The sky is falling: player with token hacked? (lolIE)

[Izzy]

1) "Hey China, your people stole 1,000 of our citizens virtual characters' login info and stole all the gear off them!"

2) "Hey China, your people stole over 1,000 of our citizens credit card numbers and maxed out the charges on all of them!"

Which one is going to get you arrested quickly, and which one is going to get you laughed at.

[Gunslinger]

That's not how this works. Both are:

Hey China, this IP compromised 1,000 records on X server, which may or may not have contained credit card information or other personally identifiable information.

SE isn't running a game, they're running a business. We're playing a game through their business, through which they make quite a bit of money.

I really wouldn't be so stubborn about this if I wasn't intimate with credit card technology as related to security. My workplace has been going through a lot of changes just like everyone else, and it's consumed me for the better part of a year

Ps. This has gotten way off topic and is pretty unrelated to anything FFXI at this point, so I'll go back to looking at BLU gear like the game would have me do No hard feelings to anyone I pissed off with my stubbornness or derail.

[evilpaul]

Stealing FFXI accounts and selling them is not illegal. Stealing credit cards and using them is.

"Unauthorized Access to a Computer System" You don't need to do any damage, access private information, or anything else. It's a Federal Crime, period.

Probably illegal to do in China, too.

[Izzy]

You're all trying to raise your fists in the air and "FIGHT THE POWER! LOOK WE CAN MAKE A DIFFERENCE!". In reality, no one is going to do anything unless large amounts of ACTUAL MONEY are being stolen. No one gives a fuck about our virtual shinies outside of the people that play the game. Intellectual property blah blah blah blah. No one cares, it's not real.

Do I agree with you that something should be done by either country to these RMT shitfucks? Yes.

Do I think that either country will actually do anything? No.

[Mistress Stowastiq]

What about Blizzard/Gravity/any other MMO company that has failed/is unable to prosecute anyone for RMT? It's not due to SE's terrible infrastructure (make no mistake, it is terrible). Do you think China is going to deport/enforce US laws in their country?

My point was that an intellectual property owner's lack of action to prosecute for an act is not always an indication of the legality of that act. Being able to get away with an illegal act is not always an indication that it is in fact legal.

I was not pretending to profess how worthwhile it is to pursue action against it, that is a preference-based, more ethical decision. Some companies take losses on the money spent on suits just to set an example within an industry.
Furthermore, it may be legal in some places while not in others. There are tons of legal loopholes to hide in to obscure legality. I am also not one to dismiss all rmt as based in Asia, it exists other places including USA.

Edit: @ Izzy,
We overlapped posts lol. I am pretty bitter about the whole thing. I don't know or have faith that a difference can be made by fighting against it, when it is accepted as the norm.

[Izzy]

Some companies take losses on the money spent on suits just to set an example within an industry.

I really wish Blizzard or SE would do this. It would be great to have some sort of precedent set for prosecuting RMT activities. SE is too money greedy to do it most likely, maybe Blizzard will do it.

[Reveria]

Has anyone been hacked that was not currently logged in? Just curious as it seems most if not everyone has been logged in when their toon was taken over from another location.

Just curious if it would be safer to acctually logout instead of always leaving my toon logged in.

A little bit late, but I was logged out when it happened. Went to bed after limbus, woke up, went to the bank, paid my rent, came back and my friend was asking me why I was showing up in Alexander on flist.

In other news got to app to get my character rolled back so hopefully I'll get everything back soon ; ;

Who didnt have token and got hacked? All i see is people -with- token getting hacked, aint that the point of the thread?

I am a no adblock/noscript user, i dont use them for personal reasons and work related stuff. I also dont have a SE ID or signed up to one. Dont use a SE token.

Not hacked yet! -touch wood- lets hope these recent server maint did something.

I don't have a token, though I do now, since this seems more and more like an SE side weakness, and if they fix that, the token won't hurt to have. Plus it looks like even though some people with tokens got hacked, the token stopped the RMT from doing any damage, just messed up their passwords and whatnot. It'll probably be better than having nothing.

[Furor]

Not sure if this has happened to anyone or if anyone has an answer, but I'll try to explain my situation as clear as possible.

One of the accounts I use has been compromised. It was transferred to Hades and I was able to have the account frozen. However I am not the account owner, but since it's a friends account(and he still pays for it), and I still talk to him on occasion, I was able to talk to him about the account being compromised. I told him he would have to talk to SE and such, but since he is busy he gave me the info that he used to register(yes, a it's a very trustworthy friend), and I contacted SE.

