News Story: GameSalad accounts hacked and sold online

tatiang

Thanks to @unbeatenpixel for posting about this here: https://forums.gamesalad.com/discussion/comment/609805/#Comment_609805.

And the link to the news story:

https://www.zdnet.com/article/round-4-hacker-returns-and-puts-26mil-user-records-for-sale-on-the-dark-web/

jamie_c

Thanks for getting the word out.

RowdyPants

Think of the energy put into security that could be saved if people were just honest.

By the way, now is a great time to CHANGE YOUR PASSWORD peeps!

AlchimiaStudios

Thanks for the heads up. Just changed my password, everyone should be doing the same!

pinkio75

Thanks for this info i just change my password; but the publishing portal site is stuck for this reason? i mean i'm unable to compile or download any of my games... anyone have the same issue???

hirobagames

Same here publishing portal is not working i am getting no internets error.

adent42

@hirobagames, @pinkio75 please try publishing / downloading now. The issue was due to us locking down the system after this breach, but missing some config updates.

Everyone else. We are aware of the issue and are working on fixes. We should be getting an email out to everyone soon.

1) If you use a strong password, you're likely safe. The breach did not include passwords for most people, just password hashes.

2) That being said, if you use a weak/ common password (or even a strong password that is common), you might be vulnerable to a reverse hash lookup.

If you're familiar with the phrase "hash", we don't store your password, we store what's known as a "cryptographic hash" of your password.

An algorithm takes your password and converts it into a different string (the hash).

There's no way to work backwards from the hash to your password via an algorithm, BUT hackers have started taking common passwords and hashing them. They then build dictionaries of these hashed passwords and can then look up the original password in these dictionaries.

We are changing how passwords are hashed so that they will be much more difficult (impractical) to dictionary attack, but if you use a password that has been put into a hacker's dictionary, you are at risk.

The other thing to note is that if you are vulnerable, you should change your password everywhere you use the same email address / username / password pair, as a competent hacker will start trying your discovered email / password combo on major services to see if they can get in.

pinkio75

Hi and thanks for reply @adent42 , yes it' works fine for me; now i'm able to generate build etc; about the passw i've changed it yesterday.

AlchimiaStudios

Thanks for the update @adent42

Hypnorabbit

Thanks for the update @adent42 - hope it's resolved.

muusi

Thanks for the heads up @tatiang !

joseaugusto

Why on earth did you NOT SALTED the hashes?

Please don't try to pass the blame on us for us having weak passwords.

We would still be safe if you had just salted the hashes. (even after allowing the hackers in)

UtopianGames

We've had much worse, I remember when GS was hacked and all our files yes everything we uploaded to GS got into the wrong hands and he was selling it all for a pretty cheap price.

DBA (if you guys remember us from back then) and one other who will remain nameless managed to get his name and address and proof he had all the files.

We handed this info over to GS and they started criminal proceedings, makes me wonder if the new hacker got into the files?

LumpApps

@adent42 said:

Everyone else. We are aware of the issue and are working on fixes. We should be getting an email out to everyone soon.

Hi there,
Was this email ever sent. I didn't receive one. I got here via @PhilipCC who geve me a heads up.

Thanks in advance.
Ludwig

tatiang

@LumpApps said:

@adent42 said:

Everyone else. We are aware of the issue and are working on fixes. We should be getting an email out to everyone soon.

Hi there,
Was this email ever sent. I didn't receive one. I got here via @PhilipCC who geve me a heads up.

Thanks in advance.
Ludwig

Yes. See this for the content: https://forums.gamesalad.com/discussion/comment/610708/#Comment_610708

LumpApps

Tja is @tatiang

samui

guys, use some protection tools

samui

I prefer to protect my privacy and use https://veepn.com/vpn-features/double-vpn/ which is good during internet surfing and visit different websites and foums.