Welcome to the Second Life Forums Archive
These forums are CLOSED. Please visit the new forums HERE
Should I Cancel My Credit Card? HELP IMPORTANT |
|
|
Thistle Decatur
Registered User
Join date: 25 Aug 2006
Posts: 77
|
09-09-2006 00:50
It's like the story of the guy who blew a million dollar deal for his company. His boss calls him into his office, and the guy says "I know. I'm fired". The boss says, "Are you kidding? We just spent a million dollars educating you."
|
|
nimrod Yaffle
Cavemen are people too...
Join date: 15 Nov 2004
Posts: 3,146
|
09-09-2006 00:51
It's like the story of the guy who blew a million dollar deal for his company. His boss calls him into his office, and the guy says "I know. I'm fired". The boss says, "Are you kidding? We just spent a million dollars educating you." RL story? O_o _____________________
"People can cry much easier than they can change."
-James Baldwin |
|
Sky Goodnight
Registered User
Join date: 28 Apr 2006
Posts: 16
|
09-09-2006 01:10
On the 1st Spetember, I received a phishing email (CC Co.). That in itself is not so unusual, although I have never received one mimicing my CC. What is unusual, is that it contained my full address and telephone number, something that I have never personally experienced. I don't want to sound uneccessarily alarmist, and maybe it's nothing, but: The email was sent to the registered email of avatar x. The particular CC co. being mimiced was the one registered to avatar x. I haven't used this particular card anywhere in nearly a year. I have never ever received a scam email that contained my full address. All these lead to me to worry. The email of course doesn't indicate that the CC no. is known, but that the scam artist knows the email + address + tel no. + CC company. Am I clutching at straws here? It was a week ago. Well Hiro... that sounds pretty darn suspicious to me. The mere fact that this mail was sent to the registered email connected to your SL account is a big red flag. Do you use the same email address for other things? _____________________
Sky Goodnight
www.slexlife.com |
|
Hiro Queso
503less
Join date: 23 Feb 2005
Posts: 2,753
|
09-09-2006 03:45
Seems to me that anyone stressed out by the possibility of credit card info having been accessed by crooks should cancel the credit card that LL has on file, to eliminate the cause of their stress, whether doing so is actually needed or not. If you cancel the card, you can stop worrying, if you don't, you will probably stay worried. Posting in the general forum and asking for a response by a Linden is not likely to be as effective as posting in the Answers forum where only Lindens can answer. Posting in the general forum and acting like non-Lindens shouldn't answer is just silly. Before making this post in general, I approached to Lindens in world. Here were the two answers from two diff Lindens: Linden 1: "email [email]support@secondlife.com[/email]" Linden 2: "blog.secondlife.com man" And duh, of course I cancelled the CC, but that CC isn't the only one in existence lol. Since LL couldn't give me any info, I wanted to not only get opinions here, but also warn others should my suspicions be founded. So, no, it's not silly. |
|
Hiro Queso
503less
Join date: 23 Feb 2005
Posts: 2,753
|
09-09-2006 03:50
Well Hiro... that sounds pretty darn suspicious to me. The mere fact that this mail was sent to the registered email connected to your SL account is a big red flag. Do you use the same email address for other things? Yes I do. Of course, it's entirely possible that some other company's db elsewhere has been hacked, but this is too much of a coincidence for me given that I haven't used this card in over a year. |
|
SuezanneC Baskerville
Forums Rock!
Join date: 22 Dec 2003
Posts: 14,229
|
09-09-2006 05:49
So, no, it's not silly. I'm not sure what you are saying is not silly. Being concerned about the security problem isn't silly. Asking a question in this forum isn't silly. Asking a question in the general forum, where anyone can answer, and expecting no one but Linden employees to respond is silly. _____________________
-
So long to these forums, the vBulletin forums that used to be at forums.secondlife.com. I will miss them. I can be found on the web by searching for "SuezanneC Baskerville", or go to http://www.google.com/profiles/suezanne - http://lindenlab.tribe.net/ created on 11/19/03. Members: Ben, Catherine, Colin, Cory, Dan, Doug, Jim, Philip, Phoenix, Richard, Robin, and Ryan - |
|
Hiro Queso
503less
Join date: 23 Feb 2005
Posts: 2,753
|
09-09-2006 05:51
Asking a question in the general forum, where anyone can answer, and expecting no one but Linden employees to respond is silly. Well I guess that it's fortunate that I was addressing everyone but the Lindens then, eh? |
|
Toreddar Luchador
Registered User
Join date: 19 Jun 2004
Posts: 20
|
see? THIS is....
