<![CDATA[Kotaku: security]]> http://tags.kotaku.com/assets/base/img/thumbs140x140/kotaku.com.png <![CDATA[Kotaku: security]]> http://kotaku.com/tag/security http://kotaku.com/tag/security <![CDATA[In-Flight Electronics Rules Eased After Two-Day Crackdown]]> The Associated Press is reporting that increased security measures on international flights inbound to the United States have been eased. The government has not publicly announced any changes, but the AP's report cites unnamed airline officials "familiar with the matter."

The tightened restrictions had meant passengers had to remain in their seats for the final hour of a flight, with nothing in their laps. Others had reported a total ban on electronics. The Transportation Security Administration was intentionally vague about what flights might or might not require, but nearly all of it meant bad things for the use of portable electronic devices - at least on international flights. Crecente, however, just flew 14 hours from Australia into the U.S. and was allowed to use electronics in flight.

The AP specifically said "In-flight entertainment restrictions have also been lifted." I suppose this means it's all over, for now anyway.

In-Flight Security Rules Eased
[Associated Press on Yahoo! News]

]]>
http://kotaku.com/index.php?op=postcommentfeed&postId=5435816&view=rss&microfeed=true
<![CDATA[How Will New Rules Affect In-Flight Gaming?]]> It's not a petty concern. Since Friday's incident en route to Detroit, airlines are ramping up security procedures at the behest of the government, and "approved portable electronic devices" have long been a whipping boy for this sort of thing.

Unfortunately, it sounds like they'll be verboten for international flights inbound to the U.S. While the Transportation Security Administration has issued no formal rules (and, in fact, is being deliberately vague about them) Gizmodo and several other sources are reporting the ban as fact.

Another key detail: for international flights inbound to the U.S., passengers will have to remain in their seats for the last hour of a flight, without access to their carry-on baggage (above or underneath a seat) and without any personal items on their laps. So, better pee up before that final hour, and make sure you're at a good stopping point in Assassin's Creed: Bloodlines.

It's also unclear how this affects travel within the U.S., but you can bet it will, beginning with long lines as screeners tighten their focus. Other measures either reported or expected include the aforementioned no cabin travel for the last hour of a flight; keeping the cabin lights on for the entire trip; disabling the display of a flight's progress in the seatback monitors offered on some planes; and generally making sure you resent the experience from check-in to baggage claim.

As there are a ton of variables in play here, for U.S. flights and for those in other countries, and as plenty of folks are flying either today or tomorrow - or this time next week - returning from holiday travels, we're opening up a comment thread here to report what you've seen. Especially as it relates to the use of electronic devices. Flying is such an unpleasant process these days, laptops, handhelds and DVD players have become almost indispensable for their diversionary qualities. Plus, some are still under the illusion they can get work done midair.

So here, and for future reference, use the hashtags #tsa #flights or #airtravel to talk about what you've seen, heard or experienced. You'll be doing your fellow flying gamers a service.

]]>
http://kotaku.com/index.php?op=postcommentfeed&postId=5434915&view=rss&microfeed=true
<![CDATA[The 360 Gets a $30 Chastity Belt]]> If you're in a crap neighborhood where smash-and-grab burglaries are a problem, maybe this thing saves your 360 even if the rest of your stuff's stolen. Chances are, you got ripped off just buying it.

This first-ever Security Kit is $29.95 worth of common stuff you can buy at a hardware store for a lot cheaper, plus one custom-fit bracket. That attaches, naturally, in the back near the fan, which is just another thing to terrorize your RRoD-paranoid mind if you don't have a Jasper board.

It does not, of course, protect your hard drive, your $150 Tournament Edition Street Fighter stick, your full set of Rock Band instruments - you get the idea. In fact, here's a better one: Spend the dough on renter's insurance.

Protect Your Xbox 360 with Security Kit
[360Sync via Joystiq]

]]>
http://kotaku.com/index.php?op=postcommentfeed&postId=5327647&view=rss&microfeed=true
<![CDATA[Atlus Site Hacked, May Have Infected Users With Virus]]> The official Atlus USA web site was reportedly compromised by a "third-party entity" today, inserting malicious software into the company's site. According to Atlus, this may have led to visitors being infected by malware.

