Forgot your password?
typodupeerror
Botnet Crime Security Games

Symantec Finds Server Containing 44 Million Stolen Gaming Credentials 146

Posted by Soulskill
from the who-wants-to-buy-a-level-80-paladin dept.
A Symantec blog post reports that the company recently stumbled upon a server hosting the stolen credentials for 44 million game accounts. It goes on to explain how the owners of the server made use of a botnet to process that mountain of data: "Now it's time to turn those gaming credentials into hard cash. But how do you find out which credentials are valid and thus worth some money? Three options come to mind: 1) Log on to gaming websites 44 million times! 2) Write a program to log in to the websites and check for you (this would take months). 3) Write a program that checks the login details and then distribute the program to multiple computers. Option one naturally seems next to impossible. Option two is also not very feasible, since websites typically block IP addresses after multiple failed login attempts. By taking advantage of the distributed processing that the third option offers, you can complete the task more quickly and help mitigate the multiple-login failure problems by spreading the task over more IP addresses. This is what Trojan.Loginck's creators have done."
This discussion has been archived. No new comments can be posted.

Symantec Finds Server Containing 44 Million Stolen Gaming Credentials

Comments Filter:
  • I must be new here (Score:3, Interesting)

    by jeffmeden (135043) on Thursday May 27, 2010 @01:58PM (#32365166) Homepage Journal

    I an a little naive to the criminal enterprise that is stolen gaming credentials, but I have to wonder: why does it matter, if you are selling a stolen credential, if it's good or not? Is the buyer really going to come back and demand a refund when it doesn't work? And what real benefit are these, anyway? Don't tell me that people buy stolen creds and log into them just to take all their e-loot (worth thousands of e-dollars)? Oh for the love of humanity the things people will do in the name of wasting time.

    • by Monkeedude1212 (1560403) on Thursday May 27, 2010 @02:01PM (#32365234) Journal

      Don't tell me that people buy stolen creds and log into them just to take all their e-loot (worth thousands of e-dollars)? Oh for the love of humanity the things people will do in the name of wasting time.

      No, this is often the people who STOLE the creds, log in, and sell the E-loot for REAL money. If you've never played WoW, Eve, or Runescape for more than a Month, I wouldn't expect you to understand. But this is a problem that does occur regularly.

      • by mlts (1038732) *

        This is very common in WoW. It usually goes like this:

        1: Someone visits a website which is either legit but gets served up a fake ad via an ad-rotater, or the site is using exploits directly. Either way, a keylogger gets downloaded. It can be an add-on that just logs keys in the background and ends when the Web browser is closed and not even installed on the system.

        2: The keylogger grabs the WoW password.

        3: The account is grabbed, password and other info is changed.

        4: The higher level characters have

      • by ch-chuck (9622)

        I wonder if anyone has ever filed a police report for stole e-goods?

        I can just see the officer's face taking a report about stolen gold as it slowly dawns on him it's from a video game.

    • by rocket97 (565016)
      I cant say for other games, but for World of Warcraft, they sell the in game items for in game currency, and then turn around and sell the in game currency for actual real currency. There are several websites set up that sell "X gold for $y".
      • Not to mention the selling of characters, which does happen on occasion.

    • by keithjr (1091829) on Thursday May 27, 2010 @02:06PM (#32365332)
      Is the buyer really going to come back and demand a refund when it doesn't work?

      Probably not, but reputation must be worth something in criminal enterprises. Giving out a bunch of bogus products kills the word-of-mouth.

      And what real benefit are these, anyway? Well, all the criminal has to do is sell off the account for less than the game costs up-front. They make pure profit and people willing to buy stolen games get a discount. Steam accounts could probably be quite lucrative, for instance.
      • Re: (Score:3, Insightful)

        by nbert (785663)

        Probably not, but reputation must be worth something in criminal enterprises. Giving out a bunch of bogus products kills the word-of-mouth.

        I can't imagine how they could sell those individually to gamers. For them it makes more sense to single out invalid accounts and to sell large blocks to less skilled criminals at a premium. Just like in the normal business world one would pay more than twice for a product which has a 0% failure rate instead of 50%. Of course one could just pretend that all accounts a

    • Re: (Score:3, Informative)

      by interkin3tic (1469267)

      Is the buyer really going to come back and demand a refund when it doesn't work?

