[Akashimo]

One of my hnmls officers found it on BG and post it on our forum, just relaying here.
New RMT attacks - Order of the Blue Gartr

Originally Posted by Tubbers on BG

Two of my LS members and good friends had their accounts stolen by RMT yesterday at around 5:45 PM EST. However these were not ordinary attacks, they were different. Smarter, faster, and at this point they don't seem to be from keyloggers (though that is still the most likely case).

In about 10 seconds from "Disconnected, this PlayOnline ID was logged in from another Terminal", both of their passwords had been changed. That is impossibly fast for a human to do, so they are using a program to change passwords immediately now.

Both of them managed to call GMs from other characters (or have friends do so), and get their accounts locked, but because it was Sunday and they couldn't phone in, the process took too long, somewhere around 45 minutes, so the damage was definitely already dealt.

Today both of them called SE and presented their info only to be told, "The name on the account doesn't match, sorry. There is no way to change the name on the account so it must not be you."

Neither of their accounts were bought, they are the original owners and have been playing for years, their names were definitely on the account prior to the hackings. This means the RMT have found a way to change the names on accounts, and now SE is unwilling to return the accounts to them.

Other peculiarities were that one of them received a PoL message immediately prior to the attack, upon looking at it, it was empty. Completely empty, no from, no message at all, just completely blank. I'm asking the other if it was the same case, but if it is, this spells for an extremely deadly new form of attack. If that was how they were hacked, there is a vulnerability in PoL messages to buffer overflow attacks (maybe). I'm not the greatest with PoL.exe, but considering Taj's malformed character exploit which DC'd players, I'm inclined to believe it is possible.

If you get a PoL message, I would urge you not to open it until this is resolved as either impossible or fixed.

I'll keep you updated with whatever I find out.

------

Finished reading whats already up. Seems somewhat fishy, but best to take to the side of caution nonetheless.

[DakAttack]

Exactly ten seconds?

[Mhurron]

No, that sounds like a pretty ordinary keylogger attack.

"received a PoL message immediately prior to the attack, ... If that was how they were hacked, ... considering Taj's malformed character exploit which DC'd players, I'm inclined to believe it is possible."
I'm not.

[Feba]

What the hell is up with this whole "Something bad happened, you should be careful" mentality people have, anyway?

"Some celebrity has lung cancer. You should stop smoking.", even though everyone already knows smoking causes cancer. "Some woman was raped last night. You should keep your eyes open.", even though everyone already knows you're at risk anywhere. "There's some new virus going around. You should use anti-virus software and be careful where you go online", even though everyone already knows that you need to either use secure software or not connect to the internet.

[Mhurron]

http://en.wikipedia.org/wiki/Culture_of_fear
Also with things like this people like to try and make a name for themselves by being 'first' to notice, mention, diagnose etc the problem.

[Durahansolo]

Originally Posted by Feba

"Some woman was raped last night. You should keep your eyes open for suspicious people."

Otherwise it just sounded like this:

O_O

[Aksannyi]

I don't buy that it was dished out through a POL message. But, once we thought this shit was (mostly) over, and here it goes again. /sigh.

[Durahansolo]

Originally Posted by Aksannyi

I don't buy that it was dished out through a POL message. But, once we thought this shit was (mostly) over, and here it goes again. /sigh.

So true. They don't have anything better to do but to hack our accounts. I wonder what the world would be like without RMT.....




Anyways, I never want to have my account stolen again. The less I have to deal with SE/Playonline the better.

[dirtyclown]

If there weren't any RMT we'd be playing My Little Unicorn: Master Chief edition?

[fallenintoshadows]

There's a similar "warning" going around at the moment that ffxiclopedia has been "infected with a virus that steals pol passwords". I take both warnings with a pinch of salt, some people just like starting a scare fest.

[Caspian]

Originally Posted by Feba

What the hell is up with this whole "Something bad happened, you should be careful" mentality people have, anyway?

9

















Wait for it.













11

[Mhurron]

Originally Posted by fallenintoshadows

There's a similar "warning" going around at the moment that ffxiclopedia has been "infected with a virus that steals pol passwords". I take both warnings with a pinch of salt, some people just like starting a scare fest.

Now this one is possible (though technically it wouldn't be a virus) and it wouldn't be the first time they were compromised.

[fallenintoshadows]

Originally Posted by Mhurron

Now this one is possible (though technically it wouldn't be a virus) and it wouldn't be the first time they were compromised.

I know it's possible but its also possible someone just thought they'd say it was. It's times like this I wonder why google flags ffxionline as a threat for every little thing and ffxiclopedia and other websites which have been compromised in the past go unnoticed.

[Neomage]

I have a question: Is that new 'software keyboard' actually any better then just typing it in?

[Mhurron]

Originally Posted by Neomage

I have a question: Is that new 'software keyboard' actually any better then just typing it in?

If you have a keylogger, yes it would be, but that's like saying you're much safer with a seatbelt on when you're driving drunk.