Atlus.com is currently down, as the company says it is working to "repair and restore" the web site, asking visitors to "protect their computers with anti-virus software and to run malware removal software on their systems to ensure that their security is not compromised."

The publisher has issued an apology via e-mail to subscribers of its newsletter, saying it is "deeply troubled" by the attack. The full communication is after this.

Dearest fans of Atlus,
Today (4/24/2009), our web domain (atlus.com) was hacked and compromised. A third-party entity embedded malicious code into the script, and regretfully, for a period of a few hours (from roughly 9:00am PST until 2:30pm PST), this malicious software (which we believe we have identified as a Trojan) may have made its way onto your systems.

The faith and trust of our fans is of the utmost importance to us, a responsibility we don't take lightly. As such, we are deeply troubled by this development, and we are now working to repair and restore the website.

We advise any and all of our fans, whether they visited our website or not in the past day or two, to protect their computers with anti-virus software and to run malware removal software on their systems to ensure that their security is not compromised.

As we work quickly to restore the Atlus website and to investigate the nature of this security breach, we ask for your understanding and patience.

Sincerely,
Atlus

]]>
http://kotaku.com/index.php?op=postcommentfeed&postId=5226831&view=rss&microfeed=true
<![CDATA[Protect Your Gil With The Final Fantasy XI Security Token]]> The newly-announced Square Enix Security Token will keep dirty hacker hands off your hard-earned gil via the magic of the constantly-changing login password.

Much like the Blizzard Authenticator released for World of Warcraft last year, the Square Enix Security Token is an actual physical device that, when linked to your Final Fantasy Online account, generates a constantly changing password that you can use to log in to your game account securely. It's a simple way to keep your items and in-game currency from suddenly disappearing from you in the middle of the night.

Square Enix has yet to set a price or release date for the Security Token, but with the added incentive of an exclusive in-game item with every Token purchase, it's sure to sell like gangbusters once Square Enix releases it via the PlayOnline Store.

Introducing the Square Enix Security Token [Final Fantasy XI]

]]>
http://kotaku.com/index.php?op=postcommentfeed&postId=5168308&view=rss&microfeed=true
<![CDATA[Is This A Stand-up Fight Or A Bug Hunt? Norton AntiVirus For Gaming]]> PC gamers don't have it easy. Alongside the constant hardware arms race and GPU penis-envy, you have the problem that your platform of choice might not just be used for gaming. Even in a locked room with no interwebs a Windows PC is like a magnet for malware and viruses. What's worse, the remedy for such net.bastards - anti virus software - can slow your PC down and hog precious memory.

Antivirus stalwarts Norton feel your pain and will try to offer succor in the form of Norton AntiVirus 2009 Gaming Edition. The release is tweaked to use 80% less memory than the standard settings and will allow security parameters to be dialled down to maximise performance.

There is also a 'Gamers Mode' that suspends all update downloads (no bandwidth sucking while you are trying to use your link for sensible stuff like killing Zombies) and stops all antiviral notifications from interrupting your playtime.

Norton AntiVirus 2009 Gaming Edition promises to be less intrusive Gamertell]

]]>
http://kotaku.com/index.php?op=postcommentfeed&postId=5083571&view=rss&microfeed=true
<![CDATA[A Batman MMORPG? Er, No, Actually]]> While tooling about the web lately you may have come across an advert for a Free Online Batman Game (pictured).

Don't get too excited, however. There is a DC MMO in development but a) it's not ready yet b) while it will feature the Bat it is in no way an 'Online Batman Game' and c) it sure as hell won't be free.

No, as the Facetime Labs Security Blog has uncovered, this looks like an attempt by (possibly someone acting on behalf of) Adware developer Zango to lure hapless gamers into downloading their search toolbar.

