PSA: Real Money Traders and Account Security

INTRODUCTION

Hello all. This is a public service announcement from a professional IT technician, concerning the rampant rise of Real Money Traders (referred to hereafter as RMT) currently spamming shout channels and tell messaging players. The purpose of this post is to give you, the players, information on how you can help prevent your account from being hacked, exploited, or otherwise wrested from your control by malicious RMTs.



HOW IS THIS HAPPENING?

Account hacking or hijacking typically happens one of two ways in today's computing world: phishing, which is the act of stealing personal information such as passwords and username accounts through fraudulent websites; and password cracking, in which specialized programs are used to forcefully guess a password based on alphanumeric keyboard input. We will speak about the risks of both of these methods, as well as how to mitigate these risks.



PHISHING FOR DUMMIES

Phishing occurs usually through email, and sometimes through website impersonation. The general idea behind email phishing is to con a user into giving the scammer access to their username, password, secret questions and answers, and so forth. Usually, they'll include a message about how your account is at risk of being banned for malicious activity or deactivation due to inactivity, or some other story to get you to provide details.

Square Enix (or any legitimate company, for that matter) will NEVER ask you for your account details or tell you to use them in an email message. EVER. The only place you should ever supply your credentials is the site you created the account at. Do not click on links to get to the site; whenever possible, either type out the site address (being certain to check for typos, as many scam sites will use addresses similar to the original) or use a bookmark for the known-good address. Likewise, if you receive an email telling you there is a problem with your account, you may email the help desk. Include screenshots or the content of the email.

On the subject of fraudulent websites, many RMT sites can infect your computer with keyloggers and other potentially compromising badware through Javascript or Flash-based content without you ever realizing such things have been installed. If you use Firefox, I highly recommend downloading and learning to configure NoScript and Adblock Plus. NoScript prevents the display and execution of Javascript programming on webpages unless you tell the program to allow for that domain to display them. Adblock Plus does the same for Flash-based programming and banners. If you use Chrome, Adblock Plus is available for it as well, though you may need to find a substitute for NoScript. Knowing what websites are likely fraudulent is always the best security, but these browser add-ons can save your bacon if you make a mistake.



PASSWORD CRACKING

When choosing your password, you will often be told to use as complex a password as possible, such as including numbers or special symbols. This is terrible advice, as unless you have someone hovering over your shoulder as you input your password, guessing will not be your concern. The truth is that cracking programs take into account every possible character that can be used and input on a keyboard, so the complexity of a password is meaningless. In addition, complex passwords are difficult to remember and change, so you run the risk of having to reset your password more frequently.

In today's computing world, few malicious users bother with guessing passwords. Instead, they use what are known as "brute force methods" to attempt to run as many password possibilities as possible. Modern computers are capable of going through hundreds of password attempts a second, and the programs used to accomplish this are very easily found.

The best way to protect an account from a brute force method attack is to have a longer password. Every character added to the length of a password exponentially increases the amount of time a password cracker needs to come to the right answer. Passwords between 6 - 8 characters can take mere days to crack. A password of 20 characters? Months. Longer? Years. The password needn't be complex; a string of easy to remember words makes for a good password because it can be easily remembered, and the length of the password greatly reduces the risk of being cracked. A good example might be, "thisisthedaymotherwasbornjan31".

Remember, RMTs are looking for quick bucks; they won't hang around years trying to bust one or two account passwords. Longer passwords are good for personal security and as deterrents, and are much easier to memorize and change.



BUT THE SERVERS WON'T LET YOU REPEATEDLY SPAM PASSWORD ATTEMPTS!

The sad truth of the world of network security is this: There is no security that cannot be circumvented. If someone really wanted to get at your account, they eventually will if you ignore them. However, more than 99.9% of the time, this will not be the case, as hackers rarely want to wait to crack your account. They want instant gratification, the easy hack, the easy script. If you practice good security, use the tools available (such as the One-Time Passwords offered by Square Enix), and make sure to change your password regularly, you will likely never have to worry about being compromised.

Please, for your own good as well as this game's, practice good security. Thank you.



PASSWORD REPETITION

It has been brought to my attention by an attentive poster that one of the biggest dangers to account security is the repetition of passwords. In general, you do not want to use the same password for multiple accounts at multiple websites, emails, or any other place you might need one. The reason for this is simple; more often than not, when they gain access to your account via password cracking or through phishing, they also gain access to your contact details. Like your email. And should that be secured with the same password, they now have password reset access to most every other account tied to that email (security questions aside, but not every place uses those). Just like that, a swath of destruction and possible loss of money, the banning of multiple accounts, and the risk of exposing anyone you know to the same phishing schemes that originally targeted your account.

For this reason, it's important to not use the same password for all accounts and websites. Even though it can be difficult to track multiple passwords this way (my roommate uses multiple passwords and forgets them on a regular basis), there are ways you can aid yourself. Keep a list in your wallet without noting what each is for (just seeing a familiar password is often enough to jog memories). Make use of a password organizer program (personally not recommended due to centralization, but what can you do). This could lead to the difference between having one account compromised, and having all of them.


