Account stolen last night at 2:53 AM EST

[ronin sparthos]

At this point i couldnt care if they jail me, at least they will see im not kidding around when i say i need help.

[Phantomwarrior]

i spoke to 2 GMs and attempted to speak to an SGM, none of which said they were even able to start an investigation upon the account, let alone freeze the account.

[Ryko]

At this point i couldnt care if they jail me, at least they will see im not kidding around when i say i need help.

You think they care? That's a good idea, get your account shitcanned too.

[Sixtail]

At this point i couldnt care if they jail me, at least they will see im not kidding around when i say i need help.

You think they care? That's a good idea, get your account shitcanned too.

They will do it too.

[Okuza]

The data I got from the person with the "frozen account" was very vague. I don't know what the friend said when she called the GM, for instance. Maybe she noticed something like a flee tool being used and got the character jailed for a while as a result of that. The entire "frozen just for being hacked" part sounded very odd to me. No one else has reported a GM being that helpful before (not ever -- not even a remotely similar helpfulness).

So, maybe the details are blurry there. Maybe she wasn't hacked at all, just had some kind of error on her account. Maybe it wasn't a GM call but a phone call or web chat with an SE employee. Or maybe SE has just now woken up to the fact that they have a really incredibly serious security hole and they're now letting GMs take action.

BTW, another friend reported a hack & sack today, too (not of her own character, but a friends -- so once removed). Same salvage shell as the "frozen" person. This one was actually able to log in, though she found a character with no gear and zero gil. Different MO from all the other reports (no changed PW/CC) and this happened while the player was off-line. She was supposedly fairly active on the Linkshell Community.

NB. I'd take both those stories with at least one grain of salt. It's not a direct report and I wasn't at all satisfied with the clarity of the answers I got when questioning the frozen one. The only reason I brought these up is because this is more hacked accounts in the past few days than I've heard of in the past 4 years -- and it's the only time someone I knew claimed being hacked.

[Mikayla]

My friend's account was stolen as I was on the account... Although I'm going to make sure she doesn't tell SE that when she calls. x.x I was logged on it last night/early this morning, and all of a sudden I got booted and it said someone else logged on. I was in the middle of besieged, and my Xbox froze (I was on Xbox, friend's account on PC), so I didn't pay much attention to it at first. By the time I said to reconnect, they had already channged the password. -.- Haven't seen her logged on since that time. But if anyone sees Foxfire logged on on Caitsith, let me know. >.< She can't log herself on because her PS2 is having issues...

[LinktheDeme]

At this point i couldnt care if they jail me, at least they will see im not kidding around when i say i need help.

You think they care? That's a good idea, get your account shitcanned too.

They will do it too.

I got my original character temp banned for GM harassment during a kirin run. Though I was saying ungimp ranger plz the entire time so i deserved it ;3. (Was the day after the huge rng patch)

[ronin sparthos]

At this point i couldnt care if they jail me, at least they will see im not kidding around when i say i need help.

You think they care? That's a good idea, get your account shitcanned too.

They will do it too.

I got my original character temp banned for GM harassment during a kirin run. Though I was saying ungimp ranger plz the entire time so i deserved it ;3. (Was the day after the huge rng patch)

At this point talking to SE is useless, but might as well exhaust my GM calls and as long as i keep trying i may get someone or they may just ban me - considering the odds are 50/50. My character is just as gone all the same if no one curbs the RMT hack n sackings.

Unless someone has a better idea hm?

[Edrick]

I didn't really think about this before I read the response above talking about a secondary line of questioning. At my workplace, to change your password, you need to answer 3 questions to get to the point where you can change your own password: 1 was your birthday, and 2 were questions about the company we work for. I think giving players the ability to make up at least 3-10 questions, and have it display 3 of those at random would basically eliminate account theft.

The only possible way to get into the account and change the password, then, would be to know those answers to the questions. As long as the players don't make stupid questions, then they'll be perfectly safe.

Unless these RMT are using a back-door program to just bypass the security and send a password change packet to SE's servers, mimicking the steps only going faster... (Is that even possible?) But, I really like the question thing. You could even make one of the questions: What's your FFXI Key? I mean, how hard would that be? It'd definitely safe SE a ton of headaches dealing with "My account was stolen!" calls, and the players wouldn't have to make those calls in the first place. ><

I don't understand how logic doesn't work well within huge corporations...

[Uzor]

I didn't really think about this before I read the response above talking about a secondary line of questioning. At my workplace, to change your password, you need to answer 3 questions to get to the point where you can change your own password: 1 was your birthday, and 2 were questions about the company we work for. I think giving players the ability to make up at least 3-10 questions, and have it display 3 of those at random would basically eliminate account theft.

The only possible way to get into the account and change the password, then, would be to know those answers to the questions. As long as the players don't make stupid questions, then they'll be perfectly safe.

