Epic & Codemasters forums hacked- Update #9- Bioware hacked, Neverwinter Nights Forum

Bamelin

Update 9:

grouch993 wrote: »

Not sure if this was added, but bioware was hacked.

The email says the information was taken from the neverwinter nights forums, but it was tied to recent account details.

I received an email and my bioware account is tied to mass effect 1 and 2, not either NWN title.

Update 8: CIA website DDOS'ed. also Lulsec released 62000 emails and passwords ... To what we don't know but apparently it's a grab bag of gmail and pay pal accounts and they are encouraging people to go on a sort of twisted treasure hunt ....


Update 7: League of Legends servers now down


Update 6: Minecraft taken out. =( edit: apparently it was a DDOS attack on the Minecraft server and it is back up.

Update5: According to GAF Eve Online login servers hacked and Eve main website is down. Escapist magazine also hacked. From lulzSec twitter:

The Lulz Boat
@EveOnline our boats sunk your inferior spaceships, ujelly?



Edit 4: US Senate hacked

John Bumgarner, of the U.S. Cyber Consequences Unit, said the break-in would cause red faces at the Senate.

“They’re all valid directories,” he said after looking at data posted online. “It’s very embarrassing that this happened that this was a government site that belonged to the Senate and was compromised.”

“They probably also got user names and passwords,” he said

.



Edit 3: Bethesda hacked


Edit 2: Epic Games
PBS
Nintendo
Sony and Sony... and Sony and Sony yet again
Eidos
Citibank
Codemasters
NHS in the UK
FBI affiliated sites
Whitehat Companies
Lockheed Martin
NASA
Northrup Grummon

List of companies that got hacked (grabbed list from GAF, can't validate accuracy although Citibank, Codemasters, Epic and Sony are for sure)

---

Edit: Codemasters forums just got hacked too:
http://games.ign.com/articles/117/1175310p1.html

Dear valued Codemasters customer,

On Friday 3rd June, unauthorised entry was gained to our Codemasters.com website. As soon as the intrusion was detected, we immediately took codemasters.com and associated web services offline in order to prevent any further intrusion.

During the days since the attack we have conducted a thorough investigation in order to ascertain the extent and scope of the breach and have regrettably discovered that the intruder was able to gain access to the following:

Codemasters.com website

Access to the Codemasters corporate website and sub-domains.

DiRT 3 VIP code redemption page

Access to the DiRT 3 VIP code redemption page.

The Codemasters EStore

We believe the following have been compromised: Customer names and addresses, email addresses, telephone numbers, encrypted passwords and order history. Please note that no personal payment information was stored with Codemasters as we use external payment providers, meaning your payment details were not at risk from this intrusion.

Codemasters CodeM database

Members' names, usernames, screen names, email addresses, date of birth, encrypted passwords, newsletter preferences, any biographies entered by users, details of last site activity, IP addresses and Xbox Live Gamertags are all believed to have been compromised.

Whilst we do not have confirmation that any of this data was actually downloaded onto an external device, we have to assume that, as access was gained, all of these details were compromised and/or stolen.

The Codemasters.com website will remain offline for the foreseeable future with all Codemasters.com traffic re-directed to the Codemasters Facebook page instead. A new website will launch later in the year.

Advice

For your security, in the first instance we advise you to change any passwords you have associated with other Codemasters accounts. If you use the same login information for other sites, you should change that information too. Furthermore, be extra cautious of potential scams, via email, phone, or post that ask you for personal or sensitive information. Please note that Codemasters will never ask you for any payment data such as credit card numbers or bank account details, nor will Codemasters ask you for passwords or other personal identifying data. Be aware too of fraudulent emails that may outwardly appear to be from Codemasters with links inviting you to visit websites. The safest way to visit your favourite websites is always by typing in the address manually into the address bar of your browser.

Unfortunately, Codemasters is the latest victim in on-going targeted attacks against numerous game companies. We assure you that we are doing everything within our legal means to track down the perpetrators and take action to the full extent of the law.

We apologise for this incident and regret any inconvenience caused.

We are contacting all customers who may have been affected directly.

Should you have any concerns or wish to speak to a member of our Customer Services team, please email them at custservice@codemasters.com

.

Names, email addresses, phone numbers, dates of birth, passwords, IP addesses and Xbox gamer tags were all taken in an attack staged on June 3

.

---

Epic situation:

Heads up just got this in inbox

Dear Bamelin,

Our Epic Games web sites and forums were recently hacked. *After some downtime, they're back up and running now.

The hackers may have obtained the email addresses and encrypted passwords of forum users. Plaintext passwords weren't revealed, but it's possible that those passwords could be obtained by a brute-force attack on the encrypted passwords. Therefore, we have reset all passwords. *Your new password at the bottom of this message.

The Unreal Developer Network (UDN) hasn't been compromised. *Thankfully, none of our web sites ask for, or store, credit card information or other financial data.

