WARNING: Account Hacking

S

Spyle

Sub Job Unlocked
Adventurer
Joined
Jul 30, 2004
Messages
17
I posted this a few hours ago on all the forums for FFXI that I knew, forgot this one though..


My name is Spyle, I wrote the log parser program..

Recently someone posted a message recommending it to everyone, said the main site was down and had links to alternatives. In my stupidity and trusting, I downloaded one to see what version they were distributing. I did not even install it, just checked the file version.

A few hours later I was informed that it contained a virus. I do not run a virus scanner, I have never had a virus on my primary PC for all the years I have had it and I am usually very cautious with unknown files. Stupid me. Anyways I download one and sure enough there are 3 viruses found. I remove them all.

I guess it was too late. The next morning I log on my account and everything is gone. 1.25 million in gil and over 3 million in items. All I have left is my EX items and other various almost worthless crap. I check the delivery guy, everything is in there. Can't cancel, too late for that. It does not even display the name of who it was sent to anymore. I will probably quit the game.

I would recommend to everyone that they change their passwords if they have downloaded the parser from ANYWHERE except the official site. You should do this after scanning/removing viruses. I am not sure if removing the viruses is enough though as they may have allowed a program to be installed to read your playonline account/password that is not considered a virus.

I have removed all files from the official site. I am fairly certain they were not tampered with as I have a different password for that but I don't want to take any chances.

It is very sad that this has happened, and very unfortunate for me. I will probably end working on the parser.

I do not know if the GMs can return any of my items. How can I prove that it was not me who transferred the items to another character and it isn't just a hoax to get some easy gil...




The GMs were not willing to help in any way. I'm still trying.
 
Ah, that's a real bummer, sorry to hear it.

Spyle said:
I do not run a virus scanner, I have never had a virus on my primary PC for all the years I have had it and I am usually very cautious with unknown files.
Click to expand...

Just out of curiosity, how would you know that you never had a virus if you don't scan for it?

There are a bunch of virus versions out there that do not require you to open an attachment, read a website or whatever, they attack the RPC port of Windows and install itself on your machine without you knowing it, or without requirering any kind of operator interaction at all. One of those is the W32.Welchia.Worm.

I guess my point is that not running some sort of Anti-Virus real-time scanner is ..., well ..., careless?

Be that as it may, it's tough to lose all your stuff. In EQ GMs would follow up on hacking issues, and usually one would get the items back, because hacking doesn't occur all that often and is usually well documented, meaning GMs can see the account history and what a character had and did not have, who logged in from what IP and what that person did, etc.

I don't think all is lost yet, if you can document your case, you can probably get a "rollback" as they call it in EQ, when your character is restored to a previous state from backups they have.
 
I'm not familiar with this log parser progam. Is it some kind of modification to the FFXI client? If it violates the EULA then I really don't see Square/Enix having an pity in this case. From the sounds of what you lost I can only imagine the amount of time you lost with this hacking. It must be frustrating. :x I'm sure people appricate the heads up though.

Good Journeys!
 
lmao i was wondering why u made that topic XD
mistakes can happen dude
 
I downloaded this thing (never got it working though >.<) and I got kinda worried reading this thread =/ Could you post a link to the main site so I can see if I downloaded your version or the "fake" one?
 
Posting a link is a bit of a touchy subject. With QCDN being an official community site I had to agree to not promote or support 3rd party programs in any way. While it is ok to discuss these conceptually, it's tricky to actually link to them.

A possible work around would be if Spyle were to add the link in his profile, as his homepage. It's all semantics, I realize that, but I would still prefer it that way. Another alternative would be PM.
 
Actually, I posted a link awhiles back to his official site. So you can look through the archives and probably find it. Either that or just search, its not hard to find his official site.

Sucks that happened Spyle, I loved your Log Parser, like keeping tabs on players skills in PT's and such. Hopefully you'll keep working on it, alot of people I know have some version or other on their PC's after I showed it to them.
 
