Blizzard owns up to data haemorrhage - painful but probably not too bad

Filed Under: Cryptography, Data loss, Featured, Law & order, Privacy

Big-time online entertainment outfit Blizzard has just owned up to a data haemorrhage.

One silver lining here (and you know how much I like to find those in any security calamity) is that there doesn't seem to be any weasel-wording going on.

Blizzard president, CEO and co-founder Michael Morhaime himself has taken up his virtual pen to explain that:

Some data was illegally accessed, including a list of email addresses for global Battle.net users, outside of China. For players on North American servers (which generally includes players from North America, Latin America, Australia, New Zealand, and Southeast Asia) the answer to the personal security question, and information relating to Mobile and Dial-In Authenticators were also accessed. Based on what we currently know, this information alone is NOT enough for anyone to gain access to Battle.net accounts.

Blizzard strongly suggests - but manfully doesn't pretend to guarantee - that financial data such as credit cards, billing addresses, and real names weren't got at.

(As you can imagine, the conundrum at the heart of any breach is working out what didn't happen. Breaches invariably lead to a lot of "what ifs", including, "What if the crooks covered their tracks or left a false audit trail?")

A second silver lining is that Blizzard stored and managed its authentication data sensibly.

There are numerous ways to do this; Blizzard chose to use the Secure Remote Password (SRP) protocol, which offers the double whammy of in-transit security (like SSL/TLS or Diffie-Hellman-Merkle) and at-rest security (like hashing-and-salting).

Greatly, if not excessively, simplified, SRP uses public-key-crypto-style calculations so that:

* The client and the server are able to exchange authentication data securely.

* Data packets from an authentication session cannot be reused.

* No hashes or dictionary-attackable data are visible in the client-server exchange.

* The server never needs to write the user's password to disk.

* The server needs a copy of the user's password in memory only once, at password setup time.

In short: sniffing SRP traffic tells you nothing about the user's password, and stealing the server's authentication database doesn't directly reveal any password secrets either.

Nevertheless, since Blizzard's servers hold enough data to verify that you know your password and can type it in correctly at your end, anyone who has a clone of Blizzard's authentication system has what he needs to run a password-guessing attack.

So the usual advice applies:

1. If you chose unwisely, your password could be guessed quickly. Stop choosing unwisely!

2. It's worth changing your Blizzard password right away, even if you did choose wisely.

3. If you've used the same password elsewhere, change that one too, and don't reuse passwords again.

4. If you store authentication data for your users, using solid cryptography to protect it in case it's stolen is good, but not losing it in the first place is even better.

And, even though it doesn't get the data back:

5. If you do suffer a security breach, a sincere apology like Mike Morhaime's goes a long way.


-

Thanks to Naked Security readers Krazymouse and Matt B for the heads-up on this story.

, , , , , , , , ,

You might like

2 Responses to Blizzard owns up to data haemorrhage - painful but probably not too bad

  1. Jay · 714 days ago

    Very peculiar how this attack took place a month prior to launch of Mists of Pandaria. Hmm ..... Also, Blizzard will auto-lock an account if someone tries to access it from a different IP range or even different computer. Authenticator data also won't save the hackers. The only valuable loss would be the answer to the personal security question. Impersonation.

  2. Kat · 714 days ago

    Since people reading this might be choosing new Blizzard passwords, it's worth noting that they are NOT case sensitive. That fact alone has made me uneasy about what else is going on behind the scenes with their security.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

About the author

Paul Ducklin is a passionate security proselytiser. (That's like an evangelist, but more so!) He lives and breathes computer security, and would be happy for you to do so, too. Paul won the inaugural AusCERT Director's Award for Individual Excellence in Computer Security in 2009. Follow him on Twitter: @duckblog