The sky is falling: player with token hacked? (lolIE)

[Meian]

Heard that a friend of mine got hacked as well on Hades a week ago-ish. He had token and continued to use it until he got hit. He is trying to get his stuff back. Strange though, the AH hasn't shown him having sold anything since he got hit a week ago. Guessing they are trading items/gil to other accounts?

Also noticed the /tell bots have been selling gil at half the price now. I wonder if it is from all the stuff they have been getting or they are just getting that desperate now.

No matter how I look at this, I can not see how someone can get on your account if the token password was used already. Seems so complicated to be able to access pol while one is on it already.

Hell, do people even still buy gil anymore?

[Aksannyi]

Dude you're on Hades, come on, do you need to ask that question? There's so many fucking gilbuyers on Hades that the server could practically sustain the RMT all by itself.

[Meian]

I play casually only now I haven't been in the HNM scene for years so hell if I know heh

[rekie]

Just out of curiosity, the people being hacked.

Are they all token users and SE Membership Users?

I keep seeing a lot of people complaining they have a token and getting hacked. I do not use one. Or SE ID.

Also out of them people, how many of you log into the LS Community often?

[Drunknmunky]

Just out of curiosity, the people being hacked.

Are they all token users and SE Membership Users?

No token here.

Also out of them people, how many of you log into the LS Community often?

I log on to the LS community on august 28 and my account was hack on august 29 at 11:55 am EST. Was lucky enough to recover my account within 20-27 minutes. Moreover, all they took from me was all my money and my PCC. Honestly before my time in this world ends, I would like the opportunity to blow one the hacks homes. Alternatively, pull a Dexter on their asses.

Yes I’ am mad and yes I’ am grateful they did not have the time to clean out my account. Still I hope my wish or an opportunity will show in my front steps in the future

[InspectorGadget]

There have been a few players on Shiva shouting to sell medium/high ticket items in Whitegate at lower than market cost. Looks pretty suspicious. I wonder if they are related to these hackings that have been happening lately. Two of which have been selling items anywhere from 30-75% off of normal AH price, and have no AH history on FFXIAH for my server, Dudesweet and Malikai.

Got myself a Haubergeon for 100k though, pretty sweet deal.

[machiko]

Of course they are linked, how else do you think they make the money off all the stolen items? but hey you got a "pretty sweet deal" of someone elses misery so its all ok right?

This whole thing has to be on SE's end, people are being hacked regardless of platform, whether they have or don't have the token and even people that know how to protect their PC well are getting caught equally. It has to be something broken on their side, they will never admit it of course but that is the best explanation. I'm sure some of the "I got hacked too!" are just abusing roll-back as always but enough of these have to be genuine to mean there is some big flaw somewhere.

[Knyghtmayre]

There have been a few players on Shiva shouting to sell medium/high ticket items in Whitegate at lower than market cost. Looks pretty suspicious. I wonder if they are related to these hackings that have been happening lately. Two of which have been selling items anywhere from 30-75% off of normal AH price, and have no AH history on FFXIAH for my server, Dudesweet and Malikai.

Got myself a Haubergeon for 100k though, pretty sweet deal.

Also happened on Fairy at least once recently, Hhfai was the name though and it was in LowerJeuno. Was a very obvious liquidation of a character, selling all kind of gear, RSE, Imp gold coins, Khromas for 50kish off, Wootz ores, I made about 400k off him ;<

[ringthree]

Of course they are linked, how else do you think they make the money off all the stolen items? but hey you got a "pretty sweet deal" of someone elses misery so its all ok right?

This whole thing has to be on SE's end, people are being hacked regardless of platform, whether they have or don't have the token and even people that know how to protect their PC well are getting caught equally. It has to be something broken on their side, they will never admit it of course but that is the best explanation. I'm sure some of the "I got hacked too!" are just abusing roll-back as always but enough of these have to be genuine to mean there is some big flaw somewhere.

People getting hacked on PS2 and Xbox only are trusting people they shouldn't trust, that's all. That is actually the best explanation, besides the fact that SE doesn't control the tokens at all, it's all handled by the token provider.

RMT have shown they will do anything to get your account, they are the slime of the universe.

[Gwylan]

Well, this's not necessary new. I saw here somewhere about something similar, but couldn't find it. Got this just this morning at 5:21:11 am EST.



http://i545.photobucket.com/albums/h...0831071434.png



There is no player by that name on Hades and GM name usually start with "[GM] Name" iirc.

Also got keylogger detected last Friday, but I think my computer was able to catch it and cleaned it out? I have been logging using the screen keypad thingy instead of typing since then though. And yes I use Firefox, have noscript, didn't go any suspicious websites, usually just browse BG, FFXI AH, my ls website, etc.



http://i545.photobucket.com/albums/h...mint77/omg.jpg



Just a matter of day till I will eventually get hacked? lol... O well...

