Forum and game security discussion

[Event "Janе" Horizon]

I am not sure if a  vulnerability in SMF 2.01 (Published: 2011-12-07) is applicable to SMF 2.02.
If you can find a report applicable to the current version then this may be more relevant.

[Leopold "Shaqan" Mutter]

I posted it as proof of concept.. Like "it has been done".

I don't argue the claim that, for now, nothing appears to exist of this nature in public.. Being sort of paranoid I do not expect it to last.. only honest hackers make their creation public.. other lot either sell theirs for money or abuses it themselves...

Pointless to argue over it though.. I just hope AW Devs thought the things properly trough and minimized as many risks as possible

[dale "dalewj" ofj]

Assume that this password will be hacked

couldnt have said it better myself

[dale "dalewj" ofj]

I am not sure if a  vulnerability in SMF 2.01 (Published: 2011-12-07) is applicable to SMF 2.02.
If you can find a report applicable to the current version then this may be more relevant.

ah there is the problem.  you hit it on the head.   You are using a program that must be upgraded routinely to make sure it doesnt have a vuln.   Im not a SMF person, but i bet 2.02 was to fix the 2.01 vuln.  If you didnt go look to see if there was an upgrade you were in danger.   Go look how many SMF boards are still on 2.01.  i bet more then 50%.  I like The daisy work in security and you can never trust any peice of software to be up to date and safe from vulns unless you spend a good deal of time and $ to have the right programs in your system to watch it.  I have one of those on my windows machines (securnia PSI) but never found that program for web based applications, and i bet my web based servers are out of date, i haven't checked them in a good 3 weeks.

Nah that couldnt happen here?    Wiki is v 1.13.2  Current 1.19.1

the only way to control this is to not use software where you dont control the code. 

[Zen "ZenX" Star]

In an ideal world of unlimited funds, resources, time , knowledge, training.............

In a perfect world i will design things for others to build that are perfect.

[dale "dalewj" ofj]

In a perfect world i will design things for others to build that are perfect.

If you care, if you try, if you follow up, you will write code that matters.  But only you will be in control of your own code.

My problem is not perfect code, I havent seen that ever.  Its using un-perfect "public" code for my ingame security.  Just unlatch the two and ill be happy.  There security code ingame is probably not perfect, but I know they wrote it and control it.

and if you haven't figured it out, yes I will fight this with what I think needs to be done.   

Last seen in Saransk West at Outpost / Storages - Dead, run out of guns/melee/Hks

[Zen "ZenX" Star]

Dont get me wrong, i am not a fan of the password secutity strategy here as it stands, i just thought i'd try and get some feet back on the ground before the conversation got to a stage where theory and practicality lost their comnnection 

[The "Fifth" Entity]

In fact there's only minimal customization needed: not user privilege level defines the right to change passwords, the server where the password DB runs simply accepts only a certain account and it's password can be reset only locally.
After this you can hack the forum and get admin rights there as much as u want, it doesn't matter.

I don't know how to break this (assuming the password on this special account is secure), maybe somebody does, or at least has heard it was successfully hacked?

OK, there's always a possibility that the core servers themselves are hacked, but i think we can safely leave this scenario aside, if we presume this can be done everything becomes pointless anyway.

[Event "Janе" Horizon]

I do agree that the strategy of having the in-game password linked to the forum password is a higher risk to player accounts than the strategy of having the in-game password controlled via the email reset process for AWA.

I would prefer to have these two separate.

A strategy that retains the AWA process with an additional action where a forum account is created and the password reset link is emailed to the account holders email address when the account holder first logs into the game would be preferred.

[Alyx "Daisy" Johnson]

+1 Jane - linking the two seems to be adding a level of insecurity I would not wish to see. seems I will not be changing the password on Forum for quite a while

[The "Fifth" Entity]

A strategy that retains the AWA process with an additional action where a forum account is created and the password reset link is emailed to the account holders email address when the account holder first logs into the game would be preferred.

Have to disagree.
I consider the chances that the e-mail account of the average user will be hacked considerably higher than the probability of losing the password as a result of someone hacking the forum.

It's a good example actually, reminds us that nothing in this world is 100% secure. If you want 100% security, close all your accounts, power off your modem and and never use it again 

[Event "Janе" Horizon]

A strategy that retains the AWA process with an additional action where a forum account is created and the password reset link is emailed to the account holders email address when the account holder first logs into the game would be preferred.

Have to disagree.
I consider the chances that the e-mail account of the average user will be hacked considerably higher than the probability of losing the password as a result of someone hacking the forum.

It's a good example actually, reminds us that nothing in this world is 100% secure. If you want 100% security, close all your accounts, power off your modem and and never use it again 

Given that my game email address is less public than the existence of this forum:
I would rate the risk of my email address being hacked as a very unlikely 5 out of 36.
While I would rate the risk of this forum / my forum password being hacked at a unlikely 10 out of 36

What is your rating?
(see the attached chart)

Note: risk is all about perception.

[The "Fifth" Entity]

All these "less public e-mail accounts" are hacked en masse daily. Only difference is, this goes unnoticed because there's even more people who's account was not hacked. When vulnerability was found in a certain open source code it will be published all over internet.
Difference is only in how much publicity this or that will receive, not the real security level.

The same goes for the famous slogan "If two systems use the same password it's less secure".
Compare: applications on 2 systems (both obviously directly accessible from the internet) that are using 3rd server (not accessible from the internet at all) as their password database; with: just 1 server that has both the application and the password database and is directly accessible from the internet. Suffices someone hacks this single server and BAM, your lost all your passwords.

Or this slogan: "If there's a password consider it will be hacked!" Sounds terribly wise, but if u look closely, it's the same as a lawyer who declares: "All cases will be lost!". Only difference is - such a lawyer will be out of job but security consultant will get a rise.
Reality is, the secure systems can be built, secure passwords that cannot be hacked can be created and it seems all the same and equally hopeless only for those who have no idea how exactly things work.

[Event "Janе" Horizon]

There is a well published survey comparing peoples attitudes to the risks associated to living beside a Nuclear power station and crossing the road.

Most people got the risk rating wrong.

[Paul "Cuey" Darkmane]

Why not have Gold cards (for wanting a better name) Like the other game has or pin system when you start the game that has nothing to do with the forum like Aion Has ... i would be happy then ... other than that ... different passwords for the forum and game.