I got hacked

[vatas]

No idea if this is connected and this is basically hearsay, but someone said they lost 4 top-quality treepots and suspected a bug.

How long ago?

It seems not enough people know about the (awesome) security logs that you can check.
On this website, the person can go to:

Code: Select all

Account -> Account Security -> View Security Log

I should've elaborated on the "hearsay" -part, it was just a conversation in realm chat.

[dor]

From discord:

To be sure, it's not just a random brute-force bot, the site does have protections against that. The attacker just logged straight into the accounts without any password misses.
Or well, there were some accounts where he used the wrong passwords, but on the ones where they did successfully log in, they logged right in.

Suggesting that the credentials that failed had changed passwords since their compromise.

This is generally suggestive of some kind of phishing/scraping.

I'm not on main HnH discord as you said to me once that it doesn't worth it

Or well, there were some accounts where he used the wrong passwords

This part kinda proves my hypothesis. But numbers are important here to really prove it. As far as I understood attacker didn't really hide his doings and all attempts was made from one(?) address, so all these failed attempts can be isolated. If majority of attempts was failed - it would mean he still was bruteforcing, but with well prepared base. If majority of attempts are successful - it would be quite concerning. But, on the second thought.. So many variants.. For example, login:pass pairs could already be validated using other place. So it would be possible to say only one thing - if HnH was used as validation for login:pass pair from leaked DB.

Sorry, love that forensics shit, since UO

[svino]

The website has had no ssl (by default, i.e 99% of all users who didn't manually install the ssl certificate) for a very long time.

In unencrypted protocols, if you log in, and your user/pass login request jumps through just one bad dns on the way you are basically compromised. Some people make a business of selling this stuff, so It could be that the guy got the information from a database of unencrypted user/pass/website from some unethical site.

[berkys]

I've also reset the password on all of these accounts, just in case they all use password123.

How this helps if their email adress is also changed? Sadly you can change email adress with only password, you dont need access to their email to change it (this is common in other sites, so you can get back your account if hacked)

[loftar]

How this helps if their email adress is also changed?

Well, the reason I mentioned it there was just so that noone got the idea to try simple passwords on the listed accounts, but since then I've also reset the e-mail addresses of the accounts to what they were prior to being changed.

Sadly you can change email adress with only password, you dont need access to their email to change it

This is said every time accounts are hacked, but needing access to the previous e-mail account to change the address of an account disables one of the main reasons to change the e-mail address of an account, namely when you've lost access to the previous e-mail account.

[PanListek]

Strange things have recently started to happen at our base.
We've lost some of our precious gear, and today when I logged into the game it turned out that we don't have permissions for our claim.
No one has attacked us, the palisade is standing, everything is in top order.
Strange...

[berkys]

This is said every time accounts are hacked, but needing access to the previous e-mail account to change the address of an account disables one of the main reasons to change the e-mail address of an account, namely when you've lost access to the previous e-mail account.

Well, if somebody hacks your email so badly you cant get it back, youre dumbass. I use mediocre passwords everywhere knowing I can reset them, but email is really long one with many diff types of characters, and I never store it anywhere... If I lost my email account, I would ask you to change it and expect you to send message to it asking if its allright. If nobody answers, its really lost. Other way I can stop it if somebody pretends loosing email to get access to others accounts...
Curious question - how often is email lost, and how often is game account lost?

[loftar]

Well, if somebody hacks your email so badly you cant get it back, youre dumbass.

It's more about many people using throw-away, temporary, secondary or old e-mail accounts to register other accounts around the Internet (I often do this myself, too), and then if/when the Haven account starts to matter to them, they switch it to their main e-mail account. I see this quite a bit, with transitions from services like Mailinator over to GMail or somesuch.
I'm also pretty sure that it's the normal case for other sites too that you don't need confirmation from the previous e-mail account when switching e-mail addresses. I've never seen that myself, at least.

[Zorander]

I don't know if this is related, but when I logged on earlier today, I found that I was missing 6 bars worth of silver nuggets, 2 rock crystals, 2 travellers' sacks, and a merchant's robe and a q300 smithy's hammer. At first I suspected someone had entered my compound through my mine (that problem has been fixed), but there were no scents. Also, there was a pile of gems next to the chest the silver was in that was untouched. The two travelers' sacks were on two different sets of clothes in my wardrobe.

[loftar]

Strange things have recently started to happen at our base.

Not sure I can tell you what happened, but I can't see any obvious indication that any members of your village (of three members, right?) has been involved in this hack.

I don't know if this is related

Your village, on the other hand, has had a Theft spree committed against it, so my bet would be on that.