      While I'd guess it's not impossible to just fake the account details, and maybe people do that, it could just be that these particular people found it is just more profitable to be legitimate after stealing the account for a variety of reasons. These are legitimate auction sites according to TFA.

      Just guessing, but you see a account you'd like to get on the auction site, check to see if that character is actually good or has good equipment on WOW or whatever. If it isn't, no bid. If you buy it and the log

    • by BobMcD (601576) on Thursday May 27, 2010 @02:10PM (#32365394)

      Oh for the love of humanity the things people will do in the name of wasting time.

      One man's wasted time is another man's Sistine Chapel, or pornography collection, or fictitious language for a fantasy book series.

      From the moment you open your eyes in the morning until you close them at night you're passing time. Whether or not it is wasted depends entirely on whether or not you regret how you spent it.

      • by fishexe (168879)

        Oh for the love of humanity the things people will do in the name of wasting time.

        One man's wasted time is another man's Sistine Chapel, or pornography collection, or fictitious language for a fantasy book series.

        I don't think that last example really helps your case...

      • by Samah (729132)

        From the moment you open your eyes in the morning until you close them at night you're passing time. Whether or not it is wasted depends entirely on whether or not you regret how you spent it.

        I think this is possibly the most profound and insightful quote I've read in the past year. Kudos to you, good sir/madam.

    • Don't tell me that people buy stolen creds and log into them just to take all their e-loot (worth thousands of e-dollars)?

      This is typically what happens.

      In WoW, for example, they'll sell off all your nifty loot for gold. Then they'll transfer the gold to some other character and leave you sitting naked and penniless in the auction house.

      They will then sell those huge piles of ill-gotten gold for real-world dollars.

      People will actually pay real cash for in-game cash.

    • When the hired thugs come by your dark alley where you conduct your stolen credential business and complain about the quality of your premium stolen information, would you prefer they break your arms or your legs?
    • by idontgno (624372)

      Oh for the love of humanity the things people will do in the name of wasting time.

      Quoth second poster on a slashdot gaming article...

    • by rednip (186217)

      Is the buyer really going to come back and demand a refund when it doesn't work?

      No, but it would be impossible to sell him a bigger list if the test account comes up empty. No one who would give any real good price for a large 'batch' of accounts would start out by 'testing' a 'supplier'. It shouldn't be surprising that, even to criminals, guaranteed results have a monetary value. e.g. If you stole an apartment super's keyring, you could break into each home yourself. However few pickpockets like yourself have the stones for burglary, so instead you sell them to someone who will.

    • by _Sprocket_ (42527)

      Don't tell me that people buy stolen creds and log into them just to take all their e-loot (worth thousands of e-dollars)?

      It's about cold, hard cash. The e-loot and e-dollars are worth hard currency; mainly because you can trade e-dollars for it. From a somewhat aged article on the BBC in 2007 [bbc.co.uk]:

      Research by security firm Symantec suggests that the raw value of a WoW account is now higher than a credit card and its associated verification data.

      One card can be sold for up to $6 (£3) suggests Symantec, but a WoW account will be worth at least $10. An account that has several high level characters associated with it could be

  • You know Slashdot doesn't let you say your own password? Check it out:

    *********

    Also, Alt+F4 gets you instant Karma!

    ---

    Had to get that out of me. So I didn't RTFA, but what I gather is that they used some kind of keylogger and now the server has 44 Million user credentials. At first I was like "Why didn't it just test the credentials when it recieved them, and then changed the password?" But that runs the risk of users detecting the virus, having it's spread shut down by Symantec, and the account being deeme

    • by jeffmeden (135043)

      To test this I found a really old article (to avoid the chance of someone coming upon it) and posted a comment in it with my password. Turns out you were wrong!!! Damn you.

      • It's the oldest trick in the book, and you'd be surprised how many people have lost their account info that way. ...

        *shifty eyes*

        I was twelve okay? I didn't know any better.

