $y".

Exactly.. and at rates that would be very difficult to make a profit from had they farmed the gold in game legitimately. It's around $5-6 per 1000g now, which unless you're very lucky, will take several hours to get. Compound this by the hundreds of servers on which they'd have to keep a decent supply of gold in stock, and it becomes nearly impossible to keep up a business without stealing from hordes of accounts.

8D

Re:I must be new here (2, Funny)

jgagnon (1663075) | more than 4 years ago | (#32365590)

It's a little easier than that... all they have to do is use hordes of 3rd world labor at low rates to farm and auction what they get, especially if they work on commission.

Re:I must be new here (1)

Zen Hash (1619759) | more than 4 years ago | (#32366722)

Many farming operations also use bots so that their workers can manage multiple characters simultaneously instead of only one at a time.

Re:I must be new here (1, Interesting)

Anonymous Coward | more than 4 years ago | (#32366546)

It took me a stack of 20 Mageweave Cloth to make 1000 pg once...
It was in my first uses of auctioneer add-on in which by mistake I’ve had put 50 pg per unit instead of 50 pg per stack.-
Surprisingly someone bought it. Ahh!!, the good old business days and the beginners luck, beautiful combination.-

Re:I must be new here (3, Insightful)

keithjr (1091829) | more than 4 years ago | (#32365332)

Is the buyer really going to come back and demand a refund when it doesn't work?

Probably not, but reputation must be worth something in criminal enterprises. Giving out a bunch of bogus products kills the word-of-mouth.

And what real benefit are these, anyway? Well, all the criminal has to do is sell off the account for less than the game costs up-front. They make pure profit and people willing to buy stolen games get a discount. Steam accounts could probably be quite lucrative, for instance.

Re:I must be new here (2, Insightful)

nbert (785663) | more than 4 years ago | (#32365700)

Probably not, but reputation must be worth something in criminal enterprises. Giving out a bunch of bogus products kills the word-of-mouth.

I can't imagine how they could sell those individually to gamers. For them it makes more sense to single out invalid accounts and to sell large blocks to less skilled criminals at a premium. Just like in the normal business world one would pay more than twice for a product which has a 0% failure rate instead of 50%. Of course one could just pretend that all accounts are valid, but word of mouth would be your least least problem in that scenario ;)

Re:I must be new here (0)

Anonymous Coward | more than 4 years ago | (#32366766)

No they sell them in bulk to interested parties who then examine each of the accounts individually.
It works just like people with bulk credit card info.
They gather a bunch and sell them in bulk sections to other people who do the dirty work of frauding them.
At least that's how it sounded like after reading some of the articles about that big credit card underground site that got busted awhile back.

Re:I must be new here (2, Informative)

interkin3tic (1469267) | more than 4 years ago | (#32365348)

Is the buyer really going to come back and demand a refund when it doesn't work?

While I'd guess it's not impossible to just fake the account details, and maybe people do that, it could just be that these particular people found it is just more profitable to be legitimate after stealing the account for a variety of reasons. These are legitimate auction sites according to TFA.

Just guessing, but you see a account you'd like to get on the auction site, check to see if that character is actually good or has good equipment on WOW or whatever. If it isn't, no bid. If you buy it and the login doesn't work, I guess you first might cancel the transaction on your credit card or report it to paypal, the auction house bans that user from selling again, they'd have to start over with a new auction account with a lower user feedback rating.

Re:I must be new here (4, Insightful)

BobMcD (601576) | more than 4 years ago | (#32365394)

Oh for the love of humanity the things people will do in the name of wasting time.

One man's wasted time is another man's Sistine Chapel, or pornography collection, or fictitious language for a fantasy book series.

From the moment you open your eyes in the morning until you close them at night you're passing time. Whether or not it is wasted depends entirely on whether or not you regret how you spent it.

Re:I must be new here (1)

Ephemeriis (315124) | more than 4 years ago | (#32365402)

Don't tell me that people buy stolen creds and log into them just to take all their e-loot (worth thousands of e-dollars)?

This is typically what happens.

In WoW, for example, they'll sell off all your nifty loot for gold. Then they'll transfer the gold to some other character and leave you sitting naked and penniless in the auction house.