[Bluefrostie]

No.

The person who hacked your account is probably on a dummy account with a fake CC anyways.

And you really think square is gonna start banning people because you walked up to the AH, and purchased something that just happened to be from a hacked account Or saw a really good bazaar in rolanmart and purchased from it.

This isn't Salvage duping >.<

Well, what I assume is that they (dickslapped-named RMT) take your account gear & gil, and send it to one person with a valid card; so who cares if the dickslap names are banned, they've got your stuff anyway.

This is the link to the person who's selling not only my boyfriend's gear (and the gear I lent him indefinitely), but some other players' too.

I don't expect the players who legitimately bought the items to get banned, how were they supposed to know?

I checked this person in game, she was bazaaring some other stuff too. It's got to be a hacked character who no longer plays. She had 75 BRD RDM BLM WHM with a nice bazaar comment professing her love to her boyfriend.

I just think SE could do so much more to make the RMT lives' harder.

[Dymlos]

I just think SE could do so much more to make the RMT lives' harder.

Oh I know how to make their lives harder...kill with extreme prejudice.. go to China and blow every single RMT building up with all the RMT inside. Yes, it makes me a monster but want to get rid of the problem? That's the best way.

[EternalSnow]

Well, this's not necessary new. I saw here somewhere about something similar, but couldn't find it. Got this just this morning at 5:21:11 am EST.



http://i545.photobucket.com/albums/h...0831071434.png



There is no player by that name on Hades and GM name usually start with "[GM] Name" iirc.

Also got keylogger detected last Friday, but I think my computer was able to catch it and cleaned it out? I have been logging using the screen keypad thingy instead of typing since then though. And yes I use Firefox, have noscript, didn't go any suspicious website, usually just brown BG, FFXI AH, my ls website, etc.



http://i545.photobucket.com/albums/h...mint77/omg.jpg



Just a matter of day till I will eventually get hacked? lol... O well...

wow what in the world is going on here this is insane. Also I only use my iphone to browse the internet while im playing on pc, etc. T_T This is just really scary. SE needs to bring this up or try and do something to stop this.


Also maybe I was just tired last not or I could have sworn I read somewhere in this thread that people believe Live journal is a source or am I wrong? Why in the world would Live journal be a source of this O.o

[The Stig]

Does that application NOT tell us what/which keylogger is installed? There's been 2 instances of that screenshot (or is it the same?) now and yet there's still a lack of information as to what it is and/or how it came from. If we can even get a name perhaps it can be traced an origin.

Also, to address jimbobsonofgod's comment of

The person who hacked your account is probably on a dummy account with a fake CC anyways.

how does that work? To jack an account you wouldn't need a dummy account, or are you talking about a dummy credit card account?

[Hanyoko]

Time to hire us some shadowrunners? I'll have to drop that concept on my GM's ear, he might actually do a scenario on it.

(for those unaware talking about shadowrun the table top RPG)

But more to topic. There defiantly seems to be some form of exploitation method which is not requiring the compromising of the system that runs FFXI. Its really concerning for them to be able to change passwords on a token'd account.

[Dimmauk]

I'm so paraniod nowadays, I get DC'd last night(which rarely happends) and I freak out. I used to have some faith that I was safe from getting hacked.

WTF is a Protocol Time out Error? I got that during Nyzul Isle last night. I DC, and log back in, only to get DC'd again. I had shut down POL, and relog in, and everything was ok. Luckily, I logged back in to get tokens for Nyzul. I didnt DC again after that.

Are SE servers going to shit lately?

[Hanyoko]

Wow, found some references to FFXI from 2003 for the "Protocol Time out".

Basic things were: network driver error, network stack problems, firewalls blocking ports, and of course the "something on SE's side".

However lately I too have been getting random R0. I drop to about 70-80% then it picks back up. Only started happening after the MKD patch. The 'hackings' have just made it that much more paranoid. However when i have two accounts logged in (seperate machines, same connection) both are hit with it at once (which puts it outside the machine and either the router, modem, ISP, or SE)

[Dimmauk]

I just noticed that my FFXIAH profile is missing the SE community link that displays my character info. I tried to login, but its say my info and password is incorrect.

[Day]

Doesn't sound good Dimm.

[solkanar]

There's some cases where the PC version doesn't require the dc...at least with some of the incorrect passwords. Myself and the golden galka for example had no signs of intrusion on our PCs, just the password error.

I'm in this boat too, spent all yesterday scrubbing through all 3 PC's I play on and nothing suspicious came up... Am I also safe to assume that if I call today I will not get my password reset due to the reg. server maintenance? I really want to avoid talking to the lovely CS reps 2 days in a row if I can...