We're sorry for the inconvenience, and appreciate everyone's patience as we wrestle our servers back under control.

Tim Sweeney
Founder, Epic Games Inc

Delta Assault

Guess the PSN was like a Pringles can. Once you pop, you just can't stop.

Bamelin

Delta Assault wrote: »

Guess the PSN was like a Pringles can. Once you pop, you just can't stop.

At least they didn't get CC info this time but yeah ....

RoyceSraphim

FUCKING HELL! Now, I like epic so I can't remember if I've registered with them over the past 10 years or not.

mere_immortal

What is it with idiots hacking game companies recently?

A Horse

Codemasters was hacked too.

Bamelin

Geez. Updated op. I think I have accounts on both sites D=

fragglefart

mere_immortal wrote: »

What is it with idiots hacking game companies recently?

Bamelin

It gets worse. Here's the full list of companies that were hacked according to GAF:

Epic Games
PBS
Nintendo
Sony and Sony... and Sony and Sony yet again
Eidos
Citibank
Codemasters
NHS in the UK
FBI affiliated sites
Whitehat Companies
Lockheed Martin
NASA
Northrup Grummon

Corpekata

Nasa? Oh god. We're all going to die.

Buttcleft

The only thing I know about Codemasters is they host the european lotro servers, which I never used.

but I got an email from them about the hack, and I cant for the life if me figure out why. Should I be freaking out?

edit

Codemasters is hte one doing Jumpgate evolution? I think I signed up to a newsletter or something with them long long ago for Jumpgate,maybe thats why I am getting the letter

Glal

Is there a recently discovered SQL exploit or something that they're all falling victim to?

Jam Warrior

Edit: I R Wrong

Moioink

Jam Warrior wrote: »

Bullcrap. If the NHS had been hacked I'd be hearing it on the UK news, not 'some guy on some forum said'.

http://www.bbc.co.uk/news/technology-13712377

Jam Warrior

Woops! My bad.

The_Scarab

mere_immortal wrote: »

What is it with idiots hacking game companies recently?

They're not idiots. Perhaps morally lacking, even malicious. But not idiots. They are fully aware of the ramifications of what they are doing, and have the capability to do so.

Calling them idiots may bring you a little bit of comfort, but it does nothing to curb their actions. If anything, it makes light of a serious situation, it oversimplifies their actions and stereotypes the perpetrators, and spurs them onward to continue what they're doing.

Saying these people are idiots only makes the situation worse.

101

At least in that instance they chose to warn the NHS about the security issues.

Echo

Glal wrote: »

Is there a recently discovered SQL exploit or something that they're all falling victim to?

Nope. There's not any security there in the first place.

As with most major corporations, any good security policies that get suggested by competent IT guys get shot down when the pointy-haired boss goes "that sounds too expensive. We have a subscription to Norton Antivirus, we're good."

Fiaryn

Bascially the Sony hacks made it apparent how fucking terrible major corporation security can be, and now everyone's hopping on the bandwagon to see how terrible.

Echo

Fiaryn wrote: »

Bascially the Sony hacks made it apparent how fucking terrible major corporation security can be, and now everyone's hopping on the bandwagon to see how terrible.

Pretty much. IT guys say this shit all the time, but it gets handwaved away until there's an actual intrusion, and then the IT guys are doing their best to avoid saying "I told you so" to avoid getting fired when the boss demands an answer to why this could happen.

Why we secretly love LulzSec

So for the last ten years I've been working in media, trying to raise awareness of the idea that maybe, just maybe, using insecure computers to hold your secrets, conduct your commerce and run your infrastructure is a shitty idea.

No one who mattered listened. Executives think it's FUD. They honestly think that if they keep paying their annual AV subscriptions they'll be shielded by Mr. Norton's magic cloak.

Security types like LulzSec because they're proving what a mess we're in. They're pointing at the elephant in the room and saying "LOOK AT THE GIGANTIC FUCKING ELEPHANT IN THE ROOM ZOMG WHY CAN'T YOU SEE IT??? ITS TRUNK IS IN YR COFFEE FFS!!!"

There is no security, there will be no security. The horse has bolted, and it's not going to be the infrastructure that's going to change, it's going to be us.

Johnny Chopsocky

Okay, the security problem is visible and public. Great.

This might actually be the worst case scenario, because now the general public is aware of it. And if they're aware of it, then the politicians are aware of it. And those two groups don't look to the IT guys for solutions, they go into histrionics and lean towards the 'BAN EVERYTHING' option.

I'm really not looking forward to the next election cycle, and if these hacks get any more public and visible then I'm REALLY not looking forward to them.

Delta Assault

I think we all became aware of it when Live Free or Die Hard came out, am I right?

Timothy Olyphant is clearly the mastermind behind LulzSec.

Glal

Ban what, exactly? The interwebs?