Following the link takes you to the anonymously registered (and currently down) website Batmangame.info featuring screengrabs from 2005's Batman Begins tie-in and the following message:

"To download and play the Batman Online Game you must download and install Zango as well. It is free, very easy to install and will give you access to the full game."

Tellingly, the site seems remarkably light on DC or Warner Bros copyright info.

Zango And The Batman Online Videogame [Factime Labs via TechDirt]

]]>
http://kotaku.com/index.php?op=postcommentfeed&postId=5049102&view=rss&microfeed=true
<![CDATA[The Science of Defrauding MMOs]]> I find security issues facing games pretty interesting; PlayNoEvil is one of my favorite spots for discussion about security related issues. Gamasutra sat down with Gene Hoffman, CEO of Vindicia, a billing and fraud management company, about the issues facing MMOs and ways to mitigate those issues. Of particular concern are the RMT resale markets (if it exists), and chargebacks. And what of the mingling of real and virtual economies? Hoffman has this to say:

These are real economies. In fact, they get much closer to the raw creation of economic growth than many national economies as these "virtual" economies prove quite convincingly that wealth isn't capital or labor but instead knowledge and creativity. Building a working infrastructure to support capital inflows and outflows in a trustworthy manner is very much a core problem we want to address.

In many ways we're facing the merging of intellectual property and "cash" into one entangled entity. When someone steals a virtual thing they've stolen real value. Cash was created in many ways because barter was hard, and cash creates prices. However if prices are now known in some exchange rate, the virtual good that was stolen is a bill denominated in the exchange value of that good in the first place.

With credit card fraud, stolen card numbers, chargebacks, and other security breeches an increasing problem, we'll no doubt see more and more focus on what can be done to prevent fraud in its many forms (though Steve at PlayNoEvil seems to harbor doubts that companies really pay enough attention to security and fraud issues, especially when it comes to implementing successful and cost-effective solutions that don't cripple usability for the consumer).

Vindicia's Hoffman On The Science Of MMO Fraud [Gamasutra]

]]>
http://kotaku.com/index.php?op=postcommentfeed&postId=5038031&view=rss&microfeed=true
<![CDATA[EVE Online Source Code Leaked, No Worries]]> The source code for CCP's EVE Online has been popping up on torrent trackers all over the place this week, leading to players worrying about the security of their accounts, as well as having the peace, sleep-inducing serenity of their mining efforts disturbed. CCP assures everyone that the leak will have no adverse effects on the EVE community.

"The server-side interface used by the client is carefully protected to ensure that no abusive or unwanted information is transmitted to, or from the internal EVE server systems. Nothing the EVE client can do can affect the game state, no advantage can be gained by manipulating the EVE client, no advantageous or disadvantageous information can be transmitted to other EVE users by altering the EVE client."
CCP is still mum on how the source code was accessed, so feel free to make up your own story. Mine involves romance, intrigue, and the movie guy voice saying, "The only thing hotter than their love...was her betrayal."

CCP plays down EVE leak
[Eurogamer]]]>
http://kotaku.com/index.php?op=postcommentfeed&postId=379832&view=rss&microfeed=true
<![CDATA[Second Life's Got Some Vulnerabilities]]> secondlifemoney.jpg Dean Takahashi of the San Jose Mercury News revealed that people can take advantage of a known QuickTime problem and become virtual pickpockets in Linden Lab's Second Life. Steve over at PlayNoEvil points out that "anything can that actually affect the integrity of the game or business application should be completely independent of these services to ensure that a breach in 'the other guy's stuff' doesn't affect the security of your business - especially casual applications and services that do not see themselves as having security functionality." Linden Lab confirmed the vulnerability, but the researchers who exploited the flaw were quick to note the issue can be resolved with a simple patch. Still - I think Steve's got a point:

In a video of a scene from Second Life, Miller showed how a player-created character, dubbed an "avatar," walks near the hacker's avatar. Nothing appears amiss, but then a message appears saying that the walking avatar has transferred 12 Linden dollars to the hacker's avatar. The oblivious walking avatar then says, "I got hacked."

