New RMT attacks

[Kipling]

This is bullshit. I request that this thread be locked until someone else can verify it happening to them. Otherwise this is simply retarded.

Sonomaa was right, this is complete and utter horse shit, and you know it.

Seriously, this is just getting people riled up/scared when there is no proof.

[Tubbers]

If I knew it was horse shit, I wouldn't have posted it. Maybe it's retarded -- some shit went down, I couldn't find a link for internal members to have stolen, the profile fit RMT MO so I posted to warn people just in case.

In any case SE needs to have a better way of locking accounts, like an online form or something. Needing to wait 40+ mins to contact GMs on weekends is unacceptable to me.

[Tarage]

If I knew it was horse shit, I wouldn't have posted it. Maybe it's retarded -- some shit went down, I couldn't find a link for internal members to have stolen, the profile fit RMT MO so I posted to warn people just in case.

In any case SE needs to have a better way of locking accounts, like an online form or something. Needing to wait 40+ mins to contact GMs on weekends is unacceptable to me.

Or you need to find better friends who aren't fucking retarded dipshits.

Don't.

Share.

Your.

Account.

Information.

It's not a hard concept. Those asshats got what they deserved.

[MisutoVapira]

Dunno if this was said yet... some semi-related info...

months ago, I don't remember, I got a POL message from a name not on my friendslist, it ended up being a RMT advertizement. I thought this was weird and scary, because I didn't know you could send POL messages to people not on your friends list. You can't, right?

I asked my linkshell and my friends in my party about it, a couple said they got the same message. All in all we didn't think nothing of it. What I'm trying to say is I'm validating the fact that POL does have holes, and the RMT have used them in the past.

Happened on Asura server to 8 or 9 unrelated players, probably alot more, I only got like 8 confirmations that it was happening and it wasn't just me. Also happened months ago, I'm sorry I can't give a time table.



...Paranoid thought: It's really SE hacking accounts to scare the community into buying the tokens!! lolnotrly?

[Tarage]

Dunno if this was said yet... some semi-related info...

months ago, I don't remember, I got a POL message from a name not on my friendslist, it ended up being a RMT advertizement. I thought this was weird and scary, because I didn't know you could send POL messages to people not on your friends list. You can't, right?

I asked my linkshell and my friends in my party about it, a couple said they got the same message. All in all we didn't think nothing of it. What I'm trying to say is I'm validating the fact that POL does have holes, and the RMT have used them in the past.

Happened on Asura server to 8 or 9 unrelated players, probably alot more, I only got like 8 confirmations that it was happening and it wasn't just me. Also happened months ago, I'm sorry I can't give a time table.



...Paranoid thought: It's really SE hacking accounts to scare the community into buying the tokens!! lolnotrly?

There was a loophole that would allow people not on your friends list to send you messages. Said loophole was closed, further disproving these chumps.

And no, SE isn't 'hacking accounts' to get people to buy tokens. They are stupid, but not that stupid.

[Tsuki]

I'll start off by mentioning a few things that are relevant to our problems. Up until recently I have had access to three FFXI accounts; those being My own (Tsuki), my significant other's, and my friend's (Dithera). I think its Important to note that the following issues have nothing to do with any sort of disgruntled relationships or things of that nature.

On Monday morning, 03/16/09 someone logged into my FFXI account while I was on my main character. I received the standard POL message that pops up when that happens "This PlayOnline ID has been used to login from another terminal." As soon as I realized it had been neither of the people who have access to my account, I logged out and tried to change my password but of course, and this is typical to my "luck" or lack thereof, unfortunately there was POL Registration Sever maintenance going on at the time so I was unable to change my password manually. In the end, the rest of the day went on without event and I was able to change my password without event, several hours later when the Registration server maintenance ended.

After I changed my password I gave the new one to my significant other as well as my friend Dithera who can't read apparently and didn't end up getting my new password until two days later because he was typing it in wrong or said I didn't give him the right one lol. and all was well until...

