Forgot your password?
typodupeerror
Security Role Playing (Games)

EVE Online Endures Downtime Due to Breached Security 69

Posted by Zonk
from the we-have-a-code-mauve dept.
Gamasutra is reporting that a serious security breach caused the closure of EVE Online this past weekend. A previously-unnoticed anomaly in a database prompted CCP, makers of the game, to close down the game world and their website while the issue was examined. The flaw was rectified, and service restored the same day. No credit card or billing information was exposed in the breach. "Explained [CCP chief of operations Jón Hörðdal], 'What we discovered was an indication that one of our databases was being accessed through a security breach. Our policy in such cases is to mobilize a taskforce of internal and external experts to evaluate the situation.' Hörðdal said that the taskforce concluded that going completely dark so that an exhaustive scan could be performed was the best course of action. 'While some may feel that such a drastic reaction was not warranted, it is always our approach to err on the side of caution in order to protect the players,' he said."
This discussion has been archived. No new comments can be posted.

EVE Online Endures Downtime Due to Breached Security

Comments Filter:
  • by Silverlancer (786390) on Monday October 22, 2007 @02:29PM (#21075009)
    The most amusing thing about this story wasn't the story itself, but the rumors. Because the main forums run off the same database server as the game (a WTF in itself!), the developers were unable to post any information except through unofficial chat/IRC/etc, resulting in a number of rumors being spread. The most popular rumor was that a rollback would be necessary due to some sort of cheating, with the numbers flying around going up to that of a 6 week rollback. Of course, this made players go nuts, and probably gave a good laugh to those who made up the rumors. Most of all, it shows how important communication with customers is.
    • by Paeva (1176857)
      I don't know what their setup is exactly, but it seems that they might have benefited from some degree of separation between their Web servers and their game servers. The fact that they chose to take both down simultaneously recommends that they are intertwined, which probably is easier to implement (considering elements of the website that access game data) and faster, but while the game may go down from time to time, as it will always be a work in progress and also always a target, you never should almos
      • by LocoMan (744414)
        Maybe it works like on world of warcraft, that you use the same login and passwords to enter both the game and the forums, so if the breach of security comes to the login and passwords of costumers, it could happen on either end so it would be safer to take them both down just in case.

        Just guessing, though.
        • Re: (Score:3, Informative)

          by Andy Dodd (701)
          This is correct. EVE's forum logins are tightly tied to your account and characters.

          It has always been that only players with active accounts could post on the forums, and in addition on some forums players are forbidden from posting unless they have chosen to make certain information (such as their corporation and alliance affiliation) public.
          • Re: (Score:3, Insightful)

            by illumin8 (148082)

            This is correct. EVE's forum logins are tightly tied to your account and characters.

            It has always been that only players with active accounts could post on the forums, and in addition on some forums players are forbidden from posting unless they have chosen to make certain information (such as their corporation and alliance affiliation) public.

            Alright, Single Sign On (SSO) is a good thing usually. But haven't they ever heard of LDAP before? Why have username/passwords in the database, especially if they s

      • I believe the forums tie into the character database, which is part of the cluster.
    • by anthonyclark (17109) on Monday October 22, 2007 @02:59PM (#21075445)
      The EVE devs remind me of many open source dev groups; really great coders, fun guys but terrible at the subtleties of customer service.

      Yes, the fact that their forums and web servers all point at the same database as the game itself is astonishing. They've certainly made some weird design decisions through the years, although we're certainly not aware of all the factors that influence those decisions. Why on earth they didn't have a static web server page up within seconds of the downtime is really quite sad.

      I was on the irc channels and watched the rumours fly around, it was all the work of a bunch of /b/ style folks who enjoyed trolling and watching the rollback rumours fly. Why anyone fell for it is beyond me to explain. (apart from "folks are dumb")

      But the amazing accomplishments of the eve team shouldn't go unnoticed. A single game world means that people actually gain fame across the entire game, not just their little sharded server. Being able to sell some guy a battleship that then gets used in a pivotal battle involving 100s or 1000s of players is just jaw droppingly cool, in my opinion. The player driven economy, complete with scams, piracy, corporate wars and all, have kept me enthralled and entertained. (zealot mode, deactivated)
      • really great coders...their forums and web servers all point at the same database as the game itself
        Just thought I'd point out your contradiction. web servers are notoriously easy to hack, so giving access to the game database to the web servers is a decision that they shouldn't have made.
      • by rrhal (88665)
        The right SQL injection attack and the Game RDMS is all yours. But I'm sure that they have an Iron clad website and nothing like that could ever happen.

    • by Brownstar (139242)
      Actually tying the Webserver to part of the game servers (particularilly authentication servers) is quite common, because to log in and post on the webserver, you need to be authenticated.

