games games games

[SLiD3]

[Tutoh]

[Emanu]

THIS GUY I HATE. ALSO SLIMES.

[garg]

One does not simply log OUT of diablo 3 either.

[ceenda]

Emanu: With this guy (and a later horror) I prepare spells and wait for him to fire first and move out of the way. He seems to wait around for a while before trying again so whack him with ice (poison bolt works well too) and then pound him with spells. After a while he goes for melee. At that point I cheat by running behind a door and doing the open door / close door with spells when the door is half-open.

[ EDIT - oh, and this finally came out in a proper release. ]



http://www.reprisalthegame.com/

[Novacaptain]

ceenda: That little populus clone is dangerous!!

[LiL QoH]

Noodle, I had my account hacked 3 or 4 times last year. I finally said fuck it, made a new bnet account under my blizzard address, and slapped a phone authenticator on it. Basically if you don't have any form of an authenticator on your account, be prepared to get keylogged and hacked constantly :(

I finally hit 60 last night on my DH. I'm still finishing up Act 3 hell mode. Looking forward to inferno!

Add me! Sai#1699

[garg]

^ How did you keep getting keylogged? Do you play on public machines often? phishing and keylogging seem like the most likely ways of getting your account broken into.



Add me. garg#1828

[Novacaptain]

what if the keylogger was in your fingertips all along?

Sometimes i wonder if someone could train a computer to decode my neural impulses into ascii characters. Thats why I sometimes try to think of a different word as i type in my password...but then i get it wrong. :(

[LiL QoH]

Keyloggers are embedded in everything these days it seems :( Nah, just my home computer and work computer. I think I just go to questionable websites a wee bit too much

[garg]

Nova > I'm certain you could.

They already have brain imaging working



And technology exists that allows humans to control prosthetic limbs using their brain waves. Typing using your thoughts probably isn't all that far off (it's probably being tested already!)

They should hook that machine up to a person in a dream state.

[LiL QoH]

So there is a rumor flying around that people can hijack your session if you play public games of D3 and steal your gold/items. I haven't played a single public game and don't plan to because of this. I would suggest choosing who you play with wisely because people can look at your packets this way and possibly get your login information.

[LiL QoH]

http://www.twitch.tv/kungentv

60 Barbarian on HC Hell mode..truly butt clenching

[Novacaptain]

oh, its a livestream kind of thing...i was wondering why it didnt end.

[Tutoh]

OK THIS IS DRIVING ME NUTS

I remember seeing some trailer for a convention or some such that was made like a turn based, xcom-ish game with lovely retro shiney graphics, but I cant find it no matter what I google for. anyone know what im talking about? or was it a dream?

Was it this?

http://www.kickstarter.com/projects/693 ... s?ref=city

[Robin]

been playin super monday night combat a bunch, free to play...its like dota meets tf2? pretty cool overall

[Tutoh]

[Noodle!]

So there is a rumor flying around that people can hijack your session if you play public games of D3 and steal your gold/items. I haven't played a single public game and don't plan to because of this. I would suggest choosing who you play with wisely because people can look at your packets this way and possibly get your login information.

I hadn't played a single public game when mine was hijacked, I did however sell stuff on the auction house, which some people say could also be it. So no using AH or playing pub games I guess?

[Katheryn]

i had heard some stuff recently saying that there wasn't actually a security flaw and it was more likely from people browsing targeted websites, then getting hit with keyloggers. i'm not sure what the deal was though. i've had an authenticator for years so i'm usually not too worried about that stuff (though i have known a friend that got hacked with an authenticator).

has anyone followed the crazy bs happening with 38 studios? i probably wouldn't have known much about it except i have a friend that used to work there and left a couple of months ago when stuff started looking bad. what a mess.

http://www.theverge.com/gaming/2012/5/2 ... -employees

[LiL QoH]

I know a couple people hit by it, the whole thing is a shitty situation for all :( It's getting a lot of negative PR right now simply because of state money that was tied into it and investment made by a celebrity.

[keith]

From all I have seen about D3 and accounts getting messed with it sounds like it is key logging or something similar. I doubt it has anything to do with session ID, it just sounds like something the community came up with cause they are adamant they were secure.

I dont think its necessarily Blizzards fault, It just seems more like Battle.net accounts are very appealing targets because all the games they are linked to are very big. Been trying to get more protective of my accounts lately as I do get a lot of stuff digitally. Things like email accounts just for those game accounts and making sure I have authenticators attached and mobile messaging of account activity.

Just pisses me off people are so greedy. How lame is your life that you absolutely have to have someone elses screen name and game accomplishments.

[garg]

Yeah, I agree. Here is an article describing the authentication system battle.net uses(used) http://www.skullsecurity.org/blog/2012/ ... onceptions

A few things that jump out

a) Passwords are not case-sensitive so you can enter paSSWORD or PAssword and both work. This makes bruteforcing a tiny bit easier (quadrillions of combinations to try vs quintillions?) But it does lock the IP after just 5 wrong passwords so brute forcing isn't really possible.

b) Data transferred after authentication is successful is in plain text (at least 4-5 years ago when the author worked at Blizzard). That could mean that data can be sniffed during transport and possibly allow a session to be hijacked. I'd love to know more details about this. Do they have some sort of way to reliably determine the identity of the machine that is responding? Now that they are dealing with money it's very likely that the entire session is encrypted...

Most likely cause of stolen accounts imo:

a) Key logging. In that case, monitor your outgoing packets because the keylogger might still be on your computer.
b) Stolen passwords. Did you use the same, similarly cased, password on a different website that might have had a security leak?

[geckzilla]

Brute forcing is still possible, you just aren't thinking outside the box. In order to brute force, first you compromise the database (the simplest way to do this is be an employee who works with the servers) and with all this encrypted data you brute force the entire database until you get a hit. The easier passwords will always be guessed first.

Regarding reasons for account theft... it's not that the person wants your account, it's that they want to sell your account, characters, items, etc for real money. If you are smart enough there is a lot of money to be made. Especially if your other option is to work at Foxconn and not even get paid for all the overtime you put in.

[garg]

You're right. You don't even have to be a Blizzard employee. You can even be a cleaning person hired by an independent contractor because they felt sorry for you because you are an immigrant with four starving kids. One day, you could sneak into the vents and and hide there until everyone leaves for the night. Now you just have to take care of the over night security guards and that can easily be done using the supplies from your cleaning cart --- bleach + ammonia. Now activate night vision in your gas mask and make your way to the datacenter where you can spend the entire night running a brute force on the passwords.

[geckzilla]

I definitely didn't mean the janitor... more like the people who keep the servers running, a database admin, or even someone closer to Blizzard. A rogue janitor I suppose isn't out of the question... though, why would he be doing janitorial work if he's smart enough to know his jiggawurtz from his gigahertz?