The sky is falling: player with token hacked? (lolIE)

[Narse]

I got this email in my POL account today when I logged on:

From: "PlayOnline Account Administrator" <[email protected]>

Subject: Regarding the Security of Your PlayOnline Account

Dear Customer;

This is a message from PlayOnline Information Center.

After investigation, we have confirmed the fact that your PlayOnline account may have been compromised by annonymous third-party.

Please check your PC to see if it is infected with any spyware or virus. After you update the security on your system, please change your PlayOnline password.

*If you happen to be using Square Enix Account, password can be changed from \\\"Square Enix Account Management System\\\" on the upper right corner of FINAL FANTASY XI official website.

*This email is sent to you as a notice.
Please do not respond to this mail as we do not reply to emails sent to this address.

************************************************
PlayOnline Information Center

Phone Support: ( 858 ) 790-7529 (PLAY)
Web Chat: https://secure.playonline.com/suppor...t_general.html

Monday - Friday
9:00 am - 6:00 pm Pacific Time

[Izzy]

Well that's new lol.

[Norellicus]

I think that's the message you get now automatically when someone tries to fubar login to a SEA linked ID, with or without token. I seem to recall people mentioning that as one of the actually useful features of SEA.

[Dimmauk]

Sounds like POL lost all your settings, that is all. As if you done a fresh install of POL.

I logged in this morning, and everything was there, so it looks like I'm ok. Just ruined a pair of underwear is all.

[Divinius]

...Buying it may even mark you as a next target since your showing them you obviously have a lot of excess gil on your char.

While I agree with you about us being the "the architects of our own demise", I would highly doubt that RMT can "target" specific people for account hacks like this. Sure, they can send you phishing tells or something, but they can't "target" which accounts they hack. They just hack whoever ends up getting their PC infected with the crap they use to hack you. They can't control which PCs they infect.

[Infini]

Security Blog - More than 60,000 websites hit by 'trojan cocktail'

Just noticed this on google....

[Dimmauk]

Security Blog - More than 60,000 websites hit by 'trojan cocktail'

Just noticed this on google....

Scary stuff.

[Kailani]

While I agree with you about us being the "the architects of our own demise", I would highly doubt that RMT can "target" specific people for account hacks like this. Sure, they can send you phishing tells or something, but they can't "target" which accounts they hack. They just hack whoever ends up getting their PC infected with the crap they use to hack you. They can't control which PCs they infect.

Well they can to an extent (EDIT) for a certain element of the playerbase. Not for anyone thats never bought bil or gone to RMT sites of course and they couldnt look at say my character and think right we will have all of that(EDIT). But if they have the ability to develop a Trojan or the like which is not going to be detected by Antivirus software as a Trojan/Virus has to be known by your Antivirus before it can detect it. They can easily place it onto their own websites that people will visit to make their purchase in the first place. I dont think they really care if they infect Wtfwuzthat's PC and take back the 20 million gil they sold him 3 days ago. I would expect Wtfwuzthat would be back in a few days to buy more. I doubt you would see many people on popular FFXI Forums stating "I bought gil from brogame and now my FFXI account has been hacked"

[EdgeMoragan]

I woke up today and logged in to find this. I have not altered my PoL version or FFXI in any way, shape or form, for even months.

This only shows up on my PC and not the 2 others + console in house.

I was not dc'd, I logged normally last night, and this appeared when I attempted my first login of the day. I have stopped at this screen and remained here.

http://i4.photobucket.com/albums/y10.../whatsthis.jpg

[Dimmauk]

I woke up today and logged in to find this. I have not altered my PoL version or FFXI in any way, shape or form, for even months.

This only shows up on my PC and not the 2 others + console in house.

I was not dc'd, I logged normally last night, and this appeared when I attempted my first login of the day. I have stopped at this screen and remained here.

http://i4.photobucket.com/albums/y10.../whatsthis.jpg

That is the same thing that happend to me last night!!

