So I was hacked... my observation so far and tip.

Let this be a lesson, I recommend everyone use an Authenticator... because no matter how secure you think you are, there is a high chance it will happen to you.

Hear me out.

I'm very computer savvy, I've been working with computers for 15 years and I know them inside-out. I have built over 100+ computers, I have done networking for 11 years and coding for 4.


My PC? very very secure
My login details? very unique and hasn't been used anywhere else, not on any forums, any games, nothing.

So I'm at work and my girlfriend calls me...

Her: "dude you're online"
Me: "what? I'm at work..."
her: "you're in Gridania... let me see what's going on"
her: "wow you're spamming for gil sales"
me: "wtf.... how could this even happen? let me enable the token, it should boot him off"
her: "yup, you're logged off now"

So i change my password and now this "hacker" can't log into my account because I am secure via password token.

What did I do in the past few days? I'm a PC user but recently purchased the PS3 version and linked it to my PC account so I can play on both machines, that's the ONLY thing I have done recently. I haven't visit any dodgy websites, haven't installed any software or run into any problems with my PC...and my guess would be that these "hackers" somehow got my account via PSN, because we all know how useless PSN is with security.

My question to Square is... who's to blame here? PSN? You? Me?

I have emailed Square but my ticket isn't showing up on the support-page, I'm hoping they still received it.

Is there counter-measures for this stuff? I'm assuming hundreds of people have black-listed me now :\ will there be a black-list wipe so all those people that were hacked aren't on ignore by half the server?

tldr: get an authenticator, don't be foolish.

Two things:

1) If you have a really secure password (numbers, upper case, lowercase, *and* special characters, no common words, more characters the better) the chances of you getting hacked are incredibly small. Like incredibly small.

2) If you have a strong password but link your login details to other networks, that is where the trouble is.

PSN has known security issues. There was a huge crisis a few years ago when it got hacked and everyone's credit card details were at risk. The only counter-measure is to use a strong password and thats it. I even think getting a security token is risky, which is why I wont buy one. The only database/network that should have my account information is this one. I refuse to put it anywhere else, as I am at the mercy of that network's security.

I'm surprised they didn't change your password when they hack your account, usually it is the 1st thing they do when they got access to your Account. I guess you got lucky this time they didn't do that and you have enough time to add in a Security Token.

I'm also surprised how they can just pull randomly username and unique password out of thin air. They may have a hacking software, but they have to start somewhere and know some hint and which one to target.

you should also check your email password aswell. they could have just requested it and delete the email. happened to me in WoW where I went back and forth with someone who found out my email password, and would keep sending the request emails. i ended up winning the battle, with all my bags stacked with titanium ore and around 50 K gold in my purse.

I got an authenticator for D3... I was hacked 15 mins later.

Lucky for me... D3 is a horrible game and I didn't really care.

Hoping the FF one works a lot better.

Sad to hear this.
And if they steal your game account it doesn't mean they can reset your password since they don't have access to your email account too :).
Unless they stole access to that too, which they don't seem to have.

I installed the security token in my smartphone. It's free, secure and easy to use. I have no regrets on my decision.

This is why I'm very puzzled..

secure pc (that i'm 110% sure of)
unique login details, never used before
no web browsing to dodgy areas

I really hope Square-Enix reset the black list for me... otherwise I am very screwed.

I had my old 1.0 account stolen, I've been with it at arms with SE for about a month now, I have to have it notarized but being disabled it's simply not plausible. As i'd have to be there in person! It's stupid. I've given them more than enough information to recover it but with out that notarization they won't do shit. I would have subbed both but hey, if they want to loose money than so be it!

Quote:

---

Originally Posted by Rekujen

unique login details, never used before

---

It cant just be unique, it has to be strong. If its not strong, you should make it strong. I mean like airtight government-level security strong.

Quote:

---

Originally Posted by Cyrus-Wallace

I installed the security token in my smartphone. It's free, secure and easy to use. I have no regrets on my decision.

---

I think the app is free but the token service cost money is it?

do they have a physical key chain type authenticatior I can get? I don't like the idea of having my code bound to a device designed to implode after a certain amount of time. Knowing SE, should I ever have to factory reset my phone or replace it, or god forbid upgrade it, they'd probably want my birth cert and social and first born son to get my account operational again, lol. So I wanna avoid the cell phone method at all costs with this company. (Blizzards good about it, but SE is just so garbage in the support department)

Quote:

---

Originally Posted by Treble

do they have a physical key chain type authenticatior I can get? I don't like the idea of having my code bound to a device designed to implode after a certain amount of time. Knowing SE, should I ever have to factory reset my phone or replace it, or god forbid upgrade it, they'd probably want my birth cert and social and first born son to get my account operational again, lol. So I wanna avoid the cell phone method at all costs with this company. (Blizzards good about it, but SE is just so garbage in the support department)

---

They do yeah, you can get it through the mogstation or square store.

