2 million NCSoft accounts stolen

you had McAfee before???

I hope that anet takes this to heart and puts back that security layer that ncsoft removed. 'Just because it seems to be working is not a reason to stop using it'.

I've been using AVG Free for years, and also started using Microsoft Security Essentials after getting Windows 7.

Both of them are free and I've never had a problem with viruses or malware.

I also got a free copy of Kapersky bundled with a motherboard, but I havnt botherd installing it since I dont need it. I think it would only be a cut down version or just a 1 year license and then you have to pay, so never bothered using it.

O.M.G.
Such poetic irony.

Good find, my friend.

I've been wondering about the relative risks of changing vs. not changing passwords too. Normally it's a no-brainer, but NCSoft is so incompetent with security that I wouldn't be surprised if it's safer to just leave things alone. What are the risks of NCSoft accidentally sending your confirmation to the wrong person, a hacker listening to NCSoft's site and intercepting your password change, etc., compared to the risks of someone having your current password? Anyone here have enough actual security knowledge to hazard a good guess?

If there is any accuracy to that Symantec report, the threat lies in the fact that the bad guys have somehow obtained about 2 million NCsoft account credentials (NCsoft master, or various NCsoft games, I don't think it made a distinction), presumably by gaining access to NCsoft's servers at some time in the past... not by hacking/keylogging individual users... this means, according to Symantec at least, that old account credentials (username, password etc) are potentially vunerable, and the safest thing to do would be to update your passwords.

Remember of course, this comes from Symantec (aka Norton Internet Bloatware).

Also, they have no idea of how old these 'NCsoft credentials' are, for all we know the 'hackers' could have obtained their data ages ago, and indeed might be the cause of the (relatively) recent huge number of compromised accounts that NCsoft addressed by (among other things) adding the character name to the login credentials for Guild Wars.

If in doubt, check your system thoroughly for virus/spyware... use multiple sources to check, don't rely on just one AV program, if your system is clean with no risk of keyloggers... go update your passwords.

Thank you for proving my point...you wouldn't know if your computer was infected...hence how can you say it worked wonders for you?

Yet...this only got found after getting how many accounts? There is no perfect AV program out there...they will all miss stuff..usually they miss the same stuff

Reading the posts of fellow Guru-members, it´s ok, not to take the message seriously.
Only to the fact that it´s Symantec?

Symantec analyzed data in a discovered botnet. They stumbled upon the account information. It´s not about virus detection software, like norton 360 etc..
Be glad they found the information, that it is made public.

If Symantec discovered 2 million accounts possible to be hacked in the future, it's in my opinion Arenanet/Ncsoft who should be talking with Symantec to investigate whether or not the owners of the 2 million accounts should have an in game message/mail stating that they should change their passwords immediately. This will also give them conclusion to check the computer for malicious software.

Don't shoot the messenger, but the content....

EDIT:
It could be originated by the hacks of several gaming fora using outdated unsecure software, like wordpress, vbulletin etc
Trojan.Loginck
Risk Level 1: Very Low
Discovered: May 20, 2010
Updated: May 20, 2010 1:36:08 PM
Type: Trojan
Systems Affected: Windows 98, Windows 95, Windows XP, Windows Me, Windows Vista, Windows NT, Windows Server 2003, Windows 2000

Trojan.Loginck is a Trojan horse that logs on to gaming websites to check if stolen gaming credentials are valid.
Deatil: This Trojan can arrive on a computer through a variety of methods. As a result the file name of the Trojan will vary from one situation to another.

When the Trojan is executed, it contacts a predetermined server and downloads a list of stored user names and passwords for gaming websites.

Note: The Trojan does not steal these account details. They have likely been gathered by other information-stealing threats.

The Trojan then attempts to log into these gaming websites in order to determine if the account is valid.

Spyware website:
Trojan.Loginck Description
Trojan.Loginck is a dangerous Trojan infection. Trojan.Loginck will corrupt a computer system in a variety of ways, either by a spam email messages, malicious websites or file-sharing networks. The file name of the Trojan may differ from one situation to another. If Trojan.Loginck is executed on the computer system, it will contact a remote server and download a list of stored passwords for online gaming websites. The Trojan infection does not steal these account details. They have likely been collected by other information-stealing threats. The Trojan then will use the infected computer for trying to log into these gaming websites for checking if the account is valid. It is very important that a Trojan such as Trojan.Loginck is automatically detected and safely removed with a spyware removal tool.

