Data leak

[Allancia]

Also, would it be possible so that people whose data was leaked can receive a report on the full extent of the damage? Like, saying what telegrams were exposed, or what puppet nations were affected to what extent, that kind of thing. It wouldn't have to be personal, it could be automatically generated, but it would help a lot of people get a safe state of mind.

[Zarvarza]

My questions are?

1. The nation who was compromised and got my telegrams exposed publicly, is that nation dead now, or alive now?

2. Moreso, I really just want to know what telegrams those actually were. In our region (Illuminati) it is not uncommon to share phone numbers, actual addresses, emails, etc as a large lot of us interact and meet outside of NS as well in yearly meet ups. Can I be privately informed of which specific telegrams were exposed? (Answered. They were all recruitment telegrams (whew).

3. What measures will be taken in the future to prevent this sort of thing from happening again?

[Smoya]

My questions are?

1. The nation who was compromised and got my telegrams exposed publicly, is that nation dead now, or alive now?

2. Moreso, I really just want to know what telegrams those actually were. In our region (Illuminati) it is not uncommon to share phone numbers, actual addresses, emails, etc as a large lot of us interact and meet outside of NS as well in yearly meet ups. Can I be privately informed of which specific telegrams were exposed?

3. What measures will be taken in the future to prevent this sort of thing from happening again?

I have these same questions, since I had a TG leaked.

[Allancia]

My questions are?

1. The nation who was compromised and got my telegrams exposed publicly, is that nation dead now, or alive now?

2. Moreso, I really just want to know what telegrams those actually were. In our region (Illuminati) it is not uncommon to share phone numbers, actual addresses, emails, etc as a large lot of us interact and meet outside of NS as well in yearly meet ups. Can I be privately informed of which specific telegrams were exposed?

3. What measures will be taken in the future to prevent this sort of thing from happening again?

I have these same questions, since I had a TG leaked.

I asked about this. Creating damage control and private leakage reports would be very helpful for everyone, in my opinion.

[Todd McCloud]

Just wanted to say that I appreciate the mods / admins being on top of this situation, in addition to being transparent about the goings-on with respect to this breech.

[[violet]]

Also, would it be possible so that people whose data was leaked can receive a report on the full extent of the damage?

Yes, if the Data Leak Checker tool finds anything untoward, you are instructed to contact us for further assistance. There we will answer any questions you have, including showing you exactly what was exposed.

[Allancia]

Also, would it be possible so that people whose data was leaked can receive a report on the full extent of the damage?

Yes, if the Data Leak Checker tool finds anything untoward, you are instructed to contact us for further assistance. There we will answer any questions you have, including showing you exactly what was exposed.

Individually responding to everyone would be difficult. I was thinking of an automatic report system for people who show their passwords and emails.

[Zarvarza]

Just wanted to say that I appreciate the mods / admins being on top of this situation, in addition to being transparent about the goings-on with respect to this breech.

Yes, I think it is thus far being excellently and quickly.

[[violet]]

The nation who was compromised and got my telegrams exposed publicly, is that nation dead now, or alive now?

Probably dead. Of the 3,325 exposed nations, I think only 17 are still current.

Moreso, I really just want to know what telegrams those actually were. In our region (Illuminati) it is not uncommon to share phone numbers, actual addresses, emails, etc as a large lot of us interact and meet outside of NS as well in yearly meet ups. Can I be privately informed of which specific telegrams were exposed?

Yes, absolutely. I know you've already figured this out, because I have sent you the telegrams, but for anyone else: contact us and an admin will go through the data for you.

The vast majority of exposed telegrams are recruitment TGs sent to dead nations, but you should contact us to make sure.

What measures will be taken in the future to prevent this sort of thing from happening again?

Well, as bizarre as it seems, at this point it looks like we basically got struck by lightning. We produced a file, it was valid, it was all okay, we copied it to a backup, and in the process of copying--which is a normal operation the server does a million times a day--the disk barfed and took some data from somewhere else.

So short of replacing the disk, which we did last October, there's not much to be done. Which I understand will not really fill anyone with confidence, least of all me, although it is the first time anything like this has happened in 12 years.

[Torisakia]

Good thing I have LifeLock(sponsor).

I'm surprised I wasn't affected, considering how much of my personal info I put on this site. I think that even if my info was leaked, no one would do anything with it. Who would want to be me?

There's not a lot that someone could do if they did get the leaked data, really. But in a worst-case scenario, it could cause problems.