The range of the hack is approximately 100 virtual feet. Nothing can stop the hacker from cashing out that money for real dollars through various exchanges associated with Second Life. Today, about 250 Linden dollars equals one U.S. dollar.

The hackers say the scene shows they can take complete control of any player's avatar and make that avatar surrender any money and other property in its account. That's a serious security breach because many of the 10.5 million registered members of Second Life are trying to make a living in the virtual world by selling goods and services.

I'm a little surprised more of the mainstream media hasn't picked up on their virtual darling's (minor? major?) problems, but the Second Life craze seems to have subsided somewhat.

Second Life pickpockets threaten real world cash potential [San Jose Mercury News via PlayNoEvil]

]]>
http://kotaku.com/index.php?op=postcommentfeed&postId=328940&view=rss&microfeed=true
<![CDATA[EVE Online, Breached But Back]]> EVE Online went down for nearly nine hours last Friday due to a security breach. Here's more from their official statement:

...we discovered an anomaly in the EVE Online Database indicating a potential exploit. Our policy in such cases is to mobilize a taskforce of internal and external experts to evaluate the situation...that group concluded that our best course of action was to go completely dark while an exhaustive scan of our entire infrastructure was executed.
Apparently no accounts were compromised, but hopefully steps are being taken to prevent such a hack in the future. Because no one wants their virtual self or their real self paying for someone else's space ship.

EVE Online service restored after unexpected downtime [eveonline]

]]>
http://kotaku.com/index.php?op=postcommentfeed&postId=313581&view=rss&microfeed=true
<![CDATA[PSN Accounts Compromised By SCEA Imposter]]> Don't panic! Yes, according to a report from GameDaily BIZ, a pair of PlayStation Network accounts were accosted during a minor "breach of security" at Sony Computer Entertainment America. This wasn't the work of a team of nefarious hackers of the Anonymous cyber-terrorist organization, but a simple duping of a customer service employee that resulted in the release of unauthorized information to a single user.

SCEA Senior Corporate Communications Manager Kimberly Otzman told GameDaily BIZ that "In response to the incident, SCEA immediately enhanced its customer service protocol, implementing additional security safeguards, and began an intensive investigation of the incident that remains ongoing." OK. Now you can panic.

SCEA IT Imposter Gains Access to PSN User Accounts [GameDaily BIZ]

]]>
http://kotaku.com/index.php?op=postcommentfeed&postId=306288&view=rss&microfeed=true
<![CDATA[Microsoft Acknowledges Phishing on LIVE]]> Microsoft has gone on the record and admitted that phishing scams are occurring on Xbox LIVE. Well, technically they are admitting that phishers are trying to get LIVE account information while ignoring that there's more on the line, like personal credit card numbers. Offering reimbursement to customers, they also wanted to make clear:

This was not a failure of software technology. We want to reassure our customers that there has been no security breach of the Xbox LIVE network or of Bungie.net.
Isn't a phishing scam occurring on a closed and thereby safe network precisely framed as a failure of their technology? There's only so much any company can do to protect customers who are willing to re-enter personal info at the drop of a hat, but for all the sacrifices we make on the closed LIVE platform, it's supposed to be an experience free from the everyday burdens of a PC.

Their full statement after the jump.

Microsoft has confirmed reports of certain individuals taking over subscribers' Xbox LIVE accounts through fraudulent behavior.

We've taken action to help protect our subscribers' accounts and are working with our call center staff to help reduce the likelihood of future incidents. This includes:

• Retraining all customer support representatives.
• Examining the policies and processes for account recovery.
• Continuing to monitor the situation closely to take appropriate action as necessary.

In addition to these steps, we continue to recommend that our customers always be careful with whom they share information while connected to Xbox LIVE.

We will reimburse any customer whose account has been compromised in this fashion. If they have lost content such as Xbox Live Arcade games, we will provide the customer with replacement content at no charge.

This was not a failure of software technology. We want to reassure our customers that there has been no security breach of the Xbox LIVE network or of Bungie.net.

