New RMT attacks

[Tubbers]

Cliff Notes:

On Sunday 5:45pm EST 2 people (Servont and Caitlyn) who play on PC in my LS were hacked and had their accounts stolen. None of their other accounts, or the accounts of anyone who had access to their accounts were compromised. Only these two. Servont and Caitlyn did not have each others info.

Today, 2 people (Holyman and Bobdeezz) claimed to get the same "Your account had been logged in from another terminal" disconnect message, but both were able to log back in and change their passwords.

Caitlyn noted suspicious PoL messages immediately before being disconnected by the thief. To my knowledge Servont, Holy, and Bob did not see anything like this.

Of these 4 people, Caitlyn was the only to exchange ID/PW info via PM on our LS website.

LS Website is clean of any suspicious files.

Caitlyn plays on PC
Servont plays on PC
Holyman plays only on Xbox360, but one other person in our LS has his ID, and plays on PC
Bobdeezz plays on PS2/Xbox360/PC, no one else has his ID/PW

The most important thing to note is that the name on the account was changed after the hacking, making Caitlyn and Servont unable to retrieve ownership.

Caitlyn and Servont were most definitely not banned, Caitlyn's character was logged fully into FFXI after being hacked, it was not her, the thief then disconnected her character. She was seen on Friend List on Hades several minutes later.

Another LS reported similar incidents.

[Kipling]

The reason everyone hopes it's this is so they don't have to be paranoid, right? Not out of some sense of mistrust and a jaded perspective on lost accounts?

Excuse me?

[Tubbers]

They shared info

I believe we have a winner somewhere in the above quote, now, it's very easy to replicate something an RMT would do, especially since it's nothing linked to your account.

I've said this a few times now, nobody had access to both Caitlyn and Servont. Nobody. Both of them were transferred to Hades after being hacked. Both of them had their passwords and personal information changed in an amount of time between 10 and 20 seconds. This is not humanly possible, that is a fact.

Uh... guhuhwhat?
You have proof of this, I assume. You "trust" them? That's what every lost account has said.
Shared info = you risk it all. Always been the case. Even if by some fluke that wasn't it, it's still stupid.

No, I only trust the people who I know in real life. The reason I am certain it was not one of the people who had their account info, is that the account information was changed faster than it is humanly possible to do so.

[Sonomaa]

Honestly, Im going with the theory that somebody shared info, somebody got "hacked" then also jumped a few other accounts to gank them, blame some random POL message that is HIGHLY IMPROBABLE. After that, some QQing and random wtf, somebody gets a bunch of shit, claims their account was stolen, decides to quit because it was bullshit, winds up on another server with a new name and a shit ton of gil. Cue people automagically blaming taj for stealing shit or chineese RMT for something that really really intelligent hackers havent figured out yet, who happen to ONLY be going for these 3 people who happen to all be connected.

Yeah... totally believe this.

[Tubbers]

Sono, I've said a few times now, nobody who had access to Caitlyn had access to Servont, and nobody who had access to Servont had access to Caitlyn. I'm not blaming or claiming the PoL message is the culprit, I'm just saying it's really strange and shouldn't be ruled out.

Furthermore I'm not looking for sympathy or whining or whatever, and neither are the people who had their accounts stolen. I'm just trying to warn the community that something strange is going on and to be careful. Maybe it was RMT, maybe it wasn't, all I know is the names on their accounts were changed, and they're unable to recover them.

If you want more background or details feel free to talk to me.

[Chrian]

if you get hacked find all your registration keys and head to one of SE's Main offices and demand to get the account fixed? I mean they should be able to know who owns the account if you can bring your own cd keys right?

[Aymee]

Even if you assume we trust all involved... there's zero other link between the people whatsoever other than their linkshell. There's no way RMT would magically have known they were all in the same LS, nor would that have even mattered to them.

If there are other incidents and/or other groups targeted out of different LSes, more info would be good so it's possible to connect the incidents. ...Until then the only possible conclusion to draw is info shared or some other internet activity combined within the LS.

[Tubbers]

Did you read the thread at all? If I read it correctly, a few other people said this was happening to people they knew as well.

[Izzy]

Did you read the thread at all? If I read it correctly, a few other people said this was happening to people they knew as well.

The people said they were getting blank messages, they said nothing about being hacked.

