The sky is falling: player with token hacked? (lolIE)

[Viller]

Welp got my account unlocked and password reset, pretty much reamed in the ass. Spent all my AP (fuck yeah hale ring), sold anything they could sell like usual. Surprisingly they weren't total a total ass as I still had all my r/ex shit.

Renamed my poor mule to sakdjflsadjfl or something rmt-esque too and left her naked in windy

Here's hoping my character rollback goes smoothly. Grats to those of you who lucked out on coming out unscathed, just bought a token tonight too, though that's probably a futile attempt, gonna do a mass password change all over the place too just in case, even though my computer is clean as a whistle.

EDIT: Hi to all you on alexander!

Sorry, to hear that. My account was also one of the ones locked along with a friends daughters account. We were both lucky enough no damage was done to ours. Good thing you do have token tho, Its my understanding you get unlimted roll backs "within reason" with a Secure ID token.

[Karinastar]

Had my password reset, logged in and everything was exactly as I had left it. Guy on the phone said "Wow that's weird" when I told him what happened. Luckily I found my reg codes so besides the 30 mins on hold was painless. Hopefully if the reg server was indeed hacked they shore it up so this shit doesn't happen again. I definitely feel like the token was money well spent now. ><

Sucks that some people without token were unlucky, hopefully you guys are able to get everything back. =(

[Drunknmunky]

If you roll your account back to a time before the pcc was obtained then you will not have item. They also do not give you items that were in your D box. If you can remember correctly when, perhaps you can ask the GM.

They tend to not let people choose their rollback times because of people pretending to have been compromised with intent to get back items they previously sold in hopes of faking for a rollback.

Looks like the best time would be after the charm was obtained yet right before the hack happened. Good luck to you.

Cdgreg and mistress thank you for your response.

To answer your question mistress I had my PCC for 8 months now and my account was compromise on Friday august 28 12:05 pm EST. and I was lucky enough to get a SE rep to change my password (It took 5 minutes for the new password to load)

My question is since I’ am doing the rollback do I need to take off everything I have in the AH and my delivery box?

In addition, it has been 3 days since that Friday am I to late to do the rollback since 3 days has pass already?

Sorry to ask so many questions just concern about the rollback either way I’ am just going to take everything I have in my delivery box and take out what ever I have in the auction house just to be safe. Moreover, might as well get a security token and I hope the investment on purchasing a token would be well worth it.

Yes, I read the policy but I always like the inputs on the players who have done the rollback.

[Ryuushin]

My friend got hacked and is in the process of rolling back and the 2 viruses that he located were:

Win32:Jomloon-B [Trj]
and
Win32:Trojan-gen {Other}

He mentions that the trojan was unremovable because it would just duplicate itself whenever he tried.. he ended up reformatting.

Now, I'm not sure if that's the cause but I suppose something to look into.

[Viller]

Cdgreg and mistress thank you for your response.

To answer your question mistress I had my PCC for 8 months now and my account was compromise on Friday august 28 12:05 pm EST. and I was lucky enough to get a SE rep to change my password (It took 5 minutes for the new password to load)

My question is since I’ am doing the rollback do I need to take off everything I have in the AH and my delivery box?

In addition, it has been 3 days since that Friday am I to late to do the rollback since 3 days has pass already?

Sorry to ask so many questions just concern about the rollback either way I’ am just going to take everything I have in my delivery box and take out what ever I have in the auction house just to be safe. Moreover, might as well get a security token and I hope the investment on purchasing a token would be well worth it.

Yes, I read the policy but I always like the inputs on the players who have done the rollback.

When you do the roll back it will restore all your charcter data from that point. Minus what you had on the AH and Delv box. Removing the items now will do nothing on saving the items from the rollback. Any thing done since the roll back will be lost.

I don't know what kinda of time frame they have on doing a rollback before its to late. I would think the sooner the better.

[Nattack]

My friend got hacked and is in the process of rolling back and the 2 viruses that he located were:

Win32:Jomloon-B [Trj]
and
Win32:Trojan-gen {Other}

He mentions that the trojan was unremovable because it would just duplicate itself whenever he tried.. he ended up reformatting.

Now, I'm not sure if that's the cause but I suppose something to look into.

oh those forking viruses, fork em hard

[Viller]

My friend got hacked and is in the process of rolling back and the 2 viruses that he located were:

Win32:Jomloon-B [Trj]
and
Win32:Trojan-gen {Other}

He mentions that the trojan was unremovable because it would just duplicate itself whenever he tried.. he ended up reformatting.