Dude, dont quit, the last thing our community needs is to lose players like you whyo go out of their way to look out for us. Talk to a GM and explain what happened. In most of the cases Ive had with item loses through bugs (no hacks, but thats worse), GMs have refunded me what I lost. Try it. They could say that because u used a third party site, it was your own fault, but ask anyway! And if not...I dunno, is there anything we can do as a community? Because think about it....We have an account hijacker here and SQUARE wont get off its ass to do anything about it. Thats not right, not right at all. SO, if they dont do squat, ill be one of those supporters that'll raise hell till something is done....not quite sure what tho.
 
Sculli said:
Ah, that's a real bummer, sorry to hear it.

Spyle said:
I do not run a virus scanner, I have never had a virus on my primary PC for all the years I have had it and I am usually very cautious with unknown files.
Click to expand...

Just out of curiosity, how would you know that you never had a virus if you don't scan for it?
Click to expand...

Just a point of clarity... Spyle said they had never had a virus scanner previous to this incident but downloaded one and used it after hearing the virus warning.
 
><@! sorry spyle. thats sucks hard. like scully mentioned though SE keeps logs of where you log in from and the Ip used.
more importantly however, they keep track of who sends what to whom. it will likely take alot of prodding, but they should be able to tell you who your character mailed the items and gil to. from there they can trace where it is. either on the unnamed hijacker toon, or someplace else.
~Syn
 
This is alredy being discussed at ffxi.allakhazam.com, where they even sent an email to the host of that fake page. On that one, spyle (I think it was spyle anyway, might be wrong =/) sent a message to SE, and tried to make them tell him who eh sent his items though. They just simply said they don't keep track of it, and if they did, they could not tell him.
 
Sorry to hear that. Account hacking was not too uncommon in Ultima Online. The only way that EA would release the IP log where to the authorities (police, FBI, etc). Contact you local police department and see if they have an internet crime department, if not contact your area FBI office.
 
Uzor said:
This is alredy being discussed at ffxi.allakhazam.com, where they even sent an email to the host of that fake page. On that one, spyle (I think it was spyle anyway, might be wrong =/) sent a message to SE, and tried to make them tell him who eh sent his items though. They just simply said they don't keep track of it, and if they did, they could not tell him.
Click to expand...
This blows hard.
What if their SE's server crashes or their RAID5 array or whatever they have gets fried? I simply can not believe that there isn't a backup of the characters somewhere, SOE's (EQ) customer service sucks for the most part, but at least they can rollback your toon if needed.

If it were me, I wouldn't put up with a simple "no can do", I'd be calling emailing whatever, I'd go to the shareholder board if necessary.
 
some good news, seems whover was doing it is returning the crap he stole. and there was much rejoicing. Spyle has gotten back his items and gil.
 
That bites.

I'll tell ya, there are reasons why my laptop is a Mac, my desktop is Unix, and I run my games on a PS2. And THIS is probably right up at the top of the list.

Though I ALWAYS recommend you have a virus scanner, though in this case it probably wouldn't have helped you even if you had it. This was obviously a carefully crafted trojan horse designed specifically for one purpose: to rape your FFXI account. The sort of thing doesn't attack the windows OS or any other software on your computer. So it's not likely that it would be found on a list of known trojans and it's not likely that virus heuristics would detect and become suspicious of it (they can detect and suspect malicious code by the very fact that it's modifying files in the OS that ordinary programs should never modify -- but this trojan wouldn't have done that.)

However, you probably *can* catch the person who did it. The malicous version of the code would probably contain an email address or IP address of the person to whom it sent your FFXI account info (so that they can log in and steal your account). FFXI *SHOULD* be able logging the IP addresses that account holders use for every login and they *SHOULD* be able to match it against the name of the person who is the recipient of these goods (even though as one person previously posted, they apparently don't keep a delivery log). With that info, they should be able to prosecute.

I'm a bit disappointed in Square's response to this. Game companies are normally accustomed to being attacked or hacked - as a result, one would expect them to have a good computer/security forensics team that would be smart enough to understand how to catch these guys (and it usually isn't very hard).
 
You must log in or register to reply here.
Back
Top