      • by daeg (828071)
        And the proper way to do this is to isolate only the information needed for the web (forum) servers to work. Replicate one way, and only replicate the precise columns and tables you need, running a database on an isolated system. You could even implement a private miniature API to do remote authentication so you don't have to store password (properly hashed and salted, of course) data twice.
        • by Brownstar (139242)
          Nope, replicating the data is bad, when you deal with the number of transactions that they deal with in the amount of time that they deal with them.

          There's a reason DB modelers normalize data to store it in only 1 place. And replicating it (Even if it can only be changed in 1 place) in a transactional system partially defeats that purpose.

          Plus while you might think rumor control when the Forums is down is bad, the rumors floating around on the forum, while the game is down will be worse. And I'm sure they h
          • by beavis88 (25983)
            I can't think of any way to say it politely, so I'll just put it out there - I think you're patently insane if this post isn't a troll.
    • by Knara (9377)

      I don't know for sure, but it's entirely possible that they took down the forums at a precaution, and that while they may hit the same authentication servers for logging in and account maintenance over the web, that the game servers are entirely separate. I know for a fact (I was on them at the time) that the forums came back up a lot sooner than the game itself did.

      • by AugstWest (79042)
        Restarting IIS is a hell of a lot faster than starting up the game itself.

        Running IIS against the same database that Eve itself runs on quite frankly scares the crap out of me.
    • Glad to see one interesting modded comment on this story, I haven't seen this many trolls since the battle of the Pelennor Fields!
  • A lot of issues (Score:3, Interesting)

    by king-manic (409855) on Monday October 22, 2007 @02:37PM (#21075105)
    I know a few Eve players but I didn't get on board myself. With all the notable controversies I find it astonishing it's still in business. I suppose if the game play is addictive in the flavor that is right for you, you'll put up with a lot.
    • Re: (Score:3, Insightful)

      by CogDissident (951207)
      A lot of people play it because its the only truely "massive" online game. WoW only has 1,000 people per server, most other games have less than 3,000 online at a time, EVE has gotten 50,000 or more people online on the same game simultaniously (with 20-30k being regular)
      • Nice math... 9 million (and change) subscribers to WoW and about 222 servers listed on Blizzard's status page. Where do you get 1,000 people per server?
        • I'm guessing he means 1000 online at a time... I know a queue forms at some point, but I don't know if that's the right number. I've also heard that, while many people can be online at a time on EVE, large battles (100-1000s) can cause unplayable lag.
          • by Knara (9377)

            Yeah, CCP really needs to work on the fleet-battle performance for the game, particularly as they encourage PvP so much. Day-to-day combat is fine, though (say a few ships vs a few ships, strike forces, etc). PvE with player vs a large number of ships runs pretty smooth.

        • by Knara (9377)

          It's one thing to have that many subscribers. It's another thing entirely when considering the number of players simultaneously on a given server. With Blizzard encouraging casual play, it's possible for people to play 1-2 days a week for a few hours at a time (and even then you encounter queues to login on "full" servers). I dunno what the official stats are, but between 1000 and 3000 to a server at any given time seems standard for most large MMOs.

          In any event, I seem to recall that EVE peaks around 30

      • by brkello (642429)
        Except that really isn't accurate. As soon as a few hundred people get in the same section of the galaxy the servers are unable to handle it. So, it's great that it can have 50k on a shard, but they would be better off having more servers and less people on each so the game would be more playable.

        It's real draw is that it is a space MMO. It has a more difficult learning curve than other MMOs. It has somewhat harsh consequences. It is basically a playground for people who enjoy griefing. The single pl
        • by Knara (9377)

          Except that really isn't accurate. As soon as a few hundred people get in the same section of the galaxy the servers are unable to handle it. So, it's great that it can have 50k on a shard, but they would be better off having more servers and less people on each so the game would be more playable.

          Not *exactly* true. Jita and the other hub systems regularly have hundreds of people in them, without counting the adjoining systems, and it runs fine (though with "traffic advisories" sometimes).

          Now, get a few hundred people onscreen from eachother at the same time, that's where EVE falls down (ala fleet engagements). Hopefully that'll get fixed up eventually. It's worth noting that many people will never be in that situation, thought, since they're not part of a huge corp/alliance in 0.0, etc.

          • by XiticiX (712612)
            That's because Jita has an entire node dedicated JUST to it. Even then, it still lags to hell. Other systems share nodes, so when you get 400+ players in the system, it's unplayable.
        • Re: (Score:3, Insightful)

          by vux984 (928602)
          So yes, it appeals to the elitist prick portion of the population. Or people who wish they made Excel in to a game.

          Aw shucks. I knew there was a reason I liked it. I'm both. Not.

          That said, I did like it, but after my trial elected not to play for 2 reasons:

          1) The dev scandal was just unfolding, and I was utterly appalled with it. Not only that they handled it so poorly, but the revelations that they allowed devs to participate at that level at all, nevermind the cheating. GM abusing mechanics is bad in a Pv
        • So yes, it appeals to the elitist prick portion of the population. Or people who wish they made Excel in to a game. So what you are saying in other words is that you tried Eve Online, failed miserably at it and went back to WoW like a pussy with your tail between your legs, calling all Eve Online players griefers because they kicked your ass.
      • Re: (Score:3, Informative)

        by CanSpice (300894)
        Eve has never had anywhere near 50,000 online at the same time. The record is 35,965 simultaneous logins.
    • by Knara (9377)

      Well, to be frank, this may very well be one of those cases where the problems seem to be larger than they are, due to the volume level of those posting the news about them.