09-09-2006 06:21
what I was thinking about happening when I first ranted about the "payment info used" BS when it first came out....about LL making things easier for a hacker who got6 ahold of the info and wanted to know who exactly to concentrate their unencrypting efforts at....why make it easier for them? Now, things are just wait and see? I have had a one dollar debit made to my account as of yesterday/last night....and that sort of thing usually only happens right before LL takes out their monthly fee right before the first of the month....why the dollar debit now? Time to change things and make others alert, too.
|
|
Jamie David
Registered User
Join date: 8 Jun 2006
Posts: 123
|
09-09-2006 07:08
Reading carefully what they said, The “Unencrypted Creditcard information” was on seperate computers. What was on the database was encrypted version of the Credit Card that was hashed and salted. It is but a matter of time before someone can figure out the key for all the numbers.
But if that is really what is happening, who knows. I have searched for Zero Day Exploits for both WorldPress and vBulletin and can find nothing. Last expolit was august 20th. I want to know what is being done to catch the hacker and secure the data? Are the FBI involved? This is a Federal crime and Visa says they have no information on any issues with LindenLabs. I want my personal data secured, not left out there to be passed around the Internet as the latest useless password file to show how LindenLabs security was broken. My Name address, City, Zip Code creditcard, birth date and mothers maiden name. What more would an identy thief want? What is happening??????? Where are the boys in Blue? |
|
Cinos Field
Registered User
Join date: 21 Jul 2006
Posts: 91
|
09-09-2006 07:32
Well...
If they used good encryption there is no realistic risk at all. If they didn't... well, I can just report "stolen" transactions and get the money back. Big deal. |
|
cinda Hoodoo
my 2cents worth
Join date: 30 Dec 2004
Posts: 951
|
09-09-2006 08:12
i still wouldnt take any chances, contact your credit card co's and banks and get the info you need to protect yourself.
id rather err on the side of being overly precausios, rather than being sorry later. |
|
Lord Sullivan
DTC at all times :)
Join date: 15 Dec 2005
Posts: 2,870
|
09-09-2006 08:39
i still wouldnt take any chances, contact your credit card co's and banks and get the info you need to protect yourself. id rather err on the side of being overly precausios, rather than being sorry later. Robin Linden has just commented about CC on this thread/post /108/3b/135848/8.html#post1278549  _____________________
Independent Shopping for Second Life residents from established and new merchants.
http://slapt.me  slapt.me - In-World HQ http://slurl.com/secondlife/Bastet/123/118/26 |
|
Cocoanut Koala
Coco's Cottages
Join date: 7 Feb 2005
Posts: 7,903
|
09-09-2006 09:09
From an email I got... Q: What was the timing of the attack and Linden Lab's investigation? A: Our forensic investigation began on September 6, 2006. Based on this investigation, the intrusion attempts may have started as early as September 3, 2006. WTF... I find this very, VERY worrisome. coco _____________________
|
|
Pumpkin Cookie
Custom Photographer
Join date: 5 Mar 2006
Posts: 108
|
cc makes ya go hmmmm....
09-09-2006 09:16
hmm on cc issue, my account was due yesterday an it wasnt taken out till this morning on sat (odd sl is closed on sat or i thought ) i have plenty of money in my checking account. my sl account says its in red a minus, i went to bank an they said no one had tried to take any money out with that amount lol an my account says on page its active an next due date is on there also sorta odd i think
|
|
Thistle Decatur
Registered User
Join date: 25 Aug 2006
Posts: 77
|
09-09-2006 09:31
My cat just sneezed! She never does that. zomg hackers!!
|
|
Annie Malaprop
Registered User
Join date: 16 Sep 2005
Posts: 82
|
Wtf?