        • The proper response is that you still see it as plain text but everyone else just sees the asterisks.
      • lol, you actually tried it - I fell for the Alt + F4 once in a game of starcraft.
        • Re: (Score:2, Funny)

          by rocket97 (565016)
          One of my co-workers was giving a presentation once (he is a self proclaimed computer expert in every facet), and he asked us "how do I make this power point presentation full screen?". We replied Alt-F4. He did it and said "hmm that is weird", and restarted power point and pressed Alt-F4 again... after attempting it 5 times he gave up and said "Oh well I guess we will just do the presentation like this".
      • Re: (Score:1, Offtopic)

        by biryokumaru (822262)
        No, no, no. He means it'll come up stars for everyone else, see: hunter2.
      • by kalirion (728907)

        Actually he was right. You can see your own password because it's your password.

        You can even see it after logging out, because slashdot remembers your ip.
        And detects it through web proxies.
        And uses biometrics on the keyboard to recognize you from another computer.

        Yeah, that's it.

      • by mcgrew (92797) *

        You can't comment in really old articles.

      • Did you know that by clicking on your username, I can see what posts you have recently made?

      • by Fnkmaster (89084)

        Apparently, your password is asstastic [slashdot.org]. Now that's funny.

    • Re: (Score:3, Funny)

      by The MAZZTer (911996)
      hunter2 [bash.org]
    • I miss the days of Ctrl-Alt-Del restarting the computer...used to be so much fun!
    • by JWSmythe (446288)

      1234

          Nope, it lets me post my own password. :)

    • yeah, it seems a little suspicious if the bot on your computer downloads and runs wow.
  • or... (Score:1, Insightful)

    by Anonymous Coward

    4) Sell them in bulk, untested.

  • Damn it. (Score:5, Funny)

    by LupidStupy (663804) on Thursday May 27, 2010 @02:03PM (#32365276) Journal
    Mom!!!! Symantec hacked my server again.
  • by BobMcD (601576) on Thursday May 27, 2010 @02:04PM (#32365286)

    They could, as a service to the online community, go ahead and post the usernames that are compromised.

    • I get your point, except that you should change your gaming password now anyway. It might have been you, it might not have, and your creds. might've been stolen by someone else entirely.

      Change your passwords anyway.

      • by BobMcD (601576)

        I get your point, except that you should change your gaming password now anyway. It might have been you, it might not have, and your creds. might've been stolen by someone else entirely.

        Change your passwords anyway.

        This is true every moment of every day. Maybe my password was stolen a second ago, or maybe in the next second. We have to make some assumptions or else the protection becomes unusable.

        Symantec, however, has the list and so makes far fewer assumptions as to whom should take action.

        Also, having the list would let people know that they are in need of better security, along with letting them know their password needs changed. Omitting the former means your new password would be immediately compromised as we

    • by Culture20 (968837)

      They could, as a service to the online community, go ahead and post the usernames that are compromised.

      Along with the passwords. Because, um, then we'd know if the thieves have old creds? Yeah, that's the reason.

      • by BobMcD (601576)

        In truth, if my password were divulged back to me I'd know WHEN the compromise happened as well.

        But, as you so eloquently pointed out, there would be other uses for this information...

    •     I used to have a lot of fun with that, when I was the sysadmin for a large site. It seemed every script kiddie wanted the password to it. It showed up regularly on passwordz sites. We had a whole bunch of triggers to detect and resecure accounts. One of the easy and obvious ones was to let them post it, and catch it afterwards (usually within seconds of being posted). The legitimate account holder got a notification that we changed their password to a secure one. Everyone else just sat there and wondered how we'd catch them so fast.

          That trigger was pretty low on the list though. My favorite was to catch 'em scanning for passwords. If they tried say 1000 wrong passwords in a short period, but got one or two right, we'd let them keep scannning for a while, and then block their access to the server. (iptables drop rule). Then the program would figure out which passwords they actually got right, change those, and notify the account holder of their new password. :) It was always fun to see what the delay was between them finding a password, and when it started being used from passwordz sites. In those cases, we always had the account secured before they had time to post it. The typical time from being scanned to being posted was about 12 hours. The typical time for us to reissue the passwords was less than 5 minutes.

          I can't imagine online game places wouldn't have something similar. Brute force attacks are just too easy, and people will always try them. How many different usernames can a person really try before you know that they're just brute force attacking.

    • Re: (Score:3, Insightful)

      by noidentity (188756)
      Hopefully they'll try to return all these stolen credentials back to the owners. Returning stolen property can get pretty costly though, with so many different owners. They can't just go destroying them, then the owners would lose them.
    • Re: (Score:2, Insightful)

      by Dumnezeu (1673634)

      What would be the point of publishing a 500 MB (@~11 chars/user) text file? And how would they do that? If anyone gives a shit about their account, they'll just change their password as soon as they hear about this.