They will then sell those huge piles of ill-gotten gold for real-world dollars.

People will actually pay real cash for in-game cash.

Re:I must be new here (1)

DarkIye (875062) | more than 4 years ago | (#32366056)

Is the buyer really going to come back and demand a refund when it doesn't work?

If enough money changes hands (they'll be bought and sold in tens or hundreds of thousands), the buyer's retaliation would probably be to have the seller whacked.

Re:I must be new here (1)

Drakkenmensch (1255800) | more than 4 years ago | (#32366142)

When the hired thugs come by your dark alley where you conduct your stolen credential business and complain about the quality of your premium stolen information, would you prefer they break your arms or your legs?

Re:I must be new here (1)

idontgno (624372) | more than 4 years ago | (#32366320)

Oh for the love of humanity the things people will do in the name of wasting time.

Quoth second poster on a slashdot gaming article...

Re:I must be new here (1)

rednip (186217) | more than 4 years ago | (#32366526)

Is the buyer really going to come back and demand a refund when it doesn't work?

No, but it would be impossible to sell him a bigger list if the test account comes up empty. No one who would give any real good price for a large 'batch' of accounts would start out by 'testing' a 'supplier'. It shouldn't be surprising that, even to criminals, guaranteed results have a monetary value. e.g. If you stole an apartment super's keyring, you could break into each home yourself. However few pickpockets like yourself have the stones for burglary, so instead you sell them to someone who will. If you sold fake keys, you might get a buyer now and again, maybe it'd even be worth the trouble. Working keys could actually generate a biding war.

As if.. (0)

Anonymous Coward | more than 4 years ago | (#32365170)

As if a million gnome mages cried out in torment and were silenced at once.

Hey you guys (1)

Monkeedude1212 (1560403) | more than 4 years ago | (#32365174)

You know Slashdot doesn't let you say your own password? Check it out:

*********

Also, Alt+F4 gets you instant Karma!

---

Had to get that out of me. So I didn't RTFA, but what I gather is that they used some kind of keylogger and now the server has 44 Million user credentials. At first I was like "Why didn't it just test the credentials when it recieved them, and then changed the password?" But that runs the risk of users detecting the virus, having it's spread shut down by Symantec, and the account being deemed worthless once the Game-Dev's shut it down and hand a new one to the original user.

So then I thought, "Why don't they have a system to report how often a keylog sends specific credentials to their server, so they know how recently certain credentials were used, to know which are still active?" Perhaps they didn't include that info when sending back keylogs though - sloppy programming, but I imagine they let this thing run for a while to see if it would even work and take off before putting in a ton of functionality.

So, I guess the issue I have is, how do you get a botnet to try out various logins without alerting the user? Could this have been how they were caught?

Re:Hey you guys (1)

jeffmeden (135043) | more than 4 years ago | (#32365228)

To test this I found a really old article (to avoid the chance of someone coming upon it) and posted a comment in it with my password. Turns out you were wrong!!! Damn you.

Re:Hey you guys (1)

Monkeedude1212 (1560403) | more than 4 years ago | (#32365244)

It's the oldest trick in the book, and you'd be surprised how many people have lost their account info that way. ...

*shifty eyes*

I was twelve okay? I didn't know any better.

Re:Hey you guys (1)

kevinNCSU (1531307) | more than 4 years ago | (#32365346)

The proper response is that you still see it as plain text but everyone else just sees the asterisks.

Re:Hey you guys (1)

2obvious4u (871996) | more than 4 years ago | (#32365260)

lol, you actually tried it - I fell for the Alt + F4 once in a game of starcraft.

Re:Hey you guys (2, Funny)

rocket97 (565016) | more than 4 years ago | (#32365446)

One of my co-workers was giving a presentation once (he is a self proclaimed computer expert in every facet), and he asked us "how do I make this power point presentation full screen?". We replied Alt-F4. He did it and said "hmm that is weird", and restarted power point and pressed Alt-F4 again... after attempting it 5 times he gave up and said "Oh well I guess we will just do the presentation like this".

Re:Hey you guys (0, Offtopic)

biryokumaru (822262) | more than 4 years ago | (#32365278)

No, no, no. He means it'll come up stars for everyone else, see: hunter2.

