Forum Settings
       
Reply To Thread

Keylog Attack ~How My Story Ended~Follow

#152 May 17 2007 at 8:51 AM Rating: Default
Scholar
****
6,631 posts
Quote:
Not so sure. FF/POL is probably one of the worst programs security-wise I can think of.


Under what basis do you make that claim?

End user mistakes and lack of knowledge of computers are the most unsecured thing over the internet.
____________________________
Amanada (Cerberus-Retired) (aka MaiNoKen/Steven)
-- Thank you for the fun times in Vana'diel

Art for the sake of art itself is an idle sentence.
Art for the sake of truth, for the sake of what is
beautiful and good — that is the creed I seek.
- George Sand

A designer knows he has achieved perfection,
not when there is nothing left to add,
but when there is nothing left to take away.
- Antoine de Saint-Exupéry
#153 May 17 2007 at 8:57 AM Rating: Decent
***
3,261 posts
Addyyuna wrote:


Not so sure. FF/POL is probably one of the worst programs security-wise I can think of. Some antivirus/antispyware programs don't get along with ff. Then there is that stupid feature that allows someone to login and knock you off the game. Its about time SE fixes the security holes in the game,


While I totally agree with you here, the issue isn't a matter of FF/POL being hacked into, but a matter of Hiro's login info being transferred to another person through the use of a 3rd party program which he activated. He even said he was going blow for blow with this guy trying to re-take the account. Now if the thief had hacked the POL servers to steal this information, that would be a different story, then I would hold SE totally acountable.

I think there's one thing that may be being over-looked. For example:

A user has an account, and decides he needs more gil/items etc... Said user creates a scenario to make it appear as if his account is being stolen with the hopes he can sell off the items, retain the gil, and convince SE to re-instate his character, at which point he would transfer all the gil/items from the previous character to the current one.

I'm sure this isn't the case in this situation, but that could be yet another reason SE is standing so firm on this. I'm sure once they see his persistance, they will do something. It would be a nice gesture on their part.
#154 May 17 2007 at 9:39 AM Rating: Default
I understand what you are feeling riht now as i am also a victim of keyloggers. Just over a year ago i lost my charcter and SE refused to do anything for me even though i could verify all the information other than the "current" credit card info. i even offered to send them copy of my i.d. credit card and light bill with my address but they declined saying it doesnt matter. I ve been playing WoW since then but just purchased the ffxi 2007 edition cause i miss the game that much but its sad to see that there customer service is still ******. My WoW account was compromised and stripped clean and they were able to not only give me back the account by providing i.d. and credit card via fax but they restored all my gear and gold that was taken. Isnt the trading and or selling of accounts against ToS? So why is it such a problem to return the account to the original purchaser? wouldnt that discourage if not do away with the selling of accounts. Makes you wonder. The only reason i'm coming bac is cause i am a ff fan and really do miss the game. however it will be very casual play as i refuse to put tons of time aqnd money on something that can be taken so easily. Not everyone is a omputer pro or has the money to invest in and maintain good internet security. anyways if you get it back kudos to SE but iwouldnt hold my breath. check my sig below to see the account i lost no where near as good as yours but still lot of effort
#155 May 17 2007 at 9:45 AM Rating: Decent
reading this thread, I noticed soemthing people were suggesting to help stop this problem...save your password info. Well, that is the worst idea from a security perspective I have ever heard. If you pick up a data miner, a worm, or just a hack that lets someone take limited control of the PC (or just have someone get access to it at all) then they can use a program called SIS to see your "hidden" password right through those *******. I use it at work to unlock things when users forget a password I can not change. You are better off with a good firewall, antivirus, and Spy ware detection program. Personally, I have a seperate PC for FFXI and avoid at all cost doing any other type of I-Net activity on it. I still use all the security software. Had the OP gone to a different PC, he might have lost some personal info, but the logger would not have been able to access FFXI. Anyway, I believe many do not realize that the pass word save protection feature of windows is so easily overcome.

BTW, sorry you got so nailed OP. Even the most careful and aware users can get caught off guard and make a mistake. A few of my LS on Cerberus got a similar /t or shout. I encouraged them to make a Gm call or send an email to SE at least. I doubt your the only person out there who got caught in this one.