      Also, let's do some statistics, shall we? Let's say there are 20 million WoW accounts (pulled the number out of my ass, Wikipedia said 12 million in 2008). There are also 0.2 million stolen WoW accounts. The chance of your account being compromised is 100:1. Pretty high, if you ask me, so just sc

  • Hey, the original users got to keep their credentials - all that happened was the hacker got a spare set! (Until the password was changed...)

  • by FrankSchwab (675585) on Thursday May 27, 2010 @02:08PM (#32365356) Journal

    OK, so Symantec "recently stumbled upon a server hosting...".

    What, was it placed on their doorstep one night, and they didn't notice it when they went outside to get the morning paper?

    So, they wrote a crawler that intrusively scanned servers that they didn't have permission to access, opening and analyzing files that they didn't have permission to read, then published what they found?

    And the penalty if I did that is, what, 5 years in federal PMITA prison?

    There is something wrong in this world.

    • by BobMcD (601576) on Thursday May 27, 2010 @02:16PM (#32365466)

      And the penalty if I did that is, what, 5 years in federal PMITA prison?

      There is something wrong in this world.

      You're quite wrong. This is an example of one of the few somethings that is right in this world. Selective enforcement is designed into the system, along with jury nullification, to help the laws achieve ends that keep the public they support happy. Any "completely fair" application of the law would make it unworkable in very short order.

      Could you imagine a robot issuing you indecency citations every time you pass gas in public? Could you imagine a police officer doing the same if you passed gas into a megaphone-amplified-sound-system aimed at, say, an Inaugural speech? Context is key, and thankfully so.

      • Re: (Score:2, Insightful)

        Selective enforcement is what creates tyranny and allows those in authority undue power in determining who's looked after and who isn't.

      • by KahabutDieDrake (1515139) on Thursday May 27, 2010 @02:55PM (#32366136)
        Neither of the cases you cite are actually illegal. This is a key feature of the law, if something isn't codified as illegal, it's NOT ILLEGAL. The context is effectively null, since the example isn't valid.

        You say that any completely fair application of the law would make it unworkable. That is the biggest pile of bullshit I've seen on /. in a long long time. Believe me, that's saying something. ONLY a completely fair application of the law works. Our founding fathers knew this. Our ancestors knew this. The fact that you don't know this is frightening beyond reason. You didn't say, but you implied that symantec should have rights and privileges that an ordinary citizen does not. That is the largest perversion of the law that is possible. Companies do not have any trust, they can't be given confidence, because they exist for ONLY one purpose, to make money. You can trust a person, you can't trust a company, and even attempting to do so is foolish (at least) and IMNSHO stupid beyond belief. Our entire foundation of laws is based on the INDIVIDUAL being the top, and everything else coming second. If you know believe that corporations should be on top (they are, but they should not be), well, we've already lost, haven't we?
        • by Monkeedude1212 (1560403) on Thursday May 27, 2010 @03:28PM (#32366762) Journal

          You know "IMHO" can sometimes be interpretted as "honest" and not "humble" right?

          • by fishexe (168879)

            You know "IMHO" can sometimes be interpretted as "honest" and not "humble" right?

            IMHO, no it can't.

        • Re: (Score:3, Funny)

          by BobMcD (601576)

          Don't let me squash your corporate angst that you're grooving on, but you're entirely off my point, and have gone on to bend it towards one of your own.

          Symantec being 'the machine' is completely irrelevant. We still use them as a tool to keep our computers protected (the effectiveness is debatable, but not the use), and so would definitely allow them more leeway than we would an individual that neither harms nor benefits us.

          Our founding fathers knew this.

          Our founding fathers were, by the strictest application of the law, brazen criminal

          • Don't toss your anti-establishment bullshit on me. I didn't invoke it, and I'm not going to debate it.

            Our founders knew that equality under the law mattered. They sure as hell didn't get it right in their lives, but they went further than anyone else had.

            YES, I expect every law to be enforced for every infraction, or I expect the law to be changed. If selective enforcement is the rule, then prejudice, classism, and eventually a chaste system will prevail. You can live in that world, or we can all
            • by BobMcD (601576)

              Jeez, but you're frothy. How do you possibly know me well enough to label me in such ways? (Hint, slashdot has a posting history feature...) And why didn't you respond to the non-prosecution of our founding father's crimes?

