Fantasy Site Hack Exposes Data on 650,000 Users

A hack on a popular Web fantasy site may have exposed the personal data of some 650,000 players, site operators revealed late last week.

Second Life, a virtual world in which players can live out another existence, was hit by a "zero-day exploit" last week, and a database containing players' names, addresses, passwords, and payment information was compromised, according to Linden Lab, which operates the site.

Systems administrators for Second Life voided all of the participants' passwords, forcing users to change to new passwords immediately. Users will have to answer a security question in order to get a new password.

Linden Lab was not specific about the details of the attack, and company officials did not reply to queries for this article. However, in messages to its customers, the company said the exploit was perpetrated on its Web server, via vulnerabilities in "third-party Web software."

So far, Linden Lab has been able only to determine the "aggregate size of the data that was downloaded through the intrusion," which appears to have been substantial. The company said it could not tell whether individual records were compromised, or which ones, which is why it decided to simply void all the passwords in the system and ask legitimate users to renew.

The database includes Second Life account names, real-life names, and contact information in unencrypted form, Linden Lab said. Account passwords and payment information (such as credit card numbers and PayPal transaction IDs) were also in the database but were encrypted via an MD-5 hash algorithm and "salt," which inserts additional data into the encryption pattern to make it harder to crack, the company said. A separate database that contained unencrypted credit card information was not compromised, according to Linden Lab.

"The compromised system was rebuilt and made more secure," Linden Lab said in its blog. The company plans to announce additional security improvements in the near future.

Second Life users, who log onto the site to buy virtual land, build virtual homes and try all sorts of pastimes they would never try in the real world, were frustrated by the intrusion.

"I've heard a number of people say it was bound to happen sooner or later, but that doesn't make it any easier to hear or deal with," says mightyoak on a Second Life message board. "I agree that until there's hard evidence that harmful data has been compromised, we should all remain calm. It's not going to be particularly comfortable waiting, though."

Aimee Weber, another Second Life user, raised the possibility that the hacker might link the real-world names with the pseudonyms assumed in the virtual world, and move from online "stalking" (an accepted practice online) to real-world stalking. More than 286,000 Second Lifers have logged onto the site in the last 60 days, according to site figures.

An investigation into the hack is ongoing, according to Linden Lab.

— Tim Wilson, Site Editor, Dark Reading