Account Lost and Recovered

[aurik]

If Taj did it, why the implication of Rykoshet? What's the connection with Ksandra? It doesn't add up.

Motive, means, opportunity, only one person really has all 3.

[Sidanoir]

Why would people leave Radiance cause they are scared of Taj? >.>

I feel bad for Garett, etc. that fell victim to this, and I am glad you got your accounts back sucks your stuck there for a bit > but hey Leviathan isnt that bad..

Anyway everything about this doesn't smell right, will be interesting to see if the truth is ever flushed out...

Hopefully people will not entrust their password to any PM box, message, electronic file or random person on the NET ever again and this probably won't happen..

Oh yeah don't go to links about SOME UBER BOT from a person in game sending out tell spam either...

Did I cover all of it?

The internet detectives seem to be doing a great job SAYING WHO DONE IT AND WHY RIGHT RIGHT? lol

[Croaker]

There's one piece of evidence you're forgetting.........


Taj isn't an idiot. It makes no sense for him to go through these lengths to obtain and coordinate all this..........and then leave a big fucking neon sign pointing to him.

Does it all seem a little odd...yup.

Howeverm, it seems just as odd that he would be that retarded to leave that many footprints.

I'll admit, Taj is a gifted hacker. That doesn't necessarily mean he is smart.

An attempt was made to cover tracks. Account info, servers, names were all changed. Those tracks were just uncovered by people who were collectively smarter than the hacker.

Who knows what his motive might have been, but for opportunity, it is public knowledge that Taj was hacking forums a few weeks ago, looking for dirt on Divisortheory. The people that got hacked were in Divisor's linkshell. Taj could have easily come across those passwords in his search of that linkshell’s forums.


There is the remote chance that Divisor is trying to frame Taj. If so, it is very ironic that Taj just happened to play right into the frame, by getting so intimate with the new Ryko.

[mahal]

Nov. '04.

I know something else that happened in Nov. '04.

might not want to brag about info you obtained about someone in this situation. its obvious you have some level of involvment but the question is how much. your friend pming me is offering some nice confirmations and extra bits of info tho.

rly if you had accomplice(s) who are most responsible for the malicious stuff, you might want to make them known. as is though you're still easily pegged as a provider and that addr creates an undeniable link.

[Shuvo]

For the people saying it was done by someone with access to the PM data - what about Garreth? He said only 1 person ever knew his acct details, a year ago, and the password was changed since.

[Kriz]

FFXI account numbers don't change, and are a really bad semi-security layer (the oh so wonderful security by obscuritiy).

So, get the account number, you can launch any sort of attack. Or, get access to a password from one forum and hope it was reused...

[Stiker]

OH OH OH! I Got it!

Taj hacked the accounts, and to make sure people didn't think it was him, he covered his tracks by making it look like it was blatantly him!!!

/sarcasm off

[Liselle]

For the people saying it was done by someone with access to the PM data - what about Garreth? He said only 1 person ever knew his acct details, a year ago, and the password was changed since.

Only reasonable explanations are:

1) keylogger of some sort
2) Garreth is not telling the whole truth (WRT where his account details are)
3) highly unlikely possibility of a remote vulnerability

What's your pick?

EDIT: PS, I vote #2.

[Shuvo]

For the people saying it was done by someone with access to the PM data - what about Garreth? He said only 1 person ever knew his acct details, a year ago, and the password was changed since.

Only reasonable explanations are:

1) keylogger of some sort
2) Garreth is not telling the whole truth (WRT where his account details are)
3) highly unlikely possibility of a remote vulnerability

What's your pick?

EDIT: PS, I vote #2.

He only played on xbox so 1) is invalid

[Magos]

At this point, we care more about getting the transfer reversed than figuring out who did it (at least for right now). If anyone has any experience with dealing with something like this with the GMs, please let us know. We've been trying to talk to GMs since yesterday and all we seem to be getting is "Well we have no way to believe you at this time and your account info is your responsibility." This whole ordeal was obviously a malicious attack, it wasn't orchestrated within the LS as some ploy to switch servers and then come back and this obviously isn't a lie. We've had 9 people just vanish and they are ALL trying to get back. What we need right now, for anyone interested in helping us, is any info or suggestions on how we can can go about getting the transfers reversed.

[Dian]

There is the remote chance that Divisor is trying to frame Taj. If so, it is very ironic that Taj just happened to play right into the frame, by getting so intimate with the new Ryko.

I don't see what made the relationship he had with the fake Ryko so intimate. It's not so uncommon for someone to ask for a pearl for their mule, it's a possibility it could've been done in linkshell chat. Also it's not so weird for someone to head out of an event without being completely prepared, and ask for someone else in the shell who hasn't left town yet to pick something up for them.

[Stiker]

For the people saying it was done by someone with access to the PM data - what about Garreth? He said only 1 person ever knew his acct details, a year ago, and the password was changed since.

Only reasonable explanations are:

1) keylogger of some sort
2) Garreth is not telling the whole truth (WRT where his account details are)
3) highly unlikely possibility of a remote vulnerability

What's your pick?

EDIT: PS, I vote #2.

