×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Codemasters' Website Hacked

Soulskill posted more than 2 years ago | from the when-in-rome dept.

Security 76

skybon writes "After similar attacks on Sony and Square Enix, Codemasters' website has now been hacked as well. The intrusion took place on 3 June, and is believed to have compromised members' names, usernames, screen names, email addresses, date of birth, encrypted passwords, newsletter preferences, any biographies entered by users, details of last site activity, IP addresses and Xbox Live Gamertags. In a letter sent out to CodeM subscribers, the company recommended changing passwords as soon as possible."

cancel ×
This is a preview of your comment

No Comment Title Entered

Anonymous Coward 1 minute ago

No Comment Entered

76 comments

Absolutely Brilliant! (-1)

Anonymous Coward | more than 2 years ago | (#36409420)

Absolutely Brilliant!

Epic Forums (1)

Cidolfas (1358603) | more than 2 years ago | (#36409428)

The Epic forums got hit too, with usernames and encrypted passwords. At least, the UDK forums did, and I assume the Gears and other game-specific ones did too. Got the email about that today. At least they encrypted passwords, hopefully with a good salt.

Re:Epic Forums (0)

Anonymous Coward | more than 2 years ago | (#36409450)

*hashed* passwords

Re:Epic Forums (1)

Konsalik (1921874) | more than 2 years ago | (#36409620)

Yes please note the difference between *hashed* and *encrypted* as passwords are usually hashed to obfuscate them.

Re:Epic Forums (2)

DrXym (126579) | more than 2 years ago | (#36409666)

Hashing is not obfuscation. It produces a one way digest of your password, which if properly salted and hashed is very difficult to recover. So a site which uses hashes can't send you a password reminder since it doesn't know what your password is. The danger is if the site doesn't salt properly an attacker can use a reverse hash lookup to figure out what the password is. In addition without salting if 2 or more users use the same password you can tell it instantly by looking for duplicate hashes.

Sites that encrypt passwords can recover them and can send you reminders. The danger with sites that use encryption is the key has to be sitting around somewhere on the login server and / or the database in order to make comparisons. If an attacker can hack the site they can probably recover the key. With the key they have plaintext passwords for everyone, even those who bothered to choose a strong password.

The strongest sites are probably those which hash AND encrypt and take care to put the service that does this on another locked down machine.

Re:Epic Forums (0)

Anonymous Coward | more than 2 years ago | (#36410102)

MD* and the SHA* family of hash functions are designed to run as quickly as possible. This is bad. Salting is now mostly irrelevant because the latest consumer ATI card can calculate 5.5 BILLION MD*/SHA* hashes per second.

Just use bcrypt and stop trying to be clever. You're not as smart as you think. In the future, crank up the work factor to keep up with advances in number crunching technology.

http://codahale.com/how-to-safely-store-a-password/

DDOS (1)

tepples (727027) | more than 2 years ago | (#36410288)

If it takes a cracker 0.3 seconds, as described in the article you cited [codahale.com] , then it also takes the legit server 0.3 seconds to authenticate the user. If a lot of people submit the login form at once, this becomes a denial-of-service attack against the server.

Re:Epic Forums (1)

DrXym (126579) | more than 2 years ago | (#36410292)

I said nothing of the hash algorithm so your point is moot. And bcrypt uses salts too so nothing I said suddenly becomes invalid.

Re:Epic Forums (1)

blueg3 (192743) | more than 2 years ago | (#36410360)

Even at that rate, a random 10-character password is essentially uncrackable.

The standard way of artificially strengthening the hash is to N-round HMAC-SHA1 (or HMAC-MD5, I suppose), where N is chosen so that the computation takes a fair amount of time. This is better for client-side encryption, where you have time to waste per request, and less popular for server-side encryption, where you don't want to consume that much processing power. Still usable server-side, though.

Re:Epic Forums (1)

Khyber (864651) | more than 2 years ago | (#36410594)

"Salting is now mostly irrelevant because the latest consumer ATI card can calculate 5.5 BILLION MD*/SHA* hashes per second."

