Account stolen last night at 2:53 AM EST

[Skyylya]

I read most of this, sorry to hear about your account.

What SE needs to do is implement a safeguard BEFORE you can change your password like say...entering in the last 4 digits of your registration code or something, or the whole registration code. You shouldn't just be allowed to change it cause there is no security in that.

as far as their security goes, if you can log into PoL you have carblanche access to change anything in the account. There should be a second safety measure before you're allowed to change any of the accounts information, like the registration codes that only the real owner would have.

[Scragg]

I'm not so good with computer related stuff, so if I'm wrong sorry in advance.

When I went to ffxiah.com about a week ago, it asked me if I wanted to download and install something from "microsoft". For those using IE, it comes up as a long bar right below your tabs asking if you want to install this. I couldn't think of a time where I was asked to download anything going to ffxiah.com since it opened up, so I exited my browser and went there again. Since then it never asked me to download anything.

Could it be that ffxiah.com got compromised and had people downloading keyloggers and stuff unknowingly thinking that it was from microsoft?

No it's not compromised and I doubt SE's linkshell community is either. They probably ask about it on the phone because they'd like to know immediately about phishing sites, not that their own site has problems.

[Okuza]

I wonder if they only target people that were never gil buying customers. It would be an interesting marketing tactic on the part of RMT to use the Linkshell Community to identify rich accounts and then compare with their own data on who buys gil. Then hack&sack the rich non-customers.

BTW, are we sure there are hacked accounts that never ever played FFXI from a PC client? If that's true, it points to either an exploitable hole in the FFXI client (or POL), or Linkshell Community, or the servers themselves. All it would have to be would be a server that doesn't have any limit on successive login failures or even a variation on the page-boundary timing attack for PW checks.

[Spekkio]

There are a few rumors on other boards about people getting weird behavior after logging into ffxiah running internet explorer. Apparently one of the ads there is trying to install something.

I also remember at least a few ads on forum sites being caught trying to install keyloggers.

Are the people getting hacked using IE (rather than firefox/opera/iceweasle/mozilla/safari) to browse the web?

The ads on ffxiah are chosen by google and tribalfusion, I'm 99% confident that none of them install software that would result in account theft. Most ads that display popups or ask you 'install this virus scanner' have been disabled by hand as I learn about them. They are just simple annoyances not anything that malicious.

However, as for accounts being stolen as a result of web browsing, that is totally possible and I've seen evidence of it because of links designated in china being posted (and quickly deleted by our admins). These pages usually have a hidden script and is purposely obfuscated in several layers. Since it's written in vbscript it's likely only to exploit users browsing in certain versions of IE. It takes nothing more than visiting the site. If you want my advice, just start using Firefox and be mindful of which websites you visit even still.

I'm not so good with computer related stuff, so if I'm wrong sorry in advance.

When I went to ffxiah.com about a week ago, it asked me if I wanted to download and install something from "microsoft". For those using IE, it comes up as a long bar right below your tabs asking if you want to install this. I couldn't think of a time where I was asked to download anything going to ffxiah.com since it opened up, so I exited my browser and went there again. Since then it never asked me to download anything.

Could it be that ffxiah.com got compromised and had people downloading keyloggers and stuff unknowingly thinking that it was from microsoft?

scragg, since you're already involved in this forum, do you know anything about ddong's situation? if you could locate a time, it might be possible to figure out what was trying to install itself. it could have been several things, but that could have been the source of the keylogging software. while i admit that the odds of the malware being linked in any fashion to your site are slim, it does seem remarkably strange that he would have something prompting to install from your site. it's also possible that he clicked on a poison link to get there, linking to ffxiah to lend credibility to the app which prompted him.

[Mord]

The bard standing next to Andrene is almost definately Whimsy, from Carbuncle server - account was hacked last week and moved to Bahamut. (Similar story to all who have posted so far, plays on PC, no one else knew password, no obvious method/reason for the hacking.)

[Francisco II]

Friend of mine was just viewing FFXIAH with Internet Explorer, noticed his computer running a little funny. He tried to terminate Internet Explorer, system kinda froze up and wouldn't let him.

He yanked the plug from the wall and restarted.

Ran a virus check, two files got picked up. He didn't catch the names, but it added files to the startup folder and System32.

He's a little worried now - and wants to change his password... so I also have two questions to ask about this?

1: To the people who got hacked, do you manually key your password in every time you log on, or is it stored in POL?

2: My friend's password is stored. Would he be better off leaving it alone, or changing it (where a keylogger could get it, if he has one)?

