Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

Fantasy Site Hack Exposes Data on 650,000 Users

Users of Second Life site forced to change passwords after zero-day exploit hits Web server

A hack on a popular Web fantasy site may have exposed the personal data of some 650,000 players, site operators revealed late last week.

Second Life, a virtual world in which players can live out another existence, was hit by a "zero-day exploit" last week, and a database containing players' names, addresses, passwords, and payment information was compromised, according to Linden Lab, which operates the site.

Systems administrators for Second Life voided all of the participants' passwords, forcing users to change to new passwords immediately. Users will have to answer a security question in order to get a new password.

Linden Lab was not specific about the details of the attack, and company officials did not reply to queries for this article. However, in messages to its customers, the company said the exploit was perpetrated on its Web server, via vulnerabilities in "third-party Web software."

So far, Linden Lab has been able only to determine the "aggregate size of the data that was downloaded through the intrusion," which appears to have been substantial. The company said it could not tell whether individual records were compromised, or which ones, which is why it decided to simply void all the passwords in the system and ask legitimate users to renew.

The database includes Second Life account names, real-life names, and contact information in unencrypted form, Linden Lab said. Account passwords and payment information (such as credit card numbers and PayPal transaction IDs) were also in the database but were encrypted via an MD-5 hash algorithm and "salt," which inserts additional data into the encryption pattern to make it harder to crack, the company said. A separate database that contained unencrypted credit card information was not compromised, according to Linden Lab.

"The compromised system was rebuilt and made more secure," Linden Lab said in its blog. The company plans to announce additional security improvements in the near future.

Second Life users, who log onto the site to buy virtual land, build virtual homes and try all sorts of pastimes they would never try in the real world, were frustrated by the intrusion.

"I've heard a number of people say it was bound to happen sooner or later, but that doesn't make it any easier to hear or deal with," says mightyoak on a Second Life message board. "I agree that until there's hard evidence that harmful data has been compromised, we should all remain calm. It's not going to be particularly comfortable waiting, though."

Aimee Weber, another Second Life user, raised the possibility that the hacker might link the real-world names with the pseudonyms assumed in the virtual world, and move from online "stalking" (an accepted practice online) to real-world stalking. More than 286,000 Second Lifers have logged onto the site in the last 60 days, according to site figures.

An investigation into the hack is ongoing, according to Linden Lab.

— Tim Wilson, Site Editor, Dark Reading

Tim Wilson is Editor in Chief and co-founder of Dark Reading.com, UBM Tech's online community for information security professionals. He is responsible for managing the site, assigning and editing content, and writing breaking news stories. Wilson has been recognized as one ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
7 Tips for Infosec Pros Considering A Lateral Career Move
Kelly Sheridan, Staff Editor, Dark Reading,  1/21/2020
For Mismanaged SOCs, The Price Is Not Right
Kelly Sheridan, Staff Editor, Dark Reading,  1/22/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
IT 2020: A Look Ahead
Are you ready for the critical changes that will occur in 2020? We've compiled editor insights from the best of our network (Dark Reading, Data Center Knowledge, InformationWeek, ITPro Today and Network Computing) to deliver to you a look at the trends, technologies, and threats that are emerging in the coming year. Download it today!
Flash Poll
How Enterprises are Attacking the Cybersecurity Problem
How Enterprises are Attacking the Cybersecurity Problem
Organizations have invested in a sweeping array of security technologies to address challenges associated with the growing number of cybersecurity attacks. However, the complexity involved in managing these technologies is emerging as a major problem. Read this report to find out what your peers biggest security challenges are and the technologies they are using to address them.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-3154
PUBLISHED: 2020-01-27
CRLF injection vulnerability in Zend\Mail (Zend_Mail) in Zend Framework before 1.12.12, 2.x before 2.3.8, and 2.4.x before 2.4.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the header of an email.
CVE-2019-17190
PUBLISHED: 2020-01-27
A Local Privilege Escalation issue was discovered in Avast Secure Browser 76.0.1659.101. The vulnerability is due to an insecure ACL set by the AvastBrowserUpdate.exe (which is running as NT AUTHORITY\SYSTEM) when AvastSecureBrowser.exe checks for new updates. When the update check is triggered, the...
CVE-2014-8161
PUBLISHED: 2020-01-27
PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authenticated users to obtain sensitive column values by triggering constraint violation and then reading the error message.
CVE-2014-9481
PUBLISHED: 2020-01-27
The Scribunto extension for MediaWiki allows remote attackers to obtain the rollback token and possibly other sensitive information via a crafted module, related to unstripping special page HTML.
CVE-2015-0241
PUBLISHED: 2020-01-27
The to_char function in PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authenticated users to cause a denial of service (crash) or possibly execute arbitrary code via a (1) large number of digits when processing a numeric ...