The sky is falling: player with token hacked? (lolIE)

[Gunslinger]

I said in my post:

Came from the script used to open/preview maps in areas, .pdf variety delivery method.

It happened when I clicked the map to open it, I don't run any ads, and I didn't allow JS to run outside of being natively hosted on FFXIwiki, so it didn't come from an ad server. I've since revoked its JS rights as well, but that is where it came from. ESET caught and quarantined them, I've since deleted it so I don't have the name, but it wasn't from an ad.

I doubt the sites webmasters/etc even know it's there, it's not like I think they put it there on purpose. Do you remember when everyone used to use ffxiatlas.com? I remember they got hit with iframes and javascript edits too, could be the same thing? Who knows, I just disabled JS and I'll keep using the site. I'll miss auto-complete though Everything in FFXI is too hard to spell lol.

[Thorny]

I was logged in overnight. I woke up, took off /away and anon, and immediately flagged up THF 73 (you take what you can get, when you get it at that level.)

Three hours later I got a party invite for a 45 level sync. I accepted, and we were heading from Whitegate to Jeuno for the trip to CN. After I paid my silver coin, I R0'd. A minute later I got an error that said "The square enix account password or one time password is incorrect."

Thinking the worst, I immediately called SE. Was only on hold for 20 minutes, not too bad (I've heard about the 3 hour hold times.) He didn't believe I could get that error while logged in >_>

He had me confirm the usual info, and then attempt to log into the SE Account page. The password hadn't been changed there. Logging back into FFXI I encountered no problems, and I returned back where I had logged out.

The SE rep thinks it was just a residual burp from the login server errors this morning, but I'm wondering if somehow someone got a hold of my old POL ID and tried inputting an old password with it, giving me the error. (The password I used for the LS community years ago has since been changed in POL several times.)

Just now logged out, same problem. I would assume it's caused by the servers as well.

[Elizara]

I've marked wikia and ffxiencylopedia as untrusted with Noscript and I'm not gonna take them off until this is fixed.

That effectively disables javascript on them, without taking it off for other sites. I think that should cover that.

[Gunslinger]

For those interested, this is what wiki triggered:

9/2/2009 10:21:45 PM	
HTTP filter	
file:   http://pib.stupidvirussite.net/nri/pdfNode.php  -note I changed this so no one visits the link.... you never know what someone will do -_-;
PDF/Exploit.Gen trojan	
connection terminated - quarantined	
name of my computer removed by me
Threat was detected upon access to web by the application: 
C:\Program Files (x86)\Opera\opera.exe

When I rebooted my computer today it said the found virus was likely new and asked me to submit it for analysis, so I did! It tried to deliver the same package 14 tries... kept trying until I could get the tab closed. Gotta love ESET, proves its value once again for me.

[Effluo]

Amazingly, if you frequent a site that doesn't have advertisement banners, this isn't a problem.

/hateon

Even moar amazing is if you don't use crap like IE and don't have to worry about ads ever again.

/hatinonu

[Vuitton]

Where is everyone getting this 20 or 30 minute timer on generated passwords when I posted a link to an interview with the token and security software manufacturer and quoted the part where it states the passwords are only good for 32 seconds. You can't generate a password, write it down, and come back 15min later and use it. The security software on the server will have long changed the current password.

[Deimos]

Where is everyone getting this 20 or 30 minute timer on generated passwords when I posted a link to an interview with the token and security software manufacturer and quoted the part where it states the passwords are only good for 32 seconds. You can't generate a password, write it down, and come back 15min later and use it. The security software on the server will have long changed the current password.

No clue what thread it was in any more, but when the tokens first came out, some people tested them and found that one-time passwords ~27 minutes old would still work, but nothing older than that. I'm sure some creative searching could find it.

The passwords generated on the token are only good for 32 seconds, that is, the token will create a new one 32 seconds after the previous one. That doesn't state that SE has to only accept the absolute most-recent one though, they've decided to allow all possibilities for the last 27 minutes or so (unless a more-recent one is used first).

Edit: found the post/thread -- http://www.bluegartr.com/forum/73427...ml#post2649988

[cdgreg]

Where is everyone getting this 20 or 30 minute timer on generated passwords when I posted a link to an interview with the token and security software manufacturer and quoted the part where it states the passwords are only good for 32 seconds. You can't generate a password, write it down, and come back 15min later and use it. The security software on the server will have long changed the current password.

I thought long ago when it first came out someone tried it. They wrote down a 5 digit pw, waited 28 minutes and then logged in with it.

[Deimos]

Actually, while we're on the topic, I believe that knowing that the manufacturer specifies 32 seconds per password on the token tells us exactly how long the passwords are good for in SE's implementation.

It should be 1600 seconds, or 26 minutes and 40 seconds. If each password is good for 32 seconds, I'm willing to bet that SE just decided to have their code try the last 50 possibilities in reverse order, since that's a nice even number that some programmer would have written a loop using. 32 * 50 = 1600.

[Izzy]

Put down the haterade... Like Izzy said, it is most likely a bad ad. Don't let your blind hatred of FFXIwiki overrule common sense.

What haterade? I don't get it? I was just saying it probley came from a Google ad. (Which it looks like it didn't)

l2read?

[Izzy]

What haterade? I don't get it? I was just saying it probley came from a Google ad. (Which it looks like it didn't)

l2read?

