Let’s say, for a moment, that you’re a hacker looking to steal usernames and passwords and whatever else you can get your hands on, like payment card and Social Security numbers while you’re at it. You’ve been trolling corporate waters for a long time and, once in a while, you’re actually running into trouble getting past certain organizations’ defenses. The nerve!
So you start looking around at some other sources – power, government, etc., many of which are also well-defended, and then you come across gaming networks.
Hmm.
Large, sprawling, global networks primarily housing information from kids, teens, young adults, and “grown-ups” who haven’t entirely grown up yet. Lots of information. Sometimes payment card info, often not, but a veritable trove of personal data.
Bingo.
Now, while it’s true that most online gamers are technologically more sophisticated than, say, the average computer user, the gaming groups and networks they belong to, in many cases, aren’t as well-defended as you’d think. Ironic, but there it is.
Things start to get increasingly squirrely when you think about how much of the data involved here belongs to children, or how that might affect those kids down the road regarding their digital identities.
Still, over the last few years, we’re seeing more and more breaches of gaming networks, starting with the huge Sony PlayStation Network incident in 2011 (77 million accounts affected), along with a Christmas surprise breach of the same network a few years later, all the way up to the recent disclosure of the Minecraft World Map site breach (which occurred this January but has only been reported this month) with 71,000 users’ data being exposed or compromised.
In between these bookends, there have been breaches at the online videogame provider Steam, the InterPals website (a penpal site) with almost 3.5 million accounts being compromised, the Nihonomaru Anime community, with 1.7 million user accounts being hacked, The GTAGaming Forum reporting another nearly 200,000 accounts being hacked, another incident leading to 775,000 Warframe user IDs being accessed, and on and on and on.
A quick jog over to Troy Hunt’s “Have I been pwned” Twitter feed highlights most of these from the last few days alone. And, for those of you over 20 but without tween or teen children, “pwned” is either a bastardization of the chess term “pawned” or a misspelling from Warcraft for the word “owned.” Either way the meaning is more or less the same: that you’ve been owned, or humiliated, or busted, in case you aren’t already familiar with that particular piece of the new digital vocabulary.
So what’s in it for the hackers? Stolen usernames and passwords, even without credit card information, can be quite valuable in and of themselves as individuals will often use the same username and password across multiple sites, and when one of them matches, THAT’s when things get really messy and suddenly you’re not only sending spam emails about Canadian pharmacies to your friends, but there’s miraculously no money left in your bank account along with $20,000 in new charges on your Visa card.
Zach Forsyth, Director of Product Strategy for Comodo, says, “We’re seeing hackers shifting their strategies from simple short-term spending sprees with stolen card info to long-term monetization of your full identity. Increasingly, hacking is treated as a serious business and regularly includes market research into the most profitable identities an attacker should focus on.”
Which leads me to wonder what different pieces of your identity are worth… And while that’s material for a future piece (it is), let’s dip a toe in that pool and give you a sneak peek now. Forsyth continues, “A PayPal account with a guaranteed balance of $500 is worth far more than a U.S. issued credit card, and what might seem like an isolated hack of a gaming network is in reality part of a much broader data collection effort that can link your identity between more valuable sites like PayPal, E-bay, Netflix, or Uber.”
This is an excellent argument for unique, site-specific passwords. Why? Because if your Minecraft World Map username and password are the same as half of your other passwords, you’re likely to be in for some trouble.
And as someone whose unique, site-specific Gmail password was hacked, again, over the last few days, I’ll admonish you, the reading public, once again to practice good password hygiene. Realizing I may very well sound like a broken record here, I’d like to stress the importance of vetting websites and companies carefully, changing passwords often, and using unique, difficult to remember ones for each site when possible. There are password programs and services out there that can help you do this as well.
A little time spent now could mean a world of difference later – as in half an hour from now, after the next, seemingly inevitable, breach.
