New RMT attacks

[Edimir]

can you post specifics besides just saying someone was hacked? it would be nice to share information on what websites were visited, which viruses were found etc besides just saying someone was hacked

Sure, I'm sorta lazy and the story spams over a few days, so i'll sum it up by basically quoting what was posted on our LS forums regarding the hackings. These events happened on the 19th March

I'll start off by mentioning a few things that are relevant to our problems. Up until recently I have had access to three FFXI accounts; those being My own , my significant other's, and my friend's. I think its Important to note that the following issues have nothing to do with any sort of disgruntled relationships or things of that nature. As it stands now, only two of the accounts in question have been compromised that we know of, and only one of the two that had been compromised has been severely altered. I think I should also note that I considered bringing this up on BG on Thursday 03/19/09 when my own Account had been jeopardized, but against my better judgment and in light of the new security token key-chain being released I figured if I did post it, since at the time the damage was really minimal, that it would just result in flames by people telling us to "Just buy the security token key-chain when its out".

I don't want anything to take away from the main issue of this testament, which is quite simply that: None of the accounts in question had previously been compromised in the past, none of the pc's involved show any signs of being compromised (not even so much as a tracking cookie on my own machine) and that they are clean (and always have been) of all previously known malicious files which have been attributed to the previous "hackings". We believe that this is something newly introduced into the ffxi community but we need help to determine what specifically the new malicious files are called, and where we came in contact with them.

On Monday morning, 03/16/09 someone logged into my FFXI account while I was on my main character. At the time I was just finishing up some morning campaign before work and I was actually speaking with my significant other while he was preparing for work. I didn't think much of it at the time because I have from time to time in the past gotten that message when either he or my friend have accidentally logged onto my account while I was online. When I got back on he assured me that it was not him.

Thursday morning 03/19/09, I Decided to do something I actually almost never do, I was about 10:30am my time and on a whim I decided to 3-box the three characters to do their MMM mazes before JP midnight since we had missed the night before due to dynamis and salvage running late. At the time I knew Dith and my significant other were both at work so I knew it wouldn't be a problem for me to do the mazes. I invited some other friends to tag along for marbles while I was doing this, and by chance they also happend to witness the events that were to follow. At some point during the maze runs Dithera dc'd with the usual message "This PlayOnline ID has been used to login from another terminal" Again, I didn't think much of this, my first thought was that dith might have gotten too many hours at work again and had gotten the day off and that this was actually him logging in. Spekkio and Meeshah who were also doing the mazes with me also didn't take much heed to this because I said something like "oops dith's logging in". By the time Dith got back in-game we were done the maze and just waiting on him to pop the chest so that he would get the marbles too. Spekkio told me to invite Dith since he was in the zone, but when I sent the invite he didn't accept. Then a few moments later he was offline again, so I just ended up logging him back in myself and completing the maze. It wasn't until after I had loaded up AIM and MSN and saw Dith not "online" that I realized whoever had just logged Dith in, wasn't actually Dith.

To sum it up:-

- No viruses, trojan's or malicious programs were found on either PC
- One of the account's originally hacked during this fiasco was then re-hacked, even after the PC was formatted, FFXI re-installed AND password changed
- I'm still trying to establish further details wether this "blank POL" message was recieved shortly before the hackings took place

[S N K]

I change all my passwords monthly because of crap like this but I already decided to buy the damn token as it is.

[Aurara]

This is making me really worried, im just gonna stop opening my pol messages ><

[Eanae]

Theres a way to get names changed on accounts, taj is the only one I know that can do it

And registration codes as well. And confirming Taj could do this, but wouldn't anymore because he isn't that stupid. Someone else probably figured it out.

[Spekkio]

it's also possible an exposed profile from their linkshell profile service (the one that feeds live gear data and such from your acct, w/e it's called) enables them to attack and many people in your shell had it exposed. not likely, but something to consider.

[Unstable]

And registration codes as well. And confirming Taj could do this, but wouldn't anymore because he isn't that stupid. Someone else probably figured it out.

Ya i am sure he will not be doing that not after SE sueing him. But there was another person who worked close to him on PXI once. Forgot the name.His main was a Galka. Might be able to pull it up later. He would of known how to do it to,

[fantasticdan]

Which is why I highly doubt they would waste time on this when they have a goldmine at their finger tips.

