MAJOR Password Logging Scheme

[Arctic Wolf]

Re: MAJOR Password Logging Scheme

Well, me and a friend, who is a Programmer, we went to some of those URL's, downloaded and ran files. We did so in VMWare to see how they were made. We couldn't find anything suspicious though. It might be because there's something hidden very good inside of them which we didn't see, or the links were just fake.

[Raydeus]

Re: MAJOR Password Logging Scheme

It's understandable that you are so upset about it, I think I would be too, but sadly SE doesn't have the responsability of parenting their costumers.

It's up to them (SE) to decide how far are they willing to go.

Although the same way the credit card companies give you a call if something unusual happens with your card SE should at least do that when the credit card info and passwords are changed at the same time.

But that might be too much of a hassle and not so cost effective, after all it's the user's responsability to keep their information safe.

[ItazuraNhomango]

Re: MAJOR Password Logging Scheme

Ask to speak to a supervisor; ask the supervisor what the policy is when there's suspicion that the account is compromised.

Propose a "freeze" until the suspicion can be lifted or proved--no one gets to use your char. (Probably already too late... but...)

Don't give up, and refuse to be put on hold as much as possible. Keep going up the chain of command until you get someone with the authority to lock the account. Stay polite and positive on the phone.

Good luck.

[Olorin401]

Re: MAJOR Password Logging Scheme

I just got off the phone with Square Enix for the second time regarding this issue, and it's now clear to me that they don't care a single bit about their customers. They are now saying that regardless of past account information, they cannot and will not give this person back their account.

Now we know why they don't do anything about the real RMT problem, or anything other problem in-game. They only give a damn about getting your money every month.

I've got a good mind to ask as many people as possible to send them a message by turning off their accounts temporarily until this person's account is restored..

[Ameroth]

Re: MAJOR Password Logging Scheme

It's been a long time since I've downloaded anything without being prompted to...

I can't think of any browser I have used within the past year (98% Firefox, 1% IE, .5% Opera, .5% Safari) that didn't ask me if I wanted to download the file before it actually did so. I'm with Feba on this one.

[Feba]

Re: MAJOR Password Logging Scheme

The browser has nothing to do with this. They clicked the link, the correct response from any browser would be to download it.

It's been a long time since I've downloaded anything without being prompted to...

[ItazuraNhomango]

Re: MAJOR Password Logging Scheme

I dunno about this being a "MAJOR" scheme. It's like training a bunch of dumb, "too weak" Yagudos, -ga nuke once or twice, and collect the necklaces.

Yes, it's simple and stupid. And, yes, it works now, and variants of this will continue to work in the future.

[Mhurron]

Re: MAJOR Password Logging Scheme

Anyone who would follow a link they got from some random person, WHICH ENDS IN .ZIP, and do it with an insecure browser

The browser has nothing to do with this. They clicked the link, the correct response from any browser would be to download it.

[Feba]

Re: MAJOR Password Logging Scheme

I guess that's too much to expect from some people now?

I suppose so. Mommy always told me not to take candy from strangers...

[Feba]

Re: MAJOR Password Logging Scheme

I don't think anyone is reacting with glee.

I am! Great demonstration of darwinism.

Dak, a browser is like a lock on your front door, and an anti-virus is a security guard. Most thieves are going to go in the front door, and a scarily large amount of people leave that door wide open (insecure settings, mainly in IE). There are other ways to get in, like windows (IRC/IM), but most people just leave their easiest method of attack wide open. Once they do get in your house, you should have some method of defense, such as a properly trained guard dog. Of course, this isn't always feasible in real life, but anyone who can't get an anti-virus for their computer is just plain lazy/stupid.

Yes, it's possible for a dedicated 'serious' hacker to break through almost anything after a point, these people *are* small timers, the kind that manages to get 90% of the people with 10% of the effort.

Anyone who would follow a link they got from some random person, WHICH ENDS IN .ZIP, and do it with an insecure browser, no antivirus, is an idiot. I probably wouldn't even look at such a link on my mac, let alone a computer that has tons of personal info on it.

[DakAttack]

Re: MAJOR Password Logging Scheme

So use an incredibly insecure browser and let that do the work for you. Got it.

Again, you're stupid if you think a browser is going to protect you. You might as well skip buying a security system for your house and just stick the sign in your yard. It might keep the small-timers away, but when something serious happens you're screwed.

