The sky is falling: player with token hacked? (lolIE)

[Gunslinger]

Well, an update for everyone following this.

Got my galka back today, not a single thing missing, exactly where I left him. The guy on the phone was extremely helpful, and basically let me know that something big had happened. The conversation went like:

"Sorry you had to wait such a long time to talk to one of us, been busy today"
"No problem, did something big happen?"
"Yeah, we've been going crazy over here all day"
"Oh, well, I hope my character is okay, I did have the token"
"Oh yeah, the token is a very good thing to have. The last guy who called had the exact same thing as you and his stuff was fine. Had a few people without them that are going to have to request rollbacks"

So it sounds like there was some massive POL password hack, and the token probably kept them from actually logging onto my character. My understanding from the conversation is that some people were careless, but some basically did everything right and information was still lost without their machines being compromised... so hopefully they fixed whatever the problem was. I'm guessing it was a web hack to one of their forms, but that's what I was suspecting and saying from the beginning of this.

In any case, I'm just glad to be back and unscathed, this time I hope all of you are as lucky.

[Zumi]

The bad thing about calling SE on the phone is that its long distance and if they put you on hold a long time it would end up being like $20 or more just to call them. Don't most companies offer a toll free number.

[Mistress Stowastiq]

I want to doubt that this is just targeting FFXI. Is there any buzz from other MMO communities? Doesn't WoW use the same/similar token technology?

Even with their tokens, Wow's RMT are clever fuckers you do not want to deal with. They have this new RMT hybrid, experimentally bred and cloned in dirty labs within the crime infested back alleys of 3rd world countries.

You may not want to hear this.
Yes, these RMT are capable of stealing accounts with tokens but more threatening is their ability to spell and write concise English.

Armed with the ability to write a name with a functioning vowel in it, they are capable of blending in amongst us, taken for legitimate players.

Right now they are currently splicing brain cells to enhance the intelligence of their current RMT so that they can be capable of properly leveling a sub job and selecting armor that is not gimp.

Disclaimer: [The above writing is a dramatization intended for humorous purposes to lighten the subject and is not intended to be taken as fact.]


@Gunslinger: did they actually say details of POL being compromised by hackers? And good to hear you got him back.

[Quetz_Jamal]

I'm also unscathed.

For those who might be confused...its not the SE password that you manually type in everytime with a token that was changed, its the POL password that you can physically store in POL. The two are completely separate from eachother...most people may know this, but just wanted to help bring clarity as it couldn't have been a keylogger, as the typing was never done on this password.

[Bluefrostie]

As noted elsewhere though, I don't have anything resembling any type of malicious software on the pc there either. I honestly think there's a loophole being exploited somewhere else.

There's got to be a loophole somewhere. It's just illogical for one account of two to be hacked. Do you know if your gear has been sold; if so, by whom?

Nycon lost at least 12 million gil on his account. He was standing naked in front of the UPS NPC in Whitegate on PLD/BLM even though he logged off in Sandy.

[Quetz_Jamal]

There's got to be a loophole somewhere. It's just illogical for one account of two to be hacked. Do you know if your gear has been sold; if so, by whom?

Nycon lost at least 12 million gil on his account. He was standing naked in front of the UPS NPC in Whitegate on PLD/BLM even though he logged off in Sandy.

I didn't lose a thing. The hack looks to be cracking the POL password...but since they didn't have the token info they couldn't get to the account, just force me not to use it.

[Bluefrostie]

I didn't lose a thing. The hack looks to be cracking the POL password...but since they didn't have the token info they couldn't get to the account, just force me not to use it.

The optional one to log in to a specific POL account? Neither I nor Nycon have one.

[Aksannyi]

Seems like there are two types of hacks going on now then.

1: The first attack (that this thread was initially about) that allows bypassing/stealing of the token passcode to get into the account, and

2: The attack stealing POL passwords only, without being able to enter the account if it has a security token attached.

Shit sucks.

[Quetz_Jamal]

The optional one to log in to a specific POL account? Neither I nor Nycon have one.

Yea...and I'm afraid that may be why Nycon got hit worse. Seems like it started with the same pw getting stolen, however it happened...With mine and the golden galka's accounts, they then needed the token ID. When they didn't have that, they couldn't get into the account.

But with Nycon's they were able to get fully in with only the POL PW.

[rekie]

Isn't the -only- way to change your password by logging into the account on Play Online and going to membership information? If so you would NEED the token id to login to begin with.

So I am a little confused as to how people are having their passwords changed but the hackers are not able to get onto the account without the token, then how did they get onto it in the first place to change the password?

Or are all your cases where they just change the SE Member Ship Password as that is on website based.

Even so, I don't think saying having a token right now makes much difference, only if they're able to get into your membership site. Which if your storing your membership site info into firefox passwords then that is easily accessable by any hack. Especially if you use similar passwords for everything all they'd need is your ID and they can try every pw you got saved.

I use unique passwords for my FF against any other pw saved. I dont use token or have my accounts linked to any SE membership and I havent been hacked yet.

[Quetz_Jamal]

Isn't the -only- way to change your password by logging into the account on Play Online and going to membership information? If so you would NEED the token id to login to begin with.

