Oh noes! GMs making people drop Snowmen!

[Frenzy]

I didn't get such a message and my Snowmen are merrily standing in my MH. (And my New Year's Present is around, too, which, btw, I got last year, it would be pretty weird to ask the dropping of that, since there is no difference between one gotten this year or one gotten last year). Well, we'll see on the 9ths what happens.

[Shadowrunner]

I didn't get such a message and my Snowmen are merrily standing in my MH. (And my New Year's Present is around, too, which, btw, I got last year, it would be pretty weird to ask the dropping of that, since there is no difference between one gotten this year or one gotten last year). Well, we'll see on the 9ths what happens.

Is it New Year's Present? or New Year's Gift. I'd imagine them to be the same, but figured I'd try.

[Frenzy]

I didn't get such a message and my Snowmen are merrily standing in my MH. (And my New Year's Present is around, too, which, btw, I got last year, it would be pretty weird to ask the dropping of that, since there is no difference between one gotten this year or one gotten last year). Well, we'll see on the 9ths what happens.

Is it New Year's Present? or New Year's Gift. I'd imagine them to be the same, but figured I'd try.

It's the Gift. I don't play the game in English, so just took a guess what it would be called in English without verifying, I looked it up now via /translate.

[Edit} Aw, shucks, I know got the message, too.

[Airenn]

I hope Aikar gets 'randomly hacked' just so he knows what it feels like. Then there'd be a legit case of a retard getting hacked.

I see this ensuing>> WHY IS THIS HAPPENING TO MEEEEEEEEEEEEEEEE

[Khamsin]

I doubt they're going to go into every single person's inventory and drop the item, they'll probably just remove it's presence from the game in a non-intrusive way.

But then again, it is SE('s GMs) and they are stupid enough to drop other items.(Such as KS, lol.)

It's just a simple Database query.

EVE's Trinity patch was supposed to be simple, too.

[darkwind]

...be serious here, if there was some 'hack in the servers' hundreds of accounts would be ransacked per day, and many of the known rich people would of been hacked already...

As demonstrated by other games it's well within the realm of feasibility that there could be a loophole in the server side security such that a carefully crafted packet injected to the server could return some or all of the authentication information for an account.

Such bugs have been shown to exist in other games and sometimes the information returned is difficult to link together or essentially random (might return non-account name information that when linked could be used to access the account) thus explaining why it wouldn't be happening to hundreds of accounts a day.

It's perfectly reasonable to believe that such a bug might exist given the problems other games have had with that specific problem and the history SE has had with servers doing bad things when they receive specifically constructed packets. You don't need to hack into a server to get information you shouldn't have from it.

[Stiker]

I find that rude and unnecessary, and probably untrue for a handful of them. :/

I mean seriously, how would you feel if it was you? Think about it. Don't give the "wouldn't happen to me cause I don't 3rd pty, go to websites, give out info" and it just randomly happened to you somehow ?


Be ironic if someone came around on your 'account got stolen' post and said 'retards deserve this shit.' lol

be serious here, if there was some 'hack in the servers' hundreds of accounts would be ransacked per day, and many of the known rich people would of been hacked already.

If you got hacked, you either a) gave your info to someone you didnt know or not too good friends with in RL or b) downloaded malware.

In either case, you screwed up.

I had two LS mates get hacked and did not fall into either "a" or "b". It was most likely due to the friend list plus back door hack that happened a couple of months ago. Which brings me to my next point...

You dont just get 'Randomly hacked' without SOME form of information leadering the hacker to your user/pass.

When SE comes out and says 'we got hacked, sorry you lost your accounts', then ill say I was wrong.

And SE did in fact admit that they got hacked regarding the friend list issue. They said sorry about an account lost as well as one of my LSmates was server transfered upon her hack after about week of continuous bitching by her and her boyfriend. SE moved her back at no charge and waived the first fee that got charged to her as well. If that isn't saying sorry, I don't know what else is.

/derail off

[Lexa]

Her account being transferred back by SE at no charge, is the only instance I've ever heard of this happening. You gotta wonder why they'd do this for that account, but not for Ultima's many accounts that ended up on Leviathan(?). One good deed doth not, etc etc etc.

[ronin sparthos]

be serious here, if there was some 'hack in the servers' hundreds of accounts would be ransacked per day, and many of the known rich people would of been hacked already.

If you got hacked, you either a) gave your info to someone you didnt know or not too good friends with in RL or b) downloaded malware.

In either case, you screwed up.

You dont just get 'Randomly hacked' without SOME form of information leadering the hacker to your user/pass.

When SE comes out and says 'we got hacked, sorry you lost your accounts', then ill say I was wrong.

