New RMT attacks

[Natara]

Assuming it was RMT, they probably stripped/sold the expensive gear and bought the basic staves they will need to use BLM. Dark/Ice/Thunder staff. Not sure about the dates though, too lazy to go back and check those.

Back to the OP, quick question: this is probably pointless, but were any of the hacked accounts using the encryption key via flash drive? I still do this even though I'm not sure if it helps my security at all...

Why would someone buy NQ staves for the accounts they stole? Doesn't even make any sense. If you are advanced enough to steal account and got name changed, assuming by a lot of people it's not even done humanly, then why they even bother buying NQ staves.. just go on and keep stealing more accounts. $$$$$$$$ without any efforts. My guts say online gaming trade/sell/buy account websites are where we need to look into.

[cdgreg]

Why would someone buy NQ staves for the accounts they stole? Doesn't even make any sense. If you are advanced enough to steal account and got name changed, assuming by a lot of people it's not even done humanly, then why they even bother buying NQ staves.. just go on and keep stealing more accounts. $$$$$$$$ without any efforts. My guts say online gaming trade/sell/buy account websites are where we need to look into.

Makes perfect sense to me as long as it's not as advanced as it is initially made out to be. If they are advanced enough to change names then ya you're absolutely right, why slow yourself down to gear the character for use when you can simply plow through 795844 more accounts in a day. I just wasn't sure if there were some lines crossed along the way because the OP said names were changed, but that big ass post from one of the people hacked said his name was not changed but the CC information was. If it's a more standard hacking, or as you pointed out sale of an account, I could see the account being stripped then used as a sky mule in the blm army. Either way I hope we get to the bottom of this soon, I've already been rolled back once and don't feel like losing it all 6 days before the security token is released. I have a POL message and I'm afraid to even check it lol.

[Volition]

One final marketing ploy to boost sales on the Security Token.

[Spekkio]

Why would someone buy NQ staves for the accounts they stole? Doesn't even make any sense. If you are advanced enough to steal account and got name changed, assuming by a lot of people it's not even done humanly, then why they even bother buying NQ staves.. just go on and keep stealing more accounts. $$$$$$$$ without any efforts. My guts say online gaming trade/sell/buy account websites are where we need to look into.

the analysis above yours is correct. when the account was recovered it was found in den of rancor logged at the friar rush camp. it had a wide variety of random tonberry fiddlybits in its inventory along with antidotes, r/ex gear, and some very basic NQ AH equipment. it was most likely being used to farm, probably by a different group within the RMT enterprise. labor is cheap in china so there's no reason to not abuse the accounts after you've gone to the trouble of stealing it. they bought only the most basic gear required to make dithera useful to them for farming and nothing more.

edit: yeah, dithera's hacking was new strain we assume of the same damn MO. we have no reason to believe anything more exotic than a new trojan is out that AV doesn't detect yet.

[Ohaigaiz]

WOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOSHHHHHHHHHHHHH

Don't even

[Pamelita]

Last thing I'm going to say on this.

ENJOY YOUR LOST ACCOUNTS BECAUSE OF YOUR OWN STUPIDITY! :D

I don't really understand why you people are being "those guys" who don't read and assume people are whining. All people are trying to do is figure out what is happening, so we can fix it, so you can take the precautions so it doesn't happen to you. Your stupid and completely waste-of-space comments of "lulz ur stoopid for giving your acct info and I'm gunna lulz at you becuz I'm impervious to hax" is irrelevant since it's been happening to people who have never shared their info.

Go post non-sense in the spam forums if you can't contribute with useful suggestions or questions.

[Ohaigaiz]

Go post non-sense in the spam forums if you can't contribute with useful suggestions or questions.

So what people are arguing isn't contributing and isn't useful because... You don't like it? That's all I see. 'If you even think for one second that this is their fault you just go back on over to them spam forums!'

How about- 90% of all 'RMT attacks' are the user's own fault. Whether it be poor security, or plain stupidity like giving out their account information. It can't happen to me! Even if someone else has my information!

This is silly.

[Tarage]

I don't really understand why you people are being "those guys" who don't read and assume people are whining. All people are trying to do is figure out what is happening, so we can fix it, so you can take the precautions so it doesn't happen to you. Your stupid and completely waste-of-space comments of "lulz ur stoopid for giving your acct info and I'm gunna lulz at you becuz I'm impervious to hax" is irrelevant since it's been happening to people who have never shared their info.

Go post non-sense in the spam forums if you can't contribute with useful suggestions or questions.

What they are suggesting is retardedly impossible. Let's go down the list.

-Hacked account: Happened before. I've been hacked, but it was my own fault for sticking with IE when I should have been using Firefox.

-Hacked account through POL e-mail: Impossible. It don't work that way. Either there is some other cause or it's a coincidence.

-Hacked account through POL e-mail AND changed account information: Doubly impossible. You would have to be a fucking moron to believe this.

-Sharing account information with anyone: Retarded. Asking for it. This is the real reason for the hacking.

The facts are clear. The people who were hacked posted their account information on the internet. If you think PMs are private and secure, you are retarded. If you think sharing account information with your friends won't result in you being hacked, you are retarded. This 'hacking' has only happened to THREE people who were ALL CONNECTED. Stop fear mongering and dig your head out of your ass. Lock this topic please.

