Hacking Controversy

[Morreion]

There have been a good number of people that seem to have been hacked in Rift; people are speculating about different fansites and downloads being the problem, or possibly an internal problem with Trion. A lot of people think that using your email as a user name game login was a bad move, and logging into the official forums with your game account info give some people worries.

Here are some Rift forum links discussing these issues. Be aware that a lot of speculation is going on right now, including in the following threads.

Thread: HACKED: never thought it would happen to me.
Thread: Another account hacked.
Thread: For those that think the hacked accounts are false
Thread: Has your account been hacked? Read here.
A post about practicing good Internet security
Thread: Dear "IT Professionals" getting hacked
Thread: RiftJunkies Stole my Battle.net account.
Thread: ZAM site and malware?
Thread: Authenticators or die!

An official response:

Update on Hacked Accounts

We are aware that there are still issues with some of you being hacked. This is a top priority for us here at Trion and the team has been working to address the situation. As we posted last week, there have already been a number of updates put in place. We are also introducing another function that should make it into the game early this week.

Coin Lock

Users will be coin locked if they log in from a significantly different location or computer.* When their account is coin locked, they will be sent an email to the address that they have on their account (their login email) with a code to enter into the game.

Users will see the Coin Locked icon in the spot where their tutorial button shows up. Deactivating the tutorial tips will not turn off the Coin Locked button.

While in a Coin Locked status, users will have the following limitations:
• No access to the auction house
• No ability to SEND mail. Users can still receive and view mail as well as remove items from mail
• No ability to SELL to vendors. Users can still purchase items from vendors
• No ability to salvage, runebreak or destroy items
• No ability to trade
• Users can continue to play and gain coin and items, but cannot get rid of them.

If you are Coin Locked, simply click on the Coin Locked icon and enter the code found in your email from Trion.

*You will only have to enter the code once for each computer at a given location. If you play from multiple locations, or on multiple computers, you will have to enter your code the first time you log in from each new location or computer.

If you log in and your account is coin locked, check your email! Someone may have logged in from another location with your account.

If you do not receive the email, please click on the Coin Locked icon and click the “Resend” button to have the email resent to you.

If you cannot access your email or you are otherwise unable to change your Coin Locked status, please contact Customer Service.

We're also working on the addition of two-factor authentication at the login level, which will let you use an app or a cell phone as a way to ensure that you're the one logging on. (You may have heard of this in other products as a SecurID or an Authenticator.) We'll be sharing specifics on that as soon as we can as well.

If you have been hacked:

Contact Customer Support immediately. The CS Team is responding as quickly as possible to restore accounts for those who have been hit.

We assure you this matter is very important to us and we are doing everything we can to resolve your issues and safeguard your account.

Cindy Bowens
Community Lead
Rift

[Regolyth]

I don't think logging in with your email has anything to do with it. I actually prefer places that use my email as my login ID. That way I don't have to worry about my usual username being taken and have to come up with something, which gives me one more thing to try and remember.

The Zam thing worries me a bit though. I've been to that site several times looking up information.

[Morreion]

Rift- Coin Lock Feature Implemented (MMORPG.com)

I hope this does the trick. It sounds like a solid idea.

One thing I'd like to see is gaming companies creating their own official character builders, parsers and add-ons. This would take away third-party security worries, and it would get more people going to their website.

[Morreion]

...and the mystery is solved!

Player identifies "huge security hole" in RIFT's authentication system, Trion seals it (Massively)

...One player, identified as "ManWitDaPlan" on the forums, claims to have circumvented the account login completely, leaving a "huge security hole" for hackers to exploit:

"I have verified the authentication system can be bypassed by successfully logging into another account without needing its credentials. Worse, all it took was about thirty seconds of time once I got all of the details locked down. I did trigger Coin Lock, but I was fully able to access that handy delete-character button, so this exploit is a griefer's dream. I will not post details on how to do this (so don't ask), but I'm positive that I can reproduce this at will and likely on any account on the system."

Later in the thread, a Trion representative added: "We have some things in the works right now and have been passing on your feedback, concerns, and thoughts throughout the day (no matter how radical or unlikely). Sharing sensitive information about our actions (no matter how broad) naturally also informs those carrying out these attacks. This puts us in a tight spot with how much information we can provide, and the questions we can answer."

And it looks as though the problem may be fixed, as ManWitDaPlan posted late last night: "Got word back from Steve Chamberlin, the development lead for Rift. This hole is sealed."

Whoa!

Glad it's been identified and taken care of, mega grats to the person who found it and contacted Trion. I'm a little unsettled that this happened.

[Morreion]

And here's an interview with the guy who found the vulnerability:

Ex-Hacker Finds RIFT Account Flaw, Talks to ZAM

ZAM: Do you feel comfortable with Trion’s response?

ManWitDaPlan: Extremely so. The response was flawlessly executed, and should become a textbook example of how a MMO company should respond to any discovered bug - contact the person that found it, get the details, verify their findings, act to secure the bug. Not only did the Trion crew take the exploit seriously, they took fixing it seriously. I mean, come on, reported discovery to implemented fixes in TWO HOURS? I've never seen anyone in IT respond to bug reports that fast.

[Morreion]

"Solid one-two punch": Trion responds to account hacks (Massively)

Citing "constant attacks" since the launch of RIFT that have impacted 1% of accounts, Hartsman said that the team is blocking hackers and botnets as quickly as they are identified, but that this will also be an ongoing process.

"Both the login fix and the Coin Lock addition have been doing their part in signficantly reducing overall incidents over the last 18 hours," Hartsman wrote. "Neither one is a silver bullet, but so far it is looking to be a solid one-two punch for the weekend."

[Regolyth]

Mar 20, 2011 8:22:35 GMT -5 Morreion said:

ZAM: Do you feel comfortable with Trion’s response?

ManWitDaPlan: Extremely so. The response was flawlessly executed, and should become a textbook example of how a MMO company should respond to any discovered bug - contact the person that found it, get the details, verify their findings, act to secure the bug. Not only did the Trion crew take the exploit seriously, they took fixing it seriously. I mean, come on, reported discovery to implemented fixes in TWO HOURS? I've never seen anyone in IT respond to bug reports that fast.

This makes me respect Trion even more. I really like their manner in how they deal with things, friendliness, and speed.