Re:Hey you guys (1)

kalirion (728907) | more than 4 years ago | (#32366426)

Actually he was right. You can see your own password because it's your password.

You can even see it after logging out, because slashdot remembers your ip.
And detects it through web proxies.
And uses biometrics on the keyboard to recognize you from another computer.

Yeah, that's it.

Re:Hey you guys (1)

mcgrew (92797) | more than 4 years ago | (#32366774)

You can't comment in really old articles.

Re:Hey you guys (0)

Anonymous Coward | more than 4 years ago | (#32365364)

When I try it, I see hunter2 [bash.org]

Re:Hey you guys (2, Funny)

The MAZZTer (911996) | more than 4 years ago | (#32365380)

hunter2 [bash.org]

Re:Hey you guys (1)

tangelogee (1486597) | more than 4 years ago | (#32365508)

I miss the days of Ctrl-Alt-Del restarting the computer...used to be so much fun!

Re:Hey you guys (1)

JWSmythe (446288) | more than 4 years ago | (#32365582)

1234

    Nope, it lets me post my own password. :)

Re:Hey you guys (1)

archangel9 (1499897) | more than 4 years ago | (#32366610)

That's the stupidest password I've ever heard in my life! The kind of thing an idiot would have on his luggage!

or... (1, Insightful)

Anonymous Coward | more than 4 years ago | (#32365208)

4) Sell them in bulk, untested.

Damn it. (5, Funny)

LupidStupy (663804) | more than 4 years ago | (#32365276)

Mom!!!! Symantec hacked my server again.

They should post the usernames... (4, Interesting)

BobMcD (601576) | more than 4 years ago | (#32365286)

They could, as a service to the online community, go ahead and post the usernames that are compromised.

Re:They should post the usernames... (1)

MikeBabcock (65886) | more than 4 years ago | (#32365536)

I get your point, except that you should change your gaming password now anyway. It might have been you, it might not have, and your creds. might've been stolen by someone else entirely.

Change your passwords anyway.

Re:They should post the usernames... (1)

BobMcD (601576) | more than 4 years ago | (#32365684)

I get your point, except that you should change your gaming password now anyway. It might have been you, it might not have, and your creds. might've been stolen by someone else entirely.

Change your passwords anyway.

This is true every moment of every day. Maybe my password was stolen a second ago, or maybe in the next second. We have to make some assumptions or else the protection becomes unusable.

Symantec, however, has the list and so makes far fewer assumptions as to whom should take action.

Also, having the list would let people know that they are in need of better security, along with letting them know their password needs changed. Omitting the former means your new password would be immediately compromised as well.

Now, as for ME, I have an authenticator, so I'm golden. But there would seem to be at least 210,000 other WoW players who do not.

Re:They should post the usernames... (1)

Smallpond (221300) | more than 4 years ago | (#32366810)

needs changed

What's the weather like in Pittsburgh today?

Re:They should post the usernames... (1)

Culture20 (968837) | more than 4 years ago | (#32365622)

They could, as a service to the online community, go ahead and post the usernames that are compromised.

Along with the passwords. Because, um, then we'd know if the thieves have old creds? Yeah, that's the reason.

Re:They should post the usernames... (1)

BobMcD (601576) | more than 4 years ago | (#32365710)

In truth, if my password were divulged back to me I'd know WHEN the compromise happened as well.

But, as you so eloquently pointed out, there would be other uses for this information...

Re:They should post the usernames... (4, Interesting)

JWSmythe (446288) | more than 4 years ago | (#32365738)

    I used to have a lot of fun with that, when I was the sysadmin for a large site. It seemed every script kiddie wanted the password to it. It showed up regularly on passwordz sites. We had a whole bunch of triggers to detect and resecure accounts. One of the easy and obvious ones was to let them post it, and catch it afterwards (usually within seconds of being posted). The legitimate account holder got a notification that we changed their password to a secure one. Everyone else just sat there and wondered how we'd catch them so fast.