[Katalyn]

Why would someone buy NQ staves for the accounts they stole? Doesn't even make any sense. If you are advanced enough to steal account and got name changed, assuming by a lot of people it's not even done humanly, then why they even bother buying NQ staves.. just go on and keep stealing more accounts. $$$$$$$$ without any efforts. My guts say online gaming trade/sell/buy account websites are where we need to look into.

I will say that when my account was compromised last summer after I called SE, and got the password changed I found my character in QSC with a couple NQ Staves, had HQ prior, and mostly random R/E stuff. It is within the pattern of RMT activity that they strip down the character, outfit it with basic equipment, and use it for farming.

[Tsuki]

The facts are clear. The people who were hacked posted their account information on the internet. If you think PMs are private and secure, you are retarded. If you think sharing account information with your friends won't result in you being hacked, you are retarded. This 'hacking' has only happened to THREE people who were ALL CONNECTED. Stop fear mongering and dig your head out of your ass. Lock this topic please.

You're an idiot, who still can't read. Stop post counting+1. You're not fooling anyone.

[Invictusx]

Don't even

I quoted the guy that said it and then did

^ this

how can you not sense the sarcasm through the internet? And since you though I was serious...

woooooosh >.>

[Ohaigaiz]

You're embarrassing yourself.

[Tubbers]

What they are suggesting is retardedly impossible. Let's go down the list.

-Hacked account: Happened before. I've been hacked, but it was my own fault for sticking with IE when I should have been using Firefox.

-Hacked account through POL e-mail: Impossible. It don't work that way. Either there is some other cause or it's a coincidence.

-Hacked account through POL e-mail AND changed account information: Doubly impossible. You would have to be a fucking moron to believe this.

-Sharing account information with anyone: Retarded. Asking for it. This is the real reason for the hacking.

The facts are clear. The people who were hacked posted their account information on the internet. If you think PMs are private and secure, you are retarded. If you think sharing account information with your friends won't result in you being hacked, you are retarded. This 'hacking' has only happened to THREE people who were ALL CONNECTED. Stop fear mongering and dig your head out of your ass. Lock this topic please.

Wow, you're an idiot. I've said this four or five times now, and I'll say it again, and doubtlessly you won't fucking read it -- I'm not even sure you can read. Two people in my linkshell with no connection whatsoever, other than the fact that they are in the same linkshell, had their accounts stolen and the names on their accounts changed. There is no person who had access to both of them. It has been said that the ability to change account info such as the name and codes of an account is real, given this it's not too hard to believe someone else is capable of it.

I never fucking said the POL e-mail system had anything to do with this. I did state in bold, that there were suspicious messages reported by one of them at the time of the hacking, and that -if- that was the method used for the hacking, which it most likely wasn't, then there's a very serious exploit in the POL system. To claim that this is impossible is foolish. Do you have any idea what a buffer overflow attack is? It is a really common form of attack that involved overflowing character buffers with nonsense, then sending binary code after that to execute malicious commands. One of the requirements to make a buffer overflow attack work is a really shitty system that doesn't enforce length requirements. Could SE fail enough to not do this? I'd believe it, but most likely not.

My main point was the passwords on the accounts were changed unbelievably quickly, as soon as they could fire up POL and attempt to re-log in, the passwords had already been changed, and they are unable to retrieve their accounts because the names on them were changed as well.

The other two supposed attempted hackings in my linkshell were most likely false alarms where the people DC'd and misread the message since they were scared. Their accounts were not stolen.

In my opinion the most likely case is that there was a trojan of some kind on their computers from either FFXIAH adds or Otherwiki -- standard RMT affair. However; they have a new method of attack which is more devastating because it changes the account owner's name and renders the real owner completely unable to recover it. I'm fairly certain at this point the empty POL messages were just a coincidence and had nothing to do with it.

Tarage, if what I'm doing is fear mongering, what you're doing is retard mongering. Speaking as if you know anything at all when you clearly don't know shit. If this topic should be locked it's because idiots like you are shitting it up.

[cdgreg]

Tubbers,

Do you happen to know if either of them were using the "new" encryption code thing that can be stored somewhere like a flash drive? I do this although I'm not really sure if it helps or not...

[Tubbers]

Neither of them were using that.

[AoshiZ]

So you started this topic yesterday with the possible intent to say April Fools today?

[Tubbers]

Unfortunately, no.

[madpersian]

Did you do try what I suggested for getting the account back?

[Tubbers]

Yeah, no luck.

I already tried that suggestion. I looked through my bank records and had already asked them everything I needed to know in order to file all the disputes against SE. So, when I explained again my situation to SE they were like sorry we can't do anything since you can't prove ownership. So, I told them exactly what that post suggested, I was like if I'm understanding this correctly, I don't own this account and yet my CC has been charged for this account since 2005. Can you please explain how this could happen and they simply said that I most likely got this account from a friend and took over and started paying for it since SE doesn't have any rules for someone other than the owner paying for the account. So, I was like, I am prepared to file my claim at the bank, which I went to this morning and told them all about this situation to have all my charges that were made on this CC from your company and have already written a letter to the BBB about the customer service I have "not" received from you regarding this situation. They basically told me, go ahead, it won't matter. I'm spending spring break with my sister, who's an attorney and I'm going to see what I can do legally because no matter what I try, they are being complete assholes.

[Tarage]

Fucking bawwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwww wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwww

I'm laughing so hard right now.