09-09-2006 09:50
Just logged in here to see if there were others who notice the GIANT GAPING HOLE in Linden Labs' "logic". Looks like there are, but LL still isn't coming clean.
Let's see... encrypted passwords were compromised, so we'd better have you reset your password. On the other hand, "only" encrypted credit card info was compromised, so your more-important-by-several-degrees-of-magnitude financial data is safe. Huh? LL, if you're reading this, please explain. Is there some reason that encrypted financial data is inherently safer than encrypted passwords? |
|
Fenris Fizz
Registered User
Join date: 2 Jun 2005
Posts: 6
|
USD balance minus side
09-09-2006 16:06
hmm on cc issue, my account was due yesterday an it wasnt taken out till this morning on sat (odd sl is closed on sat or i thought ) i have plenty of money in my checking account. my sl account says its in red a minus, i went to bank an they said no one had tried to take any money out with that amount lol an my account says on page its active an next due date is on there also sorta odd i think I noticed that USD balance on my SL account is at minus side too (the amount of SL's monthly fee, since it's been at zero all the time until now), first time ever (that I've noticed). I'm curious about this, but I guess it's related to this event that's going on currently. Fenris |
|
Gigs Taggart
The Invisible Hand
Join date: 12 Feb 2006
Posts: 406
|
09-09-2006 17:42
As I said in Linden Answers, either the credit card numbers were not encrypted, or they are easily guessed if what LL asserts is correct.
LL says our payment information was protected by MD5 hashing. MD5 is not encryption. There's no keys. There's no way to "decrypt" it really. You can guess what it might be and test to see if it matches though. The last 5 digits of our credit card at a minimum is stored in plaintext. If it were MD5ed they couldn't display it on our information page. Using the last 5 digits and the MD5 hash, you could guess the rest in about 27 hours, as a conservative estimate of trying 1 million hashes per second. I cancelled my card and they are mailing me a new one. I suggest you do the same. _____________________
|
|
Jesse Malthus
OMG HAX!
Join date: 21 Apr 2006
Posts: 649
|
09-09-2006 19:04
As I said in Linden Answers, either the credit card numbers were not encrypted, or they are easily guessed if what LL asserts is correct. LL says our payment information was protected by MD5 hashing. MD5 is not encryption. There's no keys. There's no way to "decrypt" it really. You can guess what it might be and test to see if it matches though. The last 5 digits of our credit card at a minimum is stored in plaintext. If it were MD5ed they couldn't display it on our information page. Using the last 5 digits and the MD5 hash, you could guess the rest in about 27 hours, as a conservative estimate of trying 1 million hashes per second. I cancelled my card and they are mailing me a new one. I suggest you do the same. No, they said our passwords were protected by MD5 *PLUS SALT*. This makes them fairly un-rainbow-tableable. They also said that the billing stuff was in a non-compromised database. This is why I use PayPal... _____________________
Ruby loves me like Japanese Jesus.
Did Jesus ever go back and clean up those footprints he left? Beach Authority had to spend precious manpower. Japanese Jesus, where are you? Pragmatic! |
|
Eddy Stryker
libsecondlife Developer
Join date: 6 Jun 2004
Posts: 353
|
09-09-2006 19:12
As I said in Linden Answers, either the credit card numbers were not encrypted, or they are easily guessed if what LL asserts is correct. LL says our payment information was protected by MD5 hashing. MD5 is not encryption. There's no keys. There's no way to "decrypt" it really. You can guess what it might be and test to see if it matches though. The last 5 digits of our credit card at a minimum is stored in plaintext. If it were MD5ed they couldn't display it on our information page. Using the last 5 digits and the MD5 hash, you could guess the rest in about 27 hours, as a conservative estimate of trying 1 million hashes per second. I cancelled my card and they are mailing me a new one. I suggest you do the same. Someone already pointed out the fact that the billing information was salted, so no you couldn't brute force using the hash as a test. But at least you get a shiny new card now, mine is started to get a stress line down the middle from my wallet. _____________________
http://www.libsecondlife.org
Evidently in the future our political skirmishes will be fought with push weapons and dancing pantless men. -- Artemis Fate |