New RMT Attacks, take caution

[Akashimo]

One of my hnmls officers found it on BG and post it on our forum, just relaying here.
New RMT attacks - Order of the Blue Gartr

Two of my LS members and good friends had their accounts stolen by RMT yesterday at around 5:45 PM EST. However these were not ordinary attacks, they were different. Smarter, faster, and at this point they don't seem to be from keyloggers (though that is still the most likely case).

In about 10 seconds from "Disconnected, this PlayOnline ID was logged in from another Terminal", both of their passwords had been changed. That is impossibly fast for a human to do, so they are using a program to change passwords immediately now.

Both of them managed to call GMs from other characters (or have friends do so), and get their accounts locked, but because it was Sunday and they couldn't phone in, the process took too long, somewhere around 45 minutes, so the damage was definitely already dealt.

Today both of them called SE and presented their info only to be told, "The name on the account doesn't match, sorry. There is no way to change the name on the account so it must not be you."

Neither of their accounts were bought, they are the original owners and have been playing for years, their names were definitely on the account prior to the hackings. This means the RMT have found a way to change the names on accounts, and now SE is unwilling to return the accounts to them.

Other peculiarities were that one of them received a PoL message immediately prior to the attack, upon looking at it, it was empty. Completely empty, no from, no message at all, just completely blank. I'm asking the other if it was the same case, but if it is, this spells for an extremely deadly new form of attack. If that was how they were hacked, there is a vulnerability in PoL messages to buffer overflow attacks (maybe). I'm not the greatest with PoL.exe, but considering Taj's malformed character exploit which DC'd players, I'm inclined to believe it is possible.

If you get a PoL message, I would urge you not to open it until this is resolved as either impossible or fixed.

I'll keep you updated with whatever I find out.

------

Finished reading whats already up. Seems somewhat fishy, but best to take to the side of caution nonetheless.

[DakAttack]

Re: New RMT Attacks, take caution

Exactly ten seconds?

[Mhurron]

Re: New RMT Attacks, take caution

No, that sounds like a pretty ordinary keylogger attack.

"received a PoL message immediately prior to the attack, ... If that was how they were hacked, ... considering Taj's malformed character exploit which DC'd players, I'm inclined to believe it is possible."
I'm not.

[Feba]

Re: New RMT Attacks, take caution

What the hell is up with this whole "Something bad happened, you should be careful" mentality people have, anyway?

"Some celebrity has lung cancer. You should stop smoking.", even though everyone already knows smoking causes cancer. "Some woman was raped last night. You should keep your eyes open.", even though everyone already knows you're at risk anywhere. "There's some new virus going around. You should use anti-virus software and be careful where you go online", even though everyone already knows that you need to either use secure software or not connect to the internet.

[Mhurron]

Re: New RMT Attacks, take caution

[ame=http://en.wikipedia.org/wiki/Culture_of_fear]Culture of fear - Wikipedia, the free encyclopedia[/ame]

Also with things like this people like to try and make a name for themselves by being 'first' to notice, mention, diagnose etc the problem.

[Durahansolo]

Re: New RMT Attacks, take caution

"Some woman was raped last night. You should keep your eyes open for suspicious people."

Otherwise it just sounded like this:

O_O

[Aksannyi]

Re: New RMT Attacks, take caution

I don't buy that it was dished out through a POL message. But, once we thought this shit was (mostly) over, and here it goes again. /sigh.

[Durahansolo]

Re: New RMT Attacks, take caution

I don't buy that it was dished out through a POL message. But, once we thought this shit was (mostly) over, and here it goes again. /sigh.

So true. They don't have anything better to do but to hack our accounts. I wonder what the world would be like without RMT.....




Anyways, I never want to have my account stolen again. The less I have to deal with SE/Playonline the better.

[dirtyclown]

Re: New RMT Attacks, take caution

If there weren't any RMT we'd be playing My Little Unicorn: Master Chief edition?

[fallenintoshadows]

Re: New RMT Attacks, take caution

There's a similar "warning" going around at the moment that ffxiclopedia has been "infected with a virus that steals pol passwords". I take both warnings with a pinch of salt, some people just like starting a scare fest.

[Caspian]

Re: New RMT Attacks, take caution

What the hell is up with this whole "Something bad happened, you should be careful" mentality people have, anyway?

9

















Wait for it.













11

[Mhurron]

Re: New RMT Attacks, take caution

There's a similar "warning" going around at the moment that ffxiclopedia has been "infected with a virus that steals pol passwords". I take both warnings with a pinch of salt, some people just like starting a scare fest.

Now this one is possible (though technically it wouldn't be a virus) and it wouldn't be the first time they were compromised.

[fallenintoshadows]

Re: New RMT Attacks, take caution

Now this one is possible (though technically it wouldn't be a virus) and it wouldn't be the first time they were compromised.

I know it's possible but its also possible someone just thought they'd say it was. It's times like this I wonder why google flags ffxionline as a threat for every little thing and ffxiclopedia and other websites which have been compromised in the past go unnoticed.

[Neomage]

Re: New RMT Attacks, take caution

I have a question: Is that new 'software keyboard' actually any better then just typing it in?

[Mhurron]

Re: New RMT Attacks, take caution

I have a question: Is that new 'software keyboard' actually any better then just typing it in?

If you have a keylogger, yes it would be, but that's like saying you're much safer with a seatbelt on when you're driving drunk.