The sky is falling: player with token hacked? (lolIE)

**Quince** · 2009-08-25 23:29

Originally Posted by Kaces

Mafai's friend had the disappearing act occur as well, maybe we're onto something -- but it doesn't explain the other hackings. I still haven't found anything on the sites via changes in file/registry on my VMs... So, can all of this be explained by retards not giving us the full story and visiting sites in RMT tells? ~______~

Anyway, done with tests today -- will be back tomorrow to try out the Ethereal filtering.

Well i cant talk for any1 else but like i said before i didnt visit any of those RMT sites or anything besides my EMail and my online banking i only go to FFXIAH.com Wiki and BG. I dont even go to alla or anything cause my sisters accoung was hacked over a yr ago. I think the best bet is playing on somthing besides PC until ppl find what this is. I apprciate everone trying to find out what it is btw.

Aselin · 2009-08-25 23:32

Originally Posted by Sabertiger

Not exactly.

I was playing FF via PC x2, browsing wiki via PC x3, when the internet connection died (shared connection with the network), found the suspicious line on PC x3, but POL crashed on PC x2. So yes, it went across network boundaries, at least on my machines.

EDIT: Oh, ran HJT on the PC x2 that was running FF, did not find the suspect line. That was interesting.

XP Home SP3(lolIknow) and XP Pro SP3(again lolwindows I know eh).

My next Computer Science project at school: Write a Linux emulator that runs FFXI (unless someone knows of one?)

You can do that with WINE, it isn't perfect but it works:

WineHQ - Run Windows applications on Linux, BSD, Solaris and Mac OS X

WineHQ - Final Fantasy XI Online Final Fantasy XI

**Spekkio** · 2009-08-25 23:33

Originally Posted by Akisu

So you're saying that you didn't use the machine for web browsing that was infected? And it spread over the network? Well then, that's a whole new ballgame if that's accurate.

Side note: What's up with BG? After reformatting, I never reinstalled flashplayer, and it's asking me to install flash each page view, does a main component of BG use flashplayer? Nothing seems to have lost functionality without flash installed on my end. Just a question, not saying it's releated, just didn't notice it this morning, lol.

i would be VERY surprised if it's spreading from machine to machine, as that would be way outside of the level of sophistication i would expect from the RMT. if it is happening, we need to switch up our ballgame, but as this is the first report, i would say it's far too early to draw that conclusion. let's start by analyzing the trojan's output by infecting a computer and using a dummy account or bad uname/password to try to log in while capturing the traffic across the wire, paying special attention to the destination. if we can find where the traffic is going to, (and if they were dumb enough to not encrypt their traffic) we can start to get a handle on this or at the very least try to protect ourselves by blocking any outgoing traffic to their remote servers.

**Mistress Stowastiq** · 2009-08-25 23:36

Pretty sure I read that the Clampi trojan goes through infecting networks in that article posted in this thread about it.

**Solefald** · 2009-08-25 23:44

Shut up about the proxy line in the hijackthis logs, all it means is that you bypass the proxy for sites on the local network. Since >99% of people don't use a proxy on their home computer, the line is meaningless.

Aselin · 2009-08-25 23:52

Originally Posted by Solefald

Shut up about the proxy line in the hijackthis logs, all it means is that you bypass the proxy for sites on the local network. Since >99% of people don't use a proxy on their home computer, the line is meaningless.

Then why on a clean install of Windows XP or Vista or 7, it's not there in the first place?

How does it get there? Because, one I don't have it. My Win 7 installation doesn't have it. My friend's computer with Vista 64-bit doesn't have it and it's two weeks new. Another friend with Windows XP SP3 x86 doesn't have that line when I asked to scan her computer with HJT and she goes to FFXI Wiki and plays FFXI.

The question: What programs puts it in there and why on 5 UNRELATED computers of 5 different players have the same line appear in HJT?

The exception is the last 2 or 3 posters above me.

**Izzy** · 2009-08-26 00:06

Originally Posted by Solefald

Shut up about the proxy line in the hijackthis logs, all it means is that you bypass the proxy for sites on the local network. Since >99% of people don't use a proxy on their home computer, the line is meaningless.

THANK YOU!

Also, since EVERY network connection on your network went down...I'm going to go with a router crash.

Jesus Christ the amount of overreactions and fear mongering in this thread is fucking astronomical. It's most likely another Java/Javascript/Flash exploit that was recently/has not been patched yet.