And that's why you write your own non-standard algorithm that makes GPU busting almost impossible due to modern GPU architecture.

Notice how ATi cards are beating nVidia cards in bitcoin generation. It's almost purely an architectural issue.

Re:Epic Forums (1)

Cidolfas (1358603) | more than 2 years ago | (#36411956)

I wish. They said encrypted, and warned that they could be cracked. Not that there could be a collision, but outright cracked. I have no idea why it's not standard policy EVERYWHERE just to use hashes. I'm just glad they didn't store in plaintext.

Re:Epic Forums (0)

Anonymous Coward | more than 2 years ago | (#36409592)

I came here to say that too. I got a password reset e-mail from them.

I first had to check that the mail itself wasn't a phishing attempt. Somebody could have a great deal of fun, sending out such phishing e-mails at the right moment.

Re:Epic Forums (1)

Seumas (6865) | more than 2 years ago | (#36409850)

This is yet another reason that the whole idea of forcing users to use their real names on Battle.net and Blizzard/Activision forums was a fucking awful one. And yeah, the problem with the passwords is that they point out that the passwords were hashed, but they don't mention whether they were salted. It seems obvious, but many people who bother to hash their password database don't bother to salt that hash.

YOU MEAN CRACKED !! (-1)

Anonymous Coward | more than 2 years ago | (#36409438)

Hacked is not cracked !! Cracked is not hacked !!

Re:YOU MEAN CRACKED !! (0)

Anonymous Coward | more than 2 years ago | (#36409684)

It's just as common to call "tricked" as "hacked," whenever people have obvious passwords or blatantly give them out, the most common thing they say afterwards is "I was hacked!!!"

Re:YOU MEAN CRACKED !! (0)

Anonymous Coward | more than 2 years ago | (#36422876)

The meaning of words can change over time. Words can have multiple definitions too. One can discern the meaning from the context. Get over it you illiterate fuck.

Codemasters' Rootkit? (5, Insightful)

TheVelvetFlamebait (986083) | more than 2 years ago | (#36409464)

Hey, you're not allowed to hack companies who aren't flagrantly, explicitly evil! It's almost like you're hacking companies whose security is weak, rather than acting as moral crusaders. How could that be?

Re:Codemasters' Rootkit? (0)

Anonymous Coward | more than 2 years ago | (#36409482)

Must be for the "lulz".

*rolls eyes*

Re:Codemasters' Rootkit? (0)

Kwpolska (2026252) | more than 2 years ago | (#36409502)

LulzSec is allowed to hack everyone.

Re:Codemasters' Rootkit? (0)

Anonymous Coward | more than 2 years ago | (#36412780)

LulzSec is allowed to hack everyone.

Who allowed that?

Re:Codemasters' Rootkit? (0)

Anonymous Coward | more than 2 years ago | (#36409604)

Two words: VIP Pass.

Re:Codemasters' Rootkit? (1)

RichardJenkins (1362463) | more than 2 years ago | (#36409828)

Storing personal data without appropriate security controls in place is 'evil'. If companies develop an expectation that they *will* be hacked without good security measues then that is a good thing.

Re:Codemasters' Rootkit? (0)

Anonymous Coward | more than 2 years ago | (#36411290)

There are two victimized sets in a hack like this. The 'evil' company, and every poor bastard that ever used the site.

I don't care how evil the company is... I feel bad for the users.

Eheh, Lotro Online Europe (1)

SmallFurryCreature (593017) | more than 2 years ago | (#36410020)

Evil enough for anyone. You don't get two products taken away from you if you don't suck to high heaven (Turbine took both DDO and Lotro back from Codemasters inept handling).

Re:Codemasters' Rootkit? (1)

syousef (465911) | more than 2 years ago | (#36410380)

Hey, you're not allowed to hack companies who aren't flagrantly, explicitly evil! It's almost like you're hacking companies whose security is weak, rather than acting as moral crusaders. How could that be?

