Springz retweeted
【PC Launcher Security Incident and Follow-Up Measures】
We have identified that some files in the NIKKE Windows PC launcher were recently tampered with by a third party, potentially allowing malicious programs to run when the launcher was launched.
As a result, your PCs and account information may have been exposed to security risks. We are continuing to investigate the extent of the potential damage and review appropriate response measures.
We are also conducting a thorough review of our network security environment, including our CDN, to determine how the PC launcher files were compromised. We will take all necessary precautions to prevent further damage and ensure that this issue does not happen again.
We deeply regret that this security incident has caused Commanders significant concern and distress, when our responsibility should have been to provide a safe gaming environment.
We take full responsibility for failing to uphold your trust and sincerely apologize.
The following details will be provided on our official website:
- A summary of the key developments and actions taken based on the information confirmed so far
- Instructions on how to perform security checks, protect your accounts, and report any loss
- Strengthening security to prevent future incidents
For more details: nikke-en.com/newsdetail.html…
If you believe you may have been affected by this issue or sufferred from any loss, please contact our Customer Support team. We will review each inquiry carefully and respond as promptly as possible.
Once again, we sincerely apologize for the great concern and distress this incident has caused.
Level Infinite
Springz retweeted
Apenas pra complementar, fiz esse passo a passo aqui:
Fazer varredura completa no sistema
Desinstalar o Nikke
Excluir o instalador do jogo
Reiniciar o PC
Baixar novo instalador
Reinstalar do zero.
Feito isso tudo, ao abrir o arquivo de debug na pasta do Launcher, a k2f some.
NIKKE PC launcher incident: calm progress update, with real good news. 🙂
✅ What's done
• Traced the attacker's servers (89.127.233.127 and 89.126.250.172) to one Iceland host, 1984 ehf (RIPE records; reverse DNS shows rented VPS).
• Sent evidence-based abuse reports to the host and to the domain registrar (PublicDomainRegistry).
• 1984 answered in about a minute (ticket #493052) and says the server is shut down. The email is in the picture, cropped.
🟢 What's good
• The official CDN files are clean, and an independent tester's fresh install loaded nothing from the attacker's domain.
• So far, nobody has posted evidence of stolen data being misused. Not proof, so stay careful.
• Both providers are being asked about related servers and domains, so a proper DNS and firewall block list can follow.
🔜 What to expect next
• The registrar reviews the domain (hours to days). A takedown on one side alone can just move the domain, so the registrar matters most.
• If the domain gets suspended, I'll confirm it in DNS and registry data before saying so.
• Official player guidance from Level Infinite and SHIFT UP is still pending. I'll update the guide when it lands.
Known indicators to block at DNS or firewall: insightjs[.]com, analytics.insightjs[.]com, insightjs[.]org, 89.127.233.127, 89.126.250.172. Blocking doesn't clean a PC that already ran the agent: check Launcher\intl_service\debug.log for k2f_chan first.
No overnight miracle, but the right pieces are moving. Please don't spam or harass the host or registrar: they're cooperating, and one clear report works better.
Credit: MotherSphere's report and everyone who checked and shared evidence.
Guide with checks, steps and sources:
- github.com/SpringZali/nikke-…
- github.com/SpringZali/nikke-…
- github.com/SpringZali/nikke-…
Follow me and star the repo to get updates.
ALT A card in the style of earlier updates: a small Nikke portrait on the left, a cropped screenshot of two real emails from the abuse team of 1984 ehf (ticket ABUSE #493052) answering an abuse report, and a blue stamp that reads UPDATE: 1984 replied in 1 minute, registrar report sent. Community update, not an official statement. Art (c) SHIFT UP. Email cropped.
Springz retweeted
More harm was likely done by telling panicked people to reformat their drives...
In an enterprise environment, during a security incident, you should just unplug your device from the network and wait for cyber to investigate. Or in this case, wait for a patch.
Some folks probably lost pictures of the late beloved granny. Losing customer data is a huge no, no.
That said, we aren't in an enterprise environment. So 🤷♂️.
Kudos to the folks that did sound the alarm early though.