Your ignorance is bliss. If you think RMT are stupid or any hacker for that matter to just start a hack 'war' with SE when they can just gank a few accounts per week while staying below the radar while people like you and SE representatives are completely oblivious while making some decent labor-free bank in the process? SE is protecting them and people like you follow SE like they are immortal gods.

Seriously, you need to go read up on those DDoS attacks from early '05. SE didnt 'screw up' then either right?

SE asking everyone that calls the information about the Linkshell Community doesnt set off any alarms?

You think perhaps SE will man up and say they dropped the ball?

RMT actually know who are the rich people on the server?

Theres only two ways to get hacked now?

You should get a job at SEs tech center, your train of logic is as monotonous and devoid of any common sense as much as the lot of them.

Even if a player gets there password taken by malware, do you think its good business practice to say 'ok, you screwed up and because you dont know what the credit card info is - your SOL. maybe next time you should run a scan every 5mins for a keylogger.'?

Seriously, you play for an extended period of time then you should be entitled to at the least a representative thats not reading answers out of a manual. Maybe SE should take a crash course on anti identity-theft procedures like ANY sound credit card company has done.

/rerail

I think if you keep the snowmen and your storage is gonna get screwed up because of them that they will just dbox your excess? In any idea its just best you drop them... GMs are notorious for doing stupid things like throwing you in jail for snowmen and event items instead of stopping POS RMT miners teleporting in their faces.

[MisterBob]

DDoS attacks are not in the same league as hacking accounts, FYI.


I'll believe accounts can be hacked (excluding the Friend List+ fiasco) when I see someone who plays EXCLUSIVELY on PS2/Xbox360 gets hacked, and provides definitive proof that they never let a friend use the account.

[ronin sparthos]

So basically your saying when there is an ideal world where people dont play a game being marketed for the PC that you will believe that SE cant mess up?

People have been hacked on the 360 before, maybe not on the PS2 - but thats besides the point.

Bringing up the DDoS attacks was an example that SE isnt invulnerable, i never stated that they are one and the same.

Sad, i used to be like you: 'everyone that gets hacked is some bastard that uses cheats and bit off more than they can chew' then i woke up and saw reality, that this isnt 2005 where someone shouts 'HACKED' one a blue moon then 2 pages down the 'friend' logs on and says 'paybacks a bitch isnt it?' this is a new and VERY valid RMT tactic.

Never underestimate what a bunch of people (RMT) can do when there backs are up against the wall, and the mighty SE is as shortsighted as you are.

[darkwind]

DDoS attacks are not in the same league as hacking accounts, FYI.


I'll believe accounts can be hacked (excluding the Friend List+ fiasco) when I see someone who plays EXCLUSIVELY on PS2/Xbox360 gets hacked, and provides definitive proof that they never let a friend use the account.

Security isn't exactly a trivial thing to ensure in your code. Like I said above there are methods to exploit poorly written code to obtain information from server programs that they aren't supposed to reveal to you but you can't necessarily target specific accounts or just query to get all the information.

SE has already demonstrated that their server code is not robust against forms of attack where an end user injects packets. At one point there was an issue where you could inject packets to force d/c people (someone in particular, an entire zone, or even GMs). Specific instances of this sort of attack have been addressed but there always remains a possibility that changed code introduces a new weakness or that a new attack has been developed that wasn't addressed / thought of before.

Assuming all of those bases are covered depending on the protocols used by the game it could be susceptible to man-in-the-middle attacks or reply attacks. I remember reading at one point that the game will exchange some information using symmetric keys that are established only once and not re-established unless you log in again (I forget if this was to POL or XI). Additionally I'm pretty sure that XI isn't using SHA1 or better for anything given the time period it was initially released and MD5 has already been shown to be broken. Obviously there's a good deal of conjecture not knowing the specifics of how XI security is handled but it illustrates the point that weaknesses are easily possible.

Aside from the specifics of any particular account being stolen it's basically sticking your head in the sand or being uninformed about network/computer security issues to say that it's impossible to hack someones' account without them being a moron in some way or using 3rd party tools.

Computer security concerns do enter the picture regardless of which platform you play on: the server processes aren't exactly running on PS2s and XBOX 360s.

[MisterBob]

I'm not saying that PS2/360 would be free of security holes. I'm talking about the fact that only someone who played exclusively on those systems would be truly immune to getting their info stolen by a trojan/keylogger.

There's no need to lecture me on network security, it plays a pretty crucial role in what I currently do at my job. And for your information, SE is not using MD5 to encrypt secret keys, if you were curious. (MD5 isn't ridiculously broken, its just more vulnerable to brute force dictionary attacks compared to other encryption algorithms)

[Ryko]

Because theres NO WAY that SE could possibly have any sort of hole in their security, right? When the Friendlist+ thing happened SE didn't come out and say that security hole was on their end.

