Ubisoft Hacked, Account Data Compromised 138
Freshly Exhumed writes "There's a new security breach announcement over at the website of game publisher and developer Ubisoft today. Quoting:: 'We recently found that one of our Web sites was exploited to gain unauthorized access to some of our online systems. We instantly took steps to close off this access, to begin a thorough investigation with relevant authorities, internal and external security experts, and to start restoring the integrity of any compromised systems. During this process, we learned that data were illegally accessed from our account database, including user names, email addresses and encrypted passwords. No personal payment information is stored with Ubisoft, meaning your debit/credit card information was safe from this intrusion. As a result, we are recommending you to change your password by clicking this link.'"
Re:"This isn't phishing, really!" (Score:2, Interesting)
Of course leave out the link. Email is plain text, not HTML.
If I get an email from somewhere I have an account, I know how to get to the site.
Re:The point? (Score:4, Interesting)
Plenty of time, as less than an hour after the hack occurred, for ~60% of users.
http://arstechnica.com/security/2013/05/how-crackers-make-minced-meat-out-of-your-passwords/
What Ubisoft Does Best (Score:5, Interesting)
Attempting to log-onto their website, I get the following warning:
For security reasons we recommend that you change your password
and a link to change the password.
Interestingly, there is no option to log-on /without/ changing the password. "Recommend" apparently means "you have no choice" in UbiSpeak.
Unfortunately, since the email address I used to register the account is no longer active, and there is no option to update the email address (since I can't log-on at all) I guess I'm screwed (silly me for not keeping my info up to date on a service I had little interest in joining except that it was forced on me to play a game I had legally purchased).
So, I guess it's par for the course for you guys at Ubisoft; you've screwed me over again. Great job, guys; first you force me to sign up to UPlay in the first place, then you screw up by leaking the log-in info all over the net and now you prevent me from changing my password. Maybe you can block access to the games I paid for as well just to round out the whole experience.
Cookie requirement? C'mon guys. (Score:5, Interesting)
I like how their website tosses up an error saying I "need to enable cookies" even though I do in fact have cookies turned on. Only thing I am blocking is their attempts to track me by including google analytics.. I can use their password change just fine if I use an incognito window (which temporarily disables my plugins).
I suppose the original fault lies with me for creating an account with these goofballs.