June 20, 2003 Ragnarok US Hack - Revision history

Halca: No evidence linked to ASB

2025-06-24T23:19:46Z

No evidence linked to ASB

← Older revision		Revision as of 23:19, 24 June 2025
Line 14:		Line 14:
	[[Category:Ragnarok Online]]		[[Category:Ragnarok Online]]
	[[Category:AEGIS]]		[[Category:AEGIS]]
	~~[[Category:ASB]]~~
	[[Category:Ragnarok Online Hacks]]		[[Category:Ragnarok Online Hacks]]
	[[Category:Ragnarok Online Events]]		[[Category:Ragnarok Online Events]]

Halca at 23:18, 24 June 2025

2025-06-24T23:18:56Z

← Older revision		Revision as of 23:18, 24 June 2025
Line 12:		Line 12:
	=== References ===		=== References ===
	<references />		<references />
			[[Category:Ragnarok Online]]
			[[Category:AEGIS]]
			[[Category:ASB]]
			[[Category:Ragnarok Online Hacks]]
			[[Category:Ragnarok Online Events]]

NeoJB: Added Reference

2024-03-22T04:39:40Z

Added Reference

← Older revision		Revision as of 04:39, 22 March 2024
Line 7:		Line 7:

	==== Interesting asides ====		==== Interesting asides ====
	In the research for this article, a comment was found from a Slashdot user which indicated that the previous (or current) attack utilised the SQL Slammer injection vulnerability, which was widely used by the Slammer Worm, a piece of malware which also abused this vulnerability.		In the research for this article, a comment was found<ref>https://web.archive.org/web/20210213213859/https://games.slashdot.org/story/03/06/24/0531236/ragnarok-online-hacked-user-data-leaked</ref> from a Slashdot user which indicated that the previous (or current) attack utilised the SQL Slammer injection vulnerability, which was widely used by the Slammer Worm, a piece of malware which also abused this vulnerability.
	The RO server is 31MB. I know this because I know someone that got into their system using the SQL exploit (this was a month before Slammer used the same technique). He retrieved the actual server software and released this on the net so that anyone could emulate the server (if you had 1GB+ ram). He has done a lot to the RO folks, and I wouldn't be surprised if it was him that did it.		The RO server is 31MB. I know this because I know someone that got into their system using the SQL exploit (this was a month before Slammer used the same technique). He retrieved the actual server software and released this on the net so that anyone could emulate the server (if you had 1GB+ ram). He has done a lot to the RO folks, and I wouldn't be surprised if it was him that did it.

	=== References ===		=== References ===
	<references />		<references />

Halca: 1 revision imported

2023-12-08T19:57:57Z

1 revision imported

← Older revision

Revision as of 19:57, 8 December 2023

ROPP>HalcaRO at 15:53, 29 October 2023

2023-10-29T15:53:16Z

New page

The '''June 20, 2003 Ragnarok US Hack''' was a hack which occurred on June 20, 2003 in California, in the United States on the iRO Ragnarok Server.

=== Background ===
On June 20, 2003, several users had created in-game items, presumably a lot of them, using Game Master accounts, which led to Gravity Interactive (US) which had been formed in January of the same year, to revert the data back 2 days to data from 18 June 2003. At the time, Gravity did not explain the reason for the rollback, but by means of compensation, they provided users with extra experience points to compensate for the 2 days they had lost. The incident continued on, when on June 22, 2003, a file titled '''user.txt''' appeared on several messageboards and P2P applications.<ref name=":0">Gamespot (2003) ''Ragnarok Online hacked, user data leaks''. Available at: https://archive.ph/lGiHU<nowiki/>(Accessed: 29 October 2023).</ref>

The usernames and passwords stored by Gravity at the time were unencrypted, meaning that the file '''user.txt''' was simply shared as it was, rather than decrypted and shared. The data related to people who had pre-registered for the beta test. As a result of this file being shared, several people logged into other accounts on the service, with legitimate users noting that their account had been logged into when accessing their account. Gravity then responded to this by sending out emails to everyone effected, requesting them to change their passwords and verify themselves -- but by this time the damage had already been done as some users who had mail accounts with the same password were unable to access their email to reset their passwords. As a result, Gravity temporarily shut down servers to mitigate damage, and did not respond when asked if this leak also could potentially relate to credit card information.<ref name=":0" />

==== Interesting asides ====
In the research for this article, a comment was found from a Slashdot user which indicated that the previous (or current) attack utilised the SQL Slammer injection vulnerability, which was widely used by the Slammer Worm, a piece of malware which also abused this vulnerability.
The RO server is 31MB. I know this because I know someone that got into their system using the SQL exploit (this was a month before Slammer used the same technique). He retrieved the actual server software and released this on the net so that anyone could emulate the server (if you had 1GB+ ram). He has done a lot to the RO folks, and I wouldn't be surprised if it was him that did it.

=== References ===
<references />