On a separate note, has anyone tried using FFXI through "Virtual PC" on a MAC? I may have to give it a try, but dont really have a use for VPC unless it can run ffxi. If you did this, then any logger would be deleted simply by not saving Windows when you exit the program. Then, the next time you log in to Windows and FFXI, the logger would be gone. At least, that is how I uderstood it from the Macintosh Rep. I don't completely trust sales people though LOL.
#156 May 17 2007 at 9:58 AM Rating: Default
***
3,261 posts
Only reason it's "taken so easily" is because you allow it to happen through your actions. I've never had an anti-virus program on my computer, and have never GOTTEN a virus/keylogger/spyware either because I'm smart in how I surf the web, and check my email. It's not about how much protection your PC has, but what you do with it. One very simple concept to protect yourself online is, "If you don't know what it is, and/or don't know who it's from, don't touch it"
#157 May 17 2007 at 10:10 AM Rating: Decent
Quote:
4.1 Ownership and Rights.
SEI (and, to the extent applicable, its licensors) owns and shall retain all right, title and interest in and to the PlayOnline Service, the Software and all Documentation, and will be the sole owner of any and all data you generate through your use of the PlayOnline Service, and you receive only limited rights to access and use PlayOnline Service, the Software and all Documentation, as set forth in any applicable license agreement. SEI shall reserve its rights in its sole discretion to delete, alter, or transfer any and all data at any time without notice to User. Further, SEI (and, to the extent applicable, its licensors) owns and shall retain all right, title and interest in and to any ideas, opinions, comments, or suggestions that you submit to SEI, its affiliates, its agents, or its representatives in any form or format (including, but not limited to, e-mail, telephone, facsimile, regular mail, and chat room discussions) and in any context in which it is apparent that SEI may use such ideas, opinion, comments, or suggestions to improve the PlayOnline Service or any other product or service offered by SEI to its customers. Further, SEI shall have the right to assign and/or delegate in its sole discretion its rights and obligations under this Agreement in whole or in part to third party at any time without notice to Users. PLAYONLINE, THE SOFTWARE AND THE DOCUMENTATION ARE PROTECTED BY UNITED STATES AND FOREIGN COPYRIGHT AND TRADEMARK LAWS, AND INTERNATIONAL TREATIES, AND ARE THE SUBJECT OF TRADE SECRETS.UNAUTHORIZED REPRODUCTION OR DISTRIBUTION OF THE SOFTWARE IS SUBJECT TO CIVIL AND CRIMINAL PENALTIES.


SE makes it clear, at no point do you own your account, you pretty much rent it, they own it. You can not, as such, have it "stolen" from you. Ya, ya I know some of you will say, but what if you rent a car, it's still theft. Ya it is, but from the car rental agency. SE never really had it stolen from them, just a transfer of renters. You can complain about theft all you want, and talk about lawsuits against them, but they are smart in one thing, the writing of the agreements that you agree to every time you log on.

Quote:
3.2 Indemnification.
You agree to indemnify, defend and hold SEI harmless from and against any and all claims, suits, actions, expenses, attorney and other legal fees and costs arising from your commission of any acts or activities prohibited by this Article 3.


Can't sue em either.

They may have horrible customer relations, but they have smart lawyers.