**Sekundes** · 2009-08-26 00:15

For reference I use google chrome with priovoxy proxy server(gimp adblock+ for chrome)
I also use firefox for sites that don't work with chrome, don't have no script or anything.
Perhaps this can give some comparative data.
Anyone know how comparatively safe chrome is? I know it's got a good bit of security features and is probably not targeted yet.

HJT:

Spoiler: show

Sophos Anti-Rootkit

Spoiler: show

**Akisu** · 2009-08-26 00:42

Originally Posted by Izzy

It's most likely another Java/Javascript/Flash exploit that was recently/has not been patched yet.

Indeed. I believe it actually was patched as of August 19th, because I can't re-infect my laptop using the latest flash player patches.

As I previously posted:
Adobe - Security Bulletins: APSB09-10 Security Updates available for Adobe Flash Player, Adobe Reader and Acrobat

**The Stig** · 2009-08-26 02:58

Originally Posted by Izzy

THANK YOU!

Also, since EVERY network connection on your network went down...I'm going to go with a router crash.

Jesus Christ the amount of overreactions and fear mongering in this thread is fucking astronomical. It's most likely another Java/Javascript/Flash exploit that was recently/has not been patched yet.

R8 up, etc, A+++

Even if it the proxy line is there it means fuck all, since it only points to your own PC. If anyone find something else in it, by all means let us know.

The theories are growing very epileptic.

As for what puts it (the line/registry entry) there, well the amount of over-the-top protect you guys apply to your PCs probably slipped it there some way or another. Or it is random, or it is installed by your ISP CD, whatever.

**Metta** · 2009-08-26 03:45

For the people who have been hacked WITH a token they will allways do a rollback it seems.

http://i252.photobucket.com/albums/h...okenreroll.jpg

EDIT. just read through the log again, and i asked "why is it being done" .... i wasnt really thinking there.

**Corrderio** · 2009-08-26 04:46

Originally Posted by Metta

For the people who have been hacked WITH a token they will allways do a rollback it seems.

http://i252.photobucket.com/albums/h...okenreroll.jpg

EDIT. just read through the log again, and i asked "why is it being done" .... i wasnt really thinking there.

What? Am I reading that right?

**dithera686** · 2009-08-26 04:54

Originally Posted by Quince

Man i wish i knew i bought gil, i wouldnt have spent 7-8 hrs farming each day just to try to get better gear. Just to clarify i only go to those three sites, like Akisu said it crashed on my pc thought it maybe was a bad dat or somthing i was running file check and logged into my xbox. Only to find that i was in Port Windy with 3/4ths of my gear missing. So i hope this helps any1. When ffxi did crash it didnt give me any type of error it would just shutdown.

Wow, your post made me remember something about when my account was jacked. It acted the exact same way, only this was right before token. I'd just randomly crash in multiple places and I thought it was a bad dat or something. I never had any issue with logging back in right after though... Maybe what I had is an earlier version of the new thing... Scary

**Darte** · 2009-08-26 05:22

Originally Posted by Metta

For the people who have been hacked WITH a token they will allways do a rollback it seems.

http://i252.photobucket.com/albums/h...okenreroll.jpg

EDIT. just read through the log again, and i asked "why is it being done" .... i wasnt really thinking there.

Someone needs to confirm this with like...5 other GMs and their bosses before I can rest easier knowing my char is safe from losing items.

**Sabertiger** · 2009-08-26 05:46

Well, router didn't crash.

My internet connection mysteriously and inexplicably disconnected me from my ISP and in turn FF, after scanning with HJT for the better part of the day, and NOT seeing the proxy line... then wow, guess what? Seconds after I see the disconnect, I run HJT scan, and OMG! there it is. Oh and, no, router didn't kill my net.

I've been unable to reinfect the PC after removing it, and the removal seems to have zero effect on anything else. Sure, it probably is some simple flash exploit that's got some nasty code behind it, doesn't make it any less of a threat. Hopefully, it is just a flash bug that's being proliferated via time rotating banner on some FF site, and it was patched in that recent flash patch or will be soon. That would easily explain difficulty causing the same circumstances to repeat themselves. Simple flash exploit or not, any script that can potentially disconnect me while simultaneously snatching my account information, maintaining access to the account, ganking anything worth a fuck off of it, and leaving me with a half empty account, is worthy of alarm. I'm not saying freak out and don't log in at all, I'd just say be cautious and aware of what's possibly going on.

