New RMT attacks

[Tubbers]

I'll reiterate that it is extremely unlikely the PoL messages are the source, but the RMT have demonstrated they have the ability to change the names on accounts; all I'm saying is be careful. This happened to two smart careful people. None of the other accounts they had access to were compromised, and of the people who had their account info, none of them were compromised as well. It's extremely fishy to say the least, so I felt I should post.

I'll also reiterate that the names on their accounts where changed. @Olo: The Affidavit/Notarized letter is completely useless, as that is a statement that you are X, however the names on the account are now Y. They provided all of the information about the account, the only thing which was different was the account name, and SE refuses to return them because of it.

[Meian]

Hmm, so the "theory" is that it is happening on the pol mail but not the actual messages you can read in-game right? Played since CoP and never set up the pol mail yet XD

Still scary though to hear. Here is to hoping they did something dumb (no offense) instead of there being a new mysterious cause.

[Destinye]

They're both PC users so..tell them to scan their PCs fully, it's still highly unlikely you can get hacked out of no where like this, especially through POL's mail system...so it could likely be that the POL mail was the 'trigger' and something else was planted before hand.

Need some more info.

[Olo401]

I'll reiterate that it is extremely unlikely the PoL messages are the source, but the RMT have demonstrated they have the ability to change the names on accounts; all I'm saying is be careful. This happened to two smart careful people. None of the other accounts they had access to were compromised, and of the people who had their account info, none of them were compromised as well. It's extremely fishy to say the least, so I felt I should post.

I'll also reiterate that the names on their accounts where changed. @Olo: The Affidavit/Notarized letter is completely useless, as that is a statement that you are X, however the names on the account are now Y. They provided all of the information about the account, the only thing which was different was the account name, and SE refuses to return them because of it.

Hmm.. wow that's some serious hackjob. And it sounds like it's on the server side.

SE needs to get on top of this NOW.

Edit: Just for the heck of it I'm gonna drop an email to the STF about this. Couldn't hurt.

[Sta]

fuck, the Chinese are this smart? :D

Spoiler: show

http://photos.ifmagazine.com/graphic...na_trouble.jpg

There's two million of them and their economy is getting better and with all their advances in technology they're gonna bring down America.

[Ksandra]

need to get the Security Token out already!

makes me wonder if that's why the rmt are becoming more vicious. Trying to get all the accounts they can before those tokens are out.

[Aihree]

POL message is a scary attack vector. When you receive a pol message, it's downloaded immediately to the computer you're on at that time. Even if you don't read it, it's already downloaded. This is evident by use of multiple computers to log in. If you receive a pol message, and don't read it, and then log on your other computer, there's no pol message waiting. This is because it's already been downloaded to the other computer.

An attack vector via pol message could theoretically go through without ever needing to read the message. Though the blank or otherwise unreadable message would be a dead giveaway.

Patch those Windows systems up to date folks.

[Tubbers]

Meian: not POL mail, POL messages. And once again, that's most likely not the case, I'm just trying to get the word out and not rule out any possibilities.

[Olo401]

Something else I thought of.. if a hacker has access on POL's reg servers to change account information such as the name, they are also able to copy that information and use it for other purposes such as identity theft.

[Destinye]

Something else I thought of.. if a hacker has access on POL's reg servers to change account information such as the name, they are also able to copy that information and use it for other purposes such as identity theft.

Which is why I highly doubt they would waste time on this when they have a goldmine at their finger tips.

[Unstable]

Which is why I highly doubt they would waste time on this when they have a goldmine at their finger tips.

^ This

Also if this is true that they are able to change data that is not meant to be changed these tokens that are coming out will be a waste of money as you can turn unlink them from server side.

[Khajit]

perhaps they're testing the waters first? SE has a track record of refusing to acknowledge when shit gets bad. They might do this for another 2~4 weeks and THEN use the info they grabbed for the identity theft.
Or it could be the fact that identity theft gets you into big trouble while stealing video game accounts makes the authorities laugh at any attempts by your victim to get you in trouble.

I kinda think the gilsellers wouldn't care enough to do that though so the logic above my post still does work to an acceptable degree.

[Viena]

POL messages being used as an intrusion method sounds quite unlikely, but not impossible. It sounds just as unlikely as the ability to modify the account's name.

And if that were the case, the scary thought is that it could be an attack speedy enough to make the security token unsafe. I still think that making a decent account/character recovery process should have been a priority.

[altwight]

@Khaji

I was thinkin the same thing. Identity theft is a big deal whereas stealing virtual shit is lawl.

[Tubbers]

I think it's something more along the lines up SE doesn't actually check server side whether you're able to change info, it's done client side. There is no way to do it client side, but they've probably made a program which sends the new Name to use to the server and says "update this." And the server just blindly accepts.

[Stinky]

"Sage Sundi! The servers are under attack! Oh God, the humanity! What should we do??"



"..... I don't know."

[Unstable]

I think it's something more along the lines up SE doesn't actually check server side whether you're able to change info, it's done client side. There is no way to do it client side, but they've probably made a program which sends the new Name to use to the server and says "update this." And the server just blindly accepts.

under the DPA they would have to have some one of changing names etc.

[Tubbers]

No they wouldn't, there just needs to be a protocol for it.

[cdgreg]

I have a POL message...god it's like telling someone the stove is hot so don't touch it

[Spekkio]

it's entirely possible RMT have the capacity to push new data to the server but not to retrieve it. this would make it hard for them to obtain a stored credit card number or name from the account, but would enable one to push up a new name to the account in order to take possession of it. feels like xmas 06 all over again. nobody knows where the attacks are coming from yet or how to safeguard ourselves, just that the penalty for stepping on the invisible landmine is very bad.