No sympathy. Their copy protection bullshit has on more than one occasion caused me more grief than most other company's crap (and I am not a pirate by the way). Hate that my account may have been compromised, especially since I haven't used it in years (quite literally).

Re:Codemasters' Rootkit? (0)

index0 (1868500) | more than 2 years ago | (#36411232)

This hack on Codemasters was days before their new big game came out, Dirt 3. What you may not know about Dirt 3 is the new "online pass" feature used to prevent second hand sales and piracy. What this online pass feature really did was prevent legit purchasers of Dirt 3 from playing online (because PSN was down) and from getting all the single player content (because of the online pass and PSN being down).

This just looks like the world balancing itself out. You know, Karma.

Oh brave new world! (-1)

Anonymous Coward | more than 2 years ago | (#36409476)

Viva la revolucion! This has all been just too funny of late I must say, especially to an IT manager of a global company who also have their collective heads up their asses & view IT as a cost centre & necessary evil. Don't even get me started on how much importance they place on security lol! :)))

#ifndef MASTERS (2, Funny)

waddgodd (34934) | more than 2 years ago | (#36409504)

I'm going to go right ahead and say they ain't codeMASTERS if they got hacked....

Re:#ifndef MASTERS (1)

davidbrit2 (775091) | more than 2 years ago | (#36410070)

In fairness, they never claimed to be php/SQL masters. They're probably referring to being masters at trying to sell you cheat codes to games they make.

Re:#ifndef MASTERS (1)

gl4ss (559668) | more than 2 years ago | (#36410082)

the website was probably ran by some dweebs they found on the street. but the real lessons they should take here are that they should not even ask for things like date of birth - they could just ask for the year for example, and even then store it ONLY if the user wants it to be shown on the forums. it makes it much easier for someone to do something with the hacked data - and they got about zero guarantee about the data being right so it's not much use for codemasters itself...

When eligibility depends on the birthday (1)

tepples (727027) | more than 2 years ago | (#36410352)

the real lessons they should take here are that they should not even ask for things like date of birth - they could just ask for the year for example

Some web sites have legal reasons to require all users to be at least 13, 18, or 21 years old (to use examples of thresholds from U.S. federal law). Say your web site requires all users to be at least 18 years old. If the sign-up form asks for just the Gregorian year, how would the site distinguish an 18-year-old, whose birthday is before today, from a 17-year-old, whose birthday is after today?

Re:#ifndef MASTERS (0)

Anonymous Coward | more than 2 years ago | (#36414302)

Absolutely brilliant!

Too Much Information (-1)

Anonymous Coward | more than 2 years ago | (#36409512)

I have a flamebait theory for you: these kinds of hacks are a GOOD thing. Here's why:

In an increasingly connected world, as "consumers" of various services and products from various companies, we're subjected to literally INSANE amounts of information gathering exercises. Every company you buy things from has information about you (which is usually part of them providing services, or to further communicate with you regarding new service/product offerings, etc.). What we're finding is that there's billions of dollars to be made by mining this data for information on "consumer behavior", under the theory that better understanding that behavior will lead to advertising and marketing tactics that are more cost effective (more eyeballs out of a given set buy something).

The problem with this: when that information gets spread among various "entities" (government, credit and finance industry, software companies, facebook, etc.), it becomes a bit too personal, and frankly, dangerous. You don't need to know about my prostate health, what medicine I just bought at Wal-Mart, my last three residences over the past 5 years, AND my friends list on facebook. That's just fucking scary.

My hope is that the crazy amounts of hacks going on with these companies (Sony, Codemasters) make people wake the fuck up and DEMAND the cessation of information gathering and sharing. If these companies didn't have this information, neither the hack, nor any repercussions from it, would have and/or could take place.