EDIT 9/07/2013: Added details on recommended browser add-ons and fraudulent websites.

EDIT 9/09/2013: Added details on password repetition, courtesy of Elcien.

Well said.

Thank you.

Great advice. Especially about the having long passwords. I used one of those crackers once (not to hack anyone! I had a RAR file with a password I couldn't remember) and I could only imagine how long it would take for that thing to go through a 15 character long password.

Nice post with some good info. Hopefully will help people make their accounts that much safer.

I just hope these guidelines will make it harder for RMTs to get a foothold.

Sadly people will still go and just take a peek at a gil seller site, thats also a super easy way to get ur computer infected with keyloggers thanks to flash/java codes.

This is true, it's super important to practice good security when browsing the web. I recommend add-ons like NoScript and Adblock Plus. NoScript blocks Javascript functions unless you trust and allow the web page, and Adblock prevents Flash-based content from the same. Between these and an up-to-date antivirus, you'll be pretty well protected.

Bumping to keep information available.

Quote:

---

Originally Posted by Endy

HOW IS THIS HAPPENING?

Account hacking or hijacking typically happens one of two ways in today's computing world: phishing, which is the act of stealing personal information such as passwords and username accounts through fraudulent websites; and password cracking, in which specialized programs are used to forcefully guess a password based on alphanumeric keyboard input. We will speak about the risks of both of these methods, as well as how to mitigate these risks.

---

Which makes me wonder why on Earth they've forced us to use our in-game characters on the forums, where our name, server and other information is phishable.... I don't use the word 'derp' often, but really?

Quote:

---

Originally Posted by Endy

The sad truth of the world of network security is this: There is no security that cannot be circumvented. If someone really wanted to get at your account, they eventually will if you ignore them. However, more than 99.9% of the time, this will not be the case, as hackers rarely want to wait to crack your account. They want instant gratification, the easy hack, the easy script. If you practice good security, use the tools available (such as the One-Time Passwords offered by Square Enix), and make sure to change your password regularly, you will likely never have to worry about being compromised.

---

This is, with all due respect, contradictory. Time is extremely relevant if there's a limited amount of password attempts allowed in one 'session.' Individuals breaking and hacking accounts for the impersonal (key word here) purpose of RMT and monetary gains, are not going to as you say - wait to crack your account. Square and other companies know this, which is why login attempts have limits.

It's also why the saying 'no system is impenetrable' is a bit out-dated and archaic because in the terms and scenarios you're describing, brute force methods ARE dated and easily managed/blocked by a transcending watch dog system. The only way to disable that system would be to physically do it in real life. We're getting into the realms of phreaking and the only relationship these 'hackers' you talk about have with phreaking, is by knowing someone who works for a company whom then leaks information - the SOE 'hack' of last year comes to mind as a perfect example.

The point was most things are an inside job, and no amount of complex or lengthy password will make a difference.

Quote:

---

Originally Posted by Ormathon

Sadly people will still go and just take a peek at a gil seller site, thats also a super easy way to get ur computer infected with keyloggers thanks to flash/java codes.

---

Modern iterations of web browsers have inherent OCX controls and blocks built-in for this purpose. Additionally (usefulness debates aside), a lot of people use hoggy AI suites which monitor everything pulled down over your network - so unless these loggers are bypassing the up to date definitions, then they are a moot point.
I haven't seen a successful backdoor trojan or keylogger come across anything but an email where an unsuspecting person downloaded and RAN the program locally.

This should be stickied so it can stay on the front page!! Some really good advice :)

Ranebow, you make a lot of assumptions in your arguments. It is true that social engineering attacks are always a risk, but given the standards applied to gold farming in general, it has a miniscule chance to be involved here. If it was an inside job, it would be true that no amount of caution on our part would solve the problem, but as not every account has been cleaned out on a given server, this is obviously not the case. Unfortunately, as the processing power of the common PC rises, so too does the ability to brute force. Studies in the IT industry have shown that a large percentage of compromised information outside of user error is caused by brute force methods, and the number has been on the rise since the early 2000's. I don't have a link handy, but I encourage you and all others who are curious to do research on the subject.

Also, 'modern' iterations of browsers update almost as often as antivirus suites to plug holes and bugs in the programs, as do operating system updates. If such methods as described are too dated to work or moot, this would not be necessary. However, the fact that these issues need to be fixed is proof enough that security can be circumvented, and it does indeed happen all the time. Security is not something you slap on and be done with; any IT professional will tell you the same thing. Please try not to spread misinformation by drawing only on your own experiences as a source. The fact is, nothing you do will ever completely secure you against all attacks. However, layering security provides deterrents which are effective against all but the most dedicated attackers, and they have much bigger targets than you or I.

Just as well, my topic is about what the user can do in regards to the specific problems that are likely in play as far as people's accounts being compromised. It may well be a social engineering scheme, unlikely as it may be, but that's out of the general user's hands.

Bumping to keep information on frontpage.

Being in network security as a profession, I disagree strongly about complex passwords being pointless. Yes, cracking tools will consider every string but if your using a 64 bit or 128bit complex password then this would take a lot of time and a lot of effort to break. The sad fact is that the vast majority of security breaches are caused by people using the same password for every single online service... Not to mention the potential for Squares servers to be insecure themselves (think back to the psn hack a year or so ago and that fact that all passwords were stored in an insecure unencrypted database...