They said I would have to send in a notary form to verify that my friend is the actual account owner. Now my question is even when I have him send this in, what are the chances of a game data recovery happening since he himself hasn't logged on in like two years, because it's been me that plays the account?

[Bluefrostie]

They said I would have to send in a notary form to verify that my friend is the actual account owner. Now my question is even when I have him send this in, what are the chances of a game data recovery happening since he himself hasn't logged on in like two years, because it's been me that plays the account?

I had an issue like that when my boyfriend got hacked. He kept getting into the specifics, saying how I was using his account 'illegally' because I was not the original account creator, even though he never had a problem with me logging in on him. You know, how SE says only 1 person per account, yadda yadda.

But the way that it's written on the notary, it says that the original account holder confirms there was no unauthorized use of the account prior to this specific time.

Basically, you are an authorized party to use the account by your friend, so I don't see what the problem is. Although I'm not sure how SE wants to interpret their own words, but that's how I read it.

[Furor]

Well even if I am an authorized(although SE clearly states 1 person per account) user, if they do a game data recovery and they see that it had been accessed by an unauthorized user for about two years, are they going to restore back to two years ago? I don't think that's what will happen but what I'm afraid of is that they may see that the account has been accessed by a third party for quite some time and think to ban it or just ignore the game data recovery.

Forgot to mention that I log in the game in California and the friend is in Texas.

[Aksannyi]

Just have him say he moved or something.

[Mistress Stowastiq]

I really wish Blizzard or SE would do this. It would be great to have some sort of precedent set for prosecuting RMT activities. SE is too money greedy to do it most likely, maybe Blizzard will do it.

Blizzard's rmt are pretty sophisticated from the small bit I saw in that thread here.
I don't know about SE being greedy as much as they are proud of their franchise. I think they took a loss when prosecuting Ivy's producers/record co for their music video's obscene massacre of Advent Children's themes.

I am uncertain on the value of the currency exchange but I imagine their lawyers costs way over the mark in comparison to the reward for winning the case. While it is not rmt, it is intellectual property rights violation(sp?) that they sued for. I recall hearing that Korean law enabled prosecution to be more convenient than it would be in China. This is speculation though. I do not remember who said that.

As far as the person saying they are surprised this late in FFXI's life that rmt are still present, it is the customers who are buying from them who are still present, giving them a source of income to continue to thrive.

That same motivation is there to hack and liquidate accounts that they cannot sell. We Americans need to drop our pride and accept that we are not above the highly organized rmt'ing that people are quick to associate with China, as it does exist here.

On topic, anyone want to put all those informative points made today regarding the hacks onto a sticky?

[Quetz_Jamal]

There are two different hack methods occurring at the same time here:

1. You are logged in and your game randomly closes. You try to log back in, but it doesn't work right, it gets stuck during logging in. The one-time password from your token that you just entered gets intercepted and sent to the hacker, who logs in instead of you, warps and strips your account. Only PC players are vulnerable to this attack, and it requires your PC being infected by something. Having a token will not protect you from this hack.
2. Your POL password has changed and your account may be stripped. One of the SE servers was hacked and login info was changed/stolen. Players on PC, 360, and PS2 are all vulnerable to this, your system does not have to be compromised. If you have a token, your POL password may have been changed, but your account will be untouched, since getting POL information is not enough to log in on an account linked to a token.

Think this post sums it up very well if anything is going to be a sticky...no TLDR issues, and very informative summary of the two differing hackings that are occurring.

[Vuitton]

Never heard of people getting hacked while on a Blizzard authenticator, maybe SE just made their shit ghetto? I find it highly amusing though that the gilsellers are making this big push at the end of FFXI's life with 14 looming sometime next year.

I just want to throw this out there.

Square-Enix and Blizzard use the same tokens and security system. They're supplied by the same security manufacturer (Vasco).

Vasco


Blizzard speaks about Authenticator security

Blizzard: We've partnered with Vasco, which uses the same security technology as many major banks use to protect transactions that run through their systems and supplies some of the toughest security currently available.

...

We do not reveal compromised account data as a matter of policy, but from the first run of Blizzard Authenticators, we have zero verified cases of an account being compromised while a Blizzard Authenticator was attached to it.

Here is an interview with Vasco on how things are handled after they sell their technology to Blizzard (and presumably Square-Enix.)