Maybe some of you don't give a shit about your accounts, but others do. Your opinion is what it is, doesn't make people securing their PCs wrong, or providing plausible answers to a problem wrong. Mind you, none of us ever said we had this thing pinpointed 100% and knew what was causing it, where it was coming from, etc. (at least I haven't O_o) It's all been speculation and best guesses. If one of you sitting here talking shit would kindly post and educate the rest of us on exactly what's causing this, how it's getting into PCs, crashing POL, and possibly bypassing security in place, then by all means, post. Until you've had your connection killed and your POL crash logging back in, or can tell me, precisely, how it happened, don't bother talking shit. kthx

**byte** · 2009-08-26 05:56

Originally Posted by Mistress Stowastiq

One would think. But when browsing simple things and getting denied, people want to see the content. How many people actually can tell the difference between a trustworthy site and one that is not? They go to IE because FF did not let them see some content with all of the script blockers, planning on going back after viewing that one bit of content. Viewing a game site with sneak peek vids of ffxiv is pretty boring with full blockers on, you have to open various permissions to see anything.

If a website is pathetic enough to only support IE in this day and age then I don't want to supply them with traffic and instead let websites like this die. So, get your information elsewhere. Almost everything on the internet is mirrored elsewhere or a similar service exists. Don't support bullshit sites that won't get with the times.

Also, decent websites are able to run perfectly with scripts disabled and leave javascript completely optional. Sadly this isn't the case for most sites yet.

**Izzy** · 2009-08-26 06:43

Originally Posted by Sabertiger

Maybe some of you don't give a shit about your accounts, but others do.

It's not that I don't give a shit about my account. It has to do with not overreacting and giving out information that isn't going to help someone.

By telling people, "Just remove that line in the registry and you'll be safe.", you're giving someone a HUGE sense of security even though it most likely did nothing at all. It's actually going to cause more people to get hacked by making them think they've fixed the exploit.

**Cesaria** · 2009-08-26 06:44

Originally Posted by byte

If a website is pathetic enough to only support IE in this day and age then I don't want to supply them with traffic and instead let websites like this die. So, get your information elsewhere. Almost everything on the internet is mirrored elsewhere or a similar service exists. Don't support bullshit sites that won't get with the times.

Also, decent websites are able to run perfectly with scripts disabled and leave javascript completely optional. Sadly this isn't the case for most sites yet.

I can think of at least one site I've had to visit for work before quite regularly that isn't at ALL compatible with any other web browser other than IE. No choice in going there - but it's the only fucking site I've ever visited using that piece of shit browser believe me. Sad thing is - it's actually the site used to enter data of kids' public school exams and having to have IE open drove me fucking nuts all the time I was marking their tests.

Sometimes company executives are idiots who didn't quite get the memo about Firefox and Chrome yet - and they're always the bastard companies that decide to shove all admin online only so you've got no fucking choice.

**Izzy** · 2009-08-26 07:15

Originally Posted by Cesaria

I can think of at least one site I've had to visit for work before quite regularly that isn't at ALL compatible with any other web browser other than IE. No choice in going there - but it's the only fucking site I've ever visited using that piece of shit browser believe me. Sad thing is - it's actually the site used to enter data of kids' public school exams and having to have IE open drove me fucking nuts all the time I was marking their tests.

Sometimes company executives are idiots who didn't quite get the memo about Firefox and Chrome yet - and they're always the bastard companies that decide to shove all admin online only so you've got no fucking choice.

The NYC financial portal (Dept of Education, Health, etc.) ONLY supports IE. It's fucking annoying as hell.

**Solefald** · 2009-08-26 07:47

IE is a perfectly fine browser and has about a good a security record as Firefox's ever since version 7. The problem with it is all the damn toolbars and addons that try to install themselves on it, many of which are spyware. I would love to make Chrome my main browser but it's not mature enough yet. Matter of fact, they just put out a Chrome update to fix a major security flaw discovered by, amusingly enough, Mozilla.

Thread: The sky is falling: player with token hacked? (lolIE)

Thread Tools

Similar Threads

What in the fuck is going on with Ancient Currency prices?

Ok what the hell is up with Roc?

Oldschool players with JP Accounts & The new Expansion

Latest Threads

Up & Coming Threads

Hottest Threads