[Murphie]

Re: MAJOR Password Logging Scheme

I've found everyone ends up getting burned sooner or later, just a question of when and how. I get a kick out of people that go on about how others that get screwed deserve it since they are usually the ones wailing the loudest when it happens to them in an area they are less knowledgeable about.
Thanks for the heads up I haven't seen it myself, but I can warn my younger brother who also uses my terminal just in case.
BTW Yes a person should be careful but I don't think it's good to react with glee to someone getting nailed either.

I don't think anyone is reacting with glee. They are simply saying "That sucks, but honestly, you should have known better." And I can assure you that if I were ever stupid enough to fall for something like this, I sure as hell wouldn't be telling other people about it. I don't know the first thing about PCs, but I do know not to randomly click on links sent to me by strangers. I guess that's too much to expect from some people now?

[Feba]

Re: MAJOR Password Logging Scheme

You don't necessarily have to download the file yourself, nor do you have to unzip it yourself.

If the person/people running this scheme have any amount of talent, they probably wrote cookies, ActiveX controls and/or Javascript into the webpage itself that would automate all that action behind the scenes.

So use an incredibly insecure browser and let that do the work for you. Got it.

And seriously, if this uses ActiveX, you're just plain stupid for having that enabled. The .05% of sites that require it can screw off. Seriously, I'd like to know how the hell these people got it downloaded AND running without some sort of security prompt from their browser or anti-virus

And that person from ramuh is an idiot. It doesn't take a "genius" to use a keylogger to get accounts. it takes someone with a keylogger and a place to download it from. A 10 year old could steal accounts if they wanted to.

Trust me, really awsam hackers wouldn't be targetting an MMO, they'd be targetting banks. This is user stupidity, simple as that. There's plenty of guides out there on how to stay secure on the intarwebs, it's your fault for not following them.

[Olorin401]

Re: MAJOR Password Logging Scheme

Not always stupidity, not having the knowledge is not the users fault.

Heh that's like saying "I didn't know Bush was gonna turn out to be this bad when I held my nose & voted for him.."

[Olorin401]

Re: MAJOR Password Logging Scheme

Here's a detailed account of someone on Ramuh who lost their account last night:

Roughly 6PST(9EST), I, and as far as I know, everyone else on the server did as well, received a tell from a person named "Themoonlight" saying "This is the gilsellers secret http://LINK REMOVED FOR YOUR SAFETY Enjoy"

I figured it was just a good video, perhaps some lame ass but funny pictures about gilsellers, so I checked it out. Anyhow it turned out to be a program. I deleted it, under the impression it could be a keylogger or something of the sort. I then checked my programs to see if anything had secretly installed itself, taking any precaution to be sure I wasn't compromised. I found nothing~

After checking my computer for problems, I went onto PlayOnline to change my password, as I know that even if someone keylogs your information, they can only get it once. Unfortunately, PlayOnline was doing server maintenance at this time, so no PW info could be changed.

I played around like normal until about 8:30PST, when I was kicked off my character, with the error being "You've been logged on by another terminal". At this point I knew what was happening, and spent the better part of the next 1:30 fighting back/forth with the hacker as a race to see who could change the PW first when the maintenance lifted. I had a friend of mine call a GM during this time to see if they could help me out in any way. I asked them to suspend my character, anything to help. but to no avail.

Around 9:45~10:00PST, the "Hacker" successfully changed the PW before me, and I lost my account. I contacted PlayOnline at 9:00AM PST when the opened the following day (Today), only to hear nothing can be initially done to get my account back. The "Hacker" changed the CC info to his own, so even with complete and total evidence that the characters pertaining to the account are my own, I cannot reclaim my account at this time.

Overall, this person was brilliant with their strategy. They waited until PlayOnline Registration Maintenance started, they sent the tell to EVERYONE on our server on at the time, possibly multiple servers, as bait for their trap. At this point even if you knew it was a keylogger (as I did), nothing could be done or helped. They then raced at maintenance lift to change the PW of these accounts, and permanently had access to them.

Now. the only way I can get my account back, is if PlayOnline gets proof that this wasn't an isolated incident. I don't expect everyone to do so, but anyone who doesn't mind, please call (858)790-7529 (PlayOnline's official Help Office number) if you received this tell on May 14, and just have them note this was sent to you also. That is all that needs to be done, and they claimed that if they get enough complaints about the issue, they will give accounts back to people with valid proof, CC, and character information.

This is all I can hope for~ Call me a f'ing idiot for even checking the file, that's pretty much how I feel. However immediately after checking the file, I knew what it was, but all the traps where in place, and their was nothing I could do. This was a hell of a plan, and it worked~

Note: I wasn't using windower and never ran the program. This is the first program I've heard of to-date that allows them to get information without the use of a 3rd Party program, or ever even running the program.