In a bad mood this evening. Just ordered a token.

Quote:

---

Originally Posted by Treble

do they have a physical key chain type authenticatior I can get? I don't like the idea of having my code bound to a device designed to implode after a certain amount of time. Knowing SE, should I ever have to factory reset my phone or replace it, or god forbid upgrade it, they'd probably want my birth cert and social and first born son to get my account operational again, lol. So I wanna avoid the cell phone method at all costs with this company. (Blizzards good about it, but SE is just so garbage in the support department)

---

Right at the login screen is a warning about account security. If you click on it you'll see a link to both the software token and the physical token.

http://www.square-enix.com/na/account/otp/

Quote:

---

Originally Posted by 10TailBeast

Why should I reward SE buy paying them $10 more for a device because their security is shit?

---

you can't be serious

I'm not blaming square for this, I should have enabled auth on day 1...

I'm just really puzzled.

My account was hacked today and I found out that there is a bot on my account in the Adamantoise server. How do i use the security token to boot them off?

How do you have the slightest idea how hard or not hard is it for hackers who are writing their own Phishing programs and implementing them over the web can get someone's PW? Do you write all the phishing programs and sell them to hackers? DO you know for a fact that there program they designed or are running cant get someone's PW even if its the most unique thing in the world?

Why do so many people spout off like they know everything?

Here's a fyi for you. If a hacker wanted to hack the most secure nuclear programs in the world they can. Someone's PW on FF 14 or wow or whatever it is can be hacked at any time.

Quote:

---

Originally Posted by Ershnill

My account was hacked today and I found out that there is a bot on my account in the Adamantoise server. How do i use the security token to boot them off?

---

register it with your account, it will boot them off after 5 mins of confirmation.

Quote:

---

Originally Posted by DiceMan

Here's a fyi for you. If a hacker wanted to hack the most secure nuclear programs in the world they can. Someone's PW on FF 14 or wow or whatever it is can be hacked at any time.

---

A real hacker wouldn't waste his time trying to hijack a random guy's videogame account for no reason.

Also, cool story. Needs more aliens, but cool story.

Quote:

---

Originally Posted by Rekujen

register it with your account, it will boot them off after 5 mins of confirmation.

---

I've done the entire process that I am aware of for the Token and it's been way passed the 5 minute mark. They are still logged in the game.

I thought with no authenticator if you log in from a different IP you are forced to change your password? Happened to a friend of mine who logged in from work then from home later int he day.

And if your going to ask why didn't he have an authenticator... SE does not allow you to add one on accounts in trial or beta.

I was under the impression if someone tried to login to your account from a different IP address then it would send you an email to confirm the login before you could actually login? Is this not the case anymore as you had to do something like that in 1.0

Quote:

---

Originally Posted by Lux_Rayna

It cant just be unique, it has to be strong. If its not strong, you should make it strong. I mean like airtight government-level security strong.

---

The standard password strength requirements for an NSA employee are:
Must contain at least two upper-case letters, two lower-case letters, two numbers, two symbols, and be at least 11 characters in length.
Must be changed every six weeks.
Cannot be the same as any of the ten previous passwords.
No names or dictionary words.
Cannot repeat any character more than two times in a row.

I feel like I'm forgetting one and it might be 13 character length. Anyway if you follow those rules you'll be pretty good. Although logging on will be a huge pain the butt. The worst part for me was always needing to change my password as soon as I started to remember it.

A strong password is only the start of keeping a secure account.

• Get yourself an authenticator. The phone app is absolutely free, and if you don't have a phone then buy the physical one. You're going to be wishing you spent that $10 if end up hacked one day.
• Don't use your account ID and password on another site or game. You don't know the security of those sites and if some FF14 forum gets hacked, you can bet they'll be trying every username and password on the game.
• Keep your computer up to date. Anti-virus, firewall, anti-malware, windows update, java, browser, etc. Vulnerabilities are found all the time, so make sure you always have the latest updates to prevent them.
• Don't share your account information. You may trust this person, however, do you know if their computer is secure? They might have a keylogger and the moment they log into your account, they've just given your account away.

Quote:

---

Originally Posted by AlexiaKidd

I was under the impression if someone tried to login to your account from a different IP address then it would send you an email to confirm the login before you could actually login? Is this not the case anymore as you had to do something like that in 1.0

---

No email, nothing... I was lucky my girlfriend was online when he logged on and she called me straight away.

-

Also, I submit a ticket to Square but it's not showing on the square-support page... there's no ticket history either, does any1 know anything about this?