Well, I'm thinking it might be something like 1 or 3 because we just had someone in our LS get hacked to on Valefor. Thankfully, he's still on our server, but most of his big gil items were stolen along with his gil.

Only association with Ultima was running with their dynamis shell once, never had a forum account with them either. I also don't think he posts on here (BG) either.

So really, I have no idea what the hell is going on, but it seems this isn't just limited to Ultima members or BG drama...

(edit because I can't type)

[Liselle]

An attempt was made to cover tracks. Account info, servers, names were all changed. Those tracks were just uncovered by people who were collectively smarter than the hacker.

Worth pointing out that only the account info was an attempt to cover tracks of the actual perp. The server and names were symbolic and clearly selected to make a point of some sort.

Who knows what his motive might have been, but for opportunity, it is public knowledge that Taj was hacking forums a few weeks ago, looking for dirt on Divisortheory. The people that got hacked were in Divisor's linkshell. Taj could have easily come across those passwords in his search of that linkshell’s forums.

It's true that in Internet logic he may have had the opportunity if divisor's Ultima forum login/password was either guessable (because his PW was the same as it was here) or stored in his email.

But glossing over motive is bad sauce. You can't wave your hands and say "who knows?", it's a very important piece. He's already destroyed divisor's credibility, what is the point of punking the members of the LS that he left? Seriously? At the very least you could find links on their forum where they are bad-mouthing Taj.

There is the remote chance that Divisor is trying to frame Taj. If so, it is very ironic that Taj just happened to play right into the frame, by getting so intimate with the new Ryko.

How is this ironic? I think you mean a different word.

[Croaker]

For the people saying it was done by someone with access to the PM data - what about Garreth? He said only 1 person ever knew his acct details, a year ago, and the password was changed since.

Only reasonable explanations are:

1) keylogger of some sort
2) Garreth is not telling the whole truth (WRT where his account details are)
3) highly unlikely possibility of a remote vulnerability

What's your pick?

EDIT: PS, I vote #2.

Garreth may play on XBOX, but that doesnt mean he doesn't visit website forums on a PC. The person he told a year ago my have been through PM on that forum. He may have changed his account password to match his forum password or the hacker may have a means of obtaining passwords once they have account numbers.

[mhmmimafreak]

Its pretty obvious to me that this has been an attempt to cripple Ultima as a ls not any individuals.Many of our everyday players got hit and sent to other servers for 3 months.I think the person who did this knew that the people would have their codes and get their accounts back but would be screwed for 90 days.Also the people who got their accounts taken and moved had Ultima pearls on.Meanwhile i have 3 other accounts from friends who have quit over the years and every single one of them i had to info in my PMs yet they werent touched and they r damn nice hooked up accounts.This att to me is clearly meant to cripple Ultima for as long as possible.

To the person who did this u cant cripple us u cant bring us down.If anything you have just made us stronger as a core.We are rallying, we will show that this is a sad attempt at takeing us down.

All this he said she said crap dont mean nothing theres too many people to point fingers at this wont ever be figured out cause the only ones who CAN tell who did this arent gonna do anything about it.SE is the only one who could easyly help us figure this out but it will never happen.

Whats done is done all the bitching and complaining and pointing fingers isnt gonna do nothing but make for comical relief for people not involved.I think its time to forget and move on nothings gonna change we just got to learn from our mistakes and show that this makes us stronger.

My motto for years and has always been freaks bazaar comment says it all for me.

Pride and Honor
Friendship and Respect
Live it Learn it Love it

Da FrEaK

[mahal]

OH OH OH! I Got it!

Taj hacked the accounts, and to make sure people didn't think it was him, he covered his tracks by making it look like it was blatantly him!!!

/sarcasm off

my hunch was right and someone bought my bluff but the oregon addr is for sure someone connected to taj. so who would know that addr, have ability to fish the pol ids and pws, and be friendly enough with taj's ls to get fresh anonymous renamed transfers into the ls? not to mention taj has already made known he has private info about one of the ppl in this very topic (nov 04).

assuming there are other parties involved that may have done the dirty work, taj still slipped as an accomplice. but i'm not to sure about the roles of any other parties at this point, kinda some sketch info and a lack of it.

[ono]

He only played on xbox so 1) is invalid

You all are getting the names mixed up.

Aang = Xbox360 account (can't remember main account name, but all mules), user ID was shared via PM over a year ago but password was changed a while ago
Garret = PC account, renamed Rykoshet. galka w/ Aegis, user info was shared via PM with Sarahlynn
Sarahlynn = PC account, renamed Taja, user info was shared via PM with Garret

All in all, about eight or nine accounts compromised.

[Guni]

Any kind of plausible deniability for Taj is long gone. His excuses are amazingly lame. His first response he offeres nothing but a joke that he likes the name, but when he is called out on it, suddenly he knows all about Taja being a mule of their new PLD. Taj admitting to knowledge of this "mule" is the ultimate slip up. He claims he is not in the loop for handing out pearls, yet is on very friendly terms with the new transfer/trial PLD to the point that he knows their mules names. Must be an increadibly amazing coincidence that he needed to have Taj buy him the bow because that is pretty much required gear for Divine MIght and I am sure it just couldn't wait. <sarcasm>

Giving a linkshell to a transfer PLD with no application to your linkshell is extremely fishy. Also giving a pearl to a mule of that character is far beyond fishy.