Edited, May 17th 2007 1:12pm by Bacchusthegreat
#158 May 17 2007 at 10:14 AM Rating: Default
***
3,261 posts
Good find.
#159 May 17 2007 at 10:15 AM Rating: Decent
***
1,015 posts
If you don't have an anti-virus program how do you know you haven't gotten one?
#160 May 17 2007 at 10:16 AM Rating: Good
Bacchusthegreat wrote:
Quote:
4.1 Ownership and Rights.
SEI (and, to the extent applicable, its licensors) owns and shall retain all right, title and interest in and to the PlayOnline Service, the Software and all Documentation, and will be the sole owner of any and all data you generate through your use of the PlayOnline Service, and you receive only limited rights to access and use PlayOnline Service, the Software and all Documentation, as set forth in any applicable license agreement. SEI shall reserve its rights in its sole discretion to delete, alter, or transfer any and all data at any time without notice to User. Further, SEI (and, to the extent applicable, its licensors) owns and shall retain all right, title and interest in and to any ideas, opinions, comments, or suggestions that you submit to SEI, its affiliates, its agents, or its representatives in any form or format (including, but not limited to, e-mail, telephone, facsimile, regular mail, and chat room discussions) and in any context in which it is apparent that SEI may use such ideas, opinion, comments, or suggestions to improve the PlayOnline Service or any other product or service offered by SEI to its customers. Further, SEI shall have the right to assign and/or delegate in its sole discretion its rights and obligations under this Agreement in whole or in part to third party at any time without notice to Users. PLAYONLINE, THE SOFTWARE AND THE DOCUMENTATION ARE PROTECTED BY UNITED STATES AND FOREIGN COPYRIGHT AND TRADEMARK LAWS, AND INTERNATIONAL TREATIES, AND ARE THE SUBJECT OF TRADE SECRETS.UNAUTHORIZED REPRODUCTION OR DISTRIBUTION OF THE SOFTWARE IS SUBJECT TO CIVIL AND CRIMINAL PENALTIES.


SE makes it clear, at no point do you own your account, you pretty much rent it, they own it. You can not, as such, have it "stolen" from you. Ya, ya I know some of you will say, but what if you rent a car, it's still theft. Ya it is, but from the car rental agency. SE never really had it stolen from them, just a transfer of renters. You can complain about theft all you want, and talk about lawsuits against them, but they are smart in one thing, the writing of the agreements that you agree to every time you log on.

Quote:
3.2 Indemnification.
You agree to indemnify, defend and hold SEI harmless from and against any and all claims, suits, actions, expenses, attorney and other legal fees and costs arising from your commission of any acts or activities prohibited by this Article 3.


Can't sue em either.

They may have horrible customer relations, but they have smart lawyers.


Edited, May 17th 2007 1:12pm by Bacchusthegreat


How many freakin times does it have to be said before you numbskulls get it through your thick *** heads. It's not about what's legal. It's about moral and ethical reponsibility (or the lack thereof) and good customer service (or the lack thereof).

Whether SE's TOS holds them legally responsible or not, they still have a moral and ethical obligation to their customer in situations such as these. It is THIS point upon which SE fails, and no other.
#161 May 17 2007 at 10:24 AM Rating: Default
Quote:
How many freakin times does it have to be said before you numbskulls get it through your thick *** heads. It's not about what's legal. It's about moral and ethical reponsibility (or the lack thereof) and good customer service (or the lack thereof).


Hey now, no need for name calling, this is just a friendly discussion :)
I didn't say I agree with SE, or that I am happy with the way they treat their customers. I was just pointing out the fact that there isn't much we can do about it except stop being customers.

Some companies just have horrible customer relations, but have a great product everyone wants, we just have to put up with them for our crack.
#162 May 17 2007 at 10:31 AM Rating: Decent
***
1,988 posts
Quote:
Hey now, no need for name calling, this is just a friendly discussion :)
I didn't say I agree with SE, or that I am happy with the way they treat their customers. I was just pointing out the fact that there isn't much we can do about it except stop being customers.

Some companies just have horrible customer relations, but have a great product everyone wants, we just have to put up with them for our crack.


Actually if a state attorney general or some other figure takes issue with SE's business practices there will be litigation over it and if they build a justification for the case from a State's laws it does not matter in the least what SE says in the ToS.

This has been shown many times.
#163 May 17 2007 at 10:33 AM Rating: Default
Scholar
****
6,631 posts
Well... about "ethical and moral responsibility", the extent of that is somewhat vague and unclear. However, legal responsibility is concise and exact. If someone would not take responsibility of their own action, that someone can demand other to take extra responsibility to them? The moment you demand "ethical and moral responsibility", you lose all the creditability for such demand.

You can appeal for "ethical and moral help", but you cannot demand it. There is a difference between using angry and strong language for help, then using softer language for that. I bet the angry way Stubs talk always will make customer representatives, complaints units being no less angry as Stubs himself.