It's only a matter of time until one of the "Big 3" credit bureaus gets hacked in a big way (assuming they haven't been already), along with various aggregators of medical data, insurance claims databases, etc. But the fact remains: if they didn't store such personal information, it wouldn't be a worthwhile target, and even if it was, the "thief" wouldn't get anything out of it.

Anonymous, are you listening? Your next target needs to be the "Big 3" credit bureaus in the United States: Equifax, Experian, TransUnion. Maybe that'll wake John Q Public up enough to demand some fucking privacy controls.

Re:Too Much Information (3, Insightful)

Anonymous Coward | more than 2 years ago | (#36409568)

Interesting thought, but this is the same public that now accepts getting groped at TSA checkpoints by 300lb, $14/hr rentacops because somebody could be a terrorist. If Anonymous or somebody else were to break into the credit bureaus or some other high-value target - I fully expect there may be a couple of nominal changes, but the anger will be focused squarely on the "terrorists" who are trying to undermine our country's economy.

Re:Too Much Information (0)

Anonymous Coward | more than 2 years ago | (#36410064)

The "Big 3" have enough connections not to have to worry. Even if they get hacked, they'll just instruct everybody to direct blame to Anonymous or some other scapegoat. Then they'll have 3-letter agencies publish press releases for them and politicians will pass a few new laws to increase penalties.

Nothing else would change, neither security, amount of data collected or the mindset of consumers.

Re:Too Much Information (1)

hairyfeet (841228) | more than 2 years ago | (#36410546)

I don't know about that, can you imagine if they went in and reset everyone's credit score to be "over 9000!" LOL? Even if they managed to set it back the next day just the sheer amount of chaos they could cause, especially if the group broadcast it all over the net right after (Hey got bad credit? Have fun LOL!) the amount of total pandemonium caused by everyone having wonderful credit might actually make those in power question letting everything be tied into an imaginary number held by three self appointed companies.

3rd of June? (0)

Psychotria (953670) | more than 2 years ago | (#36409554)

That was 8 days ago! I am so glad they reported this so promptly.

Re:3rd of June? (0)

Anonymous Coward | more than 2 years ago | (#36411442)

That was 8 days ago! I am so glad they reported this so promptly.

I got my notice on june 6th. Pretty quick I would say. Not that it makes me happy they have lackluster security, but at least (so far) they haven't been trying to hide the hack and the customers were notified in relatively immediate fashion. 3 days is to me a decent amount of time. Enough to figure out what happened, what was lost and who was affected and notify them.

Now the epic games email was a bit more disheartening because it said something like - "Hey we too have been hacked and the site was down but now it's back and you may have had some personal info stolen" No real insight into how long ago this occurred and how long my info may have been floating around in the wild so I'd like more from them as to timing of the hack and notification.

Epic Games too (1)

grim-one (1312413) | more than 2 years ago | (#36409652)

Got a couple of emails from them:

Our Epic Games web sites and forums were recently hacked. After some downtime, they're back up and running now.

The hackers may have obtained the email addresses and encrypted passwords of forum users. Plaintext passwords weren't revealed, but it's possible that those passwords could be obtained by a brute-force attack on the encrypted passwords. Therefore, we have reset all passwords. Your new password at the bottom of this message.

The Unreal Developer Network (UDN) hasn't been compromised. Thankfully, none of our web sites ask for, or store, credit card information or other financial data.

We're sorry for the inconvenience, and appreciate everyone's patience as we wrestle our servers back under control.

Tim Sweeney
Founder, Epic Games Inc

Re:Epic Games too (1)

maxwell demon (590494) | more than 2 years ago | (#36409688)

The mail omitted a crucial advise:
"Please log in and change your password to a new value as soon as possible."
Since the reset password was transmitted unencrypted over email, it should not be treated as secure.

Not encrypted anymore. (0)

Anonymous Coward | more than 2 years ago | (#36409656)

Seeing as a single ATI 6990 can crack a salt with 30length at 3.8billion tries per second.

