The sky is falling: player with token hacked? (lolIE)

[Snprphnx]

the only way i can see any of this occuring is if they had directly connected to the users PC and intercepted the one time password as inputed, but blocking is use, this would enable it to be used by RMT to access for the 5-10 mins needed to "smash and grab" as someone said it.

also based upon the following quote...

. How in the hell did they change the pw if you need another one-time pw to change account details and how did the character not fully disconnect? I asked to make sure that it wasn't just a really short disconnect, but he apparently stayed in the pt the entire time until after warping out of the salvage.

this could happen if some site downloaded a program to allow remote access from the RMT to users PC. these programs normally need the authorization of the PC being remotely accessed, not sure if it can be reprogrammed to instantly allow access. I allowed this to occur once, as a friend helped me with a software issue, and it made me lag horrible while the connection was established..

IE fails and is full of back doors. Use firefox or play on PS2/3 or xbox. sorry your accts got hacked good luck regaining stuff.

[Izzy]

Yea, I don't know how your account could get STOLEN if you use a security token. The worst RMT could do is just take your items.

[Madeline]

Unless someone has figured out the pattern to the token or managed to find out a way to force a temporary PW through, it's not really possible I don't think.

[iulus]

Yeah, at first I was thinking it was the guy's computer being remotely controlled by the hacker, but what's bugging the hell out of me is the fact that she says that his POL pw was changed.

[terraflarex]

That's frightening stuff if they've found a way to bypass tokens. Though I wouldn't doubt it, RMT are quite persistant as we've all come to learn

[nitsuj]

Someone from my Einherjar shell was just hacked, and he has token. His wife posted screenshots of his talk with the GM. I don't know the full story, Kadaj might know more?

[Izzy]

HA!

Told you I wasn't fucking lying Eanae!

[Eanae]

I never said you were. Post me a log where I said you were lieing.

[Snprphnx]

here is what is troubling me. to get on and access POL and play FFXI, you need 3 passwords, assuming you have the token:

1: POL password
2: SE acct password
3: Token password

say they remotely hacked your PC, and traded to RMT that way. for starters, the persons PC would have to stay on, and you would visibly be seeing on your screen what character your stuff was traded to. If this happened, unplug your modem connection, thus killing the remote access. And run a virus, ad/spyware detection program immediately.

If they caused POL to crash and made you input your passwords, only to block your access and use of the one time password so that they can get on your acct, its a one time access, unless they get your one time password again through similar fashion. That or they can simply use your one time password to go online and disable your accounts need to use the one time password. once this is done, since they have both your SE acct PW and POL PW, they can log into POL and change both, locking you out. and stealing your shit

RMT have either gotten REALLY clever with their methods, or this is total bullshit

[Indalecia]

...it begins

[Baelorn]

As if I wasn't paranoid enough. Fuck.

[Snprphnx]

inb4 SE warns people against using 3rd party tools

[Silenka]

Honestly saw this coming miles and miles away lol. Figured it was only a matter of time. However, I think people are forgetting that the token is supposed to ENHANCE your security, not be the total failsafe between your account and the hackers. Having a security token doesn't give you free reign to stop worrying about keyloggers and trojans, sadly. If your other shit's locked down tight then the token should act as the extra layer of protection that could have saved some accounts from being hacked in the past.

Not to say that everyone who is getting hacked now was being careless, but it's possible, and I bet a lot of people have gotten more lax in their security since obtaining a token.

[Thorny]

It's all about being smart on the internet.. while I wasn't personally expecting people with tokens to get hacked, it's always been a possibility. At the core though, if you pay attention to what sites you use and only allow scripts originating on trustworthy sites, you're going to be pretty safe with or without a token.. the warnings about noscript and adblock have been on bg for what, 2 years? Frequent posters here should not be getting hacked, period.

[Yugl]

Do any of these people post here?

[Snprphnx]

aren't these tokens the same type that is used by the Defense Dept, some banks, and stock/trade companies, for users to have secure, online access?

please tell me that fucking RMT haven't figured out how to hack these, while others who would want to steal your real money, get defense secrets, etc have failed.

[Snprphnx]

btw, these RMT would hit paydirt a few months ago if they had gotten a hold of minidragons accts

[Izzy]

RMT have not hacked the tokens. They've taken advantage of dumbshits who browse the internet with IE still.

[Thorny]

aren't these tokens the same type that is used by the Defense Dept, some banks, and stock/trade companies, for users to have secure, online access?

please tell me that fucking RMT haven't figured out how to hack these, while others who would want to steal your real money, get defense secrets, etc have failed.

The primary difference is that when using them to log into secure systems like the defense department, it'll be your initial logon when you start up your computer. While it'd theoretically be possible to intercept before there, it's a much much more difficult thing to pull off as at that point your computer is not even connected to the internet, and would have to log in to be able to upload a password.. at which point, the password is most likely expired. I have no experience with bank/stock trading securIDs, but assuming they're an online login they would have to automate most of the stealing process, as a real securID code only lasts 60 seconds. Additionally, any worm or trojan that is capable of this will be quickly tracked and dealt with as it's a primary concern for all companies using the system. Square Enix doesn't give a flying fuck if someone's stealing a few FFXI accounts, they certainly aren't going to put R&D on the job of finding a solution and adding the trojan to common malware scanners. There is nothing to worry about for serious securID applications, and the same ideas have been thought of regarding them, just much more difficult to bring to fruition.

[Eleven19]

Someone from my Einherjar shell was just hacked, and he has token. His wife posted screenshots of his talk with the GM. I don't know the full story, Kadaj might know more?

As far as I know, the incident with our LS member happened the same way. He was able to log back in and found his gil and items missing. He conversed with a GM and had the account locked to prep for rollback.

I'm pretty sure this isn't all BS. I'll just quote what he posted on our site to let us know what happened:

So at about 4am i got hacked just after i finished dynamis, i have a security token and i honestly have no idea how i got hacked i have no key loggers or any viruses at all on my comp. not only did [Name] get hacked and stripped of anything worthwhile i also lost a lvl 75 THF mule with 86 smithing, its an American account gave to me be a friend some time back so i cant get it back ='( i wont be able to attend to events for another 2-4 weeks until they can hopefully role [Name] back, just was making this post to let you all know.

Left his name out until I can confirm with him I'm allowed to use it.