Account stolen last night at 2:53 AM EST

[Sylphet]

survey up on playonline .com now about gm policies and information center policies

Oddly enough, got this from the SE GM policy.
Question:What if my account is hacked outside of Information Center business hours?
Answer:If you can still access your account, please take the following steps and change your PlayOnline password immediately:
"PlayOnline Viewer" -> "Service&Support"->"Membership"->"PlayOnline ID"->"Change Password"
If you have a separate account, please log into that account and make a GM call.

The whole survey is atrocious. The entire survey is written as if talking about a single GM call. I don't think anyone has ever had a problem with a GM call if they have say, gotten stuck somewhere and couldn't move their character. However it's also fairly universal that when it comes to game glitches (getting stuck outside limbus/not getting einherjar clear despite killing everything in the alloted time) their responses are universally poor.
SE has improved greatly in it's handling of the RMT situation but they still lack a whole bunch of common sense when it comes to early identification of them. Really, when you see a train of 5 taru BLMs in identical cheap gear that are anon with nonsense names all following a single hume female WHM again with horrid gear to a signet NPC followed with them all disappearing from game without red-dotting or logging out it should CLUE YOU IN.
However their handling of this situation has been abysmal and I hope they really work hard to get ALL of these accounts with their gear restored to the original characters.

[ronin sparthos]

Question:What if my account is hacked outside of Information Center business hours?
Answer:If you can still access your account, please take the following steps and change your PlayOnline password immediately:
"PlayOnline Viewer" -> "Service&Support"->"Membership"->"PlayOnline ID"->"Change Password"
If you have a separate account, please log into that account and make a GM call.

This makes me wonder what they are doing when people like myself call and a GM tells me he/she cant do anything until the information center is open....

The survey asked some questions that regarded the same pattern of hacking as well, asking about 'compromised accounts outside the information business hours'

[Izzy]

Im pretty sure she had her password saved

Ok, this leads me to believe this spyware/malware/wtfeveryouwannacallit is not actually a keylogger, but it is designed to find the file that stores your POL login info. It will then steal that, and the RMT will use replace their login file with this one thus stealing all accounts you have saved passwords for.

For the time being, I would suggest everyone removes their saved passwords, and type them manually.

[OctavoGilgamesh]

For the time being, I would suggest everyone removes their saved passwords, and type them manually.

I know you're trying to help people, but that isn't very good advice unless you have physically observed software doing this in more than one occasion. Otherwise keep your pw saved.

[Izzy]

For the time being, I would suggest everyone removes their saved passwords, and type them manually.

I know you're trying to help people, but that isn't very good advice unless you have physically observed software doing this in more than one occasion. Otherwise keep your pw saved.

Going by what boyfriend of hacked girl said, it would be worse advice to keep your password saved.

[Toralin]

When changing the password im 90% sure that you have to first type the CURRENT password. So indeed they do have the original password, not just in a 'SAVED ENCRYPTED' sense. unless they are able to hex the password out of the file that stores it.

[Wallslide]

which if you do have your browser setup like that you deserve to get your shit stolen.

This thread was created to help people solve an issue, not make them feel worse than they already do with that kind of attitude.

Nobody here deserves to get their "shit" stolen.

All I ask is if you could atleast be a bit more considerate of your wording.

Frankly, if your stupid enough to allow ActiveX to run unchecked. You deserve to get jacked.

If you want sympathy for what happened to you. Go find a therapist.

[vegetaa]

To be honnest, if I ever wrote a program to steal FFXI accounts, I'd make it so it would look for the password file, and also log keys. So both advices are reasonnable, but the only way to secure your ffxi account is to be sure that your system isn't contaminated with fishy programs :/

Yeah, that's my pessimistic mood right here...

Edit: And wallslide you're not wrong, you're just annoying and rude. That's two valid reasons for people to ask you to gtfo, and perhaps even kill yourself (which is more often than not a better solution than therapy).