For example:
-Player A uses the same password for their NS account and the email account they put on their NS nation. BadGuy gets the password hash, and because Player A uses a weak password, BadGuy is able to crack it and get into Player A's email account where any number of shenanigans can then ensue.
Or:
-Player B uses the same password/email combination on their NS account that they do on their banking website. BadGuy gets the password hash and given sufficient time manages to crack it and use it to get into the banking website account.

Scenarios like that aren't likely, granted, but it's still better that folks are aware. Also, the moral of the story: Don't use the same password you use for NS for anything important like yer banking stuff!

I use the same password (and variations of it) for all my logins...

Fuck.

[Hobbesistan]

Can't filters be put in that would quickly check for language specific for, say, telegrams, as a safety check before the dump is, well, dumped?

I don't forsee it being too extensive a 'fix' to put people at ease, but I don't know how big the mountains of data being shifted are.

I use the same password (and variations of it) for all my logins...

Fuck.

Your password is still hashed (I am unaware of what NS uses, but I believe phppBB uses salted MD5 by default), which makes it rather difficult to crack.

Using different passwords is merely a safety advisory, and while I would join Rep in advising it, you won't instantly loose all your stuff if you do otherwise.

[[violet]]

Individually responding to everyone would be difficult. I was thinking of an automatic report system for people who show their passwords and emails.

Not many people were affected and we're happy to go through it manually to answer individual questions. Just contact us.

[Ainocra]

good catch, thanks for keeping us updated.

[[violet]]

Can't filters be put in that would quickly check for language specific for, say, telegrams, as a safety check before the dump is, well, dumped?

I don't forsee it being too extensive a 'fix' to put people at ease, but I don't know how big the mountains of data being shifted are.

This check wouldn't have detected the corruption, because the original dump was fine. It was only when the file was copied to backup that it became corrupted.

[Hobbesistan]

Can't filters be put in that would quickly check for language specific for, say, telegrams, as a safety check before the dump is, well, dumped?

I don't forsee it being too extensive a 'fix' to put people at ease, but I don't know how big the mountains of data being shifted are.

This check wouldn't have detected the corruption, because the original dump was fine. It was only when the file was copied to backup that it became corrupted.

Ahh, alright.

All of this is done on the same box? Obviously the server conducting the backup would need to have this data on it to have spilled it when it became corrupted.

Apologies for being nosey, just looking for some insight.

[The Unites State-Of-Minds]

This incident seems to make it clear that the staff manning NS are more competent at managing Data leaks then the majority of US business.

[[violet]]

Creating damage control and private leakage reports would be very helpful for everyone, in my opinion.

This is what the Data Leak Checker tool is. You can quickly check whether your current nation was involved in any way, or whether it has shared an email with any involved nation, or whether any involved nation was holding a telegram sent by you.

Almost everyone is going to be cleared by that check, and anyone else should speak to us so we can answer questions.

[Kyrusia]

[violet], I have a bit of a question. Namely, considering these leaks nominally occurred when the drive went belly-up last September, and thus the leaks were likely to have occurred between September and October of 2014, am I wrong to assume that many of those affected by the data leaks would likely have already felt its effects if (and that's a pretty big "if") the leaked information was going to be used for malicious purposes?

In short, considering the discovery was made yesterday, but the leak itself occurred sometime in the last quarter (or so) of 2014, is it presumptive to assume that any potential malicious activity caused as a result would already have impacted users - if they were going to feel an impact (such as a hacked account, etc.) at all?

Much appreciated.

[[violet]]

[violet], I have a bit of a question. Namely, considering these leaks nominally occurred when the drive went belly-up last September, and thus the leaks were likely to have occurred between September and October of 2014, am I wrong to assume that many of those affected by the data leaks would likely have already felt its effects if (and that's a pretty big "if") the leaked information was going to be used for malicious purposes?

In short, considering the discovery was made yesterday, but the leak itself occurred sometime in the last quarter (or so) of 2014, is it presumptive to assume that any potential malicious activity caused as a result would already have impacted users - if they were going to feel an impact (such as a hacked account, etc.) at all?

Much appreciated.

I really can't answer that. My hope is that no-one cared enough to download that file, or at least no-one with an interest in doing bad things with personal data, and that's the end of it. But if the Data Leak Checker says you were one of the unlucky 0.08%, I definitely wouldn't be assuming that if anyone was going to abuse it, they already would have: I would be changing my password.

Edit: I should also clarify that although the corruption happened last year, the file has been sitting there until yesterday. I have logs showing that until a player reported it, it hadn't been downloaded in the previous two weeks, but beyond that I don't know. It may have been downloaded by anyone between October and then.