Re:Not encrypted anymore. (1)

_Shad0w_ (127912) | more than 2 years ago | (#36410214)

Encrypted, not hashed. Assuming they actually do mean encrypted. You'd still have to worry about whether they compromised the key as well, unless they're using something like a PrivateServer HSM - although I suspect that might be considered over kill for a games website.

Valve/Steam (3, Informative)

atomicbutterfly (1979388) | more than 2 years ago | (#36409718)

If Valve's servers get hacked with disastrous consequences (Steam accounts get deleted/hacked/etc, credit card details, other personal info), all hell will break loose. There will also be much smugness from those who don't use Steam for this very reason.

Re:Valve/Steam (2)

Richard_at_work (517087) | more than 2 years ago | (#36409780)

The fact that they haven't, while smaller targets have fallen already, might be telling...

Re:Valve/Steam (0)

Anonymous Coward | more than 2 years ago | (#36409926)

And when your house burns down and you lose all your stuff I'll be there being pretty smug knowing my gaming collection is safe from such a fate... wait, no, I'd probably ask if you needed some help, because that's what decent people do.

Then I'd go home and play GTA.

You can have your system that your comfortable with, Grandpa, sir. I'll go with shiny new world and ride through the hiccups along the way, should they actually occur (note: I'm not saying I'm bleeding edge, but Steam is hardly unproven/new technology)

Re:Valve/Steam (1)

gl4ss (559668) | more than 2 years ago | (#36410088)

steam accounts get hacked all the time, but usually through the users computers.. also cs keycodes were rampantly generated and hacked and traded, but the success of counter strike really made steam a target as soon as it started.

Re:Valve/Steam (1)

FutureDomain (1073116) | more than 2 years ago | (#36411476)

steam accounts get hacked all the time, but usually through the users computers.

Valve has actually been pretty proactive on this front. They recently released their SteamGuard system which authenticates logins from new computers via email. It doesn't help if the user uses one password for both his email and Steam, but it's pretty good against most password thefts.

Re:Valve/Steam (1)

Nemyst (1383049) | more than 2 years ago | (#36410784)

Steam and Google are the two sole online businesses that I know of (bar, say, banks) that have more than a simple username/password identification. The former forces you to authenticate every PC you use it on, which can only be done through your email. The latter uses 2-factor authentication through smartphones.

I think Steam is fairly safe. You'd have to be able to get the passwords (which are very likely salted and hashed) and could only attack those people who reuse the same password for both their Steam account and their email.

Re:Valve/Steam (0)

Anonymous Coward | more than 2 years ago | (#36411566)

World of Warcraft and Rift both support authenticators as well. I think this will become much more common as time passes.

Re:Valve/Steam (0)

Anonymous Coward | more than 2 years ago | (#36412362)

So does Square Enix. Which is why they haven't been hacked.

After similar attacks on Sony and Square Enix...

Oh. Oops. Never mind, then. I guess Square Enix must have gotten theirs from RSA...

Re:Valve/Steam (1)

Beelzebud (1361137) | more than 2 years ago | (#36411130)

Valve's server DID get hacked back before the release of Half Life 2, which resulted in the source code for their Source engine, and an unfinished build of Half Life 2 getting leaked. I have a feeling they learned their lesson after that. They definitely have the money to do security correctly, if they wish.

Re:Valve/Steam (0)

Anonymous Coward | more than 2 years ago | (#36422892)

That is a colorful, but inaccurate description of the HL2 code leak. The way I heard it, the source code was leaked, by an internal staff member, and no personal or other user data was ever compromised what so ever. Nor, was Valve's system ever compromised beyond their internal pool of employees. That's a far cry from their "server" being hacked.

As an aside, what the fuck do you think "server" means? Can you define your usage of that word in a way that makes sense given the subject matter? Because Valve has a lot of servers. Like, several thousand square feet worth, in several major cities, in several major countries. One imagines there is a rather large gulf between the ones used to support STEAM and the ones used for in house development of new products. The former being where any useful personal information is, the latter being where new games exist.