Now, I'm not sure if that's the cause but I suppose something to look into.

Win32:Jomloon-B [Trj]
This is a keyboard logger

Win32:Trojan-gen {Other}
This is prob the delivery agent and the keylogger was the "payload"

Reformatting is always a good ideal if you do infact find Viri on your machine. They can sometimes be cleaned easly but why take that chance, that you did get it all.

[Mistress Stowastiq]

Cdgreg and mistress thank you for your response.

To answer your question mistress I had my PCC for 8 months now and my account was compromise on Friday august 28 12:05 pm EST. and I was lucky enough to get a SE rep to change my password (It took 5 minutes for the new password to load)

My question is since I’ am doing the rollback do I need to take off everything I have in the AH and my delivery box?

In addition, it has been 3 days since that Friday am I to late to do the rollback since 3 days has pass already?

Sorry to ask so many questions just concern about the rollback either way I’ am just going to take everything I have in my delivery box and take out what ever I have in the auction house just to be safe. Moreover, might as well get a security token and I hope the investment on purchasing a token would be well worth it.

Yes, I read the policy but I always like the inputs on the players who have done the rollback.

Yes as far as I know, they cannot guarantee anything in the db being delivered or received or things on the ah, but double check the policy.

The rollback is to a point in time so think of going back in time one minute after the hack. The thief is on his way to the db to mail anything he can to a temp holding character. He drops one rare ex item, for example.
Gm chooses that point in the database. You have all of your items but for the rare ex item. Anything sitting in your mail box is not retrievable. Anything in the auction including unsold or gil from sold is not retrievable.

If you are talking about taking items out before you do the roll back then those items exist on a time line too. According to when you got them, they can be erased in the roll back if they were not out of the db or yours at the roll back point.

Be sure to ask a gm before hand if it is ok to give your stuff/gil to a friend in fear it might be lost in roll back. This is so that you do not get accused of falsifying a rollback to dupe the items/gil. If you specifically want only the lost pcc, perhaps you can promise the gm you will drop any items doubled by rollback if you can do that.

GM might tell you to drop the stuff, I am uncertain. I think he will be checking all of your logs though, and will be able to see you giving friends your stuff to hold for you after the theft and before the rollback so if you keep stuff that might possibly be duplicated in rollback, let the gm know and verify that it is ok to do so first.


Good luck

[Kipling]

If you rollback an item that you "duped" it'll have the same ID as the item that was restored on your account. If you don't toss it or hide the fact that you have 2 from the GM, when/if they find out you are very likely toast. Of course you could try AH-ing it to yourself as that should change the item ID, as items that are AH'd lose signatures, etc.

[The Stig]

Reg servers was hacked, this is the reason for the mass email, SE then froze all possably effected accounts on that blade server. untill the owners reset the pol passwords. This is the reason most all accounts was recoved with no damage a few people with out tokens were even saved from having to deal with a roll back.

This is what my contact told me, but he was not sure what extent of information could have been lost. IE address name Dob CC#s

Actually sounds plausible...

Sounds (actually, very) plausible to me as well, would explain the reason why only a certain amount of users are hacked and not MORE people are here reporting.

Also, lots and lots of Registration Server Maintenance in the last few days.

[rekie]

Who didnt have token and got hacked? All i see is people -with- token getting hacked, aint that the point of the thread?

I am a no adblock/noscript user, i dont use them for personal reasons and work related stuff. I also dont have a SE ID or signed up to one. Dont use a SE token.

Not hacked yet! -touch wood- lets hope these recent server maint did something.

[Shaard]

I know of 2 people in my HLS who didn't have the token and were hacked. One will not get a rollback (since it would be his second) and the other is still under investigation.

[leona]

I know of 2 people in my HLS who didn't have the token and were hacked. One will not get a rollback (since it would be his second) and the other is still under investigation.

ahah i was saying to myself, funny i have the same in my ls, then i realized wo posted

Yeah i got hacked and my char is still under investigation, scanned comp with avast, found nothing, still i formated to be cleaner.

I have a firewall active all time, avast up to date all the time, firefox, noscript, going only to ffxiah, wiki and here on the websites related to ff.

btw : this gs was fucking stupid, he didn't change my pass, we fought for like 20 minutes to gain control of my account, i finally managed to change the pass, logged in to find about 14M worth of gils lost. (hq staves, witch sash, hedgehog bomb and shit...) Still had rare/ex though.

I still had many valuables on me, he was on his way to the db when i logged back in with some more of my stuff, tried to see who it was sent to in the DB npc sender, name didn't show...