Thursday morning 03/19/09, It was about 10:30am my time and on a whim I decided to 3-box the three characters to do their MMM mazes before JP midnight since we had missed the night before due to dynamis and salvage running late. At the time I knew Dith and my significant other were both at work so I knew it wouldn't be a problem for me to do the mazes. At some point during the maze runs Dithera dc'd with the usual message "This PlayOnline ID has been used to login from another terminal" I didn't think much of this, my first thought was that dith might have gotten the day off and that this was actually him logging in. Spekkio and Meeshah who were also doing the mazes with me also didn't take much heed to this because I said something like "oops dith's logging in". By the time Dith got back in-game we were done the maze and just waiting on him to pop the chest so that he would get the marbles too. Spekkio told me to invite Dith since he was in the zone, but when I sent the invite he didn't accept. Then a few moments later he was offline again, so I just ended up logging him back in myself and completing the maze. It wasn't until after I had loaded up AIM and MSN and saw Dith not "online" that I realized whoever had just logged Dith in, wasn't actually Dith.

I spent the rest of the morning frantically trying to get a hold of Dith to let him know what happened but that was to no avail, no answer at home and we couldn't get his work number. Spekkio suggested I change his password for now then give it to him later when he got home from work, but then I realized I didn't actually know Dith's password off hand since it was saved in my POL for like over a year... so I couldn't even do that much. Spekk also mentioned that when he does get home we both change our passwords and keep them away from each other until we could figure out which person was compromised and by what. I spent the rest of the morning and a good part of the afternoon downloading newly updated virus detection and security software and running new scans on my PC but all of which kept coming up with nothing leading us towards what had caused this breach. Finally Dith got off work and confirmed what we had initially thought, it wasn't him that had logged in earlier. He promptly changed his password and began scanning his own pc at which point I turned my attention back onto my own account and decided I would go ahead and change my password for good measure and keep it to myself for a while...

When I tried to login to my account, someone had changed my password. I confirmed with dith and my significant other that it wasn't them. I immediately thought of the irony of the whole situation, I spent all morning/afternoon trying to protect Dith's account only to have my own account nabbed right under my nose. lol I couldn't believe what had just happend. I immediately got onto POL webchat and waited for a representative. It was taking a while for them to answer me and they kept posting this "we're experiencing higher then normal call volumes" message so rather then wait around for more damage to be done I got Dith to call a GM in-game and have the account locked for me. Heres the image of the GM call dith placed for me:

Spoiler: show

http://i116.photobucket.com/albums/o...chu/dithgm.jpg

While Dith was talking to the GM in-game the POL rep began talking to me in webchat here is the conversation in full with only the personal information ommited:

Spoiler: show

You have been connected to SEI POL Paul K.SEI

POL Paul K: Hello, Tsuki, thank you for contacting the PlayOnline Information Center. Just a few moments while I review your question, please.

SEI POL Paul K: For security reasons, we are unable to address your account issues without first verifying your identification. Please respond with the following information:

SEI POL Paul K: PlayOnline ID
Full Real Name
Birthdate
Complete Home Address (Not email address)
PlayOnline Registration Code
Current Credit Card information, first 4 and last 4 digits only.

Tsuki: Hi

Tsuki: POL id is @#$%

Tsuki: @#$%

Tsuki: the adress on file is @#$%

SEI POL Paul K: Postal Code.

Tsuki: POL REG code: @#$%

Tsuki: @#$%

Tsuki: sorry

Tsuki: i've sinced moved had to ask my mom for post code

Tsuki: CC# First 4 digits @#$%

Tsuki: Last 4 digits @#$%

SEI POL Paul K: Correct, please hold.

SEI POL Paul K: Ok Tsuki, your new PlayOnline PW is: @#$%

Tsuki: i called a GM about someone logging into my account on monday, they have not yet got back to me, there was Reg server maintence going on at the time so i was unable to change the password at that time, i came for webchat help but POL center was closed

Tsuki: i later changed my password after the maintenance was over

SEI POL Paul K: Once you login, assess the damage and then contact us again if you notice items/gil missing.