      Disclosure: My char has been alive on EVE since 2005.

      Anyway, there was the BoB/devhax thing, which while obviously a serious problem, also only *really* effected a portion of the game that was directly involved in with BoB in some fashion. There's a *lot* of the game that wasn't really materially involved in that particular muckup.

      Si

    • I've played plenty of games that were much less fun with much more controversy. Not for as long though. :)

      This particular one is not a big deal. Someone figured out a way to hack the database to get items. The safeguards to notice if something happened worked, they took down the game a little while, and they fixed it. Compare to games that leave major economic loopholes bascially forever. There's really only one big (and very important) black mark against CCP, and that's that employee cheating scandal and t
    • It's immersive and beautiful and sci-fi in a way that no mmo to date has been. It's riddled with problems, but at the core they have a very good game, and in the end that's what wins out.
    • I know a few Eve players but I didn't get on board myself. With all the notable controversies I find it astonishing it's still in business. I suppose if the game play is addictive in the flavor that is right for you, you'll put up with a lot.

      Oddly enough, I just canceled my account yesterday. Reading that made me think "What button did I press?"

      EVE has a great premise and a lot of good work went into putting the whole thing together. The problem, of course, is that it's a MMO and it takes way too much effort to get anywhere serious in the game. You'd have to devote yourself to it like an athlete training for an event. When I compare progress in EVE with progress made in a single player version of a similar genre game, there just really isn't a

      • by Knara (9377)

        Definitely true, EVE is a huge time sink. I never really minded the mining, to be honest, but it's definitely hard to feel accomplished in the game when playing only an hour here or there.

        • Definitely true, EVE is a huge time sink. I never really minded the mining, to be honest, but it's definitely hard to feel accomplished in the game when playing only an hour here or there.

          I had a huge time crunch where I wasn't able to play for a few months. I trained my character up to be a killer miner during that time. But ultimately, I didn't have the time to go back and do anything with that. And PVP? Ugh. I never managed to kill anyone there, was just bug-splatted when trying to rat and earn some isk. The loot tables were all screwed up so the rats never dropped anything good.

          I have a 360 now and am playing Oblivion. Man, now I know what people were talking about when that bastard cam

          • I liked oblivion a lot. it's a lot better with some of the user mods applied to it (PC only). Like the high res textures pack, the anti-checkering mod, the none auto-leveling enemies mod, beautiful people mod etc.. I definitely prefer the PC version.
            • I liked oblivion a lot. it's a lot better with some of the user mods applied to it (PC only). Like the high res textures pack, the anti-checkering mod, the none auto-leveling enemies mod, beautiful people mod etc.. I definitely prefer the PC version.

              It all sounds cool. I just don't have the scratch to keep up with the PC gaming. I'll let a few years worth of games build up as a backlog, buy a modest and reasonable system that will r0xx0r the s0xx0r of these older titles and enjoy from there. ;)

      • This is one of the flaws in Eve. It's a PVP game with some PVE grafted onto it. If all you do is missions, it's going to be boring. If you really want to enjoy the game, you need to start working in the player driven areas of the game. Commerce or combat. I played the game for almost 3 years, and spent a lot of that time in the thick of alliance dynamics. The political aspect of Eve never got boring.
        • This is one of the flaws in Eve. It's a PVP game with some PVE grafted onto it. If all you do is missions, it's going to be boring. If you really want to enjoy the game, you need to start working in the player driven areas of the game. Commerce or combat. I played the game for almost 3 years, and spent a lot of that time in the thick of alliance dynamics. The political aspect of Eve never got boring.

          I understand what you're saying but it just got too time-consuming. I understand that cooperation with corpmates is what makes the distinction between this game and single-player anything. The problem is that coordinating schedules became quite difficult to do things like a mining op. And because there's such a huge skill and capability imbalance between n00bish characters and veterans, going lowsec was just too risky to be worth it. PVP in EVE is like playing Starcraft against nothing but Korean kids, spa

          • by CanSpice (300894)

            The problem is that coordinating schedules became quite difficult to do things like a mining op.

            You need to find a different (or larger) corporation then. Given there's rarely fewer than 15000 people online at any one time, there are people online from around the world 23/7. You need to find a corporation that's more active during your playtime.

            And because there's such a huge skill and capability imbalance between n00bish characters and veterans, going lowsec was just too risky to be worth it. PVP in EVE is

  • by Anonymous Coward
    CCP will quietly admit that there was some data theft.

Wernher von Braun settled for a V-2 when he coulda had a V-8.

Working...