All these hackings..Sounds like an inside job. Or someone having knowledge of the inner server workings.

Good luck to capcom's Monster Hunter Online.

Quote:

---

Originally Posted by Rekujen

No email, nothing... I was lucky my girlfriend was online when he logged on and she called me straight away.

-

Also, I submit a ticket to Square but it's not showing on the square-support page... there's no ticket history either, does any1 know anything about this?

---

I'm sure my friend who moved house had trouble logging in because he had moved house and it wouldn't let him unless he did the password reset through email. I'm just bringing it up as if they do still do this then that must mean they have access to your email too.

Quote:

---

Originally Posted by DiceMan

Here's a fyi for you. If a hacker wanted to hack the most secure nuclear programs in the world they can. Someone's PW on FF 14 or wow or whatever it is can be hacked at any time.

---

Your FF14 account isn't a government agency, or a nuclear weapons facility - you don't have Mossad or the CIA or some black hat hacker collective trying to steal your gil. It'll be a low budget quasi-illegal RMT organisation using a simply dragnet of techniques - phishing e-mails, trojans, dictionary attacks - and seeing what bites.

Your reasoning is akin to saying that a grocery store robbery might be conducted with a nuclear bomb; afterall such devices exist. But the reality is that organisations who own nuclear weapons usually have bigger plans than holding up a grocery store...

Quote:

---

Originally Posted by RyuujinZERO

Your FF14 account isn't a government agency, or a nuclear weapons facility - you don't have Mossad or the CIA or some black hat hacker collective trying to steal your gil. It'll be a low budget quasi-illegal RMT organisation using a simply dragnet of techniques - phishing e-mails, trojans, dictionary attacks - and seeing what bites.

Your reasoning is akin to saying that a grocery store robbery might be conducted with a nuclear bomb; afterall such devices exist. But the reality is that organisations who own nuclear weapons usually have bigger plans than holding up a grocery store...

---

Who knows, he maybe has like 1,000,000,000,000,000,000,000,000,000,000,000,000k gil on his account... That is alot of IRL money and I would not like to lose those... :cool:

Quote:

---

Originally Posted by Arcaloid

I think the app is free but the token service cost money is it?

---

Nope, it's all free! You download it, register it and you can use it! =) It doesn't take much time and it will keep your account safe. And for the people without smartphones, you can download Bluestacks to your computer, download the APP from there and use it the same way.

I just wan't to know why the e-mail I sent to Square-Enix Support isn't showing up in the support page.. there's no ticket history.

I'm really sorry to hear you had to pass through this. Your story seems possible, something similar happened to me back in FFXI with the difference that I was online at the moment I got hacked. I was at Sea Serpent Grotto hunting the NM for Joyeuse and all of a sudden I got disconnected. I was in a party with a friend and he sent me a message through MSN asking me why I disband the party and warp out. I told him that I just got disconnected and I couldnt get back online. He contact a GM and my account got blocked until the investigation protocol.

Back then I had to make some phone calls to the support center, sign some papers and proof that the account was mine. It took a while but I got my account back and rolled backed since they took my items and my money. After that I bought a security token and never again got hack. I still use that same token :) So good Luck with your case and hopefully you get your account back the way it was.

Another approach would be to use a different email/account name for each service. That would throw hackers off strongly.. even if they have your password, they're not going to try every password they have with every email/username they have. If your username is different its quite useless to them even if they have your password.

Quote:

---

1) If you have a really secure password (numbers, upper case, lowercase, *and* special characters, no common words, more characters the better) the chances of you getting hacked are incredibly small. Like incredibly small.

---

Unless you're using special characters that you have to paste in, no normal password is safe against a key / click logger. The authenticators work in this case as long as you log in right away, because once you log in, that password no longer works and is useless to the person tracking you.

Authenticators are not 100% bulletproof, but they drastically improve security, especially for users who are less secure in other areas.

What options are there for getting an authenticator? (win7 user here)

Quote:

---

Originally Posted by Cyrus-Wallace

Nope, it's all free! You download it, register it and you can use it! =) It doesn't take much time and it will keep your account safe. And for the people without smartphones, you can download Bluestacks to your computer, download the APP from there and use it the same way.

---

Good to know! I must have mixed up the 'Security Token' and 'Software Token' on their description site. Registered and hope my account won't be hacked in a month again like what happened to me on D3 >.<

Quote:

---

Originally Posted by gigi_frana

What options are there for getting an authenticator? (win7 user here)

---

Order physical token via SQEX account management (costs money) or download the smartphone app (free). The app can be a bit more of a hassle if you need to upgrade your phone or reset/wipe it, but it's free. The token is probably slightly more secure overall but either one will vastly improve security.