Just because they can change the name within the PoL profile, or possibly use some kind of server side exploit to steal accounts, doesn't necessarily mean they can also get into your billing information.

[Gergall]

the process took too long, somewhere around 45 minutes, so the damage was definitely already dealt.

This is why it is so critical that everybody switch to a nation where they have no OP warps and home point in Cape Terrigan and stay there, on a level 1 job, with no oils or powders, at all times. It's the only way to ensure that no damage can be done to your account within the first several hours of being hijacked.

Be sure to leave all items of any value back in your mog house so they cannot be traded.

Also if you have any teleport crystals, wipe your character and start over.

And if you started WotG and joined a nation in the past, you could get Retraced so again wipe your character and start over.

If you follow these simple steps I'm pretty sure any hacker who took over your account would be pretty frustrated. Of course I can still think of some pretty easy ways to rescue such a character, but hopefully this will buy you the time you need to lock out your account.

[Destinye]

Someone playing only 360 got hacked?


3 things:

1. BS unless they shared info.
2. Windows Live doesn't have any gaping assholes to get penetrated atm to allow that kind of possibility.
3. XBL doesn't either.

Like it was said earlier..something isn't being told. Check your LS website.

[Izzy]

Someone playing only 360 got hacked?


3 things:

1. BS unless they shared info.
2. Windows Live doesn't have any gaping assholes to get penetrated atm to allow that kind of possibility.
3. XBL doesn't either.

Like it was said earlier..something isn't being told. Check your LS website.

Going with this. I'm betting Mr. 360 shared his info.

[Funkworkz]

If these poisoned messages are really how RMT get ahold of your account information, 360 and PS2 players will be vulnerable too, and not only PC players

[Kipling]

Just have them admit they shared info already, lol. Everyone knows they did. It's just like when people get banned and go "OMFG I DIDN'T DO ANYTHING!!"

They know what they did.

[Destinye]

If these poisoned messages are really how RMT get ahold of your account information, 360 and PS2 players will be vulnerable too, and not only PC players

SUPPOSEDLY, someone who only plays the 360 got hacked.

[Tubbers]

Just have them admit they shared info already, lol. Everyone knows they did. It's just like when people get banned and go "OMFG I DIDN'T DO ANYTHING!!"

They know what they did.

None of them denied this, I stated other people had their info. The thing is this wasn't done by someone they gave their account info to. Both characters that were stolen were server transferred.

As for Mr. 360, it may have been his friend trying to scare him, or he may have misread the message when he was disconnected. He managed to log back onto his account and didn't have it stolen.

Sorry for the late reply, I've been out.

[Kipling]

Lol...

[Budonez]

None of them denied this, I stated other people had their info. The thing is this wasn't done by someone they gave their account info to. Both characters that were stolen were server transferred.

I believe we have a winner somewhere in the above quote, now, it's very easy to replicate something an RMT would do, especially since it's nothing linked to your account.

[Aymee]

None of them denied this, I stated other people had their info. The thing is this wasn't done by someone they gave their account info to. Both characters that were stolen were server transferred.

Uh... guhuhwhat?
You have proof of this, I assume. You "trust" them? That's what every lost account has said.
Shared info = you risk it all. Always been the case. Even if by some fluke that wasn't it, it's still stupid.

[Araelus]

Just have them admit they shared info already, lol. Everyone knows they did. It's just like when people get banned and go "OMFG I DIDN'T DO ANYTHING!!"

They know what they did.

In other words
http://img7.imageshack.us/img7/816/tracer.png

The reason everyone hopes it's this is so they don't have to be paranoid, right? Not out of some sense of mistrust and a jaded perspective on lost accounts?

[Spekkio]

at this point it's not been externally confirmed that these POL message hackings have happened, however absence of evidence is not evidence of absence. it still is well advised to be on the lookout for suspicious behavior.

[Skjie]

If the POL messages had extra characters in them pointing to a buffer overflow, would it not be possible to look at them when they've been downloaded to your PC but not opened yet? Sorry, not sure how they're stored locally, but shouldn't this be the case?