    That trigger was pretty low on the list though. My favorite was to catch 'em scanning for passwords. If they tried say 1000 wrong passwords in a short period, but got one or two right, we'd let them keep scannning for a while, and then block their access to the server. (iptables drop rule). Then the program would figure out which passwords they actually got right, change those, and notify the account holder of their new password. :) It was always fun to see what the delay was between them finding a password, and when it started being used from passwordz sites. In those cases, we always had the account secured before they had time to post it. The typical time from being scanned to being posted was about 12 hours. The typical time for us to reissue the passwords was less than 5 minutes.

    I can't imagine online game places wouldn't have something similar. Brute force attacks are just too easy, and people will always try them. How many different usernames can a person really try before you know that they're just brute force attacking.

Re:They should post the usernames... (2, Insightful)

noidentity (188756) | more than 4 years ago | (#32366580)

Hopefully they'll try to return all these stolen credentials back to the owners. Returning stolen property can get pretty costly though, with so many different owners. They can't just go destroying them, then the owners would lose them.

Re:They should post the usernames... (2, Insightful)

Dumnezeu (1673634) | more than 4 years ago | (#32367144)

What would be the point of publishing a 500 MB (@~11 chars/user) text file? And how would they do that? If anyone gives a shit about their account, they'll just change their password as soon as they hear about this.

Also, let's do some statistics, shall we? Let's say there are 20 million WoW accounts (pulled the number out of my ass, Wikipedia said 12 million in 2008). There are also 0.2 million stolen WoW accounts. The chance of your account being compromised is 100:1. Pretty high, if you ask me, so just scan your computer online with an antivirus [google.com] if you don't have one installed, change your password and stop asking for stupid stuff in the name of the community (what community?!?).

Re:They should post the usernames... (1)

BobMcD (601576) | more than 4 years ago | (#32367212)

You might want to check out some of the other posts in the thread...

Infringed! (1)

TaoPhoenix (980487) | more than 4 years ago | (#32365296)

Hey, the original users got to keep their credentials - all that happened was the hacker got a spare set! (Until the password was changed...)

And if I did this... (3, Insightful)

FrankSchwab (675585) | more than 4 years ago | (#32365356)

OK, so Symantec "recently stumbled upon a server hosting...".

What, was it placed on their doorstep one night, and they didn't notice it when they went outside to get the morning paper?

So, they wrote a crawler that intrusively scanned servers that they didn't have permission to access, opening and analyzing files that they didn't have permission to read, then published what they found?

And the penalty if I did that is, what, 5 years in federal PMITA prison?

There is something wrong in this world.

Re:And if I did this... (4, Insightful)

BobMcD (601576) | more than 4 years ago | (#32365466)

And the penalty if I did that is, what, 5 years in federal PMITA prison?

There is something wrong in this world.

You're quite wrong. This is an example of one of the few somethings that is right in this world. Selective enforcement is designed into the system, along with jury nullification, to help the laws achieve ends that keep the public they support happy. Any "completely fair" application of the law would make it unworkable in very short order.

Could you imagine a robot issuing you indecency citations every time you pass gas in public? Could you imagine a police officer doing the same if you passed gas into a megaphone-amplified-sound-system aimed at, say, an Inaugural speech? Context is key, and thankfully so.

Re:And if I did this... (2, Insightful)

girlintraining (1395911) | more than 4 years ago | (#32365726)

Selective enforcement is what creates tyranny and allows those in authority undue power in determining who's looked after and who isn't.

Re:And if I did this... (1)

BobMcD (601576) | more than 4 years ago | (#32365772)

Selective enforcement is what creates tyranny and allows those in authority undue power in determining who's looked after and who isn't.

Clearly, but then we like a little tyranny, don't we?

Re:And if I did this... (4, Funny)

idontgno (624372) | more than 4 years ago | (#32366440)

We don't care about your sick perverted little secret fetishes.

Oh, "tyranny." Never mind.

Re:And if I did this... (2, Insightful)

BobMcD (601576) | more than 4 years ago | (#32366770)

I lol'ed. :P

Re:And if I did this... (3, Insightful)

KahabutDieDrake (1515139) | more than 4 years ago | (#32366136)

Neither of the cases you cite are actually illegal. This is a key feature of the law, if something isn't codified as illegal, it's NOT ILLEGAL. The context is effectively null, since the example isn't valid.