Tsuki: and i logged in now and it was changed again, by someone else

SEI POL Paul K: Ok, then before we perform a Game Datat Recovery we need you to read and agree to our terms at: FINAL FANTASY XI Official Web Site

SEI POL Paul K: Please contact us again when you have read and agreed to them.

SEI POL Paul K: Are there any other issues I can assist you with right now, Tsuki?

Tsuki: hold on let me login

SEI POL Paul K: Ok, I can wait a minute or so.

Tsuki: ok

SEI POL Paul K: .

Tsuki: my friend called a GM inside for me

Tsuki: im sorry i was freaking out

Tsuki: they locked the account

Tsuki: its locked currently

SEI POL Paul K: Tsuki, please hold while I look into your issue.

Tsuki: thank you, sorry for causing trouble i was really panicking

SEI POL Paul K: That's ok, I see that the account was locked very recently. Possibly a couple of minutes ago.

Tsuki: yeah he mentioned that

SEI POL Paul K: You can login now.

SEI POL Paul K: Please read those terms and then contact us again.

Tsuki: can you wait a sec while i login?

SEI POL Paul K: Sure.

Tsuki: hmm must be lagging still getting that i cant login

Tsuki: how did this happen?

Tsuki: my system is clean

Tsuki: is there someway i can prevent this type of thing?

SEI POL Paul K: If your computer has a virus or a keylogger on it they can steal your information that way.

SEI POL Paul K: Hackers have a variety of tools at their disposal to steal accounts.

Tsuki: okay everything seems in order

Tsuki: seems we caught this early

Tsuki: there is no keylogger on here that is picked up by any of the updated scanners

Tsuki: i entered my password with the keypad

SEI POL Paul K: Try using the mouse instead.

SEI POL Paul K: Not the keyboard.

Tsuki: thats what i mean

Tsuki: i used the mouse

Tsuki: when i changed it on monday

Tsuki: the little SE keypad that pops up, thats what i used

Tsuki: how could anyone possibly get it

Tsuki: i'm really afraid this is going to happen again

Tsuki: but im not confident that even if i have advanced software for maleware that it would detect something that hacks FFXI since it is such an isolated and small community

SEI POL Paul K: I'm sorry Tsuki but I wouldn't be able to recommend any other solutions to prevent someone from hacking your account.

Tsuki: i see, thanks for your time sorry for any problems caused by double GMing with my friend

Tsuki: can you mail a copy of this transcript to me?

SEI POL Paul K: I'm sorry but I can't email it to you. Please copy and save it into a notepad or word document.

Tsuki: okay thanks

SEI POL Paul K: No problem.

SEI POL Paul K: Thank you for visiting PlayOnline Chat support, Tsuki!

Tsuki: thanks for helping so quickly

SEI POL Paul K: You are welcome. Hope it doesn't happen again to you.

Tsuki: hope so too ; ;

Thank you for visiting our PlayOnline Chat line. Take care and hope to see you online!

When I was able to log back into my account, Tsuki was still in order nothing had been touched and she was still on my original server. Nothing else has happened with my account any further up to now and I witheld my new password from Dith as he has done with me only because we were not sure which PC is the one that is compromised as of yet. I gave my new password to my Significant other though, but his account is the only one that has remained untouched as far as we know up to now.

Thursday 03/26/09, At 4pm CST Dithera logs in to find his password has been changed. He tried to contact POL webchat for support but he didn't have his credit card on him at the time so the rep couldn't do anything for him. By the time he got his credit card the Center was closed so he had another friend contact a GM in-game and have his account locked. As far as we know, the account was moved from Kujata to Ifrit server under the same name (Dithera), they also took his mules there. The account was completely stripped and we've found two characters on Ifrit Server that has sold multiple items that to belonged to Dith (Delagard.Ifrit & Caoilte.Ifrit). We believe that these are loot mules and that the other items that did not belong to dith that have been sold belong to other stolen accounts. We're awaiting the recovery process on this account currently.