Being helped extra for ethical and moral reasons should be considered a favor, not a demand. May be if you talk to a CS in equal and calm manner is a better way, things will work out better. CSs should not be punching bag for angry people.

Edited, May 17th 2007 2:42pm by scchan
____________________________
Amanada (Cerberus-Retired) (aka MaiNoKen/Steven)
-- Thank you for the fun times in Vana'diel

Art for the sake of art itself is an idle sentence.
Art for the sake of truth, for the sake of what is
beautiful and good — that is the creed I seek.
- George Sand

A designer knows he has achieved perfection,
not when there is nothing left to add,
but when there is nothing left to take away.
- Antoine de Saint-Exupéry
#164 May 17 2007 at 10:39 AM Rating: Decent
***
1,806 posts
This same exact thing happened to one of my LS mates (Johnson - we're on Sylph server) and probably one of my best friends on the game. He'd just wrapped up CoP the week before and he'd been around roughly 4 years as well and accomplished a lot in that time. Apparently last weekend, half the server got spammed with /tells from him saying he was quitting and posted a link to some .zip file. Obviously it wasn't him.

He's dealt with S-E, pretty much same as you have, but he's about ready to give up, as he's constantly been told there's nothing they can do to reactivate an account that's been banned. Members of our linkshell have been calling up fairly regularly to see if anything can be done for him. He's a pretty well-liked guy with a good sense of humor but he's really upset with the way S-E is handling this.

Here's a snippet of webchat that he posted for us. 'None' is Johnson.

Quote:
GM Hermetica > well, Sir. If you believe your password was changed, then I advise you contact information center by phone to recover your account.
GM Hermetica > but from what I can see here, you have full access to your account.
GM Hermetica > because I am talking to you.
None > Recover my account?
None > It was hacked and my password was changed, but I got it changed back, so I should be able to do everything now.
GM Hermetica > I don't even believe your account was hacked.
GM Hermetica > how?
None > Keylogger.
GM Hermetica > who changed it back to you?
None > POL support.
GM Hermetica > did you call them?
None > I went on web chat.
GM Hermetica > when was that, Sir?
None > Not even fifteen minutes ago.
GM Hermetica > Ok.
None > So I'm sure if you contact them, they'll show you the chat log I had with playonline support about changing my
None > password.
GM Hermetica > This account was found in violation of FFXI policy by advertising RMT websites

Nice customer service, huh?

Edited, May 17th 2007 1:44pm by Dyterium
#165 May 17 2007 at 10:44 AM Rating: Excellent
*
84 posts
If S.E. holds current credit card information to be the trump card for character ownership, then it seems like they bear some responsibility to safeguard that information somehow. A previous poster's suggestion that previous credit card info be required to change the current credit card seems like a good start. If the person wants to change the c.c. number but for some reason doesn't have it on hand, then there should be a waiting period where the account is suspended for a few days to ensure that the request is legitimate.

Edited, May 17th 2007 2:45pm by GarudaEban
#166 May 17 2007 at 10:45 AM Rating: Decent
Scholar
****
6,631 posts
Quote:
He's dealt with S-E, pretty much same as you have, but he's about ready to give up, as he's constantly been told there's nothing they can do to reactivate an account that's been banned. Members of our linkshell have been calling up fairly regularly to see if anything can be done for him. He's a pretty well-liked guy with a good sense of humor but he's really upset with the way S-E is handling this.


I think there is an uncomplete story for that. Do you mean someone is claiming your friend is quiting and go check a website that has malware in it? Why would your friend be targeted for it? Just mere coincidence? Or indeed, someone may be abusing your friend account to begin with by hijacking your friend account and spread malware?

Quote:
Nice customer service, huh?


If indeed your friend account was hijacked, he had to at big chunk personal responsibiltty being hijacked. From a GM/STF POV, they can only see tells being sent in the game, but nothing else. There cannot proof who is controlling the account is your friend or not, but they do have evidence (chat log) that is beyond doubt that your friend account is used to spread malware/RMT info.

I will play devil advocate, if you cannot proof your friend account is being misused by another person, I cannot believe a single word you say. It only takes unbiased common sense and reasoning to see that.

