E-mail lists, encrypted passwords stolen in Battle.net hack

[DarkyAngel]

The company behind games such as World of Warcraft and Diablo tells customers it believes no financial information was accessed but suggests users change their passwords immediately.

Game maker Blizzard Entertainment's internal network security has been breached, the company informed customers today.

While the company behind World of Warcraft and Diablo believes no sensitive financial information was compromised, it said e-mail addresses for non-China Battle.net players and scrambled passwords were stolen, Blizzard President Michael Morhaime said in a company blog post:

This week, our security team found an unauthorized and illegal access into our internal network here at Blizzard. We quickly took steps to close off this access and began working with law enforcement and security experts to investigate what happened.

At this time, we've found no evidence that financial information such as credit cards, billing addresses, or real names were compromised. Our investigation is ongoing, but so far nothing suggests that these pieces of information have been accessed.

In addition to the e-mail lists, the company said the personal security question and mobile and dial-in authentication information for users in the United States, Australia, New Zealand, and Latin America were also illegally accessed.

The company said it believes its cryptography techniques will make it very difficult to crack the passwords and hack into accounts.

"Based on what we currently know, this information alone is NOT enough for anyone to gain access to Battle.net accounts," Morhaime said in the blog. However, the company is nevertheless recommending that users change their passwords immediately:

We also know that cryptographically scrambled versions of Battle.net passwords (not actual passwords) for players on North American servers were taken. We use Secure Remote Password protocol (SRP) to protect these passwords, which is designed to make it extremely difficult to extract the actual password, and also means that each password would have to be deciphered individually. As a precaution, however, we recommend that players on North American servers change their password.

The disclosure comes at a time of heightened awareness over password security. Last month, Yahoo confirmed that some 453,000 login credentials stored in plain text were stolen from the Web pioneer's network. Other recent high-profile password thefts at LinkedIn, eHarmony, and Last.fm contributed to approximately 8 million passwords posted in two separate lists to hacker sites in early June.

Sursa