Dota 2 Forum Breach Leaks 2 Million User Accounts (zdnet.com) 34
Reader cloud.pt writes: In another case of serious programmer impairment, the DOTA 2 official forums have been hacked, making available to the perpetrators around 2 million emails, usernames, and MD5 hashed passwords. [...] From the report: The hack was carried out last month on July 10. The copy of the leaked database was provided to breach notification site LeakedSource.com, which allows users to search their usernames and email addresses in a wealth of stolen and hacked data. The hacker took advantage of an SQL injection vulnerability used by the older vBulletin forum software, which powers the community. That allowed them to access the database of limited user data, such as username, email, IP address of the user. The data also includes the user's hashed password -- which uses the MD5 algorithm, which is widely considered insecure by today's standards, alongside the salt, used to scramble the password further. A member of the LeakedSource group told me that 1.54 million of the passwords -- or about 80 percent -- have already been unscrambled using rudimentary and run-of-the-mill cracking tools.
OOPS! (Score:2)
My Bad!
For those who don't know what DOTA stands for: (Score:2)
Re: (Score:2)
Acronyms have dumbed down our culture greatly. It was once Kentucky Fried Chicken and now it's just KFC.
In KFC's case it was more a marketing ploy to hide the word 'fried'. At the time, fried food of any type had a lot of bad press.
Re: (Score:2)
http://dictionary.cambridge.org/dictionary/english/acronym
Re: (Score:3)
All the acronyms on this site, and THAT one you have to Google?
Based on your comment, it appears that you are a gamer, all 3 of your friends are gamers, and you can't imagine that anyone on a News for Nerds site is not also a gamer.
You might want to get out of your mom's basement more often.
Re: (Score:2)
You might want to get out of your mom's basement more often.
I tried that one, but the Day Star burned me!
Re: (Score:2)
Re: (Score:3)
https://en.wikipedia.org/wiki/... [wikipedia.org]
Dota 2 is a free-to-play multiplayer online battle arena (MOBA) video game developed and published by Valve Corporation for Microsoft Windows, OS X, and Linux. The game is the stand-alone sequel to Defense of the Ancients (DotA), which was a mod for Warcraft III: Reign of Chaos and its expansion pack, The Frozen Throne. Dota 2 is played in matches between two teams that consist of five players, who each occupy their own base on the map. Each player controls a powerful charac
Link for mobile users (Score:1)
http://www.zdnet.com/article/dota-2-players-targeted-by-forum-hackers-in-new-breach/
Attention Slashdot staff: The link doesn't show up in Safari on iPhones using iOS 9.3.3 in the default "mobile" mode.
Modern hacking (Score:2)
took advantage of an SQL injection vulnerability
I'm glad to see hackers are having to constantly refine their skills and take advantage of the newest exploits in order to bypass security nowadays.
Seriously, those who run DOTA2 should be shot. There is no excuse whatsoever for this type of hack. Parse your fucking inputs.
Re: (Score:3)
Re: (Score:2)
On top of the fact that it was subject to a SQL injection attack, the passwords were hashed with salted MD5. I feel like I'm reading a story from 10 years ago or something...
Re: (Score:2)
On top of the fact that it was subject to a SQL injection attack, the passwords were hashed with salted MD5. I feel like I'm reading a story from 10 years ago or something...
It doesn't to me. The last time I pointed out salting + hashing is more of a joke than a solution just a few months ago a number of people right here jumped on me. One actually went as far as posting what they claimed was the hash for their own password to prove a "point"... Life lock style.
Some portion of operators today in 2016 think one or more of the following:
1 - 1.2 of 1.54 million people whose passwords were successfully cracked "deserved" what they got for using "weak" passwords.
2 - Selection of h
Re: (Score:2)
Parse your fucking inputs. (Score:2)
" Parse your fucking inputs."
3,2,1... What? nothing happened yet?
So, here I go: use parametrized queries.
Who uses the same userid and password now days? (Score:2)
Blame to the users who use the same account information for multiple systems and forums now days. Users have no real control of the systems they have to log into, but they don't have to be easy targets by using the same passwords and accounts on everything they use. There is no excuse to let yourself be a victim of credential loss because some stupid system admin doesn't fix security issues on their sites.
Re: (Score:2)
Forums with mods / add on are hard to update (Score:2)
Forums with mods / add on are hard to keep up to date
Re: (Score:2)
Re: (Score:2)