              I'm not telling you that I necessarily support every possible imaginary application of selective enforcement, but only that it is implicit and necessary in the system for us to have a thing we like to call 'justice'. If you don't get it, fine. If you disagree, try and do so on more th

              • I don't recall labeling you, just rejecting the labels you put on me. Also, I would have prosecuted the founders of this country, if they had violated the laws of this country (which they almost certainly did)

                Let me try again with a little less froth. I believe in justice, and I don't believe that can be achieved by selective enforcement. Only by just laws. I do realize that under our current system I pretty much have to accept a little bit of both. At least for now. However, that doesn't mean I'm o
      • Re: (Score:3, Insightful)

        by mcgrew (92797) *

        Selective enforcement is designed into the system

        [citation needed] Can you cite a single government document that says this? "Selective enforcement" does in fact exist, but it is almost always used unfairly. It's an excuse to target the poor or minorities and let the rich and powerful off the hook.

        Sometimes they have "zero tolerance" policies in place in my city, and they're always in place in the ghetto. This coountry was NOT started with the concept of "selective enforcement" in mind, it was started with

        • Re: (Score:3, Insightful)

          by BobMcD (601576)

          "Selective enforcement" does in fact exist, but it is almost always used unfairly.

          Selective enforcement, by definition, is ALWAYS used unfairly. Sort of like how water is wet.

          • by fishexe (168879)

            "Selective enforcement" does in fact exist, but it is almost always used unfairly.

            Selective enforcement, by definition, is ALWAYS used unfairly. Sort of like how water is wet.

            Not necessarily. I say this having had a law selectively enforced against me. In my state, it is illegal to gamble, except in the state lottery or at Indian casinos. This is selectively enforced, and everybody knows it. It's even in the case law. The purpose of the law is not to stop gambling from occurring, but to stop it from becoming a racket or other public nuisance. It would be nearly possible to write all the distinctions into law for the types of gambling our state considers okay and the types

            • by BobMcD (601576)

              Perhaps I got my arguments crossed, but I've been tangoing with many on here that want to see every infraction dealt with on exactly the same terms, and are labeling this as 'fair'. You're saying it can be (something close to) fair to society while not necessarily being entirely fair to the individual, or something, which is fine.

              But as long as it is selective, there will be errors and 'fair', being equitable, in the sense it was being used earlier cannot exist.

    • by InsertWittyNameHere (1438813) on Thursday May 27, 2010 @02:22PM (#32365574)
      It was probably one (some) of their client's servers that got hacked and used in the collection of the credentials. The client found out that they got hacked and demanded that Symantec explain what happen. Symantec investigated and found out.

      They're not going to say "a server we were protecting with our products got hacked and was used in an operation to steal 44 million credentials..."
    • by TubeSteak (669689) on Thursday May 27, 2010 @02:27PM (#32365628) Journal

      OK, so Symantec "recently stumbled upon a server hosting...".

      What, was it placed on their doorstep one night, and they didn't notice it when they went outside to get the morning paper?

      So, they wrote a crawler that intrusively scanned servers that they didn't have permission to access, opening and analyzing files that they didn't have permission to read, then published what they found?

      Symantec and many other companies set up honeypot computers.
      The honeypot gets infected, Symantec pulls apart the trojan and studies its web traffic.
      This usually leads to the dumpsite where the trojan is uploading the data.

      Many botnet/trojan masters don't bother to encrypt their data dumps or secure the server hosting it.
      And even if they did, are they going to sue Symantec for unauthorized access?

    • Re: (Score:3, Insightful)

      by Demonantis (1340557)
      Sounds more like FUD to get people to buy into Symantec so something like this never happens to your computer. Legitimately though they could have looked at the viruses they were finding and traced them back to the server that was commanding the botnet. I would say the numbers are estimates and no actual cracking occurred as there was no specifics on how they found the data, which would be much more interesting. Everyone has heard tonnes about DDOS already and this is just another boiler plate application o
    • Re: (Score:1, Insightful)

      by Anonymous Coward

      > OK, so Symantec "recently stumbled upon a server hosting...".
      > What, was it placed on their doorstep one night, and they didn't notice it when they went outside to get the morning paper?
      > So, they wrote a crawler that intrusively scanned servers that they didn't have permission to access, opening and analyzing files that they didn't have permission to read, then published what they found?

