Thanks to a community "white hat," the RIFT account security exploit (that had nothing to do with ZAM) has been squashed. Read our exclusive interview here!

For the past two weeks, the RIFT community has been rocked by a seemingly endless onslaught of accounts being compromised. Account security is an incredibly touchy subject with MMO players, and once it became apparent that this was an epidemic rather than a handful of occurrences, fansites like ZAM were blamed as part of, as Trion put it, a “witch hunt” by some members of the community.

The culprit behind a portion of the account debacle was tracked down by a member of the RIFT community that ignored all of the speculation going on around him and put real effort into making RIFT a safer place to play. Known only as ManWitDaPlan on the RIFT forums (and Webmaka on ZAM’s own forums), he exposed the flaw with the aid of several other committed RIFTers. Trion quickly found his post, contacted him directly, and within hours had the exploit fixed. The entire community, including all of us at ZAM, breathed a huge sigh of relief.

UPDATE: Trion speaks out and clears the air about ManWitDaPlan's find.

Over the last few hours, we’ve managed to reach out to MaWitDaPlan and get his side of the story, find out what his background is, and see what he thinks of the future of RIFT. We hope you enjoy this exclusive interview!

---

ZAM: What’s your background? Do you often work with account security?

ManWitDaPlan: I've been a programmer for most of my life (started at age ten), and professionally so since 1995. I currently own a small security-software company specializing in secure data destruction. I'm also something of a "white hat" (aka "ethical hacker") in that I was involved with the cracking and warez scenes in my younger days and have basically employed the skillsets from that era of my life for more worthy pursuits.

ZAM: Why did you want to pin it down? Did you get an account hacked? Or did you just feel like doing a good deed?

ManWitDaPlan: My account was hit during the start of the hack-fest on the weekend of the 12th-13th of March. I was left with only two pieces of armor and some gold, but my bank and mailbox were completely untouched, which deviates from the norm for what happens to hacked accounts. That made me immediately suspect there was a bug of some sort.

Since I've been working with security for so long I run a very, VERY locked-down system and knew that there was pretty much no way I could have been hacked via the usual avenues (e.g., malware). Still, I invoked some of my more aggressive anti-malware scanners, including a couple that act as hypervisors, and every scan I could throw at the systems turned up nothing at present, and no signs of ever having been infected in the past.

Between these two - the bank being untouched and the systems being clean - I started looking up the chain from me to the game servers proper. I started searching for man-in-the-middle attacks and server-side compromises. That avenue began with investigating how the game works, which led to finding an exploit, which led to working out how it works, which led to the forum post that from the looks of things shook all of Telara in a way that'd make Regulos go "umm, okay, let's go find another planet to eat - these people are nuts!"

ZAM: There was a lot of finger pointing going on around the community, especially towards ZAM RIFT and RIFT Junkies. What would you tell those folks that were on, as Trion called it, a “witch hunt?”

ManWitDaPlan: Unfortunately that sort of thing is normal human nature. 99.999% of the time a game account gets hacked it was because the user of that account did something dumb, like using weak passwords or reusing compromised credentials, or just as frequently, allowing malware to get a foothold and leech previously-safe credentials.

This time around, it was an active, in-the-wild exploit, so the normal causes were not the primary ones. Some people cannot remove the blinders of their own preconceptions, though, and couldn't adjust to the idea that it wasn't malware or poor client security in all cases, so they stuck with what would be the most likely answer under normal circumstances.

Once it became increasingly clear there was more going on that just bad/reused passwords and those folks were forced to rethink their "it's got to be your fault" stance, the next target was anyone that ran anything that could conceivably be a hacking vector. Thus, the finger pointing toward fansites that offer any form of active content or add-on. ZAM took an extra-tough dose of baseless blame thanks to the old, no-longer-valid link to RMT companies from back in the IGE days.

ZAM: You’ve been hailed as something of a savior on the forums. How’s that make you feel?

ManWitDaPlan: I find it fun in some ways - everyone loves to feel "special" after all - but disconcerting in others - I'm not the spotlight-seeking type.

That having been said, I do understand why some are making a big deal of it. Trion sunk how many millions of dollars and years of time into making Rift? Hint: Over $50 MILLION and at least a couple years. That is a LOT of capital and work hanging out there. The last thing anyone at Trion needs is to have the playerbase for a pay-to-play game lose confidence in the game's internal security, so they set what I suspect is a new speed record for fixing the exploit.

Continued on Page 2.