[EdgeMoragan]

That is the same thing that happend to me last night!!

Okay, now I'm bothered :<

[Deimos]

Okay, now I'm bothered :<

Why? Because it turned out to be absolutely nothing?

[Dimmauk]

Okay, now I'm bothered :<

Ok, lets walk through this together. What happends when you click next?

[EdgeMoragan]

Why? Because it turned out to be absolutely nothing?

Who said it turned out to be nothing? It could still be anything, and now we've confirmed its happening to more than one person, and without a reasonable explanation for doing so.

@ Dimmauk when I click next is does the usual stuff for when you start with a "fresh" pol. It asks if you're a new member who wants to reg, or a current pol member. If you say current pol member you end up needing to place information exactly like when you add another user to your "Add Member" list in normal PoL. It asks for the PoL-ID, the password, whether or not there is a SQ-enix ID, and all related information.

I am not entering information at this time. If I do, I will have a housemate log me in from another machine the moment I finish, and change most of my passwords. To me, it seems if this is a hack at all, they're trying to prompt me to go through this screen specifically, where I'd manually enter my Member ID among other things.

I realize there are keyloggers out there and trojans or hacks advanced enough to just pull this info from files in my actual computer, but what else can I really do if there's no way to identify what this is at this time?

[Dimmauk]

When you click next, I think POL will update, then you will get a screen with register ID and something about proxy server.

[Aksannyi]

Now people are just being paranoid though. I've had it happen to me before, and while it freaked me out, hearing that it had happened to others once in a while eased my mind a bit.

It's not anything new. It'll make you shit bricks, but it's not exactly a new occurrence. Whether or not it's related remains to be seen, but just having this happen (coincidentally with another BG member) doesn't mean it's related to being hacked.

[Dimmauk]

Who said it turned out to be nothing? It could still be anything, and now we've confirmed its happening to more than one person, and without a reasonable explanation for doing so.

@ Dimmauk when I click next is does the usual stuff for when you start with a "fresh" pol. It asks if you're a new member who wants to reg, or a current pol member. If you say current pol member you end up needing to place information exactly like when you add another user to your "Add Member" list in normal PoL. It asks for the PoL-ID, the password, whether or not there is a SQ-enix ID, and all related information.

I am not entering information at this time. If I do, I will have a housemate log me in from another machine the moment I finish, and change most of my passwords. To me, it seems if this is a hack at all, they're trying to prompt me to go through this screen specifically, where I'd manually enter my Member ID among other things.

I realize there are keyloggers out there and trojans or hacks advanced enough to just pull this info from files in my actual computer, but what else can I really do if there's no way to identify what this is at this time?

Yeah it looks and sounds like the same thing that happend to me last night. Then I had my wife freaking out, cause she had heard about the recent hacks about people's bank accounts getting stolen.

This morning when I logged in, everything was cool. Ive been at work all day, spamming my FFXIAH profile to see if im naked. Im hoping and I'm sure we will be ok.

[Karinastar]

Well, I just turned on POL, and it's telling me that my POL ID or password is wrong. I've had both set to saved, re-entered both and nothing. Not the SE password, but the POL password. I do have a token. I didn't get kicked off or anything, logged out normally last night. Guess I get to call them tomorrow... I run Firefox with noscript, updated adblock plus, and commodo software firewall. I just hope I can find my reg codes. ><

Edit: Oh wait, weekend... awesome.

[Mistress Stowastiq]

That is the same thing that happend to me last night!!

Does anyone know if the pol secure code verification process that Isladar mentioned in the 3-d secure deadline thread is related to this screen that people are getting?

[Karinastar]

Ok, this is weird. I can't log in to LS community, but looking it shows me active with all my gear... I know that's not too reliable, but the actual site updates with some frequency. Also, my friend was able to dbox items to me which means that I wasn't moved off the server. Thinking about it, if I logged normally, the hackers would have had to make it past two token prompts to change my POL password....