[Tubbers]

I was referring to this:

Sure, I'm sorta lazy and the story spams over a few days, so i'll sum it up by basically quoting what was posted on our LS forums regarding the hackings. These events happened on the 19th March

To sum it up:-

- No viruses, trojan's or malicious programs were found on either PC
- One of the account's originally hacked during this fiasco was then re-hacked, even after the PC was formatted, FFXI re-installed AND password changed
- I'm still trying to establish further details wether this "blank POL" message was recieved shortly before the hackings took place

At this point I don't think the blank PoL messages have anything to do with it.


Also, I'll be the first to say I hope it is someone in my LS, because as gay as that is, at least it isn't the fucking plague.

[Eanae]

Honestly, Im going with the theory that somebody shared info, somebody got "hacked" then also jumped a few other accounts to gank them, blame some random POL message that is HIGHLY IMPROBABLE. After that, some QQing and random wtf, somebody gets a bunch of shit, claims their account was stolen, decides to quit because it was bullshit, winds up on another server with a new name and a shit ton of gil. Cue people automagically blaming taj for stealing shit or chineese RMT for something that really really intelligent hackers havent figured out yet, who happen to ONLY be going for these 3 people who happen to all be connected.

Yeah... totally believe this.

No one blamed Taj. We simply stated that he was able to change registration codes, names, address, etc for peoples accounts.

[Spekkio]

the people from my LS who were hijacked were under somewhat different circumstances if you read the post by edimir. the attacker would log in for a short period of time and then log out (i hypothesized to get an inventory of the char) then later they would come back and actually steal the account. they also strategically used a registration server maintenance to gain more time with tsuki's account (perhaps by chance) but did not take that opportunity to steal any material.

in dithera's case the account was looted immediately after the password was changed. in both cases the accounts were logged into momentarily without changes made before the attackers returned a period of time later. neither computer had any signs of infection that any av scanners could find.

in their case, however, there's no reason to believe there's anything more exotic than some new, ffxi exclusive password stealer trojan that doesn't have a signature yet and is packed to avoid heuristics. tsu's computer we're fairly confident is clean, while dithera's we formatted completely (i actually made him format the whole drive ext3 so i KNEW he didn't just repair xp and think he'd solved the problem) so we're under the impression that that threat has been mitigated. it's possible that there are 2 new RMT groups out there doing account thefts again, however i find it hard to believe that the events are related (unless your hacked friends somehow picked up the same trojan) as the apparent attacks seem to show different approaches.

[Aymee]

Did you read the thread at all? If I read it correctly, a few other people said this was happening to people they knew as well.

Testimonials. LSes, relations to your people, common friends, RL issues, etc.. In other words, there needs to be a common thread between your cases and the others to figure out how any why you were targeted. Otherwise, it's simply impossible to think there's anything but a shared info link.

[AlexRuzhyo]

This is off topic, but does anyone have a link to the post that tells you how to configure NoScript/AdBlock/NoFlash? I believe there was a post link it to the Windower forums, it ha step by step and images of what the options should look like. (I think Wafik posted something similar in General chat one).

I'd just like to go over it.

[Tubbers]

My mistake then, I read that they were hacked with no evidence of a trojan and skimmed the rest. I'm investigating now, if it was inner-LS I'll be sure to let you know.

[Tordall]

Any chance they were using their PoL passwords for other websites/services?

[Tubbers]

I only know Caitlyn didn't.

[Casey_]

Oh god.. not Holyman.. I saw him in bastok mines earlier today where a shitton of RMT were gathered trading random shit around.. This was around 4 PM PST.

What really confused me about the RMT is there were at least 20 of them and I randomly traded a few and one gave me an Onion sword, and one attempted to trade me Garidav{sp} grass in a stack, they all had names like Oaall or Oalkl in patterns.

[Tarage]

This is bullshit. I request that this thread be locked until someone else can verify it happening to them. Otherwise this is simply retarded.

Sonomaa was right, this is complete and utter horse shit, and you know it.

[Issac]

This is off topic, but does anyone have a link to the post that tells you how to configure NoScript/AdBlock/NoFlash? I believe there was a post link it to the Windower forums, it ha step by step and images of what the options should look like. (I think Wafik posted something similar in General chat one).

I'd just like to go over it.

GUIDE: Protecting your web browser. - Windower