Beware of Suddenly Missing FC Members...

Character hijacking is still a thing.

A few days ago, our FC's resident tank/healer, who'd been in since Beta, with the FC since its inception, and is currently on hiatus awaiting EA, logged on, quit the FC, and disappeared. He was later found (using the Lodestone), renamed, on another server, in an FC with three clones of the same character and two more who were probably stolen (the clones all low-level- including the FC leader, and the others were max level/gear, with matching names).

I placed a "missing character" report with Support, but now dread telling him when he logs on that his character's gone, probably for good. Whether he'll fight it remains to be seen. It's happened to someone in our FC before, and it took her months to get her character back.

So consider this a reminder to use common sense. Change passwords regularly. Don't share passwords with ANYONE. EVER. Use a security token if you can. And keep your security question up-to-date.

Stay vigilant. Stay safe.

yikes, thats why i never ever play without a Security Token

tell them to get more accuracy. oh

Quote:

---

Originally Posted by Dree-Elle

So consider this a reminder to use common sense. Change passwords regularly. Don't share passwords with ANYONE. EVER. Use a security token if you can. And keep your security question up-to-date.

Stay vigilant. Stay safe.

---

If it's a logger no password will stop them. maybe they used the same password for a fan site etc... A token will however stop that but you have bigger issues if someone can access your account.

It's possible to get hacked using a token (happened once in FFXI) using a very sophisticated injection virus that hooks into your launcher, steals your username and one time password the second you enter it but without sending the information to SE, and then crashing your client permanently. Any good virus detection program will detect such a virus the second you launch the client - BUT a sketchy illegal third party program also has to do the same thing. The XI account hacks were believed to be the result of an infection after visiting a bot site, then later on unfortunately the legit website Vana'diel Atlas. Moral of the story: use the token, use good antivirus software (even Microsoft's free one is better than nothing), and don't trust third party illegal things.

You'd think this'd all be common sense. There was a recent thread that, I kid you not, had the originator complaining about having to change their password whenever they played from different networks (you know, Square's attempt at helping keep player accounts secure) only to complain about how much of a 'hassle' a token would be. I don't know about some people...

ILLUMINATI NOT CONFIRMED

Quote:

---

Originally Posted by Kettle

tell them to get more accuracy. oh

---

I laughed way harder than I should have. Thanks for the levity while I ponder what to do next.

however, you can reset the password by resetting the token. Say you enter the token and it crashes, you just hit the back button the token (cell phone) or the red button the SE provided token to reset the pass

They must of used the same password for their email, because when my IP changes it locks me out of log in until i reset my password, so that then leads me to think he has a logger or virus on his system.

Or they're lying to you.

Some people sell their accounts when they quit. Happens all the time.

(Not saying that's what this person did of course but) This is a good reason not to visit RMT sites over curiosity- I know a few players who looked at a site for that reason alone though they'd never actually be a customer. And lately there were warnings about malware on these sites. The owners of these sites would have a very high interest in installing keystroke loggers to capture the passwords of people who visited them even once, because those are the people who have accounts to steal in the first place. What's surprising is that they'd pay for a server transfer- they'd only do that if the profit they stood to gain was more than the transfer cost, and you're looking at $20 for just one account that could get banned faster than the bots they create themselves. I'm guessing perhaps the player had enough gil and other resources valued in excess of the cost of the transfer, and that it was transferred through their own network of bots as soon as the character landed on the other server.

I guess at least we now know how some of them are planning on getting to Ishgard- why level the characters and run through the MSQ fetch quests yourself when someone else could do it for you.

Quote:

---

Originally Posted by Kyomagi

however, you can reset the password by resetting the token. Say you enter the token and it crashes, you just hit the back button the token (cell phone) or the red button the SE provided token to reset the pass

---

The token isn't exactly wifi enabled or anything. It just generates a number using an algorithm. The number it generates is actually good for a 27 minute window (or it was in FFXI) - but it can only be used once. Generating a new token number doesn't automatically invalidate the old number, only using it does. That's why they crashed the client and then disabled your ability to open it again with the injection virus. If you tried to log in using a newly generated number, it'd kill the one they captured. But if they broken your client after stealing it, they had time at their leisure to log into your account and steal all your stuff.

If they really wanted to keep people's accounts safe, they would implement a similar system like Rift.

If you log in from a different Ip, your account gets coin locked. Meaning you can't do any trades, buying/selling etc or delete a character until you unlock it. Of course this isn't fool proof either if you use the same email password everywhere but there is only so much one can do to protect people from their own stupidity.

Quote:

---

Originally Posted by Chessala

If they really wanted to keep people's accounts safe, they would implement a similar system like Rift.

If you log in from a different Ip, your account gets coin locked. Meaning you can't do any trades, buying/selling etc or delete a character until you unlock it. Of course this isn't fool proof either if you use the same email password everywhere but there is only so much one can do to protect people from their own stupidity.

---

You already get your account locked when trying to login from another IP address (unless you have a token, in which case this never happens) and asked to change password via a link sent to your email. Of course, if they know your email address and its password, you're sol.

Quote:

---

Originally Posted by Catwho

The token isn't exactly wifi enabled or anything. It just generates a number using an algorithm. The number it generates is actually good for a 27 minute window (or it was in FFXI) - but it can only be used once. Generating a new token number doesn't automatically invalidate the old number, only using it does. That's why they crashed the client and then disabled your ability to open it again with the injection virus. If you tried to log in using a newly generated number, it'd kill the one they captured. But if they broken your client after stealing it, they had time at their leisure to log into your account and steal all your stuff.

---

Seems like there would be a number of ways around this. 1. If you have the game installed on more than one machine, you could just log on using the non-infected machine. 2. You could log out of the forums and log back in, using a new password in the process.

Now I totally want Hildibrand to investigate a kidnapping case. Dozens of adventurers missing. Can lvl 60 Alchemists brew chloroform?

Quote:

---

Originally Posted by Amelia_Pond_Behemoth

Seems like there would be a number of ways around this. 1. If you have the game installed on more than one machine, you could just log on using the non-infected machine. 2. You could log out of the forums and log back in, using a new password in the process.

---

The RMT monitoring these hacks moved fast - people didn't have enough time to find another machine that wasn't infected before their accounts got cleaned out. XIV doesn't let you log in as long as someone else is logged in already, I don't think. (XI booted the original person off at least.) Logging into the forums won't stop someone who has already logged into the game.

Just keep your virus scanner up to date, though, and any AV software worth its salt will catch an injection virus the second you launch the game (before entering the passwords) and quarantine it and give you a warning about it.

this has always been a good guide for me. most hackers...if they are using ways other than phishing, have to rely on a brute force method.

https://imgs.xkcd.com/comics/password_strength.png

this makes it as long as possible.

Quote:

---

Originally Posted by Gilraen

You'd think this'd all be common sense. There was a recent thread that, I kid you not, had the originator complaining about having to change their password whenever they played from different networks (you know, Square's attempt at helping keep player accounts secure) only to complain about how much of a 'hassle' a token would be. I don't know about some people...

---

It's already hard enough to get people to use their seat belt or a condom, dear god they actually maintain a decent grasp on the security of an internet account.