Unless these RMT are using a back-door program to just bypass the security and send a password change packet to SE's servers, mimicking the steps only going faster... (Is that even possible?) But, I really like the question thing. You could even make one of the questions: What's your FFXI Key? I mean, how hard would that be? It'd definitely safe SE a ton of headaches dealing with "My account was stolen!" calls, and the players wouldn't have to make those calls in the first place. ><

I don't understand how logic doesn't work well within huge corporations...

Yeah, I was thinking something similar would work...

btw, is it possible that its SE changing the password? 'cause, you know, if SE changed the password, someone else could just login, thus making it seem like they change the password in under 30 sec.

[Tordall]

There are a few rumors on other boards about people getting weird behavior after logging into ffxiah running internet explorer. Apparently one of the ads there is trying to install something.

I also remember at least a few ads on forum sites being caught trying to install keyloggers.

Are the people getting hacked using IE (rather than firefox/opera/iceweasle/mozilla/safari) to browse the web?

[Scragg]

There are a few rumors on other boards about people getting weird behavior after logging into ffxiah running internet explorer. Apparently one of the ads there is trying to install something.

I also remember at least a few ads on forum sites being caught trying to install keyloggers.

Are the people getting hacked using IE (rather than firefox/opera/iceweasle/mozilla/safari) to browse the web?

The ads on ffxiah are chosen by google and tribalfusion, I'm 99% confident that none of them install software that would result in account theft. Most ads that display popups or ask you 'install this virus scanner' have been disabled by hand as I learn about them. They are just simple annoyances not anything that malicious.

However, as for accounts being stolen as a result of web browsing, that is totally possible and I've seen evidence of it because of links designated in china being posted (and quickly deleted by our admins). These pages usually have a hidden script and is purposely obfuscated in several layers. Since it's written in vbscript it's likely only to exploit users browsing in certain versions of IE. It takes nothing more than visiting the site. If you want my advice, just start using Firefox and be mindful of which websites you visit even still.

[Aidin]

btw, is it possible that its SE changing the password? 'cause, you know, if SE changed the password, someone else could just login, thus making it seem like they change the password in under 30 sec.

When they reset my password for me a few years ago, they reset it to the 4 numbers at the end of the POL ID. I'm not sure if this is still how they do it, though.

[Naramaska]

btw, is it possible that its SE changing the password? 'cause, you know, if SE changed the password, someone else could just login, thus making it seem like they change the password in under 30 sec.

When they reset my password for me a few years ago, they reset it to the 4 numbers at the end of the POL ID. I'm not sure if this is still how they do it, though.

I recall something similar to that when I called in for a password reset as well.

[Mici]

Did someone say they seemed to change the PW in 30sec or so?
something about a "back way" into changing the PW, well if it was that, then they would not have to get the PW at all
and could change it, then log in.

God i hope its not something like that, we would all be fucked

[Jeny]

Meh... Can't sleep. I did some research... Alot of the stolen accounts were dispatched to Kuftal Tunnel and Wajaom Woodlands; and the majority are at Hades and Bahamut.


Oh and... I was feeling a bit crazy today, so I re-activated an old account on Bahamut and found Andrene camping Amemet. Do any of these characters next to her look familiar? ~~ They are most likely stolen too.

http://i7.photobucket.com/albums/y29...ntasy8/3-1.jpg

http://i7.photobucket.com/albums/y29...ntasy8/4-1.jpg
The bitch took my boyfriend's name off bazaar message. It makes no sense now...lol

http://i7.photobucket.com/albums/y29...ntasy8/5-1.jpg
Slightly better geared than most BLU I've seen. :3

And uh, I forgot to take screenshots, but here are a few lines of what Andrene said to me. Of course I didn't want to alarm them...so I played the dumb noob who asks obnoxious questions.

[19:49:36]>>Andrene : What are you looking for here?
[19:50:14]Andrene>> No . For Amemet Skin ><
[19:50:58]Andrene>> For money

When did I ask a yes or no question? >.>

[19:52:03]>>Andrene : are you Japanese?
[19:54:00]Andrene>> No
[19:54:14]Andrene>> USA ^.^
[19:54:16]Andrene>> florida
[19:54:46]>>Andrene : Wyoming, New York?
[19:55:13]Andrene>> yeah =)
[19:55:32]>>Andrene : really?? what part?
[19:55:50]Andrene>> I'm sorry. I'm busy now

They said yes to Wyoming, New York....................

[20:04:45]>>Andrene : Where ya going?
[20:05:14]Andrene>> Goin raise III my friend
[20:05:24]>>Andrene : You have WHM?
[20:05:31]Andrene>> yeah
[20:06:13]>>Andrene : What other jobs do you play?
[20:07:53]Andrene>> very much

Wut?....