You say that any completely fair application of the law would make it unworkable. That is the biggest pile of bullshit I've seen on /. in a long long time. Believe me, that's saying something. ONLY a completely fair application of the law works. Our founding fathers knew this. Our ancestors knew this. The fact that you don't know this is frightening beyond reason. You didn't say, but you implied that symantec should have rights and privileges that an ordinary citizen does not. That is the largest perversion of the law that is possible. Companies do not have any trust, they can't be given confidence, because they exist for ONLY one purpose, to make money. You can trust a person, you can't trust a company, and even attempting to do so is foolish (at least) and IMNSHO stupid beyond belief. Our entire foundation of laws is based on the INDIVIDUAL being the top, and everything else coming second. If you know believe that corporations should be on top (they are, but they should not be), well, we've already lost, haven't we?

Re:And if I did this... (3, Interesting)

Monkeedude1212 (1560403) | more than 4 years ago | (#32366762)

You know "IMHO" can sometimes be interpretted as "honest" and not "humble" right?

Re:And if I did this... (2, Funny)

BobMcD (601576) | more than 4 years ago | (#32366894)

Don't let me squash your corporate angst that you're grooving on, but you're entirely off my point, and have gone on to bend it towards one of your own.

Symantec being 'the machine' is completely irrelevant. We still use them as a tool to keep our computers protected (the effectiveness is debatable, but not the use), and so would definitely allow them more leeway than we would an individual that neither harms nor benefits us.

Our founding fathers knew this.

Our founding fathers were, by the strictest application of the law, brazen criminals. Do you think they paid for all that tea before tossing it into the harbor? Do you think they properly rescinded all those treaties broken with the native population? Are you under the assumption that open rebellion was somehow legal? Because if the answer to any of these is 'no' then you ought to be calling for their (historical) prosecution for these crimes.

Don't dilute the point with your anti-establishment crap. Nobody, and I mean nobody, wants every law enforced for every infraction. That just isn't how the system was set up.

Re:And if I did this... (2, Insightful)

mcgrew (92797) | more than 4 years ago | (#32367486)

Selective enforcement is designed into the system

[citation needed] Can you cite a single government document that says this? "Selective enforcement" does in fact exist, but it is almost always used unfairly. It's an excuse to target the poor or minorities and let the rich and powerful off the hook.

Sometimes they have "zero tolerance" policies in place in my city, and they're always in place in the ghetto. This coountry was NOT started with the concept of "selective enforcement" in mind, it was started with the concept that "all men are created equal" and that all people should be treated equally.

If I shoot and kill a rapist I should go to prison for murder. Period. No exceptions. They can't enforce all the laws? Well, maybe they should repeal a few of them.

Re:And if I did this... (2, Insightful)

BobMcD (601576) | more than 4 years ago | (#32367602)

"Selective enforcement" does in fact exist, but it is almost always used unfairly.

Selective enforcement, by definition, is ALWAYS used unfairly. Sort of like how water is wet.

Assumptions (0)

Anonymous Coward | more than 4 years ago | (#32365542)

I like how a post full of nothing but pure assumptions somehow gets modded insightful. Maybe check the facts? How do you know they weren't tipped off to the server? Some other rival hacker might have found it and wanted to spite their competition. My assumption is just as valid as yours.

Re:And if I did this... (0)

Anonymous Coward | more than 4 years ago | (#32365572)

It was probably one of their own Norton 360 servers they found. Who know what kind of information that sends back and forth all the time.

Re:And if I did this... (3, Funny)

InsertWittyNameHere (1438813) | more than 4 years ago | (#32365574)

It was probably one (some) of their client's servers that got hacked and used in the collection of the credentials. The client found out that they got hacked and demanded that Symantec explain what happen. Symantec investigated and found out.

They're not going to say "a server we were protecting with our products got hacked and was used in an operation to steal 44 million credentials..."

Re:And if I did this... (4, Interesting)

TubeSteak (669689) | more than 4 years ago | (#32365628)

OK, so Symantec "recently stumbled upon a server hosting...".

What, was it placed on their doorstep one night, and they didn't notice it when they went outside to get the morning paper?

So, they wrote a crawler that intrusively scanned servers that they didn't have permission to access, opening and analyzing files that they didn't have permission to read, then published what they found?