Removal instruction:
To remove Trojan.Loginck, you must first stop any Trojan.Loginck processes that are running in your computer's memory. To stop all Trojan.Loginck processes, press CTRL+ALT+DELETE to open the Windows Task Manager. Click on the "Processes" tab, search for Trojan.Loginck, then right-click it and select "End Process" key.

To delete Trojan.Loginck registry keys, open the Windows Registry Editor by clicking on the Windows "Start" button and selecting "Run." Type "regedit" into the box and click "OK." Once the Registry Editor is open, search for the registry key "HKEY_LOCAL_MACHINE\Software\Trojan.Loginck." Right-click this registry key and select "Delete."

Finally, to completely get rid of Trojan.Loginck, you must manually remove other Trojan.Loginck files. These Trojan.Loginck files can be in the form of EXE, DLL, LSP, TOOLBAR, BROWSER HIJACK, and/or BROWSER PLUGIN. For example, Trojan.Loginck might create a file like
%PROGRAM_FILES%\Trojan.Loginck\Trojan.Loginck.exe. Locate and remove these files.

There's something I don't get here...

it took me a few hours to read though every post about the bans, and 5 minutes about this?

Isn't 2 million compromised accounts something more alarming to you people than 3,700 banned people? Where's ArenaNet now?

Look at it like this, because of the lack of responses in this thread, it means its no big deal.

Its pretty safe to say that if the system hasn't been slowed down, taken over, or any kind of personal info has been compromised that they doesn't have a virus, or at least one that's anything to worry about...

If you feel fine then there's no reason to believe that you're sick and you just don't know it yet. Unless, of course, you're a hypochondriac...

This thread is not getting the kind of attention that it should be. I know there's WiK and the account bans and other stuff to keep people distracted, but still, we ought to be paying more attention to something of this magnitude.

People would rather spam "QQ MOAR BOTTURZ LOL DHUUMSDAY" than discuss something important in an intelligent manner, Chthon.

Could someone please translate that article for the computer illiterate.
I get the part about the server, but how they got info I did not understand. Did the virus take info from the user's pc's or did they use the infected computers to search for databases and test passwords?
And yea that's pretty disconcerting. Would definitely be interested to find out what NC has to say about those accounts being new potential thefts or if it was old data from the accounts they worked to fix before.

edit: I went back to the Riverside page just to make sure I didn't miss something.
It might be good to relay that this is a new incident. I thought that it was an old thread that just had a new comment. I know I would have read this much sooner otherwise.

Is everyone too busy attacking one another to notice this? Thanks for posting. Password changed. Again. It sure wold be nice to see a response from NCSoft or ArenaNet about this.

I don't like Norton software either, but that has nothing to do with Symantec's report.

Frankly, login anouncement would be great. Red "Change your password NOW!" popup after login even better.

People usually do not think kind of dange applies to them, so apathy is understandable, even if stupid.

Check this out

Might be worth mentioning (and hopefully reassuring to you):

So, credentials were stolen in some other way (keylogging, phishing, scam).

Nothing new, but if I were you I'd change my password anyway.

Maybe the server just generates random credentials, and all infected systems just test them out. If it's used that way, they DO steal credentials

I wonder if all the WoW emails I have been getting the past few days is part of this theft ring. I don't have a WoW account, but have been told 5 times over the past 3 days I need to first protect my account, then recover my account.

Completely OT, I know, but I can't sit by and watch somebody recommend Nod32.

I can understand the vitriol regarding Symantec, especially where Norton is concerned. However, since the 2009 release of 360, the AV suite has actually been very well-reviewed. I've tried the version that my ISP gives out for free, and I think it's very passable. It's very fast, has great detection rates, and the company has good response times to outbreaks. It's not the best, but they're much better than ESET or Grisoft. The only free AV that's worth any time these days is probably Microsoft's own, unless your ISP offers Norton 360 for free. They're going to have a very tough time cleaning up their reputation of being the Quicktime of antivirus, but the new stuff is doing a good job of it.

I don't think they know, the database contained account info for a variety of games, this info was probably gathered using methods specific to each game - or game-publisher.

The virus (a trojan actually) was used to test the passwords.