Chinese web giant Tencent has admitted to a significant account hijack attack on its QQ.com messaging and social media platform.

In a [1]post to rival social media platform Sina Weibo – a rough analog of Twitter – Tencent apologized for the incident.

The problem manifested on Sunday night and saw an unnamed number of QQ users complain their credentials no longer allowed them access to their accounts. Tencent has characterized that issue as representing "stolen" accounts.

[2]

Tencent asserts the incident stared with criminals posting QR codes that claimed to offer game logins. Users who scanned the codes were asked to authenticate using their QQ creds.

[3]

[4]

Which was a mistake, as the criminals behind the scam observed those logins. A machine translation of Tencent's explanation produces the phrase "the login behavior was hijacked and recorded by the black industry gang, and then used by criminals to send bad picture ads," which does not read like something you want to happen.

Users were also locked out of their accounts.

[5]

Tencent's security team swung into action and the company stated that by early Monday morning accounts had been restored. The web giant is now gathering evidence to share with local authorities and has pledged co-operation.

[6]Tencent's WeChat wants no more talk of cryptocurrency and NFTs

[7]Tencent completes 50 million core migration of its own apps to its own clouds

[8]Tencent happily parting ways with loss-making cloud customers

Those authorities are likely to be interested in Tencent and whoever created the poison QR codes, as China has recently made it clear it expects its web giants to take their responsibility to the nation seriously. If Tencent is held to have provided insufficient security to prevent this incident, a "rectification notice" will soon be headed its way. Such notices are usually resolved with some behind the scenes work to fix the issue and then a public admission that the entity in receipt of the notice should really have done better to begin with and won't be so lax again.

China has in recent weeks eased its criticism of its web giants, and suggested their expansion is acceptable provided they make positive contributions to society and promote socialist values.

Beijing, however, does not believe that games are a good expression of those values. It has made several moves to restrict development of the local gaming industry and prevent youth from spending more than a few hours a week gaming.

That this incident started with a game-related lure will not have escaped authorities' attention. ®

Get our [9]Tech Resources



[1] https://weibo.com/2508053484/LzDBhlSsp?refer_flag=1001030103_

[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YrrRRJgcvNJaH@JwdVvWNQAAAEA&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0

[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YrrRRJgcvNJaH@JwdVvWNQAAAEA&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YrrRRJgcvNJaH@JwdVvWNQAAAEA&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0

[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YrrRRJgcvNJaH@JwdVvWNQAAAEA&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[6] https://www.theregister.com/2022/06/22/tencet_/

[7] https://www.theregister.com/2022/06/17/tencent_cloud_migration/

[8] https://www.theregister.com/2022/05/19/tencent_q1_2022/

[9] https://whitepapers.theregister.com/