Symantec and many other companies set up honeypot computers.
The honeypot gets infected, Symantec pulls apart the trojan and studies its web traffic.
This usually leads to the dumpsite where the trojan is uploading the data.

Many botnet/trojan masters don't bother to encrypt their data dumps or secure the server hosting it.
And even if they did, are they going to sue Symantec for unauthorized access?

Re:And if I did this... (2, Insightful)

Demonantis (1340557) | more than 4 years ago | (#32365644)

Sounds more like FUD to get people to buy into Symantec so something like this never happens to your computer. Legitimately though they could have looked at the viruses they were finding and traced them back to the server that was commanding the botnet. I would say the numbers are estimates and no actual cracking occurred as there was no specifics on how they found the data, which would be much more interesting. Everyone has heard tonnes about DDOS already and this is just another boiler plate application of the concept. I wouldn't be surprised if this was just a hypothetical situation dreamed up by Symantec.

Re:And if I did this... (1, Insightful)

Anonymous Coward | more than 4 years ago | (#32365722)

> OK, so Symantec "recently stumbled upon a server hosting...".
> What, was it placed on their doorstep one night, and they didn't notice it when they went outside to get the morning paper?
> So, they wrote a crawler that intrusively scanned servers that they didn't have permission to access, opening and analyzing files that they didn't have permission to read, then published what they found?

Yeah, it's not like Symantec reverse engineered a trojan that was attracting their attention (Trojan.Loginck), analyzed its traffic, did their "mumbo-jumbo" on it and came across a server hosting *all* the accounts (which would mean a mistake by the trojan's creators I assume, hence the "stumbling upon," given that a distributed trojan is pretty much a clever thing), and was startling as it held 44 MILLIYUN accounts.

No.

They must've written a crawler.

We're not paranoid.

Re:And if I did this... (4, Informative)

BForrester (946915) | more than 4 years ago | (#32365808)

RTFA. This is not a case of Symantec hammering through random servers looking for bogeymen.

The very first sentence of the article states that the server was flagged from a new set of sample data submitted to Symantec. This is likely user data aggregated from Norton's threat detection network.

Re:And if I did this... (0)

daten (575013) | more than 4 years ago | (#32365874)

Why is the parent being modded down? The GP is an ignorant troll and this is an informed response.

Re:And if I did this... (2, Interesting)

FrankSchwab (675585) | more than 4 years ago | (#32367042)

OK, so a compromised machine was pointing to the server.

That somehow gives them the right to go rummage through that server uninvited, reading and analyzing what they found and publishing it? Now, I know the vigilante in all of us wants to say "yes", but it's not clear to me that the law permits that kind of activity. And I stand by my statement that, if I did it, I'd end up a very unhappy puppy.

Let's imagine that I find some Symantec product on my machine that I didn't install, and I find a server address in the code. Does that give me the right to go pillage Symantec's machine and publish information about what I'd found?

And did Symantec report this to the authorities? (1)

BcNexus (826974) | more than 4 years ago | (#32366110)

So, did Symantec do what they could to A) report the server and botnet; B) take it down; and C) prosecute the alleged criminals?

Re:And did Symantec report this to the authorities (0)

Anonymous Coward | more than 4 years ago | (#32366268)

So, did Symantec do what they could to A) report the server and botnet; B) take it down; and C) prosecute the alleged criminals?

What gives Symantec the right to prosecute?

Re:And if I did this... (1, Insightful)

Anonymous Coward | more than 4 years ago | (#32366140)

OK, so Symantec "recently stumbled upon a server hosting...".

No.

What, was it placed on their doorstep one night, and they didn't notice it when they went outside to get the morning paper?

No.

So, they wrote a crawler that intrusively scanned servers that they didn't have permission to access, opening and analyzing files that they didn't have permission to read, then published what they found?

No. Looks like they took a shufty through a promiscuous database server that didn't mind them running their fingers through it's long, flowing indexes.

And the penalty if I did that is, what, 5 years in federal PMITA prison?

Was the server asking for it? Or was it wearing a chastity belt?

There is something wrong in this world.