So I am a little confused as to how people are having their passwords changed but the hackers are not able to get onto the account without the token, then how did they get onto it in the first place to change the password?

Or are all your cases where they just change the SE Member Ship Password as that is on website based.

Even so, I don't think saying having a token right now makes much difference, only if they're able to get into your membership site. Which if your storing your membership site info into firefox passwords then that is easily accessable by any hack. Especially if you use similar passwords for everything all they'd need is your ID and they can try every pw you got saved.

I use unique passwords for my FF against any other pw saved. I dont use token or have my accounts linked to any SE membership and I havent been hacked yet.

POL password is uniquely different from the SE password you need token to access. Again, I'm looking at a loophole on SE's end, as a keylogger wouldn't be able to trace a keystroke that hasn't been typed.

[Drunknmunky]

If I choose to go thru with the data recovery will I be able to get my money and PCC back? Reason I ask because if there is a chance I’ am not be able to get my money back then I feel is not worth been out of the game for 2 weeks.

In addition, has anyone done the recovery data and got everything back? Anyone that has gone thru this your responses will be appreciating.

[Dragon10]

So here is what I got out of the online rep after having my POL password reset. (Firefox user, Token, all that jazz)

Anthony: i do have a quick question
SEI POL Chris S: Sure, go ahead.
Anthony: any idea what measures I need to take to prevent this from occuring in the future?
Anthony: was this a POL side error that caused the PW issue, or did my account get hacked from my side?
SEI POL Chris S: Unfortunately that is not information I would be able to release. You already have the security token which is what I recommend, you shouldn't hopefully have any further issues like this occur.
Anthony: hmmm, ok. not really an acceptable answer but I understand.
SEI POL Chris S: Are there any other issues I can assist you with right now, anthony?
Anthony: thank you for your time, that is all
SEI POL Chris S: Thank you for visiting PlayOnline Chat support, anthony! Take care and hope to see you online!


I decided to let the poor guy off the hook without giving him too much crap as I am sure he has had to do a ton of these requests today. Plus the front line folks are typically pretty limited in what they can say.

[cdgreg]

If I choose to go thru with the data recovery will I be able to get my money and PCC back? Reason I ask because if there is a chance I’ am not be able to get my money back then I feel is not worth been out of the game for 2 weeks.

In addition, has anyone done the recovery data and got everything back? Anyone that has gone thru this your responses will be appreciating.

By data recovery I assume you mean a rollback. What SE does is once they determine it was indeed a hacking they will roll your account back to the last time you safety logged out. So basically they'll check IP logs and roll you back to the last time you /logged out from your regular IP. You will have all the gil, items, whatever from that day. Whatever you achieved between that log out and hack you will not. When I was rolled back I lost W legs since I got them about 3 hours before I was hacked and never /logged out between those points.

[Nattack]

edit:lolwrongthread

[rekie]

You guys let them of way to easily, you should of kept questioning them and squeezing more and more juice out but they cannot really say the same thing twice, so they're going to slip up somewhere or just tell you something to shut ya up.

My prediction it's just SE Membership Stuff?

[Viller]

Reg servers was hacked, this is the reason for the mass email, SE then froze all possably effected accounts on that blade server. untill the owners reset the pol passwords. This is the reason most all accounts was recoved with no damage a few people with out tokens were even saved from having to deal with a roll back.

This is what my contact told me, but he was not sure what extent of information could have been lost. IE address name Dob CC#s

[stewie]

Reg servers was hacked, this is the reason for the mass email, SE then froze all possably effected accounts on that blade server. untill the owners reset the pol passwords. This is the reason most all accounts was recoved with no damage a few people with out tokens were even saved from having to deal with a roll back.

This is what my contact told me, but he was not sure what extent of information could have been lost. IE address name Dob CC#s

Actually sounds plausible...

[Mistress Stowastiq]

If I choose to go thru with the data recovery will I be able to get my money and PCC back? Reason I ask because if there is a chance I’ am not be able to get my money back then I feel is not worth been out of the game for 2 weeks.

In addition, has anyone done the recovery data and got everything back? Anyone that has gone thru this your responses will be appreciating.

If you roll your account back to a time before the pcc was obtained then you will not have item. They also do not give you items that were in your D box. If you can remember correctly when, perhaps you can ask the GM.

They tend to not let people choose their rollback times because of people pretending to have been compromised with intent to get back items they previously sold in hopes of faking for a rollback.

Looks like the best time would be after the charm was obtained yet right before the hack happened. Good luck to you.

[Reveria]

Welp got my account unlocked and password reset, pretty much reamed in the ass. Spent all my AP (fuck yeah hale ring), sold anything they could sell like usual. Surprisingly they weren't total a total ass as I still had all my r/ex shit.

Renamed my poor mule to sakdjflsadjfl or something rmt-esque too and left her naked in windy

Here's hoping my character rollback goes smoothly. Grats to those of you who lucked out on coming out unscathed, just bought a token tonight too, though that's probably a futile attempt, gonna do a mass password change all over the place too just in case, even though my computer is clean as a whistle.

EDIT: Hi to all you on alexander!