Both of the accounts in question have quite a bit of worth attached to them, so we're both pretty confident that these accounts would definitely be targets. We're just more interested in figuring out what the culprit was that got us into this mess so that we can avoid the same thing happening to us again while we wait for these security token things to be released.

A few important facts that I think are worthy of noting:

We both use firefox only+addons (noscript/adblock)

AVG stuffs etc. didn't pull anything up in the way of keyloggers or anything really noteworthy at all (but to be honest I expect that something that messes with ffxi will not show up in these in fact I'm not even so sure the OLD exploits relating to ffxi compromised accounts will show up in there)

these do not show up on either PC
rsbo.exe
kb1ss1p.dll
kb1ss1p.sys
in3.dll

HijackThis logs are available if anyone wants to look at them. But Dith's pc has since been formatted with good reason so that he could begin the recovery process with his character. So any new data will have to come from my pc but we feel since my account has been untouched up till now that we're unlikely to get any more "good" data on whatever might have been the cause.

And finally that prior to me changing my password on the first monday when I had issues, we had not input our pw's into POL in a very...very long time and each time since we have both always used the POL provided keypad input with a mouse. Also, we do not use our POL passwords anywhere else.

Sadly, I wish I could say this is "bullshit" and "scare tactics" but unfortunately I happen to know first hand that this isn't the case.

Edit: for clarification, when this happend to us, there was no POL messages involved in either incidence.

[thetruepandagod]

doesnt really matter what really happend to who the OP is talking about, just chalk this thread up as being a reminder to everyone to have up to date computer security

[Stubwub]

urgh wrong thread

[Tarage]

After I changed my password I gave the new one to my significant other as well as my friend Dithera

Stopped reading there.

How hard is it for you people to understand the concept of "DON'T GIVE YOUR FUCKING PASSWORD TO ANYONE"? Significant other fine, but you should check on this 'friend' of yours.

Sorry pal, I'm still not buying it, and probably never will.

[Tsuki]

Stopped reading there.

How hard is it for you people to understand the concept of "DON'T GIVE YOUR FUCKING PASSWORD TO ANYONE"? Significant other fine, but you should check on this 'friend' of yours.

Sorry pal, I'm still not buying it, and probably never will.

yeah except we both got hacked and this "friend" of mine is now completely looted and on another server. if you can't read all the details, then just don't comment seriously, you just come off as an idiot, which no doubt, you are.

[Fallyn]

The part that everyone seems to be missing, bullshit stolen accounts aside, is the fact that name details were changed within seconds. If it's not possible for us, how come it is possible for the "hackers"?

[Ollieyk]

yeah except we both got hacked and this "friend" of mine is now completely looted and on another server. if you can't read all the details, then just don't comment seriously, you just come off as an idiot, which no doubt, you are.

What's to say your friend decided he wanted to quit the game, stole your account, planned on moving both accounts to a new servers, stripping them, selling the gil and saying both accounts were "Stolen by RMT"?

[Tsuki]

What's to say your friend decided he wanted to quit the game, stole your account, planned on moving both accounts to a new servers, stripping them, selling the gil and saying both accounts were "Stolen by RMT"?

That' quite unlikely considering how long we've known each other, and also considering the fact he's actively trying to recover his account and we've been in contact everyday. It just doesn't add up. He's well known, liked, and he still had goals ingame. We're regularly on vent together and stuff so if it was like that why wouldn't he do it at a time when hes not at work and when I'm not online. That's not even counting the fact that when my account did get hacked, nothing was touched (probably because we were onto it so fast). If he wanted to do something like that he could have easily done it at a time where I couldn't have done anything about it.

But really, I think alot of these misconceptions about it that you guys are bringing up have already been cleared up in my OP on the subject. Its not my account that was fucked over, it was his.