Customers who have any concerns about their account should visit www.xbox.com/support, click on the link titled "Troubleshooting Access to your Xbox Live Account," and perform the steps outlined there."

Xbox Live Abusers Gone Phishing [nextgeneration]

]]>
http://kotaku.com/index.php?op=postcommentfeed&postId=299554&view=rss&microfeed=true
<![CDATA[PS3 Home - Security, Age Verification, and Booze]]> PlayNoEvil has an interesting meditation up on some remarks made by Peter Edward, director of the Home platform for PS3, relating to some of their advertisers (Marlboro, Durex, and Bacardi - woo!), and tangentially, some of challenges of age verification and the threat of having to move and buy a new PS3 if your account is banned for not being able to play well with others (are we looking at another minor PR disaster when someone buys a refurbished PS3 that comes pre-banned?).

There was an implication that [banning by machine] is a much superior capability to other online services like Second Life. However, the PS3 has the advantage of being a hardware based system. Also, many online communities do support robust banning systems. Particularly, services that are targeted at children. Since the Playstation Network service is not a "for fee" service, identity and registration information could be weak. Also, banning is kind of a strange response for a service that seems to be focused on selling digitally distributed items (games, movies, music, etc.). It will be interesting to see how this plays out.

The gamesindustry.biz discussion with Edward that PlayNoEvil links to has the original snips on 'branding for mature users' and the 'you complain, we ban' system of policing they're intending on implementing.

Sony's PS3 Home Security, Age Verification, Condoms, Alcohol, and Cigarettes [PlayNoEvil]

]]>
http://kotaku.com/index.php?op=postcommentfeed&postId=291050&view=rss&microfeed=true
<![CDATA[Cursor Hackers Hit WoW]]>

BBC is reporting that World of Warcraft gamers are being targeted by a group of hackers using the cursor hack that takes advantage of a flaw in the way Windows handles animated cursors.

The story says Warcraft players have become targets because there's so much money tied to the game's millions of accounts.

Research by security firm Symantec suggests that the raw value of a WoW account is now higher than a credit card and its associated verification data.

One card can be sold for up to $6 ( 3) suggests Symantec, but a WoW account will be worth at least $10. An account that has several high level characters associated with it could be worth far more as the gold and rare items can be sold for real cash.

In a bid to head off the growing threat from the animated cursor flaw, Microsoft took the unusual step of releasing a patch for the bug on 3 April.

Now get out there and download that patch.

Cursor hackers target WoW players [BBC]

]]>
http://kotaku.com/index.php?op=postcommentfeed&postId=249911&view=rss&microfeed=true
<![CDATA[Xbox Live Accounts Compromised (Really, This Time)]]> After some initial confusion involving crazy Bungie.net hacking rumors, Microsoft seems to have determined from where recent Live security issues originated. True, accounts were not "hacked" via Xbox Live or Bungie's web site, but accounts were compromised by old-school, tech-free conning of customer support reps.

Xbox Live's Larry "Major Nelson" Hryb explains what happened on his blog:

Earlier this week when I first heard about the "Xbox Live network hacked" story, I checked with the people on our end, and then posted about it. As originally posted, Xbox Live has not been hacked. That is still true. A security researcher, Kevin Finisterre, discovered not a hack, but the fact that some accounts may have been compromised as a result of 'social engineering', also known as 'pre-texting', through our support center. Kevin gave me a call directly and once I realized what he was talking about (he sent me some painful-to-listen-to audio files) I confirmed that the team is fully aware of this issue. They are examining the policies, and have already begun re-training the support staff and partners to help make sure we reduce this type of social engineering attack.

Larry adds apologetically, "There's no other way to say it; this situation shouldn't have happened. Our customers deserve better." Xbox Live subscribers with questions about their account should contact Microsoft and the Xbox customer support team at 1-800-4MYXBOX.

Xbox Live Security Update [Major Nelson]

]]>
http://kotaku.com/index.php?op=postcommentfeed&postId=247230&view=rss&microfeed=true
<![CDATA[Microsoft Responds to Live Hack Concerns]]> It appears that reports of a systemic hack of Bungie.net to obtain a slew of Xbox Live accounts may be blown out of proportion.

