Article
Some of you old enough may remember that several years ago, an SQL injection vulnerability was found and exploited in a kinda cheeky way by a player from Lithuania (iirc), when he added 60k gold to all share companies. E-sim had to roll back a day and the SQL injection vulnerability got probably patched (can't confirm, as I have not done a penetration test on e-Sim and will not do it either).
Still, those familiar with the term SQL injection probably know that the attack did not have to stop at adding some gold to SCs, or that if one guy found it, others could have, too. SQL injection attacks can be used to also get all data from the database table of users.
Now back to the point. As I tested recently, passwords are stored in e-Sim database as plain text. That means, if anyone got access to the users table back in the day, could simply see the passwords of all users, completely exposed, instead of a hash that is only semi-useful.
With the old, but still useful in many cases table of users and their passwords, hacking accounts is not a difficult job. This hypothesis could explain the following:
- accounts of players who have been playing long enough to have their accounts during the time when the SQL injection vulnerability were the ones hacked. As I was told, the hacker did not need many attempts to break into them, which rules out brute force attacks.
- Still, he needed several attempts in some cases, which could be attributed to account owner changing the password over the years, but only slightly, so a persistant hacker after a few attempts with variations of the old password could guess the correct one.
- There were attempts to hack several accounts that failed. Adaline was not the only GO affected, but others changed their passwords to something completely different over the years, so their accounts were left unharmed.
- There was a case several months ago when some years-long inactive accounts got hacked. I can't confirm they were all from the era when the SQL vulnerability was found, but it is quite likely
Is this the piss-poor security of user's login data in the e-Sim database in combination with old SQL injection vulnerabilities the explanation for all this mess? I am not sure. But still, it is better to make sure you can't get affected. Please, do the following:
- If you are still using a very old password, change it
- If you are using that password anywhere else, change it there, too. It is highly likely it is compromised
- Use a unique password for e-Sim. Keep in mind that your password is stored in plain text, so if another vulnerability was to be found and exploited, all other accounts on other sites where you use this password may get hacked.
Stay safe, keep your accounts secure!
Thraxx
Previous article:
New achievement unlocked (5 years ago)
About the game:
USA as a world power? In E-Sim it is possible!
In E-Sim we have a huge, living world, which is a mirror copy of the Earth. Well, maybe not completely mirrored, because the balance of power in this virtual world looks a bit different than in real life. In E-Sim, USA does not have to be a world superpower, It can be efficiently managed as a much smaller country that has entrepreneurial citizens that support it's foundation. Everything depends on the players themselves and how they decide to shape the political map of the game.
Work for the good of your country and see it rise to an empire.
Activities in this game are divided into several modules. First is the economy as a citizen in a country of your choice you must work to earn money, which you will get to spend for example, on food or purchase of weapons which are critical for your progress as a fighter. You will work in either private companies which are owned by players or government companies which are owned by the state. After progressing in the game you will finally get the opportunity to set up your own business and hire other players. If it prospers, we can even change it into a joint-stock company and enter the stock market and get even more money in this way.
In E-Sim, international wars are nothing out of the ordinary.
Become an influential politician.
The second module is a politics. Just like in real life politics in E-Sim are an extremely powerful tool that can be used for your own purposes. From time to time there are elections in the game in which you will not only vote, but also have the ability to run for the head of the party you're in. You can also apply for congress, where once elected you will be given the right to vote on laws proposed by your fellow congress members or your president and propose laws yourself. Voting on laws is important for your country as it can shape the lives of those around you. You can also try to become the head of a given party, and even take part in presidential elections and decide on the shape of the foreign policy of a given state (for example, who to declare war on). Career in politics is obviously not easy and in order to succeed in it, you have to have a good plan and compete for the votes of voters.
You can go bankrupt or become a rich man while playing the stock market.
The international war.
The last and probably the most important module is military. In E-Sim, countries are constantly fighting each other for control over territories which in return grant them access to more valuable raw materials. For this purpose, they form alliances, they fight international wars, but they also have to deal with, for example, uprisings in conquered countries or civil wars, which may explode on their territory. You can also take part in these clashes, although you are also given the opportunity to lead a life as a pacifist who focuses on other activities in the game (for example, running a successful newspaper or selling products).
At the auction you can sell or buy your dream inventory.
E-Sim is a unique browser game. It's creators ensured realistic representation of the mechanisms present in the real world and gave all power to the players who shape the image of the virtual Earth according to their own. So come and join them and help your country achieve its full potential.
Invest, produce and sell - be an entrepreneur in E-Sim.
Take part in numerous events for the E-Sim community.