Edited, May 17th 2007 2:51pm by scchan
____________________________
Amanada (Cerberus-Retired) (aka MaiNoKen/Steven)
-- Thank you for the fun times in Vana'diel

Art for the sake of art itself is an idle sentence.
Art for the sake of truth, for the sake of what is
beautiful and good — that is the creed I seek.
- George Sand

A designer knows he has achieved perfection,
not when there is nothing left to add,
but when there is nothing left to take away.
- Antoine de Saint-Exupéry
#167 May 17 2007 at 10:51 AM Rating: Decent
**
313 posts
RealGallow wrote:
If you don't have an anti-virus program how do you know you haven't gotten one?


The same way I have for the past 3 years. Scanning once every 6 months, setting up your PC properly (not using your admin acount for everything) and avoiding suspicious things on the internet.


As a bit of a derail, Vista is trying to move people more to the model of having a user account and an admin account. The current pop up warnings when you try to do anything is a temporary measure until software companies start writing their software properly (SE THAT MEANS YOU TOO!) I hate very much having run anything as admin. If you can't make it work with safe computing practices, such as limited user accounts, you need to go back and hit your programmers again untill they smarten up!
#168 May 17 2007 at 10:53 AM Rating: Default
scchan wrote:
Well... about "ethical and moral responsibility", the extent of that is somewhat vague and unclear. However, legal responsibility is concise and exact. If someone would not take responsibility of their own action, that someone can demand other to take extra responsibility to them? The moment you demand "ethical and moral responsibility", you lose all the creditability for such demand.

You can appeal for "ethical and moral help", but you cannot demand it. There is a difference between using angry and strong language for help, then using softer language for that. I bet the angry way Stubs talk always will make customer representatives, complaints units being no less angry as Stubs himself.

Being helped extra for ethical and moral reasons should be considered a favor, not a demand. May be if you talk to a CS in equal and calm manner is a better way, things will work out better. CSs should not be punching bag for angry people.

Edited, May 17th 2007 2:42pm by scchan


Not only are you obviously biased toward SE, you clearly haven't read the entire discussion, and therefore should refrain from adding your own 2 cents until you do so.
#169 May 17 2007 at 10:55 AM Rating: Good
***
1,015 posts
Quote:
If you can't make it work with safe computing practices, such as limited user accounts, you need to go back and hit your programmers again untill they smarten up!


So noted.

*grabs a bat and heads off towards Microsoft HQ*
#170 May 17 2007 at 10:55 AM Rating: Good
Scholar
****
6,631 posts
Quote:
Not only are you obviously biased toward SE, you clearly haven't read the entire discussion, and therefore should refrain from adding your own 2 cents until you do so.



If you would talk in a less angry and arrogant manner, your ideas will be clearer? Do you always have to talk angry to convince people you are right?
____________________________
Amanada (Cerberus-Retired) (aka MaiNoKen/Steven)
-- Thank you for the fun times in Vana'diel

Art for the sake of art itself is an idle sentence.
Art for the sake of truth, for the sake of what is
beautiful and good — that is the creed I seek.
- George Sand

A designer knows he has achieved perfection,
not when there is nothing left to add,
but when there is nothing left to take away.
- Antoine de Saint-Exupéry
#171 May 17 2007 at 10:55 AM Rating: Decent
***
3,261 posts
RealGallow wrote:
If you don't have an anti-virus program how do you know you haven't gotten one?


Because I know my computers, all 4 of them, inside and out. I do periodic scans for different types of viruses/keyloggers/spyware with some inexpensive, but efective scanning programs that I have, but no 'active' anti-virus programs.

I was wrong in saying that I've never had a virus though. About a year ago I did get a virus from downloading a program from an untrusted site. I should have known better, but thought, what are the odds, lol. Well apparantly pretty good. It installed a trojan, that kept prompting me to go to their website and buy this anti-virus program because it scanned my PC and listed a bunch of viruses. Some were bogus, and others were from this program itself. Well, obviously I didn't go to their site, but in my searches I found the necessary tools to remove it from my computer. Basically, I didn't go with my better judgement in that case, and I screwed myself. Was an easy fix though.
#172 May 17 2007 at 11:05 AM Rating: Default
scchan wrote:
Quote:
Not only are you obviously biased toward SE, you clearly haven't read the entire discussion, and therefore should refrain from adding your own 2 cents until you do so.