I'm going to leave my post here, to teach everyone a lesson on how to read. Please, learn from my mistakes

[Seraph]

I'm going to leave my post here, to teach everyone a lesson on how to read. Please, learn from my mistakes

It's ok Izzy. We all now know that one layer of protection is better than two. :_:

[Elizara]

I think I might actually see if I can get ESET soon as I can afford it. Using Avira right now but if that other can do that..it's worth the money. Can't afford right now and I have a personal rule that pirated software doesn't get within 10 miles of my computer. I got burned once, once was enough. ^^ (bought a copy of MS Office off Ebay, turned out to be pirated.)

[Seraph]

I think I might actually see if I can get ESET soon as I can afford it. Using Avira right now but if that other can do that..it's worth the money. Can't afford right now and I have a personal rule that pirated software doesn't get within 10 miles of my computer. I got burned once, once was enough. ^^ (bought a copy of MS Office off Ebay, turned out to be pirated.)

/facepalm

[Gunslinger]

/advice on

Make sure when you go to buy it you go to the "Home and Home Office" tab for pricing, the other stuff is pretty expensive. Also, NOD32 is probably as good as their 'security package' depending on the other stuff you're running. Malwarebytes has a good free version and the firewall in Vista/7 is actually pretty good on its own.

Combine with noscript/or/opera security policies and you should be pretty damn safe (you should actually bordering impervious, but that depends on what sites you 'allow' and your habits with downloading). Also, despite what any other expert tells you, do NOT turn UAC off

/advice off

Edit: Check this link out, eset has a free online scanner now too to let you see what your AV may be missing:

http://www.eset.eu/eset-online-scanner

And info about it here:

http://www.eset.com/threat-center/blog/

It's the September 3rd post.

[cdgreg]

I think I might actually see if I can get ESET soon as I can afford it. Using Avira right now but if that other can do that..it's worth the money. Can't afford right now and I have a personal rule that pirated software doesn't get within 10 miles of my computer. I got burned once, once was enough. ^^ (bought a copy of MS Office off Ebay, turned out to be pirated.)

How did you manage to escape the federal authorities?

[Elizara]

Not that way lol!

I bought a most likely pirated copy of MS Office off Ebay (got cheated) and it messed up my 'puter so bad I had to reformat (we still got it but I ain't touching it. Tried to throw it out but my dad wouldn't let me at the time, saying it was good when I think it was to blame.) (I did report it btw. With a scan from one of the scanners in my college's computer lab.)

You can bet that little getting my piddy paws burned by bad copy made it so I won't touch pirated software. I still like free stuff, but it has to be true freeware, not adware. (I'll take nagware if the nag isn't too bad and doesn't disable stuff, but there's a limit)

And yeah, I was young, a newbie at managing my system at the time, didn't know the diff between a legit copy on ebay and a pirated one (My dad NEVER figured it out) and I was a bit dumb. I've smartened up since then. ^^ I rarely buy software off Ebay anymore unless it has box/manual. If I want a OEM copy, I buy off Newegg instead.

And just to set the record straight for everyone; I use OpenOffice now. I have used it (and its predecessor) since that time, so this was YEARS ago, when I was still running windows 98.

And thanks Gunslinger. Scanning now. I really really am anal about security since 3 of my friends got hacked back when we heard of the first hackings. (I was a PS2 player at the time) I've only had XP a year really, kept 98 way too long. I run Avira atm and do a Malwarebytes scan once a week, as well as a superantispyware scan once a week. And I run a HJT log once a month or whenever I get nervous, whatever comes first, and go over it and have a trusted friend go over it. What can I say? I hate spyware/crap. Have since I was in college. (And bleeeeeeh, Dad needed his puter license revoked before he died. We're still trying to clean the crap off his computer, it's a MESS with adware, spyware and assorted trash. And it's been a year since he died. Not gonna use that puter for anything FFXI related until we clean it.)

[edit] BTW, it only found one thing, something about a toolbar. Prolly something I downloaded like CCleaner or Recuva, but I don't install those toolbars. Otherwise I'm as clean as a whistle..gonna finish what I'm doing in game then run the weekly scans with the adware programs while I take a nap. ^^

[Elizara]

Oops! don't know how THAT happened. Stupid double post; ignore.

[Reveria]

So the big wad of server transfer charges that the RMT used my CC to take my characters to Alexander just showed up on my bank account today, will SE clear those charges on their own in the process of investigating my hacking? Or do I have to tell them to clear them on my own? I only ask because the charges weren't even showing up as pending when I got this whole situation started, so I figured maybe the hackers didn't use my info for the server transfer, so I didn't ask the service rep about it.

Also, I've sent in the game data recovery declaration thing into them, will they respond that they've started, or will they just kinda start doing their own thing and contact me when they're done and I'm all fixed?

Pardon the ignorance, I'm uneducated in this matter and I am paranoid they didn't get the email, and I'm frugal/stingy and I want my 50 bucks back and don't particularly want to sit on hold with them for another several hours to get said cash back.

[cdgreg]

So the big wad of server transfer charges that the RMT used my CC to take my characters to Alexander just showed up on my bank account today, will SE clear those charges on their own in the process of investigating my hacking? Or do I have to tell them to clear them on my own? I only ask because the charges weren't even showing up as pending when I got this whole situation started, so I figured maybe the hackers didn't use my info for the server transfer, so I didn't ask the service rep about it.

Also, I've sent in the game data recovery declaration thing into them, will they respond that they've started, or will they just kinda start doing their own thing and contact me when they're done and I'm all fixed?

Pardon the ignorance, I'm uneducated in this matter and I am paranoid they didn't get the email, and I'm frugal/stingy and I want my 50 bucks back and don't particularly want to sit on hold with them for another several hours to get said cash back.

Once I was officially rolled back I requested a charge back THROUGH SE for the world transfer cost. They had to perform *another* investigation and eventually charged the money back. It took a few months though tbh.