(funny thing to note is that i have 4 char on my account, the one who was raped was the 3rd on the list - showed up as blm75 in morrigan body, guess that's why it was the 1st target -.
But still the 1st char on my list was logged as a PUP24 in sandoria, left untouched, well at least i still have haubergeon+1, osode and stuff...)

[Effluo]

Who didnt have token and got hacked? All i see is people -with- token getting hacked, aint that the point of the thread?

I don't have a token. It sounds like I got lucky though.

When I got the "logged in from another location" error, I immediately shutdown my PC and logged in on XBox. Everything was there, items and gil. I've been checking daily to see if anything happens. So far I haven't lost anything, or been logged in from another location again. I need to check a couple other accounts that haven't logged in for a few months though, just to be sure they didn't get into them.

[millionsknives]

Would it be able for SE to open up an optional policy where our accounts can only be signed in from certain places, like your home state or country? I'm not very savy on how I.Ps work, but say I restricted my account to just logins from England, that would make things a lot safer.

(I know RMT operate in many country's, but lets be honest, most are in Asia unless their gonna ship their staff all over the globe)

[jeggred]

my brothers account was hacked at the beginning of the weekend. it was noticed by a rl friend that saw him on line but knew that he was not home. a gm was called and asked him to verify name,race,nation,jobs,levels then froze the account. however it was to late and he was cleaned out. avalon, genie, novia, novio, pcc, hq blessed set, and tons of hq crap.

he has never played on a pc. he doesnt share his information with anyone either. se is going to do a roll back but even that is going to be painful as a 3 100+3 crafts leaves alot of items and gil on the ah and in the delivery box. even that aside the worst part is that you can only ever get one roll back. se simply puts their head in the sand and say im sorry i cant comment on that. or company policy is one roll back sorry. the problem her is not the player in any way its an internal se problem that they need to fix and or adress for their clientel. i have never seen or delt with a company that has such terrible customer service or support. i run my own three companies myself and if i conduct myself like that with customers i would be out of business very soon.

any advice or information relating to accounts on ps2/360 being hacked would be appriciated.

[Neb]

Has anyone been hacked that was not currently logged in? Just curious as it seems most if not everyone has been logged in when their toon was taken over from another location.

Just curious if it would be safer to acctually logout instead of always leaving my toon logged in.

[Mistress Stowastiq]

I think it would be resourceful if some one started a stickied thread with updated info and a listing of the things that each hacked account has in common, in one place.

Something along the lines of the forum cooperation that took place here prior to the rollback policy implementation when massive amounts of accounts were getting jacked and a formal account restoration policy had yet to be put in place.

I see a lot of repeat questions and instances of similar patterns and I think it would be helpful if people could have some common format to follow in posting their issues. The info is all in this thread, it is just unorganized and people are missing details that might help them.
-I am willing to help mods/others with this kind of thread if anyone thinks this is a good idea.

[Deimos]

There are two different hack methods occurring at the same time here:

1. You are logged in and your game randomly closes. You try to log back in, but it doesn't work right, it gets stuck during logging in. The one-time password from your token that you just entered gets intercepted and sent to the hacker, who logs in instead of you, warps and strips your account. Only PC players are vulnerable to this attack, and it requires your PC being infected by something. Having a token will not protect you from this hack.
2. Your POL password has changed and your account may be stripped. One of the SE servers was hacked and login info was changed/stolen. Players on PC, 360, and PS2 are all vulnerable to this, your system does not have to be compromised. If you have a token, your POL password may have been changed, but your account will be untouched, since getting POL information is not enough to log in on an account linked to a token.

[Mistress Stowastiq]

There are two different hack methods occurring at the same time here:

1. You are logged in and your game randomly closes. You try to log back in, but it doesn't work right, it gets stuck during logging in. The one-time password from your token that you just entered gets intercepted and sent to the hacker, who logs in instead of you, warps and strips your account. Only PC players are vulnerable to this attack, and it requires your PC being infected by something. Having a token will not protect you from this hack.
2. Your POL password has changed and your account may be stripped. One of the SE servers was hacked and login info was changed/stolen. Players on PC, 360, and PS2 are all vulnerable to this, your system does not have to be compromised. If you have a token, your POL password may have been changed, but your account will be untouched, since getting POL information is not enough to log in on an account linked to a token.

Regarding the underlined part:

I did not see any official information confirming the SE servers being compromised. Just one post from some one who claims to have an inside friend at SE. Are you basing your info on that or official information?