An interview with Vasco

All banks, everything use that, but basically yeah, it's real technical, you can see it on our website, everything of that nature. Basically, it's a matching algorithm, client generates a one-time password, server generates a one-time password, both match, you get in, that's right.

^-- on this last quote. Once you enter in a one-time password and it is accepted, the server invalidates it so it can't be used again and all other previously generated one-time passwords that haven't been used are also destroyed.

Basically, Blizzard has stated 0 of their authenticated (security token) accounts have been hacked. Vasco states they're selling and providing the same technology to Square-Enix, as well as for the banking industry worldwide. I don't see SE can be at fault here. I blame the user.

Edit:

Here is the technology that Blizzard bought from Vasco. It looks to be the basic package, not the best of what is offered. Therefore, SE can't have anything lesser than this.

Vacman Controller

Edit:

Here is a bunch of .pdf files that go into detail on what this stuff is.

Product Literature

Case Study on Online Gaming <--- this one is a good overview.

Money quote:

"Hacking is made virtually impossible. Fraudsters need to operate in real time as the passwords can only be used once and expire after 32 seconds [if not used]. Hackers can no longer store username and password combinations for batch processing."

[Vuitton]

.

[Agrasso]

I was also hacked, stripped, and transferred to Hades server. I keep all of my updates and anti-virus software updated and do not use this computer for anything other than basic email and looking up stuff on wiki and AH.

I did a full system scan and even combed through the system files looking for any possible infected folders. Two of my friends who live fairly close have my login information, but they have not been hacked themselves (and why would the hacker only choose one account and leave the rest that are saved on POL alone?)

I'm not looking for sympathy, I just wanna figure out wtf happened and how to avoid it from ever happening again.

[rekie]

It seems so random, I wish there was just notice to explain what has been the cause. I dont even want to log into LS com or even buy a token or make a SE account, for the simple fact of these hack causes, but damn i need that satchel!

[Destinye]

(and why would the hacker only choose one account and leave the rest that are saved on POL alone?)

Because you likely have more shit to sell off which means more real money for them. Hackers always pick their targets, that's why it is VERY unlikely you'll have joe blow level 3 hacked and stripped and dumped on a foreign server.

Never heard of people getting hacked while on a Blizzard authenticator, maybe SE just made their shit ghetto? I find it highly amusing though that the gilsellers are making this big push at the end of FFXI's life with 14 looming sometime next year.

See, this is why people are mislead to believe Blizzard is the best company and WoW is the best MMO ever, you personally may have never heard of no hackings, but if you browse around, they DO get hacked just like people get hacked in FFXI, authenticator or not, WoW has its fair share of hackings, and is targeted even more than FFXI is.

As said, SE didn't make these, people need to stop trying to blame SE for everything, especially for things they have zero control over, i.e they can't modify any provided by a third party, in this case Vasco.

On the other hand, it's too unlikely that SE's servers themselves were hacked, because think about it, the hackers having access to CC info? Having access to unlimited gil? You seriously think they'd be picky?

[Edricofifrit]

Originally Posted by Deimos View Post
There are two different hack methods occurring at the same time here:

1. You are logged in and your game randomly closes. You try to log back in, but it doesn't work right, it gets stuck during logging in. The one-time password from your token that you just entered gets intercepted and sent to the hacker, who logs in instead of you, warps and strips your account. Only PC players are vulnerable to this attack, and it requires your PC being infected by something. Having a token will not protect you from this hack.
2. Your POL password has changed and your account may be stripped. One of the SE servers was hacked and login info was changed/stolen. Players on PC, 360, and PS2 are all vulnerable to this, your system does not have to be compromised. If you have a token, your POL password may have been changed, but your account will be untouched, since getting POL information is not enough to log in on an account linked to a token.

This shit. Happened to me over the weekend. I have SE account with a token and tried to log in to find my POL pw was changed. After being on hold for over an hour, I managed to get my pw reset and was relieved to find all my gilz and gear was still fucking there.

I've done 9001 system scans with every freaking tool I can think of. No rootkits, viruses, keyloggers or anything... There's gotta be something though. The SE rep told me that the shit had been hitting the fan all weekend and I basically described the "session interception" method and he confirmed that that's what they believe is going on. The token saved my ass from being stripped, raeped and totally fucked.

[Dimmauk]

Not sure if this helps, but I hid the equipment history of my profile on FFXIAH. I would do the same if I had more crafts leveled too. Dont need to give the RMTs a menu of shit they might want to steal.