Security Breach in Second Life Prompts Protective Measures

Linden Lab‘s Second Life has been in the news a lot recently, if only because a presidential candidate decided to try and drum up interest for the next elections by going into the Second Life world. That’s not the only news that’s hit the Linden scene, however, as an attack on the Second Life servers prompted Linden to shore up their defenses.

The security breach hit their databases, “which potentially exposed customer data including the unencrypted names and addresses, and the encrypted passwords and encrypted payment information of all Second Life users,” according to their security bulletin. Credit card information remained protected, fortunately, and they’ve made the affected system more secure. One other effect of the attack was the resetting of passwords, which also opened up additional ways for users to remember their passwords, just in case.

It’s just sad that someone even tried it on Second Life, which is less like an MMORPG and more like a socialization and world creation game. In any case, we’ve provided the main security bulletin after the jump. Stay safe folks, and remember to use protection. You never know what could be lurking out in the internet. Thanks to Sudden Device for the heads-up.

Linden Lab‘s Second Life has been in the news a lot recently, if only because a presidential candidate decided to try and drum up interest for the next elections by going into the Second Life world. That’s not the only news that’s hit the Linden scene, however, as an attack on the Second Life servers prompted Linden to shore up their defenses.

The security breach hit their databases, “which potentially exposed customer data including the unencrypted names and addresses, and the encrypted passwords and encrypted payment information of all Second Life users,” according to their security bulletin. Credit card information remained protected, fortunately, and they’ve made the affected system more secure. One other effect of the attack was the resetting of passwords, which also opened up additional ways for users to remember their passwords, just in case.

It’s just sad that someone even tried it on Second Life, which is less like an MMORPG and more like a socialization and world creation game. In any case, we’ve provided the main security bulletin after the jump. Stay safe folks, and remember to use protection. You never know what could be lurking out in the internet. Thanks to Sudden Device for the heads-up.

The following FAQ was sent out this evening to all Second Life Residents:

===================
FREQUENTLY ASKED QUESTIONS

Q: I can’t log in to Second Life. How can I regain login access?

A: As a security precaution, all Second Life account passwords have been invalidated. You need to establish a new password in order to log in. You can receive instructions for changing your password by visiting http://secondlife.com/password. Please note that we are updating the password request process – if you have recently tried that page and could not change your password, please try again.

Q: Was my account information compromised?

A: We discovered that a database was accessed by the intruder, and we are able to determine the aggregate size of the data that was downloaded through the intrusion. The database accessed includes customer account information, including Second Life account names, real-life name and contact information in unencrypted form. Account passwords and payment information (consisting of credit card numbers and Paypal transaction IDs) are stored in this same database in encrypted form. However, there is no way to identify which data were accessed at the level of individual users, only the aggregate size of the downloads returned from the intruding database queries. We are conducting further investigation to try to determine the class of data exposed.

Q. Is my information still at risk from another attacker?

A: The compromised system was rebuilt and made more secure. We will be announcing additional plans for security improvements in a post to come on our blog, at http://blog.secondlife.com/?tag=security.

Q: Should I be concerned that encrypted password and encrypted payment information may have been exposed? Is the encryption unbreakable?

A: We use an MD-5 hash (scramble function) and salt (additional data) to encode passwords and payment information, an industry standard technique that is commonly regarded as difficult to defeat. However, no hash or encryption is unbreakable, given enough time and computing power. If you believe that you may be the victim of credit card fraud, you should contact your credit card company. If you use your Second Life password on other websites, online services, or any other services, you should change the password on that service as well. You can find additional tips for protection of your identity online at http://www.privacy.ca.gov/sheets/cis1english.htm.

Q: What kind of attack was used to gain access to the Second Life databases? Has the identity of the attacker been established?

A: We have gathered a significant amount of information regarding the attack and the attacker. However, because the investigation is ongoing, we cannot provide very detailed information regarding the type of attack or identity of the attacker. We can disclose that the intrusion path took advantage of a “zero-day exploit” in third-party web software.

Q: What was the timing of the attack and Linden Lab‘s investigation?

A: Our forensic investigation began on September 6, 2006. Based on this investigation, the intrusion attempts may have started as early as September 3, 2006. However, we have not found evidence of successful database access occurring before September 5, 2006. On September 6, 2006, unusual activity in our database logs revealed the attack to Linden Lab, and we investigated, found and closed the intrusion on the same day. At that point, there was no evidence that databases containing customer identity information had been compromised. For the following two days, the focus of our investigation was to determine the extent of the database access and the nature of the data downloaded from our system. On September 8, 2006, we concluded that there was a substantial likelihood that customer account information could have been accessed. The investigation is ongoing and we will report further results as they become available at http://blog.secondlife.com/?tag=security.

Via Second Life Community Page