Three Million DiRT 3 Game Vouchers Stolen by Hackers

September 7, 2011 -

Codemasters and AMD have confirmed that over three million digital vouchers for Steam have been stolen for DiRT 3. According to a report from Industry Gamers (citing a Steam forum post), hackers used an .htaccess exploit that allowed them to gain access to an .sql database containing the codes. Those codes were meant to be used for a future AMD graphics card promotion.

"This past weekend, activation keys associated with free DiRT 3 game vouchers shipping with select AMD products were compromised," said AMD in a statement. "These activation keys were hosted on a third party fulfillment agency website, www.AMD4u.com, and did not reside on AMD's website. Neither the AMD nor Codemasters servers were involved."

"We are working closely with Steam, Codemasters, and our fulfillment agency to address the situation. AMD will continue to honor all valid game vouchers, however the current situation may result in a short delay before the vouchers can be redeemed."

The good news is that the huge batch of codes that were stolen can be traced, and Codemasters claims that they should be able to deactivate the codes in due time.

Source: Eurogamer by way of Industry Gamers


Comments

Re: Three Million DiRT 3 Game Vouchers Stolen by Hackers

Stolen? That's bit of a stretch given how the keys were made available for the whole world to see.

Re: Three Million DiRT 3 Game Vouchers Stolen by Hackers

I disagree (though it's quite possible I've misunderstood exactly what happened here).  If someone takes my stuff without my permission, my stuff has been stolen.  It doesn't matter if I've left my front door wide open with my stuff neatly piled in the doorway.

That does make me stupid but it doesn't make my stuff any less stolen.

 

Andrew Eisen

Re: Three Million DiRT 3 Game Vouchers Stolen by Hackers

Taking your stuff against your will is stealing, but you're using that logic on something that doesn't apply. Stealing leaves the victim without what is theirs. Has anyone lost anything? No, they still have the codes, but the hackers (sic) have them too, which they can invalidate. So they might be able to acquire copies of Dirt3 without participating in the promotion, but Codemasters will not have fewer copies of the game as a result. That is, if they are digital downloads and not printed discs shipped in boxes. It might be applicable to accuse them of fraud if they attempt to redeem those vouchers, but stealing isn't. What they did would be more akin to eavesdropping, espionage,  or wiretapping.

Your definition of stealing is flawed, especially in the eyes of the law. That said, what happened was a deplorable act that resulted in an interruption of service for actual customers of AMD and Codemasters. It was rather pointless act as well since it's easier to acquire the DRM-free version from bittorrent. Given all that, it's a seriously dick move and they should stand to answer for the damage they did.

-Greevar

"Paste superficially profound, but utterly meaningless quotation here."

Re: Three Million DiRT 3 Game Vouchers Stolen by Hackers

Replace "stole" with "misappropriate" if it makes you happy.

 

Andrew Eisen

Re: Three Million DiRT 3 Game Vouchers Stolen by Hackers

It's more like an infringement of privacy, similar to trespassing.

-Greevar

"Paste superficially profound, but utterly meaningless quotation here."

Re: Three Million DiRT 3 Game Vouchers Stolen by Hackers

Whatever, buddy.  I know you understand the specifics of what happened so I really don't care what you call it.

 

Andrew Eisen

Re: Three Million DiRT 3 Game Vouchers Stolen by Hackers

I believe this situation is more akin to leaving all of your stuff in the middle of a busy intersection and then claiming that it was stolen when you come back 3 days later to find it all missing.

Re: Three Million DiRT 3 Game Vouchers Stolen by Hackers

Not unless those keys were posted in plain text on the front page of AMD4u's website or something similar.  Hell, even my "open front door" analogy isn't applicable.

 

Andrew Eisen

Re: Three Million DiRT 3 Game Vouchers Stolen by Hackers

They were stored in plain text. All you basically had to do was add /keys to the end of the URL.

Re: Three Million DiRT 3 Game Vouchers Stolen by Hackers

"Not unless those keys were posted in plain text on the front page of AMD4u's website or something similar."

 

Andrew Eisen

Re: Three Million DiRT 3 Game Vouchers Stolen by Hackers

I think it would be more apt to say you left your door unlocked. From an external perspective it would seem that your stuff was secure, but when more closely inspected the flaw is revealed.

Re: Three Million DiRT 3 Game Vouchers Stolen by Hackers

That seem a fairer analogy. But then, on the internet, you'd have to account for thousands of people that keep trying the lock every day... You can argue it's good or bad, but it most definitely is common enough to take into account.