Because technically it wasn't. Granted their method of password resetting was woefully predictable but
1) You can specify another password than the one they give you while on the phone with them.
and
2) They tell you to change it the second you log in.

If you do neither of these then the fuckup is on your part, not theirs. Even so, they went to extra unnecessary and honestly futile lengths to fix the issue for people. I'm not one to think SE has their shit together, because they don't, but this pass the buck bullshit is retarded.

[Spekkio]

DDoS attacks are not in the same league as hacking accounts, FYI.


I'll believe accounts can be hacked (excluding the Friend List+ fiasco) when I see someone who plays EXCLUSIVELY on PS2/Xbox360 gets hacked, and provides definitive proof that they never let a friend use the account.

Security isn't exactly a trivial thing to ensure in your code. Like I said above there are methods to exploit poorly written code to obtain information from server programs that they aren't supposed to reveal to you but you can't necessarily target specific accounts or just query to get all the information.

SE has already demonstrated that their server code is not robust against forms of attack where an end user injects packets. At one point there was an issue where you could inject packets to force d/c people (someone in particular, an entire zone, or even GMs). Specific instances of this sort of attack have been addressed but there always remains a possibility that changed code introduces a new weakness or that a new attack has been developed that wasn't addressed / thought of before.

Assuming all of those bases are covered depending on the protocols used by the game it could be susceptible to man-in-the-middle attacks or reply attacks. I remember reading at one point that the game will exchange some information using symmetric keys that are established only once and not re-established unless you log in again (I forget if this was to POL or XI). Additionally I'm pretty sure that XI isn't using SHA1 or better for anything given the time period it was initially released and MD5 has already been shown to be broken. Obviously there's a good deal of conjecture not knowing the specifics of how XI security is handled but it illustrates the point that weaknesses are easily possible.

Aside from the specifics of any particular account being stolen it's basically sticking your head in the sand or being uninformed about network/computer security issues to say that it's impossible to hack someones' account without them being a moron in some way or using 3rd party tools.

Computer security concerns do enter the picture regardless of which platform you play on: the server processes aren't exactly running on PS2s and XBOX 360s.

how does POL assign your initial email address that they provide with your account? like a fool, i assumed it might actually get used for something other than SE's spam and changed mine, but i'm curious if the original name is based on your POL account number. if that were the case, a vulnerability in their mail configuration, coupled with the regular naming scheme of POL accounts makes the space of POL account names a reasonably searchable space. i presume this method is how taj did it when he mounted his attack on the friends list plus feature, but i obviously can't say for sure. if such a vulnerability were found, usernames could be isolated which is half the battle in breeching an account. worse if the user used the same password for their mail and their POL account, because a breech on the mail account escalates to a full breech of the account.

POL mail a neglected system that nobody uses and many even forget exists. how well monitored is it? has anyone checked the log files for any kind of brute force cracking attempts on it in the past...oh...forever? legacy and forgotten systems are a great way to gain access to other, more important targets as they're often tied to the newer systems in ways lost to the mists of time as well as being rarely scrutinized or maintained. they're a potentially viable foothold from which to escalate privileges and often low hanging fruit.

[Sesar]

When SE comes out and says 'we got hacked, sorry you lost your accounts', then ill say I was wrong.

Saying they lost accounts would make them accountable and therefore people could sue them right ?

No, because players don't own anything. You are paying them for permission to use their software according to their rules. If they lose something, or decide to unplug the servers one day, there is nothing that anyone can do about it.

Unless they did it midway through a billing cycle, of course. Then they would owe everyone a prorated refund for a partial month's billing, nothing more.

[CharlotteW]

blah blah blah...
Yes SE's ways of helping customers in getting their accounts back after being stolen is fucking idiotic and retarded and should be changed, but that doesnt change the fact its the users fault they got hacked.

SE's "fucking idiotic and retarded" ways of helping their customers wouldn't come into question if their security wasn't shitty in the first place. They also wouldn't come into question if the average IQ of their CSRs didn't amount to less than that of a wet shoelace.

On to the non-derail...

Good to see the GMs are using their GM powers for something as retarded and trivial as a bunch of snowmen furnishings. It's not like there are any REAL problems that need a GM's attention. (Not.)

[Ashira]

Everyone just come visit me and make real Snowmen, they're better than pixels anyway.

And we have plenty of snow!

So much angry in this thread.

[Lyramion]

http://lvlup.tsunami-art.com/view.aspx?Rec=181

[nekura]

Everyone just come visit me and make real Snowmen, they're better than pixels anyway. :(

And we have plenty of snow!

So much angry in this thread. :(

Besides, we can take digital photos of them and turn them into pixels anyway. :D