Linden Labs have just announced in a security bulletin that their databases have been compromised.
Detailed investigation over the last two days confirmed that some of the unencrypted customer information stored in the database was compromised, potentially including Second Life account names, real life names and contact information, along with encrypted account passwords and encrypted payment information.Â
As announced on our website at http://secondlife.com/corporate/bulletin.php and corporate blog at http://blog.secondlife.com/?tag=security, Second Life discovered an attack on our servers on September 6, 2006. The full security bulletin is reprinted below, followed by a FAQ that includes important security advice for our community.
This represents a significant issue for social networking and is likely to be used by gainsayers as evidence that social networking sites are of dubious merit. However, it seems the realityof the situation is that like many other corporate entities there were vulnerabilities in their database systems.
All users are being required to change their Second Life login details and encouraged to look at changing their PayPal details as well.
Here is the introduction to the complete security bulletin:
===================
SECURITY BULLETIN*SAN FRANCISCO, CA. (September 8, 2006)* – Linden Lab reported today that it is notifying its community of a database breach, which potentially exposed customer data including the unencrypted names and addresses, and the encrypted passwords and encrypted payment information of all Second Life users. Unencrypted credit card information, which is stored on a separate database, was not compromised.
The breach was discovered on September 6, 2006 and promptly repaired. The company then launched a detailed investigation that revealed an intruder was able to access the Second Life databases utilizing a “Zero-Day Exploit” through third-party software utilized on Second Life servers. Due to the nature of the attack, the company cannot determine which individual data were exposed. The company’s technical investigation is ongoing.
“We’re taking a very conservative approach and assuming passwords were compromised and therefore we’re requiring users to change their Second Life passwords immediately,” said Cory Ondrejka, CTO of Linden Lab. “While we realize this is an inconvenience for residents, we believe it’s the safest course of action. We place the highest priority on protecting customer data and will continue to take aggressive measures to protect the privacy and security of the community.”
Linden Lab advises all users to take appropriate precautions against misuse of personal information. To reduce the risk of fraud, Linden Lab will not contact individuals by phone or any other method asking for private information unless it is in response to an inquiry from the individual user.