FFXI Token hack?

[Germ]

Saw this thread on BG while looking for the "sky is falling" augment thread. I found a "the sky is falling, my token got hacked" thread instead. Not sure what to think. It seems a proxy server line appeared in the log for people when they used Hijackthis, after being kicked out of playonline. Some of those that had the line have been "hacked", while others haven't been. The BG link is http://www.bluegartrls.com/forum/80487-sky-falling-player-token-hacked-lolie.html.

What I gathered from the thread is people with the "proxy server" line in the log after running HJT were both people that were hacked and weren't hacked. I'm just wondering what to believe. Some of the people that were hacked said they frequented Wiki and BG.

I am an accountant by trade, so proxy servers and all that jargon doesn't mean much to me. Can someone explain to me the situation. I just got the security token and would be pissed if it's for nothing.

**edit Supposedly some of the people visited sites using IE. People should be using Firefox and the tighter security, w/e. Even with the security token, can IE make the token obsolete due to shitty security?

 

[Crumpet]

Internet Explorer...

lol...

But there has been some talk about how long the codes take to expire, making hacking still possible.

 

[Germ]

and for lack of confusion, I strictly use firefox and all of it's goodies. Just wondering if the non IE users have something to worry about.

 

[masterorion]

the thing with the tokens, to be able to hack them, the hacker needs the token number that is printed on the back

 

[Khajit]

the thing with the tokens, to be able to hack them, the hacker needs the token number that is printed on the back

Simple problems like that are easy to get around. like for example keylogging the pw the person types then stopping pol from sending it out on your end to SE while crashing pol and making it unable to connect to the network.

 

[masterorion]

Simple problems like that are easy to get around. like for example keylogging the pw the person types then stopping pol from sending it out on your end to SE while crashing pol and making it unable to connect to the network.

for that to work, they would have to re-use that key before it expires and do everything you just mentioned before that user clicks login

 

[Dancingweapon]

for that to work, they would have to re-use that key before it expires and do everything you just mentioned before that user clicks login

I swear I read something saying that the one time password can last up to 30 mins.

 

[Tok]

this is interesting, cause when i was hacked i had my token active too

thing is i don't use IE and according to FFXI my character is still active and buying and selling shit both what i did and didn't have

 

[masterorion]

when you hit the button. it stays on the screen x amount of seconds. once it goes away and you hit the button again, the new one shows

 

[Germ]

I swear I read something saying that the one time password can last up to 30 mins.

When we handle direct deposits for payrolls through wells fargo, the key changer is every thirty seconds. I thought the SE token kept the one time pw up for 30 seconds also. The wells fargo security doesn't have a button to push to activate a new one-time pw, but displays the one time pw for 30 seconds, then changes to a different pw for 30 seconds

 

[masterorion]

When we handle direct deposits for payrolls through wells fargo, the key changer is every thirty seconds. I thought the SE token kept the one time pw up for 30 seconds also. The wells fargo security doesn't have a button to push to activate a new one-time pw, but displays the one time pw for 30 seconds, then changes to a different pw for 30 seconds

aol techs use the same kind of device. which, the technical term for them are secure IDs. the only way to be able to login with the aol tech user name was to have that randomly generated number. however, there is a way to hack them. if you have the serial number of that secure ID, you can get the randomly generated number very easy

 

[Khajit]

for that to work, they would have to re-use that key before it expires and do everything you just mentioned before that user clicks login

You misunderstood. they dont have to reuse the key. they just stopped you from using the one you inputtted and sent it to themselves so that they can login instead while you wonder why you're having problems logging in.
There are even reports of people being hijacked while they're logged on without the character fully disconnecting(but you are)as well.

 

[Princemercury]

"Real-time sniffing/hacking."

It's possible... But if there are people out there who really do that for a few XI accounts... lol since the tokens only last a few seconds. Not 30 mins, whoever said that above.

 

[masterorion]

You misunderstood. they dont have to reuse the key. they just stopped you from using the one you inputtted and sent it to themselves so that they can login instead while you wonder why you're having problems logging in.
There are even reports of people being hijacked while they're logged on without the character fully disconnecting(but you are)as well.

you misunderstood what i said. re use/use, whatever. that key is good for a total of 30 seconds. thats it. you can log on and log right off and log right back in with that same key until it expires.however, if they are going to use that key, they need to use/reuse it before 30 seconds has passed. not impossible, but they cant be dilly dallying.

as for the reports of people being hijacked while still online or not fully disconnecting. i find that hard to believe. number 1... when someone such as myself loses connection in any way, i have to wait for that character to completely disconnect from the server before logging back in with it. if someone were to hijack your character, the connection to the server would have to have some type of lapse. therefore, there is a period of time that it cannot be logged into until it has fully disconnected from the server. and, if your like me, i try to log into my char as soon as i disconnect. even so, if your force disconnected, they would have to log into your account. at this point, they have no secure ID number. unless of course, they have that code on the back of it. which, people are dumb enough to give that number out. heck, a keylogger could be on the system at the time they register it with POL. if thats the case, the person with the keylogger has all of the info that they need.

with these cases of people losing their accounts, i would venture to say that there is more to it than what they are saying. IE: getting phisched by a fake pol site that asks for that code, pw, etc.

but hey, anything is possible.

 

[Vandoura]

Another way to prevent this is to have a PAID Antivirus/Internet Security software

I'm pretty sure those that got hacked use a free version.

I knew sooner or later RMT found a way to bypass token

 

[Tristam Green]

this is interesting, cause when i was hacked i had my token active too

thing is i don't use IE and according to FFXI my character is still active and buying and selling shit both what i did and didn't have

You mean, Firefox(/Safari/Opera/Chrome) didn't use its Aegis of Awesome +42 to protect you against all Interweb viruses, malware, and STDs?

Another way to prevent this is to have a PAID Antivirus/Internet Security software

I'm pretty sure those that got hacked use a free version.

I knew sooner or later RMT found a way to bypass token

How much per month are you getting from Symantec, anyway?

 

[Layeena]

Hmmm, this could be a problem, yes? One would think the Secruity Token was to be, well, secure, correct? Eh.


On a side note, Germ, I love the fact you put "1/3 Ass Charge" in your sig, though I know it's supposed to be Assassian's Charge. I still find it worth a giggle. :biggrin:

 

[Langly]

The # does last up to 30 minutes.

You can push the button 3 times and you can use all 3 of those within the 30 minutes. I've done it multiple times.

Just FYI.

 

[Dancingweapon]

The # does last up to 30 minutes.

You can push the button 3 times and you can use all 3 of those within the 30 minutes. I've done it multiple times.

Just FYI.

Yeh, like I said earlier, I saw loads of people saying it lasts 30mins.

 

[masterorion]

The # does last up to 30 minutes.

You can push the button 3 times and you can use all 3 of those within the 30 minutes. I've done it multiple times.

Just FYI.

i just tried it. once the new number is available, the first numbers are still useable. but that first number will very soon, expire.

that, itself, needs to be fixed. that delay between the login server and that ID should not be there. even if it just for about 5 seconds