Re: Three Million DiRT 3 Game Vouchers Stolen by Hackers

.htaccess exploit? I'd hardly call it an exploit. Hell, I wouldn't even call it a hack. The directories (plural. There was more than one: an SQL directory showing some keys in 3 sql files, and a keys directory showing ALL keys in plain text files) were WIDE OPEN (and continued to be such for hours after it was made public). A hack? More like a complete lack of security.

----
Papa Midnight

 
Forgot your password?
Username :
Password :

Shout box

You're not permitted to post shouts.
MattsworknameWilson: how? Im still waiting for my upgrade notice07/29/2015 - 3:44am
Matthew WilsonI updated to a clean instill of windows 10.07/29/2015 - 2:36am
Mattsworknameargue that it's wrong, but then please admit it's wrong on ALL Fronts07/29/2015 - 2:06am
MattsworknameTechnoGeek: It's actually NOT, but it is a method used all across the specturm. See Rush limbaugh, MSNBC, Shawn hannity, etc etc, how many compagns have been brought up to try and shut them down by going after there advertisers. It's fine if you wanna07/29/2015 - 2:05am
Mattsworknamediscussed, while not what I liked and not the methods I wanted to see used, were , in a sense, the effort of thsoe game consuming masses to hold what they felt was supposed to be there press accountable for what many of them felt was Betrayal07/29/2015 - 2:03am
MattsworknameAs we say, the gamers are dead article set of a firestorm among the game consuming populace, who, ideally, were the intended audiance for sites like Kotaku, Polygon, Et all. As such, the turn about on them and the attacking of them, via the metods07/29/2015 - 2:03am
MattsworknameAndrew: Thats kind fo the issue at hand, Accountable is a matter of context. For a media group, it means accountable to its reader. to a goverment, to it's voters and tax payer, to a company, to it's share holders.07/29/2015 - 2:02am
Andrew EisenAnd again, you keep saying "accountable." What exactly does that mean? How is Gamasutra not accounting for the editorial it published?07/28/2015 - 11:47pm
Andrew EisenMatt - I disagree with your 9:12 and 9:16 comment. There are myriad ways to address content you don't like. And they're far easier to execute in the online space.07/28/2015 - 11:47pm
Andrew EisenMatt - Banning in the legal sense? Not that I'm aware but there have certainly been groups of gamers who have worked towards getting content they don't like removed.07/28/2015 - 11:45pm
DanJAlexander's editorial was and continues to be grossly misrepresented by her opponents. And if you don't like a site, you stop reading it - same as not watching a tv show. They get your first click, but not your second.07/28/2015 - 11:40pm
TechnogeekYes, because actively trying to convince advertisers to influence the editorial content of media is a perfectly acceptable thing to do, especially for a movement that's ostensibly about journalistic ethics.07/28/2015 - 11:02pm
Mattsworknameanother07/28/2015 - 9:16pm
Mattsworknameyou HAVE TO click on it. So they get the click revenue weather you like what it says or not. as such, the targeting of advertisers most likely seemed like a good course of action to those who wanted to hold those media groups accountable for one reason07/28/2015 - 9:16pm
MattsworknameBut, when you look at online media, it's completely different, with far more options, but far few ways to address issues that the consumers may have. In tv, you don't like what they show, you don't watch. But in order to see if you like something online07/28/2015 - 9:12pm
MattsworknameIn tv, and radio, ratings are how it works. your ratings determine how well you do and how much money you an charge.07/28/2015 - 9:02pm
Mattsworknameexpect to do so without someone wanting to hold you to task for it07/28/2015 - 9:00pm
MattsworknameMecha: I don't think anyone was asking for Editoral changes, what they wanted was to show those media groups that if they were gonna bash there own audiance, the audiance was not gonna take it sitting down. you can write what you want, but you can't07/28/2015 - 8:56pm
MattsworknameAndrew, Im asking as a practical question, Have gamers, as a group, ever asked for a game, or other item, to be banned. Im trying to see if theres any cases anyone else remembers cause I cant find or remember any.07/28/2015 - 8:55pm
Andrew EisenAs mentioned, Gamasutra isn't a gaming site, it's a game industry site. I don't feel it's changed its focus at all. Also, I don't get the sense that the majority of the people who took issue with that one opinion piece were regular readers anyway.07/28/2015 - 8:43pm
 

Be Heard - Contact Your Politician