If you would talk in a less angry and arrogant manner, your ideas will be clearer? Do you always have to talk angry to convince people you are right?


Maybe you have a comprehension problem? I see no anger in my quoted statement. What I do see is someone who perceived it as such in order to fling insults rather than address the topic. Like I said.. why don't you read the whole discussion and then come back and post.

Edited, May 17th 2007 2:07pm by StubsOnAsura
#173 May 17 2007 at 11:07 AM Rating: Decent
**
313 posts
RealGallow wrote:
Quote:
If you can't make it work with safe computing practices, such as limited user accounts, you need to go back and hit your programmers again untill they smarten up!


So noted.

*grabs a bat and heads off towards Microsoft HQ*



As much as I hate to admit, they are at least taking steps in the right direction finally. Any straight out of the box MS apps do work with my limited user account, and that's just by making them only use the my documents folder, which is in the user's home directory, the only place a limited user can make any changes. The big trouble is all the damned holes people keep finding. Lord there is a lot of them. Of course there are a lot of people looking for them, as breaking MS stuff means more targets. :)

Then again, I'd like to see how apple or some flavour of linux would fare if they were the top dog. I wonder how many holes in them would be found. It would be interesting to see. My bet is they would be almost as bad as Windows, but we're not likely to see for a long time, if ever.
#174 May 17 2007 at 11:11 AM Rating: Default
**
313 posts
scchan wrote:
Quote:
Not only are you obviously biased toward SE, you clearly haven't read the entire discussion, and therefore should refrain from adding your own 2 cents until you do so.



If you would talk in a less angry and arrogant manner, your ideas will be clearer? Do you always have to talk angry to convince people you are right?


I'm with you scchan. As a bst, I'm ashamed to say I am of the same job as stubbs. I'd like to apologize for his asshattery on behalf of bsts everywhere.

Edited, May 17th 2007 3:14pm by alricflaim
#175 May 17 2007 at 11:15 AM Rating: Decent
***
3,261 posts
alricflaim wrote:
RealGallow wrote:
Quote:
If you can't make it work with safe computing practices, such as limited user accounts, you need to go back and hit your programmers again untill they smarten up!


So noted.

*grabs a bat and heads off towards Microsoft HQ*



As much as I hate to admit, they are at least taking steps in the right direction finally. Any straight out of the box MS apps do work with my limited user account, and that's just by making them only use the my documents folder, which is in the user's home directory, the only place a limited user can make any changes. The big trouble is all the damned holes people keep finding. Lord there is a lot of them. Of course there are a lot of people looking for them, as breaking MS stuff means more targets. :)

Then again, I'd like to see how apple or some flavour of linux would fare if they were the top dog. I wonder how many holes in them would be found. It would be interesting to see. My bet is they would be almost as bad as Windows, but we're not likely to see for a long time, if ever.


I don't know about that. I won't say that they are un-hackable, but I feel thay are a bit more secure. Also more stable. I hate Windows with a passion, always have, and now with Vista I'm just pissed that I'm going to have to learn that crap. We're already being flooded with calls at work here from Vista users having issues with our programs running properly for them. 90% of them are because they need to run the program as administrator to get them to work.
#176 May 17 2007 at 11:16 AM Rating: Default
alricflaim wrote:
scchan wrote:
Quote:
Not only are you obviously biased toward SE, you clearly haven't read the entire discussion, and therefore should refrain from adding your own 2 cents until you do so.



If you would talk in a less angry and arrogant manner, your ideas will be clearer? Do you always have to talk angry to convince people you are right?


I'm with you scchan. As a bst, I'm ashamed to say I am of the same job as stubbs. I'd like to apologize for his a[i][/i][u][/u]sshattery on behalf of bsts everywhere.


LOL you're one you talk... and being a beastmaster has absolutely squat to do with the discussion at hand, which I might add people are very good at derailing from.
Reply To Thread

Colors Smileys Quote OriginalQuote Checked Help

 

Recent Visitors: 68 All times are in CST
Anonymous Guests (68)