Springz retweeted
Texas voter: I want to have a leader who I can trust.
Q: So who do you trust?
Texas voter: I'm actually conservative, but I'm voting for Talarico.
Springz retweeted
i would advice to not run random scripts made by strangers, especially during a moment of chaos, many opportunistic ppl might actually hack your pc's
I have a possible "easy" solution for non-technical fellow #NIKKE PC players.
gist.github.com/neutralnikke…
I've had a few mutuals test it. The script is extremely overly documented due to ensure it's doing nothing sketchy.
Springz retweeted
危機対応で大変なのは同情するけど、このコメントの内容なら朝にやっておくべきだったのでは。自分を含めユーザーは今「自分はセキュリティ対策をどうすればいいのか、修正したというがもうプレイしていいのか」を知りたがっている。それを早急に情報提供してほしい。
Springz retweeted
NIKKEの件、そもそも放置したらどうなるの？
情報抜かれるとどんなリスクがあるの？
そのリスクの確率はどれぐらいなの？
申し訳ないがそのレベルのリテラシーなんですよこちとら
有志の人がすっごいのは分かるけど何が何だか…飛び交ってる用語も何一つわからん
時代に向いてなさすぎる
Springz retweeted
【NIKKE PC版に関する注意喚起】
現在、NIKKEのPC版ランチャーを経由して、ブラウザのパスワードやCookie、認証トークンなどを窃取するマルウェアへの感染が海外コミュニティで報告されています。
報告によると、公式配信ファイルに悪意あるコードが混入していた可能性があり、通常どおりランチャーを起動しただけでも感染する恐れがあります。
現時点で確認されている攻撃経路はPC版ランチャーですが、Google Play Games版やスマートフォン版を含め、その他の環境についても安全性が保証されているかは未確認です。
PC版ランチャーの起動は控え、既に利用したことがある方も感染の有無を確認することを推奨します。
また、今回の問題に便乗した偽の修正パッチやウイルス駆除ツールなど、二次被害にも注意してください。信頼できないファイルは安易にダウンロード・実行しないようお願いします。
なお、現時点でSHIFT UPおよびLevel Infiniteからの公式発表は確認できていません。パニックにならず公式からの発表を待ちましょう。
Springz retweeted
처음 이슈 발견도 유저... 코드 분석도 유저... 공지도 유저... 해결법도 유저 공유.... 진짜 레벨인피니트, 텐센트가 하는 게 뭐죠..???
#NIKKE
Springz retweeted
情報がかなり錯綜してるように思うのでまとめときます。
信用するかは任せますが私が改ざんされた四つめのファイルの確認、検証をしました。
まず、k2f_chanというのがウイルスではなく、k2f_chanというのはエージェント本体であるk2fと情報送信用のl.jsの通信経路のことを指します。つまりk2f_chanが見つかったのであればk2fが収集した情報がl.jsを通じて攻撃者に渡っている可能性があるということです。そしてdllとk2fはまた別物です。dllはk2fが設置するスクリプトでChromeの情報を集めて自動で攻撃者に送信します。なのでdllがなかってから安心ではなくそれはChromeの情報が自動で送信されなかっただけであってk2f_chanのログがある場合は既になんらかの情報が攻撃者に渡っている可能性があります。
なおl.jsに関しては攻撃者が無害なものに差し替えているので開発者コミュニティでもどんな振る舞いをするのかわかっていないというのが現状です。
一応現在は既に攻撃者のドメインは第三者のものに変わってるけど、改ざんされてるFeedListに関してはまだCDNで配信中(日本時間4:49に自分が最終確認43.175.144.148 と 43.175.145.181)
また、侵入経路がわかっていないので攻撃者は別ドメインで新しいローダーを仕込める状態。
時系列順に並べると
9/27 公式ファイル改ざん(ローダー設置)
10/31~ランチャー起動時にローダー起動
11/2~11/3 遠隔操作ツール起動
11/4 NIKKEのDiscordコミュニティで発覚
目的としては、一般的にゲームを遊ぶ人というよりかは開発者をターゲットとした鍵やクラウドの認証情報、暗号資産を集めるものだった。