[Jeny]

which if you do have your browser setup like that you deserve to get your shit stolen.

This thread was created to help people solve an issue, not make them feel worse than they already do with that kind of attitude.

Nobody here deserves to get their "shit" stolen.

All I ask is if you could atleast be a bit more considerate of your wording.

Frankly, if your stupid enough to allow ActiveX to run unchecked. You deserve to get jacked.

If you want sympathy for what happened to you. Go find a therapist.

First of, my IE isn't set to that manner, so I have no clue who you are flipping out at in your post....maybe you just wan't some attention....

When your account gets hacked don't come back here screaming that you need help.

You may want to contact your local therapist. ^^

[Shuvo]

Isn't the password stored in memory encrypted? I recall their being an update about it about 1.5 years ago.

[ronin sparthos]

Frankly, if your stupid enough to allow ActiveX to run unchecked. You deserve to get jacked.

If you want sympathy for what happened to you. Go find a therapist.

No ones running ActiveX unchecked, Attempt to Flame: Failed.

Seriously, if you have nothing productive to say then keep your mouth shut.

You sound like a GM, you have no idea whats going on in this thread.

[Midnitelouie]

Frankly, if your stupid enough to allow ActiveX to run unchecked. You deserve to get jacked.

If you want sympathy for what happened to you. Go find a therapist.

And if you're stupid enough to post in a thread for people trying to determine threat analysis, and methodology to recover an account?

Hmmm...assclown comes to mind...

================================================== ==================

On a more on topic note, people were mentioning the .BIN file getting copied over and then "replaced"...

Would it not be more logical if you're going to take the file, that you'd be able to replace the encrypted character string with the "new" password and info rather quickly? (ie, if the correct input values were known, would it not be possible to have an automated script to return the values that the "password change" screens are looking for?)

[Kimmie]

I have 2 accounts that were hacked last night while I was sleeping. Regarding the issue with saving passwords- I only have the playonline ID saved, I have to retype my playonline password each time for both accounts.

[Maaglin]

Advising people to type or not type their password is silly (especially based on third party accounts of the situation) until we know exactly how the malware works. Since we don't, the best piece of advice anyone can give is to stay away from suspected site (ffxiah.com) and to check your system for malware and if you find some, how to remove it.

Anything outside of that is just speculation.

[Wallslide]

You want to sit here and say you were key logged, fine.

Reguardless if you type in your password every time or if you have it saved.
The one thing that you NEVER type in is your POLID.

Because typically it is saved on there. Unless you ALWAYS log in as Guest.

Edit: The only time I have every typed in my POLID, is after a fresh install.
Meaning. I re-install Windows, Install POL, Setup my account information and THEN i connect to the internet and update.

I have no idea how others do it, but if i ever have a problem i play it safe and format. It's ridiculous that people sit there with key loggers and try to steal peoples information instead of putting their skills to use.

-------------
I understand your accounts were stolen as many others have been.

It is unfortunate.

A lot of people have given suggestions, and advice already.

What more can they say other then:
(1) Legal advice
(2) Complain untill you get someone to help you
(3) Harass them untill they help you or ban you.

--------------

Ronon, speak for yourself.

There are plenty of people out there that do not know any better and leave ActiveX without authorization.

And i wasn't attempting to flame anyone.

Good luck with it all.

[Izzy]

I have 2 accounts that were hacked last night while I was sleeping. Regarding the issue with saving passwords- I only have the playonline ID saved, I have to retype my playonline password each time for both accounts.

Well, that settles that lol.

[ronin sparthos]

Thats fine and all Wall, but its very obvious that this operation is large scale and doesnt involve the storybook: cheater who got cheated. Telling people about security is fine and all... just dont insult people while doing it and your good to go.

This is large-scale RMT shit, think imma go snoop around RMT camps on Raggy/Hades/Bahamut and SS some of the RMT wearing 'questionable gear' and bazaar messages (oddly they dont change them from what ive seen.)

