The sky is falling: player with token hacked? (lolIE)

[Eanae]

<Izzy> so
<Izzy> fun story
<Izzy> someone in my LS with a security token just got hacked hahaha
<Doofus> izzy
<Doofus> i do not believe you
<Izzy> you know what i think happened though
<Izzy> i think SE just fucked up
<Izzy> and rolled him back to the first time he was hacked
<Izzy> he was hacked before tokens were there
<Izzy> now, he just got kicked off FFXI, logged back in immedately, then he's at la thene missing a fuckton of gil and osode/pcc/etc.
<Doofus> so
<Doofus> he didnt get hacked
<Izzy> thats just what I think
<Izzy> he's calling a GM now
<Izzy> to see what actually happened
<Izzy> the hack sounds pretty clever too
<Izzy> when he logged in, the second he hit enter to login, POL hung up
<Izzy> which was probley the hack sending the one time code where it needed to be sent
<Izzy> before getting to SE's servers to be disabled
<Izzy> "i was browsing some FFXIV sites in IE"
<Izzy> apparently whatever it did
<Izzy> also disabled POL from starting up
<Izzy> until he restarted his computer
<imitarate> hmm
<Izzy> like
<imitarate> yeah... that would do it
<Izzy> it would hang every tiume he loaded it
<Izzy> so they had just enough time to get everything

Plausible? Possible? Attention Whore? POIDH?

[Doofus]

IM IN AN OP YAY

also lol, i dont believe it for a second

[Izzy]

I"M NOT LYING I PROMISE!

[Izzy]

He got DC'd from FFXI
Tried to log back in
POL Locked up and crashed after he tried to login
POL would no longer open until he restarted his computer
By the time he was restarted, he was in La Thiene on WHM with all his shit gone.

[Madeline]

People still use IE? Fucking really?

I say it's entirely possible, but this means those hacks are becoming more sophisticated than just simple keylogging.

I guess locking you out of PoL.exe is their way of keeping you off your account. I don't think it's possible to guess/know the token's number. Since you have to re-enter the token PW+original PW to change over information, they can't lock you out like usual.

[Izzy]

I'm assuming it's a simple Capture>Crash>Send injection.

Remember when we were all being cynical twats when the token came out, and someone proposed that this was a possibility haha.

[Therin]

Was this Marcus? =/

Hope it gets worked out.

[Izzy]

Yes Q_Q

[Izzy]

All the other accounts are fine, just the one he attempted to login to was hacked.

Also, the GM's refuse to help him since he's already had a rollback before. YAY GM POLICIES!

[Madeline]

Awesome. Has he scanned yet to see what program did this to him?

[Izzy]

Not yet. Oh, and also the account was not "stolen" as the RMT would need another one time key to change account info. It's basically an RMT version of a "smash and grab".

[Madeline]

Keep us posted. And make him download Firefox/NoScript/AdBlock/Flash updates!

[iulus]

Same thing just happened to the husband of a ls member except there was something slightly different. The two of them apparently were in salvage together when the husband's POL crashed and wouldn't restart. She noticed that her husband's character was red dotting, when suddenly it came back from disconnecting and immediately warped out and jacked all his shit. He rebooted his computer in the meantime and his password was changed, so he was locked out until the damage was done. How in the hell did they change the pw if you need another one-time pw to change account details and how did the character not fully disconnect? I asked to make sure that it wasn't just a really short disconnect, but he apparently stayed in the pt the entire time until after warping out of the salvage.

[The_OG_Nelta]

it's not really surprising honestly, he got keylogged.

They got ready and got both his POL pw, and his generated, and bam.

[Suiram]

So this thing d/cs you from POL, then while you're trying to login intercepts your token code and prevents you from logging in, then logs in with the code you're trying to enter and steals your stuff?

[Madeline]

Pretty much.

[iulus]

The thing about what the person in my ls reported is that the guy was online at the time when it happened and they changed his password all without the character fully disconnecting.

[Doofus]

Same thing just happened to the husband of a ls member except there was something slightly different. The two of them apparently were in salvage together when the husband's POL crashed and wouldn't restart. She noticed that her husband's character was red dotting, when suddenly it came back from disconnecting and immediately warped out and jacked all his shit. He rebooted his computer in the meantime and his password was changed, so he was locked out until the damage was done. How in the hell did they change the pw if you need another one-time pw to change account details and how did the character not fully disconnect? I asked to make sure that it wasn't just a really short disconnect, but he apparently stayed in the pt the entire time until after warping out of the salvage.

i seriously do not believe this at all, i mean that sounds more like someone taking control of his PC or something, rather than a simple stealing of passwords

[Narse]

i seriously do not believe this at all, i mean that sounds more like someone taking control of his PC or something, rather than a simple stealing of passwords

His POL crashed, however, the character did not disconnect. It's not like it's being done from his PC at all.

[iulus]

i seriously do not believe this at all, i mean that sounds more like someone taking control of his PC or something, rather than a simple stealing of passwords

That's what I told her. She's not too great with computers apparently so she couldn't give me exact answers to the questions I was asking her, but how did the password get changed? I was just going to shrug it off, but some of the things she said were eerily similar to what the OP posted and she was sharing that with us before this thread was posted, so figured I'd share.