      Yeah, it's not like Symantec reverse engineered a trojan that was attracting their attention (Trojan.Loginck),

    • by BForrester (946915) on Thursday May 27, 2010 @02:38PM (#32365808)

      RTFA. This is not a case of Symantec hammering through random servers looking for bogeymen.

      The very first sentence of the article states that the server was flagged from a new set of sample data submitted to Symantec. This is likely user data aggregated from Norton's threat detection network.

      • Re: (Score:3, Interesting)

        by FrankSchwab (675585)

        OK, so a compromised machine was pointing to the server.

        That somehow gives them the right to go rummage through that server uninvited, reading and analyzing what they found and publishing it? Now, I know the vigilante in all of us wants to say "yes", but it's not clear to me that the law permits that kind of activity. And I stand by my statement that, if I did it, I'd end up a very unhappy puppy.

        Let's imagine that I find some Symantec product on my machine that I didn't install, and I find a server address

        • by TubeSteak (669689)

          Let's imagine that I find some Symantec product on my machine that I didn't install, and I find a server address in the code. Does that give me the right to go pillage Symantec's machine and publish information about what I'd found?

          There are several underlying issues which are highly relevant to your argument:
          1. Was the unwanted code contacting that particular server from your computer?
          2. Can a bad actor grant access rights to his program but not to you, the user whose machine it is residing on?
          3. If the bad actor does not secure the information on an internet facing server, have you exceed access by "pillaging" it?
          4. Can a bad actor even make a claim of unauthorized access?

          Personally, I'd make the argument that the answer for #2,3,4

        • by fishexe (168879)

          That somehow gives them the right to go rummage through that server uninvited, reading and analyzing what they found and publishing it? Now, I know the vigilante in all of us wants to say "yes", but it's not clear to me that the law permits that kind of activity.

          Yes.

    • So, did Symantec do what they could to A) report the server and botnet; B) take it down; and C) prosecute the alleged criminals?
  • Botnet does things botnets do! Data stolen, data processing distributed, Mayor surprised and outraged! Read all about it, only a nickle!
  • A Symantec blog post reports that the company recently stumbled upon a server hosting the stolen credentials for 44 million game accounts.

    Symantec has reportedly bought up all the beer in the area and is planning raids into the deep mines.

  • Summary (and article) claims "44 million stolen gaming credentials", which sounds like a lot of us English-speaking and English-game-playing Slashdot readers.

    However, in the article, they analyze "a particular sample", with about ~18.3 million accounts in it. Of those ~18.3 million, ~16 million of them were game accounts for "Wayi Entertainment", which is an Asian company. They have no English website, that I can tell, and I think it's a safe assumption there are no English counterpart to these games.

    So we'

  • For MMORPGs its fairly easy, so I've read. Sell off their items/gold to other players for RL cash
  • The article glosses over the fact that *millions* of accounts are discovered.

    That suggests the data is captured in massive quantities at one time. Specifically, 210,000 WoW accounts are hard to come by one-by-one. The computing effort might not be great, but the time to trawl compromised PC's would seem to be. Am I completely off-base with this assumption?

    My point being, the bigger problem seems to be blocks of data that must come from the inside of these organizations pretends not to exist. Instead we

  • They would split up the list and sell it as small lists. E.g. you could split it up into lists of 1000 accounts or less, wheras the newest accounts are the most likely to work, thus having the highest price or similar.

    • Your post is the closest in the discussion to how to make money out of the list. The only problem is that you didn't think big enough. So the problem is that you can only sell each list once, and the stinky ones are hard to shift.

      Rather than sell the lists you want to securitise them. Bundle the lists up into tranches and sell rights to the loot in each tranche. By using clever financial magic we can make the bad stink from the oldest accounts go away and sell each account many times over.

      Absolutely nothing

  • For the benefit of the non-gamers amongst us, perhaps someone could explain exactly how one goes about converting game accounts into "hard cash".

  • Who says they're stolen?

    Could be the owner suffered from schizophrenia with multiple personalities and had 44 million separate personalities, all avid gamers... ;)

Pause for storage relocation.

Working...