The sky is falling: player with token hacked? (lolIE)

[Quetz_Jamal]

Exact same thing with me, I'm betting this is a POL problem and not something with our machines. ESET NOD32 finds nothing, malwarebytes finds nothing.

Yea, wondering if I jumped the gun freezing my account...better safe than sorry I guess...still going to be a long weekend until we know for sure.

[Gunslinger]

Yea, wondering if I jumped the gun freezing my account...better safe than sorry I guess...still going to be a long weekend until we know for sure.

If you can't play this weekend with no POL password might as well be safe anyway! I'm going through the process of having some friends try to lock my account for me, just don't want to have to worry about doing a rollback :/

[Narse]

So let's see, those of us that had this happen:

We have token'd accounts, we get an email from POL stating that we may have been compromised. Personally I know I actually was like, last week, but it seems because I did not attempt to relog after being knocked offline, at least for some time, nothing happened.

Anyways, get the email from POL stating to change PW. I had already changed it, so I didn't change my PW again. Perhaps my PW was changed by POL 'for my protection'?

[Dimmauk]

someone from my ls got this tonight
http://i545.photobucket.com/albums/h...mint77/omg.jpg

Whats is up with this?

[Gunslinger]

So let's see, those of us that had this happen:

We have token'd accounts, we get an email from POL stating that we may have been compromised. Personally I know I actually was like, last week, but it seems because I did not attempt to relog after being knocked offline, at least for some time, nothing happened.

Anyways, get the email from POL stating to change PW. I had already changed it, so I didn't change my PW again. Perhaps my PW was changed by POL 'for my protection'?

I think that's possible or it's a POL exploit to change that account password... hopefully having the separate and more secure SE account and token is enough to keep our accounts safe if the first layer is hacked.

I just got my account locked and they can't say if it's been moved or anything, guess we'll find out Monday! The plus side is no one has seen me on any server from flist and I was able to change my SE account np, so I think those are positive signs that I was just changed on the first (and most annoying) layer.

[The Stig]

Whats is up with this?

Not a lot. Absolutely no info besides the potential obvious. And possibly a lot of porn surfing.

[Izzy]

Do people know you can use the same token password to get past the second token prompt when you're logging in and such? It being valid for a bit and all... recently had t change my own info and just used the same one.

After you use the password, it's supposed to expire.

[Lordender]

Whoever did all of this must of been pretty professional. My friend has played the game since release, doesn't use I.E, doesn't go to any related FFXI sites and was still hit while on a security token. He has scanned his PC with 3 different scanners kaspersky, malwarebytes and avg all turning up nothing. My friend isn't an idiot, before he quit he ran a successful LS which had over 200m in our gilbank so he's already an extremely paranoid dude when it comes to this sorta shit.

[Reveria]

I think that's possible or it's a POL exploit to change that account password... hopefully having the separate and more secure SE account and token is enough to keep our accounts safe if the first layer is hacked.

I just got my account locked and they can't say if it's been moved or anything, guess we'll find out Monday! The plus side is no one has seen me on any server from flist and I was able to change my SE account np, so I think those are positive signs that I was just changed on the first (and most annoying) layer.

Heh, I wish I was so lucky to have not been spotted elsewhere. A friend just spotted me on Alexander, and I can't get into my account as of like a half hour ago. Someone spotted me on ragnarok earlier so it must have happened this morning. I don't use a token, but now I wish I kind of did. It's not like I wander around places where I can get keylogged by RMTs or any shit like that though.

Hopefully you'll come out safer than I did.

Does anyone know a way I can start right now getting my password reset, or am I hosed till monday?

[rekie]

Heh, I wish I was so lucky to have not been spotted elsewhere. A friend just spotted me on Alexander, and I can't get into my account as of like a half hour ago. Someone spotted me on ragnarok earlier so it must have happened this morning. I don't use a token, but now I wish I kind of did. It's not like I wander around places where I can get keylogged by RMTs or any shit like that though.

Hopefully you'll come out safer than I did.

Does anyone know a way I can start right now getting my password reset, or am I hosed till monday?

Even with Security Token it seems people are getting hacked so wishing you had used one don't make any difference at this point.

I do not use one, I've not been hacked yet touch-wood.

[Reveria]

Well true, but it's probably at least a little bit safer.

Thing I don't get is that I haven't even had to type in my PW for months either cause I keep it saved, so I'm at a loss for how I could have been hacked, since keylogging probably wouldn't work. But then I know zilcho about hacking so I could just be retarded.

[Shade]

Ok so, dumb question, and sorry if it's been discussed already....

My passwords are set up so that I have to input a password at the first POL login screen, but my actual POL ID password is set to -saved-, so there is no keyboard input to keylog. The first password keeps anyone else from logging in locally, but wouldn't help anyone who was trying to log into my account from some other computer if somehow they managed to get it. Right?

So is this secure? Or is it possible for hackers to hijack the (saved) password as it is being sent out to SE? And if the answer is that they can't get at it, why is everyone not doing this instead of bothering with security tokens, etc. ?

Thanks. D:

[Reveria]

Well, as I just stated, I've had my password saved on my PoL for months. I haven't typed it in for a long ass time. So I would suspect it's probably not safe. How they get it, I have no clue. But they obviously can, so I dunno what to tell you. Cross your fingers and hope you're not unlucky next month in the next round of hackings? :/

[Shade]

Oh, I must have just missed your post. Sorry.

Damn, the sky really is falling.

[Reveria]

Yep, hoping I can get all my shit back and my money that the hacker inevitably spent 20 bucks of to server hop me, otherwise I guess I'm just gonna not play MMOs till 14 comes out heh. Damn retarded that SE won't handle compromised account services on weekends though, seems like a service you'd want to offer at least 7 days a week, if not 24/7 <_<

[Aksannyi]

Yeah, I've always found that to be incredibly retarded - to run a 24/7 operation but not run 24/7 service. Along with the lack of a toll-free number. It's total fail.

[Reveria]

Update~ Got my account locked by supplying mule information as well as main character with a GM on a friend's account...going to be a long weekend waiting till Monday to see what can be done about it.

What section of the GM Call menus did you go through to do this? I want to do this via an alt as well but not sure which one to use :/

EDIT: Went ahead and just picked one, got a GM on the line now

[Gatsby]

The big issue is that the passwords are being changed so I can't even log in from the playonline website membership area. (https://secure.square-enix.com/cisweb/app) Somehow someone is changing passwords w.o needing token access.

[Reveria]

Without needing any access really, since I think I've got the same issue basically, just that I don't have a token. Sounds about right.

[Quetz_Jamal]

What section of the GM Call menus did you go through to do this? I want to do this via an alt as well but not sure which one to use :/

EDIT: Went ahead and just picked one, got a GM on the line now

Sorry, without FF I tried having a life today, lol...I just used the normal reporting of TOA