[20:16:18]>>Andrene : What system do you play from?
[20:16:37]Andrene>> yes

[20:25:59]>>Andrene : What do you do for a living?
[20:26:15]Andrene>> No goin work
[20:26:30]>>Andrene : Oh? So you play all day?
[20:26:57]Andrene>> yeah
[20:27:09]>>Andrene : Then how do you make money to pay for your character?
[20:27:20]>>Andrene : ?
[20:27:21] Your tell was not received. The recipient is either offline or changing areas.

[Ddong]

There are a few rumors on other boards about people getting weird behavior after logging into ffxiah running internet explorer. Apparently one of the ads there is trying to install something.

I also remember at least a few ads on forum sites being caught trying to install keyloggers.

Are the people getting hacked using IE (rather than firefox/opera/iceweasle/mozilla/safari) to browse the web?

The ads on ffxiah are chosen by google and tribalfusion, I'm 99% confident that none of them install software that would result in account theft. Most ads that display popups or ask you 'install this virus scanner' have been disabled by hand as I learn about them. They are just simple annoyances not anything that malicious.

However, as for accounts being stolen as a result of web browsing, that is totally possible and I've seen evidence of it because of links designated in china being posted (and quickly deleted by our admins). These pages usually have a hidden script and is purposely obfuscated in several layers. Since it's written in vbscript it's likely only to exploit users browsing in certain versions of IE. It takes nothing more than visiting the site. If you want my advice, just start using Firefox and be mindful of which websites you visit even still.

I'm not so good with computer related stuff, so if I'm wrong sorry in advance.

When I went to ffxiah.com about a week ago, it asked me if I wanted to download and install something from "microsoft". For those using IE, it comes up as a long bar right below your tabs asking if you want to install this. I couldn't think of a time where I was asked to download anything going to ffxiah.com since it opened up, so I exited my browser and went there again. Since then it never asked me to download anything.

Could it be that ffxiah.com got compromised and had people downloading keyloggers and stuff unknowingly thinking that it was from microsoft?

[ronin sparthos]

Problem is that people that play on 360/PS2 we're hacked as well, so unless all those people got keylogged too.... it doesnt explain everything.

[Brill Weave]

Problem is that people that play on 360/PS2 we're hacked as well, so unless all those people got keylogged too.... it doesnt explain everything.

I'm willing to bet my account that it is the Linkshell Community site. I've been reading all of the sites that have threads up about accounts being hacked. There are a slew of people saying multiple folks from their linkshells got hacked into.

As someone has mentioned before, this has to be a RMT operation. China has an extremely active hacker base and they have shown in the past they have no problems hacking an MMORPG(Lineage.)

SE has hit their money making ability so hard that they are now stooping to blatantly stealing accounts from people. But it seems like they are only stealing accounts that are very well equipped(ie K-Club, PCC, etc.)

What was said a few pages back about calling SE and saying you want a refund for fraudulent charges has been done before and to my knowledge, it has worked every single time.

But while the concept is correct, the steps are not. First contact SE and ask them to restore your account back to your control. When they say that you no longer have the current credit card numbers advise them that you will be filing a grievance with your credit card company since they are unable to provide any proof that you ever controlled the account.

Contact your credit card company and tell them that you would like to file an inquiry into a possibly fraudulent charge on your credit card. Explain to the rep that you have been charged for X amount of years and months for a product that you are not in possession of, and by SE's own admission, they cannot prove you have ever used.

Now SE is in a catch 22. If they continue to play the hard line and say you did not control the account, your credit card company will then file the grievance on your behalf in an attempt to recoup the monies that you have spent on the game.

So SE will be stuck with two options.

A. They will eat the money and issue a refund to your credit card(this won't get your character back, but you will at least have some peace of mind.)

B. They will restore the character back to your control so they do not have to pay back the money they have already taken from you.

Fair warning though. This is an EXTREMELY lengthy process and you can expect this to take over three months in most cases. By that time your toon may have been banned for RMT operations or been deleted. But it has worked before and I'll try to find the links that walks you through it step by step.

[Aerides]

YYMV depending on the issuing bank of your CC (and if it's debit you may find it harder than credit). But, typically banks won't allow dispute beyond 60 days of the transaction unless you are claiming fraud as the dispute reason. Even then (hey you didn't complain for 1,2,3 years why now? may be the roadblock you run into with your bank). Be sure to try and get as many charges included as possible or it might fall under your bank's limits to write off and not even pursue with SE.

Also, with Visa/MC, your bank will likely do an instant chargeback (debit to SE, credit to you) and then SE has something like 45 days to dispute back. The whole cycle can take up to 3 billing cycles tops by law. SE policy is to cancel any account where they get a chargeback, but it's going to be interesting if the account is no longer on that CC whether they'd do that.

It's worth a shot but be prepared to haggle with your bank to get the past billings included as much as you can to present the largest dollar total you can.