Videogame developer defies hacker threat
Runes dude moons forum warning on data leak
Regcast training : Hyper-V 3.0, VM high availability and disaster recovery
The publisher of the Runes of Magic videogame is defying a hacker who has threatened to release personal details and payment information on users.
The threats were made in posts to the Runes of Magic forum, promising dire consequences unless staff at games publisher Frogster were treated more fairly and the security of the site was improved. Augustus87 threatened an escalating campaign, starting with taking Frogster's servers offline before progressing towards the phased released of customer account details held by the German firm.
The post was quickly deleted from the forum, but not before it was captured and preserved for posterity in a blog post by Sophos, and elsewhere.
Augustus87 published personal information on 2,000 users, including billing information, in order to prove he had access to sensitive data and to show he wasn't bluffing. To take such an action while simultaneously claiming to be out to protect customers takes a remarkably "twisted logic", a spokesman for net security firm Sophos told El Reg.
Frogster deleted the data before posting a message saying that the information dated from 2007. It reset the passwords of compromised accounts before running a security review, as a statement by the firm explains.
Right after the publication of the attack, Frogster systematically inspected all of its systems for weak spots and backdoors and implemented new firewalls, new user privileges and passwords, as well as introducing further security measures.Frogster takes protecting its players from these types of risks and threats very seriously and uses all means to contain and prevent them. At the same time, the publisher is pushing on with its continual process of expanding and optimising its technical infrastructure.
The games publisher is keen to emphasise that the vast majority of its subscribers were unaffected by the attack and were able to go on playing the game as normal.
Frogster Chief Operating Officer Dirk Weyel told GameIndustry.biz interview that it had no intention of been coerced into anything by the hacker. Frogster has reported the matter to German police.
It's unclear whether a dedicated (obsessive) gamer or an insider carried out the attack. However, given the unusual list of demands by the hacker - which omits demands for payment - it wouldn't come as too much of a surprise if it turned out that he or she had some past or current affiliation with Frogster. ®
COMMENTS
"20 years in prison should be resonable punishment."
One year for every point of your IQ.
Controlled Payment Numbers
Does this meet your criteria?
"Typically, a controlled payment number has a limit, and an expiration date between two and twelve months from the issue date, both chosen by the account owner, and while it can usually be set up to allow multiple transactions, it can only be used with a single merchant. This 'alias' number is indistinguishable from an ordinary credit card number, and the user's actual credit card number is never revealed to the merchant."
http://en.wikipedia.org/wiki/Controlled_payment_number
I don't have to worry about my billing data being breached, because the most they will get is a card number that only works with the merchant/vendor in question. It also helps to keep merchants on a tight leash, because they cannot sneakily charge more than the limit that I allow.
As a bonus, CPN's act as an indirection layer. I got a new CC account number last year due to a massive data breach at some undisclosed card processor. However, all my recurring billing had been setup via ShopSafe controlled payment numbers. These continued to work, and BoA just updated them to point to my new account number. No fuss.
I understand that having one's name and billing address exposed is very irksome. However, I use indirection for those as well: a PO Box billing address and a Google Voice phone number. With GV, I can route specific callers to spam and/or create a whitelist-only system for callers, sending all others directly to voicemail.
hard to tell who's worse
So Frogster bravely beefing up their security has nothing to do with being blackmailed into improving their security? Maybe they only did it to make it harder to blackmail them into dealing with staff conditions or responding to their pissed off customers.
There are no good guys in this story and as usual the register is very late to the story and too lazy to dig deeper.
IT infrastructure monitoring strategies
Agentless Backup is Not a Myth
Top 10 SIEM implementer’s checklist
Steps to Take Before Choosing a Business Continuity Partner
Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider
