Escapist article on FFXI Account Theft

[Bardlet]

She borked the last computer they had so bad (an lolCompaq) we had to buy them a new one (HP this time) because the other was beyond any sort of repair. Made her swear not to do it again. 2 year later, the desktop is littered with install files for more of those stupid games. -.-;

Viruses do not destroy hardware in this day and age.

It was so virus-ridden it wasn't even worth trying to fix it. The computer was old so rather than deal with a reinstall and reformat, it was much easier to buy them a new one.

Sorry I didn't spell it out for you.

No offense, but let me get this straight...you chose to spend another $700-$1000 instead of spending 1 hour on a format/reinstall because it was easier to spend the money? It doesn't matter how fucked up a computer is due to malware/viruses/etc., a format fixes 1 to 1000000 problems in the same amount of time in one shot.

The Compaq was from freaking like 1998 for the record, it was time for an upgrade anyway (since the gdamn thing was still running Windows 98 or some shit). We actually bought the new computer for my parents as an anniversary gift- only bought the tower and it was like ~$300 iirc. I don't even think the Compaq had more than a gig of memory, thing was freaking ancient and between my mother and sister downloading random games and shit and doing stupid crap on AOL (which they still claim to need to use to "get on the internet" despite having upgraded them to cable from dial-up back in '04), the thing was better off in the trash than bothering to reformat it for umpteenth time.

[SnickySnacks]

Did you get a virus?
Did you get FOUR-HUNDRED-THOUSAND VIRUSES?

http://www.homestarrunner.com/sbemail118.html

[Lampoon]

I don't know if this has been suggested before before, but how about SE locks in the IP address from which the account owner logs in and ONLY allow access from that IP. In a situation where a person logs on from more than one location, as some do from work lol, have an option of selecting up to 3 or so IP addresses. Any unauthorized changes to preset IP address, after initial account registration, will lock the account until proof of ownership can be procured. (This includes day of original registration and registration codes or what have you)

[Xanthe]

I don't know if this has been suggested before before, but how about SE locks in the IP address from which the account owner logs in and ONLY allow access from that IP. In a situation where a person logs on from more than one location, as some do from work lol, have an option of selecting up to 3 or so IP addresses. Any unauthorized changes to preset IP address, after initial account registration, will lock the account until proof of ownership can be procured. (This includes day of original registration and registration codes or what have you)

This doesn't work because most ISPs do not assign static IP addresses to customers. You can have the same address for a long time, but there is no guarantee that you won't be given a different one when your lease renews (typically done weekly).

[Sorrower]

I don't know if this has been suggested before before, but how about SE locks in the IP address from which the account owner logs in and ONLY allow access from that IP. In a situation where a person logs on from more than one location, as some do from work lol, have an option of selecting up to 3 or so IP addresses. Any unauthorized changes to preset IP address, after initial account registration, will lock the account until proof of ownership can be procured. (This includes day of original registration and registration codes or what have you)

SE has to adhere to the traveling man who lives in Tepeka, KA, hops into a missile, and flies himself over to China for his 2 o'clock lunch. C'mon now.....can't let 10,000 ppl's problems ruin one guys fun.

[Lordender]

This article was a great read, mass hackings like this were bound to happen sooner or later from rmt companies. I kind of found it funny that SE had no plan once so ever about the possibility this could happen when they started going after people who make a living rmt'ing on their game.

As shady as RMT companies are, I am surprised SE did not expect them to become desperate to do whatever it takes to get their money. People need to remember that in the end this is how certain people make a living IRL, they will do anything to keep making money even if its through illegal means.

[Purrrfect]

I don't know if this has been suggested before before, but how about SE locks in the IP address from which the account owner logs in and ONLY allow access from that IP. In a situation where a person logs on from more than one location, as some do from work lol, have an option of selecting up to 3 or so IP addresses. Any unauthorized changes to preset IP address, after initial account registration, will lock the account until proof of ownership can be procured. (This includes day of original registration and registration codes or what have you)

This + security questions/answers + revised ownership criteria would equal win. Unfortunately, it would take SE until 2012 to realize this, and then 2014 to implement it.

[layoneil]

locking IP is stupid, most ISPs will not let people handle that well.

a security question/answer when changing important information and e-mail confirmation should fix most problems.

[Lampoon]

A security question/answer input thru computer can as easily be keylogged.

[Xanthe]

A security question/answer input thru computer can as easily be keylogged as passwords do.

Multiple questions asked from a larger pool of questions in a random order beats that.

[Aselin]

I don't know if this has been suggested before before, but how about SE locks in the IP address from which the account owner logs in and ONLY allow access from that IP. In a situation where a person logs on from more than one location, as some do from work lol, have an option of selecting up to 3 or so IP addresses. Any unauthorized changes to preset IP address, after initial account registration, will lock the account until proof of ownership can be procured. (This includes day of original registration and registration codes or what have you)

The problem with this is that consumer level internet access has "dynamic IP" addresses, whereby the IP addresses change on occasion within a set time period. Companies such as AT&T and Covad offer static IP addresses that do not change, but costs significantly more.

I thought that would be a good idea too, but IP-locking an account would not work especially those that are behind proxy servers to get online. To make it work would need a very good program in place to determine significant changes to the IP address. (See below as to my suggestion.)

SE needs better security, but at the same time players need to be diligent in getting into habitual patterns. We cannot always expect SE to do all the work, the players have to do their part.

Players will need to do the following:
- be aware of security updates to software such as Flash Player

- install and update their anti-virus and anti-spyware software. Do periodic scans of your computer every week.

- do not visit suspicious websites or click on them in e-mails

- never give out your account information even if it's a friend, significant other, or even LS member

- never have a false sense of security stating that this will never happen to you. I already have two friends in this game that think that and are too stubborn and hard-headed to listen. But, if they get hacked, their fault. I'm sorry.

- never use Internet Explorer as that is laden with security holes just waiting to be discovered and exploited. If you can't live without IE, be sure pop-ups are disabled, set security to Medium-High, install IE7 Pro add-on, install anti-phishing toolbar.

- change your password on a periodic basis. I change mine every two to three months and have been doing that for the past three years.

- use the PlayOnline software keyboard that was added in the last update then have your PlayOnline automatically log you in afterwards. This way you don't have to keep re-entering your PlayOnline ID and password everytime you log in.

At the same time, SE needs to implement the following:
- higher cipher for SSL or better encryption upon logging in

- IP-locking may work if and only if the system or software developed for it notices a pattern of significant changes to the IP address. Even though consumer-level internet service providers give dynamic IP addresses, the first two to three digits in an IP address are almost always the same. Example: If you are 64.212.79.111 when you log into PlayOnline and 64.212.83.115 twelve hours later, you are still within the same region or country. These IP addresses would be logged onto the PlayOnline servers. However, when the system sees an IP address such as 22.56.34.212, it would automatically lock the account and prevent further access from that location. The system would compare that to the log of IP addresses used by the player and consider it a significant change and begin auto-locking the account. But, SE would have to do their part and make this work. The only problem I see are with proxy servers unless that person uses the same proxy server each time they log on.

- make the software keyboard within PlayOnline Viewer the only way for users to enter their password and/or POL ID.

- implement, as one has suggested, a security question or picture-based security question as is used by many banking websites. No one can figure out who your first school is or first street you grew up on or your mother's maiden name unless they personally knew you.

But, most importantly, a lot of these hackings would have been prevented if players kept their computers secure, knew that IE is an unsafe pile of crap, updated their software frequently, paid attention to security warnings, didn't visit websites known to have exploits or malicious software, didn't download software from suspicious websites or questionable P2P software, or even as simple as not giving out your account information.

Here is something to think about: malicious software and exploits can get onto your computer through website ads that use scripting (ActiveX or JavaScript, or scripts hidden within an invisible IFRAME); can come from opening a file in an e-mail or even an IM from a person you may or may not know; can come from software you thought was safe from getting it off a torrent or other P2P software (images, videos, music files, zip and rar files, exe files including keygens and no-CD/DVD hacks).

Hackers are creative which is why there are always new trojans, viruses, and keyloggers floating on the web. If there is a way into your computer and steal any sensitive information, then they have already found it. The catch though is if you are one step ahead of them to prevent that from happening.

[setzor]

A security question/answer input thru computer can as easily be keylogged.

the concept is, you set the answer and question when you first setup your account, and that you DON'T type it on the computer, you give it over the phone. When I worked at SBC back in 2001, all dialup accounts had a secret question/answer that was set when they setup their account. and if they forgot their password or address or whatever, all they had to do to get it resetup was to call and give the secret answer. typing it on the computer would be just like adding a 2nd password option, and OBVIOUSLY that's not secure. If you forgot your secret answer, you had to fax a copy of your state ID/Driver's License, end of story.

