Page 1 of 3

IMPORTANT ANNOUNCEMENT: BREACH OF SECURITY

Posted: 08 Oct 2018 10:20
by Nuko
IMPORTANT ANNOUNCEMENT: BREACH

Dear Players,

It has come to our attention that we have recently had a breach of our server's security. We believe that we have now got the situation under control and are continuing to search for any undetected vulnerabilities.

We know that e-mail addresses and password hashes were accessed and it is possible that they may have been leaked.

Password hashes are not plain-text passwords but are essentially encrypted by an algorithm that can only go one way and are thus meant to be unreadable on first glance. However, it is still possible that some of them may have been or could be brute-forced to reveal the original plain-text password, possibly even all of them.

We suggest you take no chances and therefore:
.
CHANGE YOUR PASSWORDS EVERYWHERE WHERE THEY ARE THE SAME AS HERE

.

This includes your personal and non-TrueWoW accounts. E-mail, Facebook, etc.

We offer our most sincere apologies to you, our players, for this lapse in our security. You trust us to keep your information safe, and we try our best to do so, but it appears that was not enough this time. The original hole was quickly locked-down after coming to our attention and we've taken additional measures to beef-up our security all-round. We have spent a few days double checking our code and permissions to make sure there is no remnant backdoor open before making this announcement as it would be worthless to announce it, have you change your passwords while the attacker can re-attack the systems. Now that we are confident your data is safe - please go ahead and change your credentials where possible.

We hope these actions will restore any trust you might have lost in us as a result of this incident.

More detailed information about the breach is to follow soon.

Re: IMPORTANT ANNOUNCEMENT: BREACH OF SECURITY

Posted: 08 Oct 2018 10:23
by Jiranthos
Please change your passwords even if no suspicious activity has been seen on your accounts - these password hashes are usually sold to general (not targeting any individual specifically) hackers for password hash dictionaries so your password can be used months or years from now. The effect may not be immediate.

Once more, we express our sincerest apologies for letting this happen to your data and are available to answer any questions you may have about your account or steps that need to be taken to avoid or mitigate any damage.

Re: IMPORTANT ANNOUNCEMENT: BREACH OF SECURITY

Posted: 08 Oct 2018 10:37
by Jiranthos
Let this fiasco also serve as a reminder to never use the same password twice on multiple sites as your password will be only as safe as the weakest link and you risk the most valuable thing that password has also been used for - usually your e-mail inbox which can then be used to social engineer your friends and coworkers, recover passwords to your other accounts and gather personal information about you and blackmail you.


PLEASE CHANGE YOUR PASSWORDS EVERYWHERE.

Re: IMPORTANT ANNOUNCEMENT: BREACH OF SECURITY

Posted: 08 Oct 2018 12:35
by Benedictus
To change your in-game accounts passwords, you do it under "Account" then "Account manager".

To change your Forum passwords you do it like this: Under your profile> User control panel > Profile > Edit Account settings.

Re: IMPORTANT ANNOUNCEMENT: BREACH OF SECURITY

Posted: 08 Oct 2018 13:22
by mummieman
tnx for the info and kudos for the quick fix

Re: IMPORTANT ANNOUNCEMENT: BREACH OF SECURITY

Posted: 08 Oct 2018 14:53
by ashpool
Couple questions:
  1. Were the password hashes salted?
  2. Did they all use the same salt?
  3. If they weren't salted and/or used the same salt, are you going to change this?

Re: IMPORTANT ANNOUNCEMENT: BREACH OF SECURITY

Posted: 08 Oct 2018 15:08
by BlackArcane
I have no doubt you guys will get the matter sorted, and I continue to have full faith to you all. I know all TW players appreciate the time and effort the staff put in to make us all safe!
On that note, I shall go make some extreme password changes right now :D

Re: IMPORTANT ANNOUNCEMENT: BREACH OF SECURITY

Posted: 08 Oct 2018 17:23
by Bloodshade
o no my magic rooster and 200k gold got stolen by chinese hackers, mail them to me gm, thanks

Re: IMPORTANT ANNOUNCEMENT: BREACH OF SECURITY

Posted: 08 Oct 2018 17:54
by Nuko
To answer your questions:
  1. Yes, they were salted.
  2. Yes, the salts were all different.
  3. We are looking at further ways to improve them anyway despite the above.

Re: IMPORTANT ANNOUNCEMENT: BREACH OF SECURITY

Posted: 08 Oct 2018 18:41
by Regent
Thank you for informing us.
Passwords changed. I hope the damage to TW was minimal.

Re: IMPORTANT ANNOUNCEMENT: BREACH OF SECURITY

Posted: 08 Oct 2018 20:32
by Gadoschi
When did this happen exactly?
I need the exact time if you don't mind.

Re: IMPORTANT ANNOUNCEMENT: BREACH OF SECURITY

Posted: 08 Oct 2018 21:44
by Roel
Gadoschi wrote:
08 Oct 2018 20:32
When did this happen exactly?
I need the exact time if you don't mind.
Last Wednesday night.

Re: IMPORTANT ANNOUNCEMENT: BREACH OF SECURITY

Posted: 09 Oct 2018 02:08
by Kniteknite
Thanks for this~

Re: IMPORTANT ANNOUNCEMENT: BREACH OF SECURITY

Posted: 09 Oct 2018 14:18
by NoblestHeart
I got hacked, put in a ticket to get a piece of gear back and got told "CAN'T DO ANYTHING, GOOD BYE" (This was on Primal 2 - 3 dyas ago now after coming back) Not the first time either. I had a DK on the the True WoW releam and that disappeared after me being away for a long while, I didn't delete. That was a few years back. Got told same response "CAN'T DO ANYTHING, GOODBYE".

Re: IMPORTANT ANNOUNCEMENT: BREACH OF SECURITY

Posted: 09 Oct 2018 15:19
by Ravenseeker
NoblestHeart wrote:
09 Oct 2018 14:18
I got hacked, put in a ticket to get a piece of gear back and got told "CAN'T DO ANYTHING, GOOD BYE" (This was on Primal 2 - 3 dyas ago now after coming back) Not the first time either. I had a DK on the the True WoW releam and that disappeared after me being away for a long while, I didn't delete. That was a few years back. Got told same response "CAN'T DO ANYTHING, GOODBYE".
That was actually a week ago, before this breach. And the actual response was
We are sincerely sorry for your loss, but there isn't anything we can do about it. Always remember to secure your account.
I was unable to find any logs showing that you had indeed lost this item, possibly due to the age of the issue, and thus i am unable to help in your case.