Yeah. It is full of ignorant assburger geeks who start spouting assumptions after skimming the summary instead of RTFA and also full of ignorant assburger moderator geeks who mod the aforementioned hasty assumption-spewing assburger geeks as insightful when they're being anything but.

Maybe the world would be different if there was a "-1, Didn't bother to read the article before commencing outraged rant on the injustice of it all" mod?

Re:And if I did this... (1)

Jeng (926980) | more than 4 years ago | (#32366374)

I thought having a Just Plain Wrong moderation option would be useful, but it would just be abused by trolls. So instead one must actually respond to wrong such as you and others have. It helps foster the community in that we can't just say something is wrong, but we have to say how it is wrong.

Read all about it! Read all about it! (1)

spleen_blender (949762) | more than 4 years ago | (#32365358)

Botnet does things botnets do! Data stolen, data processing distributed, Mayor surprised and outraged! Read all about it, only a nickle!

In other, unrelated news... (1)

Bobfrankly1 (1043848) | more than 4 years ago | (#32365550)

A Symantec blog post reports that the company recently stumbled upon a server hosting the stolen credentials for 44 million game accounts.

Symantec has reportedly bought up all the beer in the area and is planning raids into the deep mines.

Inflated Numbers Are Misleading (2, Interesting)

Maarx (1794262) | more than 4 years ago | (#32365594)

Summary (and article) claims "44 million stolen gaming credentials", which sounds like a lot of us English-speaking and English-game-playing Slashdot readers.

However, in the article, they analyze "a particular sample", with about ~18.3 million accounts in it. Of those ~18.3 million, ~16 million of them were game accounts for "Wayi Entertainment", which is an Asian company. They have no English website, that I can tell, and I think it's a safe assumption there are no English counterpart to these games.

So we're mainly talking about accounts for crazy Asian freemium sprite-based "MMO's". There were only ~210,000 World of Warcraft accounts, most of which, I assume, are also for the Chinese version of the game.

So if you're reading this, I'm going to go out on a limb and say your account is probably safe.

how to make money from stolen gaming credentials (1)

CosaNostra Pizza Inc (1299163) | more than 4 years ago | (#32365756)

For MMORPGs its fairly easy, so I've read. Sell off their items/gold to other players for RL cash

Hold it Right There.... (1)

mpapet (761907) | more than 4 years ago | (#32365880)

The article glosses over the fact that *millions* of accounts are discovered.

That suggests the data is captured in massive quantities at one time. Specifically, 210,000 WoW accounts are hard to come by one-by-one. The computing effort might not be great, but the time to trawl compromised PC's would seem to be. Am I completely off-base with this assumption?

My point being, the bigger problem seems to be blocks of data that must come from the inside of these organizations pretends not to exist. Instead we have 'fun with large data sets' infotainment.

Its not about logging on. It's about selling (1)

fluor2 (242824) | more than 4 years ago | (#32366004)

They would split up the list and sell it as small lists. E.g. you could split it up into lists of 1000 accounts or less, wheras the newest accounts are the most likely to work, thus having the highest price or similar.

Release it (1)

w00tsauce (1482311) | more than 4 years ago | (#32366524)

Just make it into a torrent and post it on the internet. It will all get sorted out eventually.

I smell a RAT (0)

Anonymous Coward | more than 4 years ago | (#32367172)

From TFA:

"So, picture this: you are a bad guy and have created or purchased a botnet"

My first thought when I read this...is that Symantec purchased THIS botnet for advertising, PR purposes. That's right. Is it really out of the ordinary for a criminal enterprise to 'anonymously' approach a security vendor and offer to sell their data (especially if the data maybe isn't worth much anymore"? This would seem pretty valuable to me from a vendor perspective.

"Hey there, what if I told you that you could be the first to 'stumble' upon 44 million stolen credentials and you can release blogs, releases, statements, quotes and all kinds of great things hailing yourself as a security pioneer who won one for the customer...would you be interested in that?"

??? Profit!!! (1)

Angst Badger (8636) | more than 4 years ago | (#32367564)

For the benefit of the non-gamers amongst us, perhaps someone could explain exactly how one goes about converting game accounts into "hard cash".

Load More Comments
Slashdot Login

Need an Account?

Forgot your password?
or Connect with...

Don't worry, we never post anything without your permission.

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>