I also find it very funny, that the people who haven't been hacked yet are still sitting on their high-horses that they are the greatest masters of the interwebs and are invincible enough to talk shit about the people hacked. There's no full-proof way of keeping your computer safe unless it's behind a firewalled subnet, and all you do is play ffxi, nothing else, no browsing, P2P, etc. Say whatever you want, alot of people don't care to be "computer smart". That doesn't mean they are asking for trouble. They, like with most everything in life, just expect it to work. And yea, they will probably get hit with the bullshit, but SE should be ready to back up the customer.

NOBODY, and I mean, NOBODY (well, maybe with the exception of the cheaters and gilbuyers/sellers) deserves to have this happen to them.

[Fadian]

I like that article. Shows a common person who plays this game what could happen. A few things that wasn't pointed out.... What websites did she go to? Did she use 3rd party programs to get those key loggers or some of em. In either case, SE still needs to improve their efforts. I have 2 ways they can drastically improve it.


1. Implement a separate password for your personal account information within Playonline, that is separate then your login password. Most accounts that are hacked are from key loggers, you wont be entering that password information soo that is one way to safe guard that portion of your information.


2. Implement a procedure where if your account is taken while the call center is down, you can go to the official Playonline website and through a procedure of asking security questions get your password reset to a different one or at least have the option to lock the account until you can call SE. That way, no matter what time of day it is or day of the week, there is a option to change your password and/or lock the account without going in to playonline itself.

[S N K]

This was a really good read. I feel bad for the person getting jerked off by SE but sadly so many of us have come to accept it. <_<

[Ace-o-fire]

Why not have shit like rapidshare has? some annoying cat picture that you have to punch in each time before you log on.

[Purrrfect]

So since an IP lock may not work in some cases, couldn't they at least limit it to a region of the globe? I've seen sites where you can go and it gives you a location based on your IP.

[The Blackrose]

IP-locking may work if and only if the system or software developed for it notices a pattern of significant changes to the IP address. Even though consumer-level internet service providers give dynamic IP addresses, the first two to three digits in an IP address are almost always the same. Example: If you are 64.212.79.111 when you log into PlayOnline and 64.212.83.115 twelve hours later, you are still within the same region or country. These IP addresses would be logged onto the PlayOnline servers. However, when the system sees an IP address such as 22.56.34.212, it would automatically lock the account and prevent further access from that location. The system would compare that to the log of IP addresses used by the player and consider it a significant change and begin auto-locking the account. But, SE would have to do their part and make this work. The only problem I see are with proxy servers unless that person uses the same proxy server each time they log on.

What do you do if you are moving from one place to another and cannot guarantee the sufficient number of octets to maintain the same IP range? What if you tend to connect in via public WiFi networks from a laptop?

There would have to be many factors SE would have to take into account. Hell, we haven't even started talking about IP spoofing. Simply saying "they can lock it over x IP range up to x octets" is a shortsighted policy asking for trouble. If anything, they should be locking it by region or location. And if you do need to get access to the account and bypass the lock, the authentication process needs to be painless. That means not getting cockblocked by SE customer service after-hours or on a weekend.

[ronin sparthos]

Regarding world transfers:

You should be required after filing the world transfer petition to call the information center and provide your standard information SE asks over the phone in order for the petition to go through. Namely the one thing that RMT would lack: The POL Registration Codes. I dont think that so many people are doing a world transfer per day for this to be a huge cockblock regarding the call volume and it makes things slightly more personal, getting away from the automated process RMT love to abuse.

There is no way that RMT could get your POL reg codes unless you were keylogged when you first started the account because there is no other time you are required to punch that into the PC. Also i really doubt that they would call POL and wait on the lines for a representative in order to process a world transfer.

It'd be one slight cockblock for them, not being able to bail servers ASAP with a players account.

[Shafted!]

My original acct was hacked + banned before all these new policies (circa 2005), think there is a chance in hell i can get it back?

[The Blackrose]

My original acct was hacked + banned before all these new policies (circa 2005), think there is a chance in hell i can get it back?

Not a chance in hell.