To anyone thats been hacked: if you remember your bazaar message, it'd help identify your char if its been name-changed.

[mschaffer66]

First off let me say that I've never been one to post on these forums, but this post really got me thinking.

At this point no one can rule out any website or service as being a possible suspect, and on the same note no one can blame any website or service. There isn't nearly enough information about this to immediately blame FFXIAH or to dismiss the LS community site.

In my opinion one the last sites I would rule out is the LS community site. My reasoning is as follows. While this could be a key logger or trojan downloaded from some website or third party software, but that doesn't explain how people have had their accounts stolen when they play exclusively on PS2 and Xbox 360.

If its a key logger how does that explain the people that lost their accounts that never enter their password?

In my opinion this has something to do with either the LS com site or a possible security breach with POL itself. I know someone will now say, well I didn't go to the LS com site and lost my account. To that I would ask...do you even need to go there? Think about it. You enter your POL ID and password and 2 seconds later every single detail about your character is on the screen in front of you. Whats to say that wherever that login screen runs off to fetch info from is secure? I mean we are talking about a video game company that is known to implement poorly thought out ideas on a regular basis. All you need to do is look at the whole once the CC# gets changed its lost dilema to see that. So think about that...if you could find a hole to get into the "room" where all of that account data is stored. It would be like a supermarket for account thieves. I wouldn't doubt if there is a hole someone would find it.

And on a side note, if it is a problem on SE's end with security do you honestly think they will admit to it? Somehow I don't see them making a General News bulletin that says, "Umm...yeah, we really screwed up our security and many people had their accounts stolen. Unfortunately we aren't going to help them get their accounts back because thats a violation of our TOS. But on the bright side we just banned another 1000000000000000 RMT accounts...sorry if your stolen account was one of them."

For example, recently my wife had pictures of our dogs taken by a studio. They sent us a web link to a sideshow preview of the pictures. From this website you couldn't right-click and save as and you couldn't even print screen. But somehow she had one of her senior web developers figure out where they were stored and what not and pull them off. I know this really isn't related...but it shows that if there is a will and someone with the knowledge they will make their way.

The only way we will get to the bottom of this is with information. We need to know everything about the accounts that were stolen. What do they play on? What sites do they visit? What browser? What OS? What third party tools do they use like windower? Have you ever bought gil? Have you ever MPKed a slew of RMT? Have you ever sat around and harrassed an RMT fisher until he gets upset and warps out? /em raises his hand

Ask questions people. Lets learn more about this before everyone freaks out and starts a riot.

[ronin sparthos]

Hey, last i heard it CANT be SE because they are immortal gods that make no mistakes. /sarcasm off

Your right, we cant blame it all on the AH site because the AH issue could just be one step in this grand plan devised by RMT to get away with hijacking.

My Girlfriend visits:

BG
FFAH
Mysterytour
'Zam
FFXIclopedia
BG Wiki
Somepage

as her FF Resource sites, and im pretty sure most people do as well.

She has software that deals with all the usual malware/trojans and the sort but my main point is that like the above poster said, we cant dismiss it all on one place when it could be an issue on SEs side that they would never tell us.

[mschaffer66]

The more I think the more stuff comes to mind.

From what I can figure there are 3 factors in an account that would make it desirable to someone, mainly RMT, for theft.

1)Liquid gil. Its not traceable and it can be resold instantly
2)Sellable high end equipment. Converts to gil and off to market it goes
3)Jobs beneficial to NM hunting. With the big crack down on third party what is the best way to get characters leveled for NM hunting?

I would bet my account it has nothing to do with key logging. No one out there enters their POL ID every time they log on. So even if you were key logging you would have a password to nothing.

My gut feeling still points towards SE security issues and that LS com site. Thats the only place outside of POL that someone could gain access to your POL ID.