Microsoft sent their official response to this morning's story to me just a bit ago:



Recently, there have been reports of fraudulent activity and account theft taking place on the Xbox LIVE network. Security is a top priority for Xbox LIVE, and we are actively investigating all reports of fraudulent behavior and theft. Any customer with a question about the security of their Xbox LIVE account should contact 1-800-4-MY-Xbox, and
an Xbox Customer Service Representative will help them understand our security policies and procedures.

A Microsoft rep went on to tell me that while they are investigating the concerns, they have not found any security breach of Bungie.net or Xbox Live accounts.

Xbox Live Hacked, Accounts Stolen [Kotaku]

]]>
http://kotaku.com/index.php?op=postcommentfeed&postId=246044&view=rss&microfeed=true
<![CDATA[Xbox Live Hacked, Accounts Stolen]]>

I was waiting to hear back from Microsoft on this, but haven't so here's where things stand according to ZDnet.

According to a group of Xbox 360 gamers and Kevin Finisterre, a security researcher at Digital Munition, there are rumors that Bungie.Net was hacked and that a portion of Xbox Live was taken over. This hack allowed people to control gamer tags and either steal their points or purchase more points through the accounts.

Finisterre says that he called Microsoft Tech and they confirmed that "accounts are being stolen and that "Hackers have control of Xbox live and there is nothing we can do about it"

ZDNet's Ryan Naraine goes on to point out that a number of people are complaining about the thefts on the official Xbox Live forums and saying that Microsoft reps are doing nothing to help out.

I'll make sure to update this once I hear back from Microsoft.

Xbox Live hacked, accounts stolen [ZDNet]

]]>
http://kotaku.com/index.php?op=postcommentfeed&postId=245887&view=rss&microfeed=true
<![CDATA[Vista Flawed, Insecure]]> The New York Times is reporting that reports of serious flaws and security holes in Vista are already starting to roll in to Microsoft.

Despite Microsoft assertions about the improved reliability of Vista, many in the industry are taking a wait-and-see approach. Microsoft's previous operating system, Windows XP, required two "service packs" issued over a number of years to substantially improve security, and new flaws are still routinely discovered by outside researchers.

On Friday, a Microsoft executive posted a comment on a company security information Web site stating the company was "closely monitoring" the vulnerability described by the Russian Web site. It permits the privileges of a standard user account in Vista and other versions of Windows to be increased, permitting control of all of the operations of the computer. In Unix and modern Windows systems, users are restricted in the functions they can perform, and complete power is restricted to certain administrative accounts.

"Currently we have not observed any public exploitation or attack activity regarding this issue," wrote Mike Reavey, operations manager of the Microsoft Security Response Center. "While I know this is a vulnerability that impacts Windows Vista, I still have every confidence that Windows Vista is our most secure platform to date."

While so far the flaws and security holes don't seem to have anything to do with gaming, it still would suck to buy an upgrade for your system only to have the computer infected with bugs.

Although the operating system isn't suppose to ship to us regular Joes until next month, the corporate customers got an eyeful of the bugs last month when they received their copies.

Flaws are detected in Microsoft's Vista [New York Times]

]]>
http://kotaku.com/index.php?op=postcommentfeed&postId=224368&view=rss&microfeed=true
<![CDATA[Day Old PSP Firmware Gets Fix]]>

Security hole ho!

One day after releasing firmware 3.0 for the Playstation Portable, Sony released firmware 3.01... now with anti-homebrew fixes.

I would hate to be the guy who has to come up with these fixes. You know he was just sitting back in his office chair, about to sip down a Pumpkin Spice Latte after a firmware update well done when someone burst through his door and shouted "exploit!"

I wonder if he did a coffee spit-take?

System Updates [Sony PSP]

]]>
http://kotaku.com/index.php?op=postcommentfeed&postId=216803&view=rss&microfeed=true