Codemasters had it coming! (-1)

Anonymous Coward | more than 2 years ago | (#36409834)

IMHO this has been coming since codemasters decided to opt-out of dedicated PC servers for Operation Flashpoint: Dragon rising. Way to kill what could have been a great PC multiplayer game codemasters :p

However this crack, highlights several problems in our society today.

1) We are too comfortable trusting companies with our private information and trusting them to secure it (all credit card information stored everywhere is encrypted right? right???)
2) We are too comfortable using outdated and terribly insecure credit cards to authorize transactions
3) credit card companies get off scott free allowing illegal transactions, we are in a world where micro-second transactions can take place on the stock exchange but visa/mastercard/american express/etc can't cancel an illegal transaction?
4) It should be illegal for companies to store private information without conforming to some form of regulation such as encrypting ALL private information instead of simply "hashing" credit card numbers.

I'm sure there's more...

Re:Codemasters had it coming! (1)

XionOfChaos (1506163) | more than 2 years ago | (#36409874)

This is one of the reasons why I will not get a credit card!

Re:Codemasters had it coming! (1)

Ihmhi (1206036) | more than 2 years ago | (#36410126)

Actually, compared to a debit card a credit card is pretty safe. Debit cards are easier to get but you lack many of the protections (like chargeback) that credit cards offer.

Be careful all in all - not having a credit card might actually bite you in the ass if you ever decide to buy a home or get some type of loan. No credit is practically worse than bad credit.

Re:Codemasters had it coming! (1)

XionOfChaos (1506163) | more than 2 years ago | (#36410172)

Have had no problems getting loans without a credit card. Of course you can't buy anything online without one.

Re:Codemasters had it coming! (1)

sourcerror (1718066) | more than 2 years ago | (#36410370)

I had no problems buying stuff online with debit card. (from Amazon; for noname shops there's Paypal; I wouldn't trust them with my CVV)

Re:Codemasters had it coming! (1)

_Shad0w_ (127912) | more than 2 years ago | (#36410218)

It's the reason I use a virtual credit card with one-time numbers online. I only use my real credit card at a limited number of places.

What's the point in hacking? (1)

Scissorsman (2256102) | more than 2 years ago | (#36410374)

Why is there so many hacking lately? I really don't understand people's motive to hack some servers, websites. Ok one could be money (credit card info, mail databases to sell, etc.) and maybe the other challenge for someone. But hacking is never harmeless.

Re:What's the point in hacking? (1)

Anonymous Coward | more than 2 years ago | (#36410792)

The answer is surprisingly simple.

Hackers have very tiny penises.

Re:What's the point in hacking? (0)

Anonymous Coward | more than 2 years ago | (#36411062)

Recognition, attention seeking, boredom.

There's blood in the water. (0)

Anonymous Coward | more than 2 years ago | (#36410716)

Game companys are clueless about security, and the feeding frenzy is just starting.

This shoud get all of us very worried... (1)

mihamicka (2135636) | more than 2 years ago | (#36412892)

At least news like this gets me very worried... why? cos all this announcements ware not made by the companies who got their servers hacked... but ware made by the hackers who did that... i wonder how many hackings are done without anyone knowing ... without anyone making those attacks public... and in theory security engineers learn from things like that.... is called Forensics right? hmmm and some ppl say " There is not such thing as ethical hacking..".... why not? i know from experience that you need a thief to catch a thief.... and another things that gets me worried is the fact that many security engineers say " hackers have small penises" and things like that... but they should see them as enemies and and do not underestimate them... some of them are kids who do this to have fun... some of them do hacking shit cos they are payed to do so... and all this attacks who took place lately... all this has on propose : to take somebody else identity.... why? that is the big answer...
Check for New Comments
Slashdot Account

Need an Account?

Forgot your password?

Don't worry, we never post anything without your permission.

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>
Sign up for Slashdot Newsletters
Create a Slashdot Account

Loading...