The_Scarab

The idea that you can 'ban everything' on an international, decentralized network such as the internet was laughable back in 1997. Today, there is simply nothing the politicians can do that the smarter people out there can combat.

Short of banning internet usage entirely, which is ridiculous considering the UN proclaimed it a basic human right like three days ago.

You needn't worry about this kind of stuff. Everytime that technology has been misunderstood, people have feared a reactionary, primitive response. And it simply never happens. Politicians and governments propose their ideas, then when they get to the eleventh hour and speak to the tech guys who actually have to implement their crazy schemes, they get nothing but 'yeah no you can't do this ever'.

CorriganX

They'll just require every ISP to track everywhere you visit to make sure you're not hacking things. You know. For public safety and what not.

Johnny Chopsocky

Probably ban nothing, really. Just decided that hyperbole would be more fun (even though the American public is pretty damn ban-happy).

But more of the public knows about the evil evil hackers right now than about Net Neutrality. I'd rather it be the opposite, but I guess Net Neutrality is harder to write news segments about.

Echo

And if LulzSec does this loudly and brashly... imagine how much this shit happens without it ever getting reported or even detected by means of industrial and international espionage.

Echo

CorriganX wrote: »

They'll just require every ISP to track everywhere you visit to make sure you're not hacking things. You know. For public safety and what not.

Already on track to happen in Europe for ISPs and cell phone providers. Woo, Data Retention Act.

Shadowfire

Corpekata wrote: »

Nasa? Oh god. We're all going to die.

I'd be less worried about NASA than about Lockheed or Northrup Grumman.

Xenogear_0001

I understand that they're doing it for shits and giggles, but I'm still deeply disturbed by all of this. The way I'm seeing this framed, there is no hope for any sort of real security, like, ever.

Maybe it's because I was under the impression that the major players and world governments had the really secret stuff so far under lock and key that nobody could ever get to it. Damn movies, making me think things that aren't true.

The_Scarab

It's not really a case of making the security overwrought. But maybe storing your customer details in plain text is a dumb idea and probably deserves outing.

Of all the possible reasons for becoming a hacker and hacking, doing it for the lulz is the most benign of them all and the one we absolutely want most.

Cause there are groups out there of hackers who do it for more usual reasons, like money and power or espionage.


Better that Anonymous uncovers security flaws for shits and giggles if we're being honest.

Senshi

mere_immortal wrote: »

What is it with idiot game companies getting hacked recently?

sorry

fixed that for you

the original was so ridiculously uninformed and vapid that I felt I needed to do something about it

Bamelin

Add Bethesda to the list

Hoz

Update #4: Hackers attempting to crack forums.penny-arcade.com were thwarted by a new sophisticated network security system which blocks hacking attempts with,

The server is too busy at the moment. Please try again later.

TetraNitroCubane

Lulzsec wrote:

"Please find enclosed everything we took, excluding one thing — 200,000+ Brink users."

What does that mean, that they took "200,000+ Brink users"? So far as I can tell, you don't need to log into the game, or even give it your email address. It's all streamlined through Steamworks to use your Steam data for your player name and such. What could they have stolen from Brink users?

fragglefart

Hoz wrote: »

Update #4: Hackers attempting to crack forums.penny-arcade.com were thwarted by a new sophisticated network security system which blocks hacking attempts with,

The server is stuffed full of wangs. Please try again later.

L Ron Howard

Looks like the Senate was also hacked.

Bamelin

L Ron Howard wrote: »

Looks like the Senate was also hacked.

Playing with fire ... ?

Fantastication2

TetraNitroCubane wrote: »

Lulzsec wrote:

"Please find enclosed everything we took, excluding one thing — 200,000+ Brink users."

What does that mean, that they took "200,000+ Brink users"? So far as I can tell, you don't need to log into the game, or even give it your email address. It's all streamlined through Steamworks to use your Steam data for your player name and such. What could they have stolen from Brink users?

People who registered for the stats site and emails of those who asked for newsletters to be sent to them. It's certainly not on par with the PSN/SOE hacks for severity.

kildy

Maybe this will force companies who have a web presence to sit down and have a mature discussion about properly tiered infrastructure, and secure code for custom web apps.

Or, you know, we'll do what we always do, patch everything to the latest rev and claim it's fixed.

So far from the hacks that were detailed, they're all using really REALLY idiotic attacks, like people who are still vulnerable to SQL injection: the world's easiest thing to not be fucking vulnerable to you lazy coders.

Usually I never get "it's too expensive" when suggesting security. Usually it's "that interferes with business" when you suggest that an open ssh connection to every system in the datacenter should be replaced by a vpn client.

Shadowfire

kildy wrote: »

Usually I never get "it's too expensive" when suggesting security. Usually it's "that interferes with business" when you suggest that an open ssh connection to every system in the datacenter should be replaced by a vpn client.

To many business managers these are the same thing. Doing things correctly costs more money, but the quick way? Shit, no one will ever know, right?