The hacker hacks again. Big suprise. Maybe our hero, the BatTaj, only did it to show SE how vulnerable their accounts are due to some new glitch he found?

I'm not going to come out and say that your theory is an impossibility, but you really haven't provided enough justification to claim that you know Taj actually did it.

The first point you bring up is Taj knew that Taja was the fake Rykoshet's mule. How could he know this? You may want to carefully reread the comment you quoted because Taj states "Rykoshet told us that Taja was his mule". So far none of Taj's former LS mates have come out to contradict this statement and so we have no reason not beleive that Taj only knew about the mule was because he was told.

Next you say it seems strange that Taj was so affable with with a PLD who had just migrated and joined his LS. If you take the time to consider Taj's actions you will come to realize that buying the million gil bow wasn't as unreasonable as it sounds. The worst that could have happened is that Taj fails to pay attention during the trade and gets duped out of the bow without being payed, but considering the value of the item this is the least likely scenario. What is more likely to happen is that Taj notices something is wrong during the trade or the the fake Rykoshet refuses to take the bow. In either of those cases Taj would lose no more than the tax required to put the bow back up on auction and possible loss because of a drop in the price of the bow; which would be at most was at most 40-50k? In exchange for making a new member feel welcome that doesn't seem like such a large risk.

Regarding the last comment I highlighted, from what I understand it was another member of the LS, independent of Taj, that gave the fake Rykoshet a pearl (wish I had the name, but I'm posting between classes and don't have the time to look it up) . Unless again one of Taj's former LS mates comes out and denies this I don't see how this puts any suspicion on Taj.

Anyway, for those who lost their accounts they have my sympathy. For those throwing accusations around please take the time to think things through before you post and try and provide some evidence for you claims.

[Croaker]

There is the remote chance that Divisor is trying to frame Taj. If so, it is very ironic that Taj just happened to play right into the frame, by getting so intimate with the new Ryko.

How is this ironic? I think you mean a different word.

No. I mean ironic.

IF Taj is innocent and IF Taj is being framed, then it is IRONIC that Taj just happened to buy a bow for the hacker.

i·ron'i·cal·ly adv., i·ron'i·cal·ness n.

Usage Note: The words ironic, irony, and ironically are sometimes used of events and circumstances that might better be described as simply "coincidental" or "improbable,"

[Garret]

People should get their facts straight or you just muddy the analytic waters.

1) THE NAME IS G A R R E T
2) PC only, no PS2/XBox360, Windower 3.24, no other 3rd party software
3) PoL PW has been the same up to the incident for a long time
4) PoL ID/PW were PM'd within the last few weeks, prior to this only 1 person had my info, which was possibly sent through PM over a year ago
5) Kalia/DT did not have full admin capacity, he had mod/admin capacity to a specific subforum
6) Of the accounts stolen there is no single person who had ALL their information
7) Someone asked about how someone would know I would not be online, depending on the culprit it is relatively common knowledge within our LS, and to at least part of the server that I am in law school and that I have typically only been logging on recently when I run Dynamis. As far as I can tell my account was stolen in the hours after I finished Dynamis on Sunday, that could be either coincidence or that the culprit knew I would probably not log on again for a few days. I did not actually even know my account was compromised until Tuesday afternoon.

To the "If you give out your PW then you deserve whatever happens" crowd I would comment with this. There is a large difference between giving your information to someone who turns out to be untrustworthy and then screws you over by dumping your items, deleting your account, etc and having your account info ripped out of a private forum database through some form of illicit means, whether compromised admin passwords, bruteforce attacks, or whatever the hell actually happened. That is a significant difference in the mode the account was compromised. Let's use another example

You occasionally play FFXI at a friend's house, you installed a copy of it on his computer and happened to accidentally leave your manual and information on his computer. One day someone breaks into his house, robs him blind, and happens to snag your manual while they are at it. They happen to be a big FFXI fan and decide to hijack your shit.

In this case you have given out your information, but it's been compromised in a way that is clearly far outside the realm of foreseeability. Now, conversely, had your friend decided to take over your account, steal your gil, items, etc in the same scenario you could easily say that you risked your account being compromised. The two are incredibly different occurences and what happened here is much more similar to the scenario above than just having a buddy screw you, which is the general manner accounts end up being ripped off in.

Sorry, but if you think those two are essentially the same then you are flat out retarded. Excuse me for apparently not correctly analyzing the security weaknesses of a privately hosted forum, which is not hosted on site in someone's house, and not properly expecting what was likely a very illegal manner of accessing that information. My bad yo.


Edit for new posts: I personally find it unlikely that Taj did it. Like or dislike Taj he is usually quite vocal in what he does, and if he had done this I think he would be more than happy to say so. That doesn't mean he didn't do it, but evidence is murky at best that he did it outside of the fact that he is probably capable of doing.