[Aymee]

That's not even counting the fact that when my account did get hacked, nothing was touched (probably because we were onto it so fast). If he wanted to do something like that he could have easily done it at a time where I couldn't have done anything about it.

RMT's MO is that things disappear pretty much instantly, so this surprises me.

To naysayers (myself included), it's pretty hard to argue with that length of a testimonial so there's obviously some information to be found there. A few things of note that were still worrysome:
--Password saved on PC without question, so no way to change it if you're multi-boxing for someone.
--You cannot speak for the integrity of your friend's account in terms of who else might have had login info... or at least not be 100% sure.
--Was your login info saved into the POL viewer the same way on their PCs or anywhere else at all? If so, there's a 2nd possible source PC where this could have been started.


Even so, there's no evidence whatsoever that there's RMT involvement because this is so limited. The fact that it's struck in JUST those accounts that happen to have login info on that PC can't be ignored. Unless other people come forward with similar stories there's nothing more to look at.

[Tsuki]

RMT's MO is that things disappear pretty much instantly, so this surprises me.

Because, again, like i stated in my OP................. (did you guys all catch downsyndrome? <.<) I was logged in when it happend, Also there was registration maintenance going on at the time, so i, and whoever it was, could NOT change my password. when they revisited my account for then second time and actually did change my password, obviously I had the account locked within minutes.

Again, We think that the intial "short" logins were to get "inventory" on the character to determine which ones were worth looting.

Edit: also yes, both PC's had the info saved in POL for a very long period of time. the only time it was changed in just a guess ballpark figure would maybe be one time back when all the hackings previously spooked us so we changed our pw's just to be safe. and yes we used the POL keypad.

Edit2: we don't really care if you believe us or not, that wasn't the point of the post. I'm quite confident we'll see more cases of this, up until the 7th at least (yay token lol) and yadda yadda told you so etc. we've always only been interested in getting help to figure out where the threat comes from and how to protect ourselves against it. I can't speak for dith, but i only really visit BG, FFXIAH, otherwiki and my LS page on this machine.and we've established whatever it is, isn't tagged for threats on any security software as of yet.

[Destinye]

yeah except we both got hacked and this "friend" of mine is now completely looted and on another server. if you can't read all the details, then just don't comment seriously, you just come off as an idiot, which no doubt, you are.

Hmm...why do I have Dithera on my friendlist..? Was wondering why they were suddenly off of kujata one day.

[Cesaria]

RMT's MO is that things disappear pretty much instantly, so this surprises me.

I don't know - when the last wave of hackings were going on and people were getting the "interface not suported" message or whatever it was sometimes it was a few days later the account was actually ganked. The other thing they seemed to do was wait until the weekends when it was harder to get accounts put right before ganking a load of accounts at once.

I'm prepared to give people the benefit of the doubt until proven otherwise - if nothing else it's a useful reminder that the issue hasn't gone away.

[Tsuki]

Hmm...why do I have Dithera on my friendlist..? Was wondering why they were suddenly off of kujata one day.

:/ are you/were you ever on Kujata? Dith has like *everyone* on his flist lol. He's very social like that. yeah his toon is still on ifrit, he's going through the motions of getting it restored atm. possibly you caught him actually being hacked, or you saw him "assessing the damage" for the GMs.

[Destinye]

:/ are you/were you ever on Kujata? Dith has like *everyone* on his flist lol. He's very social like that. yeah his toon is still on ifrit, he's going through the motions of getting it restored atm. possibly you caught him actually being hacked, or you saw him "assessing the damage" for the GMs.

My brother was on kujata a few years back (who added him most likely) I just eventually ended up talking to him every and now then when my brother gave me his account since he quit, yeah he was very social lol. Hopefully he get it restored.

[Shinsei]

I may have missed it if you did say it but Tubbers, which day did this actually happened?

Was it Friday/Weekend? I know someone on another server that's "probably" going through the same scenario going by what you have said and it happened to him just this weekend.