NCsoft Master Account Security Issues

For those who have played Guild Wars, there might be some pretty concerning security issues around NCsoft master accounts.

Might be a good time to change your master account password even if you didn't play GW, just in case.

Great work, thanks for the heads up.

Yeah, there were some accounts taken over by Aion goldspammers that way. It happened to a very good friend of mine a couple weeks back. He changes his master account password regularly and it still got taken over, but Support was able to reset his password and restore it, thankfully.

Unless they change your password they have no way back in after login timeout right?

Yeesh, this is terrible. So if you get an account hacked and then recovered too many times the account gets banned? That is TERRIBLE.

Changing my password actually CAN hurt because I'm liable to forget the new one, and I have to get through all of the security questions, which never really fit my needs, anyway. If players are working off a password list, won't I just update their list?

Quote:

Originally Posted by Arcanaville Samuel_Tow is the only poster that makes me want to punch him in the head more often when I'm agreeing with him than when I'm disagreeing with him.

After reading the list of vulnerabilities, I'm not too sure that changing my account pwd is all that helpful.
I don't actually see any vulnerability that would be affected by changing my pwd more often than usual.

• 1. Wrong Account Bug. Sometimes simply logging into the NCSoft site takes you to someone else's account instead, with FULL CONTROL over that account. An attacker need only use a bot to log into their own account over and over until the bug occurs, then steal the account the bug gives them.
• 2. Advanced Vulnerabilities Reported by Mung on Aion Forums
  • "SQL injection is apparently NOT prevented very well. [Mung] was able to send a basic acknowledge request and instead of "page not found" or "incorrect login" [Mung] received an SQL ack!"
  • "The ENTIRE web domain is unprotected from file mirroring (process of copying all files housed at the web host)." Chthon's note: HOLY ****! That's very bad....
  • "[T]he majority of the process functions for each page under the "secure.ncsoft.com" domain are scripted in PERL but referencing Javascript multiple times for all sorts of verifying processes. This can easily be manipulated to a users intention."
• 3. Brute Force Vulnerabilities
  • Login failure gives different error message for real usernames and non-usernames. An attacker can generate a list of valid usernames by systematically running all character strings against the NCSoft site's username field.
  • Security questions for password reset have dangerously small search spaces that can be guessed quickly. The birthday question (which is the default!) is particularly easy. So is the car color question.
  • Failed attempt at answering security questions that includes one correctly guessed question returns error message that tells user which question is correct. This vastly reduces search time for a brute force attack.
  • Password reset attempts are allowed too frequently. 5 attempts every 12 hours is too many given the small search spaces.
  • IP's attempting multiple failed logins or password reset attempts are not blocked, blacklisted, or greylisted.
  • Attacker can specify new NCSoft password immediately upon correctly guessing password reset questions. The system should create a random password sent in a confirmation e-mail it to the account's associated address.
  • The GW username is displayed from the NCSoft site. It should not be. This gives an attacker 1/3 of the GW login credentials.
  • Attacker can specify new GW password immediately upon accessing the NCSite. User should be required to enter old password and/or respond to confirmation e-mail to the account's associated address. [Edit: Apparently this was fixed a few hours ago. Old password is now required.]
  • No countermeasures at all against brute forcing NCSoft password.(Gaile states that she has been told there are, but forum members making repeated failed login attempts did not encounter lockout, blacklisting, or increasing delay. Suspect Gaile has been misinformed by NCSoft staff.)
• 4. GW character names are present in old support tickets. This renders the new character name security question useless.

I keep getting this error when I try to login

Quote:

Internal Server Error

Quote:

The server encountered an internal error or misconfiguration and was unable to complete your request. Please contact the server administrator, you@example.com and inform them of the time the error occurred, and anything you might have done that may have caused the error. More information about this error may be available in the server error log.