[Hobbesistan]

[violet], I have a bit of a question. Namely, considering these leaks nominally occurred when the drive went belly-up last September, and thus the leaks were likely to have occurred between September and October of 2014, am I wrong to assume that many of those affected by the data leaks would likely have already felt its effects if (and that's a pretty big "if") the leaked information was going to be used for malicious purposes?

In short, considering the discovery was made yesterday, but the leak itself occurred sometime in the last quarter (or so) of 2014, is it presumptive to assume that any potential malicious activity caused as a result would already have impacted users - if they were going to feel an impact (such as a hacked account, etc.) at all?

Much appreciated.

I'm not [violet], but I can give a general idea.

In short, yes, though the way it looks the leak wasn't any malicious action, and I don't think anyone who caught on to it (the 'daily dump' backups are not exactly regularly browsed) used it maliciously, as [violet] said, only 17 of the nations discovered are still alive, so theres really not much at risk numerically, however, I would imagine that if any of it was used maliciously pertaining to nations directly affected, it probably would've already happened.


As previously said though, if you're one of those affected, you really should change your password.

[Kinstantia]

The fact that this was brought to our attention as soon as NS was aware, and the fact that NS is willing to give further details to those few who were affected by this issue, make me feel safer on NS than most other websites. Thank you for your prompt warning on this matter and for the actions taken since. It is nice to know there is one place on this internet where such issues are taken seriously and dealt with accordingly.

[Kyrusia]

Thanks, [v] and Hobbes. I understand, especially with things like this, you can't ever work under a presupposition of absolute certainty - nor should you. Even if people aren't impacted by this (Thanks for the Data Leak Checker, by the way; that was exceptionally helpful - even for the vast majority of us who only see the pretty green box saying we're effectively safe.), it does serve, I feel at least, as a good lesson to keep up-to-date with your regular password changes and the like.

[Allancia]

Alright, all of my conceivable questions have been answered. Thank you Violet and Hobbes for remaining so vigilant. It means a lot in times like this.

[Hobbesistan]

Thanks, [v] and Hobbes. I understand, especially with things like this, you can't ever work under a presupposition of absolute certainty - nor should you. Even if people aren't impacted by this (Thanks for the Data Leak Checker, by the way; that was exceptionally helpful - even for the vast majority of us who only see the pretty green box saying we're effectively safe.), it does serve, I feel at least, as a good lesson to keep up-to-date with your regular password changes and the like.

The reason it's always advised to use a password on NS that's different from your other sites is, even though in reality it is 99.999% probable that your password is secure, in that 0.001% chance that it isn't, your other services are protected.

Even in the event that your password is leaked, it's in a hashed format, for example:

d1baa9f1cb3e931e735fc91938aea11c

directly translates to

Hellomynameishobbes

(this is not the hash NS uses, i'll go into more detail below)

The server keeps a specific "key" with it that is able to decypher this hash and verify if the password enters matches. Any hacker will just have the hash and will not have the ability to see what the password is from the hash code.

That said, there are methods to crack hashing. It takes time, but it's doable, particularly in the example of 'dictionary crackers' which litterally go through a online dictionary with numbers added to generate common passwords, often at thousands of tries a second. This is why [violet] previously advised against using common dictionary words as your password, as these are easilly crackable. (side fact: this is why there is a x amount of tries before you time out of password attempts, is to counter crackers like these which try thousands of combinations a second)

Overall, you shouldn't be afraid of your 'plain text' password going anywhere, because it doesn't exist within the software. Hashes are designed to offer you a extra level of security in the event of this exact situation, but they are not perfect.

(@Violet, The language 'Only (encrypted) password hashes were exposed, not plaintext passwords.' I would reccomend possibly changing as it may put the mindset to people that 'plaintext' passwords are on the server)

My tips for a 'secure' password:
1) Don't use dictionary words (see above), even adding numbers won't help (e.g: Fabulous1) as most 'dictionary crackers' will check for this.
2) The longer it is = the more secure the hash
3) Don't use it anywhere else, I am aware this is a lot to ask for, so at the least, use 2-3 different passwords and spread them out.
4) Important use a different password for your personal things (say, email) then 3rd party sites, say, NS, as both someone getting access to your email gives them more information and Email will likely be the medium you will use to get your NS account back if it is lost, If the hacker has your email password to, then you're SOL.

[Kyrusia]

[snip]

Much appreciated for the further explanation. And aye, dictionary attacks or other means of brute force are possible, especially with simple passwords. I know I have advised other players to utilize a full, 30-character, randomized alphanumeric string with variable case just for an added degree of security. Sure, it's more difficult to remember, but mnemonics can be made to remember just about any random string if you work at it long enough.