24,000 Nintendo Site Accounts Compromised 36
hypnosec writes "Nintendo has revealed that it has detected illicit logins in nearly 24,000 accounts on one of the main fan sites in Japan 'Club Nintendo' and account details such as real names, addresses, emails and phone numbers may have been accessed. According to Nintendo the mass login attempts have been made using a list of login credentials containing usernames and password obtained from some service other than Nintendo. The company revealed that it detected over 15 million login attempts out of which 23,926 were successful."
24,000 Accounts? (Score:4, Funny)
So... all of them, then?
Zing.
Re: (Score:2)
The article notes that they have 4 million users just in Japan, oddly enough. That's about 3% of Japan's population.
Just guessing? (Score:5, Insightful)
Re: (Score:2, Insightful)
Re:Just guessing? (Score:5, Insightful)
GP meant that they tried several easy passwords on many more than 24,000 accounts. 24,000 / 15,000,000 = .16% success rate... This might be the fraction of accounts using 12345 as a password.
Re: (Score:2)
Re: (Score:2, Interesting)
Re: (Score:2)
How much brute force traffic do you expect before you do something?
Obviously, you did not read TFA. Yes, it creates traffic, but it might not create enough noticeable traffic at first until it became obvious later on.
On further investigation Nintendo found that the attempts started on June 9 and the scattered instances of illicit logins became a problem on July 2.
Re: (Score:2)
I have accounts where the password is something useless like that. Those are on sites where the host forced me to create an account to get a coupon or something similarly idiotic to drive up their subscription rates. I suspect these hackers have a nice long list off accounts for the surname "yourself"
Re: (Score:2)
I have accounts where the password is something useless like that. Those are on sites where the host forced me to create an account to get a coupon or something similarly idiotic to drive up their subscription rates
When you come across these sites you should post your log-in info to http://www.bugmenot.com/ [bugmenot.com]
It's helped me get into sites that I didn't wish to log into and I pay back by posting log-in's myself.
It's become well known and many sites have requested theirs not be listed; but in the long run it works very well.
Re: (Score:2)
Re: (Score:3)
More like they tried 15M attempts at logging in with various username-password combinations, of which 24,000 of them were successful.
Though, given how little information Nintendo asks, one wonders what the whole point is - I don't think Nintendo even asks for an address until they absolutely need it, so if it was an account created but not really used, there's no information at all. Maybe a few coins, but you can't take t
Re: (Score:3)
Standard english grammar has 1.1 bits of information per character (at least in larger text bodies).
Re: (Score:2)
Re: (Score:2)
24,000 out of 15 million? If it really is brute force, why so few?
Re: (Score:2)
because that is exactly the definition of a brute force, using non-impressive means to gain access to accounts by people stupid enough to use easy to guess passwords.
Re: (Score:2)
using non-impressive means to gain access to accounts by people stupid enough to use easy to guess passwords.
So you believe that only 24,000 out of 15,000,000 used "easy to guess passwords?"
Re: (Score:2)
Username or Email? (Score:2)
How is brute force even a viable means of hack? (Score:2)
It should be very obvious how to guess the difference between a human logging in an a bot.
If a user is generating 100k failed password attempts a minute, day, week, month, or even a year, chances are they are a bot.
Also if someone is logging in from various places around the world, chances are its a bot. If the user sets up an account from the US or Canada, but is logging in from China one minute then Russia another, its probably a bot.
Also even if the bot has 1 failed attempt a day using some discretionar
Re: (Score:2)
Except Club Nintendo is NOT tied to anything you already have. It's a separate account and
Re: (Score:1)
Guildwars - I've screwed up and typo'd the damn pw (n)x times in a row w/o hitting their limit. Of course, it's also a registered IP with them so maybe the system would lock things if to many failures from various unrecognized locations.
Linked to Pokémon fansite hack? (Score:2)
A bunch of Pokémon fansites were hacked recently (here's one reasonably detailed report from one of the sites). Although as far as I know no plaintext passwords were stored on any of the servers, there were a bunch of password hash databases taken; and because Pokémon is a Nintendo property, Nintendo's website would be an obvious place to try any username/password pairs that were weak enough to be reversed from the databases (and some plaintext passwords would be available as a result of compromis
Fine, I'll say it (Score:2)
Yahoo hack led to this (Score:1)
As per the parent post they were referencing a list of usernames and passwords sourced 'elsewhere'. Yahoo jp edition lost pretty much everyone's details about six weeks back [wired.co.uk] - this is more than likely the source.
I have a club nintendo jp account (no notice of hacking yet, though I did receive notice from Yahoo above). From memory the user ID for the club nintendo service needed to be an eight digit number rather than a more usual word based UID. That could easily explain the perceived low success rate of