[Scragg]

scragg, since you're already involved in this forum, do you know anything about ddong's situation? if you could locate a time, it might be possible to figure out what was trying to install itself. it could have been several things, but that could have been the source of the keylogging software. while i admit that the odds of the malware being linked in any fashion to your site are slim, it does seem remarkably strange that he would have something prompting to install from your site. it's also possible that he clicked on a poison link to get there, linking to ffxiah to lend credibility to the app which prompted him.

I'll get in touch with him. Although ads trying to install adware isn't very unusual to me... either way I'm disabling ones that do.

[LinktheDeme]

as far as i know they only install stuff from other add programs that say stuff like OMG YOUR BEING VIRUSED INSTALL THIS TO STOP IT.

[virusiidx]

A friend of mine almost got hit last night. While she was AFK someone logged on from another terminal. Fortunately, when she came back everything was OK and right where she left it. She checked her account info and changed her PW asap. She's on PC.

This is just starting to get scary and after reading through the ToS and all these stories is just sickening.

Anyways, best of luck to whoever's account got stolen/hacked into, hope everything turns out ok.

Not sure if it was mentioned before, but I would say that having auto-saved passwords turned off is a good thing. I never auto-save my passwords because I believe it is stored on client side in an encrypted file.

[Sanjiyan]

Saving passwords means somewhere on the computer is a file with the password.
Not saving passwords means it makes it easier for keyloggers to record the password every time you log on.

I don't know what to do anymore.

[Jeny]

Saving passwords means somewhere on the computer is a file with the password.
Not saving passwords means it makes it easier for keyloggers to record the password every time you log on.

I don't know what to do anymore.

I refuse to believe there are keyloggers involved, because I have logged in and out of two other accounts during the week I had been hacked, yet only my character was touched. The RMT have found a loophole in SE's system, and people refuse to believe this.

[Lyramion]

Technical Things:

If you autosave your password it will be stored and encoded in the "login_w.bin" file (83KB approx) in your FFXI folder. This file can be used on any installation of FFXI to log in with your account data. if someone gains access to this file your life is over.

I used my login_w.bin from my JP installation on my US installation when I forgot my POL PW.

[vagus]

Wow, i did not know that many accounts were stolen / hacked / stripped in the past 3 weeks. Pretty sad that SE isn't making any attemps to prevent or fix the problem. Original CD Key would definetly be a way to prevent. Also, SE needs to follow in the footsteps of Blizzard. A friend of mine who plays WoW got his account hacked. 3 weeks later he got all his gold back with all of his gear. Got all his rare/ex gera back, was missing some of his non rare/ex, but still not bad.

[Liseth]

Just incredible. SE needs to get with the program.

[Ddong]

It happened again. I have been using it all day without it trying to download something. Now it just happened.
http://img266.imageshack.us/img266/861/safehd0.th.jpg

When I click the "x" on the pop up box, it pops another box trying to send me to another webpage.
http://img89.imageshack.us/img89/9039/safe2ra5.th.jpg

[DragonCloud64]

It happened again. I have been using it all day without it trying to download something. Now it just happened.
http://img266.imageshack.us/img266/861/safehd0.th.jpg

When I click the "x" on the pop up box, it pops another box trying to send me to another webpage.
http://img89.imageshack.us/img89/9039/safe2ra5.th.jpg

http://www.cwinters.com/images/blog/its_a_trap.jpg

[Lyramion]

Try this:

http://www.superantispyware.com/downloa ... PYWAREFREE

And scan your PC for spyware and things. I once had some mean spyware on my PC that tried to tell me Im infected and things. Even made a nice little icon in the taskbar... antispy gets rid of usually

[Aurara]

I'm a little worried, is the ffxiah only if you have an account on there? or is it unsafe even if you are just browsing?

[dyluck]

It happened again. I have been using it all day without it trying to download something. Now it just happened.
http://img266.imageshack.us/img266/861/safehd0.th.jpg

When I click the "x" on the pop up box, it pops another box trying to send me to another webpage.
http://img89.imageshack.us/img89/9039/safe2ra5.th.jpg

this is very discouraging. it appears that malicious ads may have infiltrated ffxiah.com as some have already suspicioned. I personally haven't encountered an ad such as that one on ffxiah.com, and i visit ffxiah.com multiple times per day. You can never be too safe, however. I switched to firefox today, and installed adblock, and a few other plugins recommended by others in the advanced discussion sticky. i suggest everyone read that sticky for more info on the subject. Also make sure you have active and up-to-date anti-virus running. finally, the safest precaution i think one could take is not visiting the site in question (ffxiah) until we are 100% positive on these ads.

[Naramaska]

I've never seen anything at all to that effect

I suspect you may have a bit of spyware tinkering with your hosts file...