Solution: Download a soft token or buy one of Squares own.

People reusing passwords is indeed a problem and should be addressed in the post. I will add that at the first opportunity.

However, there is still no real point to complex passwords because the number of possible combinations remains the same regardless. Using encrypted ciphers is not something in the standard user's control and is dependent upon where you're putting in your password as far as the context of the post is concerned, so such was omitted. As is the idea of an internal breach causing a security concern. This post provides information on what the USER can do, in the context of Final Fantasy XIV. Please do not post misleading or out of context scenarios.

As well, the vast majority of repeated passwords found in multiple security studies were simple strings of letters and numbers, often eight characters or less. You can be certain that attackers will know that, especially those whose jobs it is to profit from bad security (such as RMTs), and it's a simple matter to set priority scripts in crack attempts.

Quote:

---

Originally Posted by Jessikia

This should be stickied so it can stay on the front page!! Some really good advice :)

---

It's the same advice every MMO forum contains, it's nothing new, no one should have learned anything from it.

There is always someone new who hasn't been told or seen such guidelines. If you've seen it before and have nothing to learn, please move on.

Bumping to keep active.

Bumping to keep active.

Bumping to keep active.

dude.. your not helping. You keep bumping something as if SE is clueless here and has not done a good enough job in the past or now and needs a "professional IT technician". Sorry but you are wrong on some things. Cracking passwords 8-35 and so on with the right tools can take a day or less. This is if they want in, you clearly never hung around, did any kind of hacking or studied very hard on this but copy and paste. Most gold sellers are not just waiting for someone to come to their site so they can then script or hack or download blah blah. That is a billion dollar biz. Its opening emails from some so called mmo telling you your account has been hacked and ask you to CLICK THE LINK is one simple way.

Anyway

Please refrain from stating falsehoods about security. This post exists for the sole purpose of describing what the user can do on their end to protect their accounts to the best of their ability and does not concern itself with Square Enix's own security, as that is beyond the user's ability to influence.

If you cannot read, then I'm afraid no one will take your claims seriously. Please move on.

Also avoid any dictionary word for your password. If it's a simple word, it can be 30 characters long but it will be easy to figure out. Crackers have a list of common words/dictionaries.
Always try to mix multiple words, acronyms, alternate case and put some numbers and symbols in there too if possible. The more complexity you add to it the harder it will be to crack.

These are good points but I would also like to bring up some important points you missed when it comes to online gaming.

SE does address this the same way Origin does with SWTOR, and Blizzard with WoW. Security tokens. You can purchase a physical token or use the Android or Apple software version. So there is FREE protection out there to deter the would be "Hacker"

If you pay attention to the spam in game, most RMT advertise power leveling as well. Certain individuals want to be cap and in the best gear without actually doing anything, so they are enticed by this. Why? /shrug. They give away their information and actually PAY for it.

Keep in mind these RMT are in business because there are a lot of lazy people out there. So yes they can hack, but why bother when people are giving it to them? Also, what is the big deal of having your character name , server and lvl in these forums. Who cares, all the other MMO's do the same sheesh. I mean if you go buy services from RMT, You're giving it to them anyway.

I work in computer security myself. So you received an email supposedly from SE or any other game you play, but it was actually a fake? Again 13 years gaming, only emails I get, come from the actual company. So if you are getting emails, its either a giant coincidence, or you're being tracked. Check you security and cover yourself.

Another thing, people who played previously as well as new players. I imagine that some V1 players sold off there accounts, if they haven't played or had interest, how were they hacked? No they sold them, I would bet money on it.

New players distraught over issues, scramble to get ahead after missing 2 days of play time, have to get ahead, have to buy my fun and adventure in a new game...........

If you visit an RMT site, well........... Hate to say it, you made your bed.

I've been playing MMO's for 12 years, I've been "hacked" one time. My ex apparently sold his account to some site and they gathered all information from his computer and got mine. BUT since then I've had security tokens on everything I play and have had no problems since I don't buy or trade with these people.

Remember, SE has a task force dedicated to all this. They have always been hard on those who don't play buy the rules. As of the 6th, 518 accounts Banned. Also remember, if you are buying services you're as guilty as the RMT. Remember the selling OR buying of SE virtual property is against their user agreement. So buyers face the same punishments.

Keep away from the sites, download and use the security token or buy the physical token. You will be safe.

Quote:

---

Originally Posted by ZohnoReecho

Also avoid any dictionary word for your password. If it's a simple word, it can be 30 characters long but it will be easy to figure out. Crackers have a list of common words/dictionaries.
Always try to mix multiple words, acronyms, alternate case and put some numbers and symbols in there too if possible. The more complexity you add to it the harder it will be to crack.

---

This was for the most part true, though terribly dated. In reality the online standard is to use complex passwords and we are told most everywhere we make a password to do so. Most crackers therefore do not actually use dictionary attacks anymore, and due to the way dictionary lists are formatted, stringing words without spaces is all the complexity one would need until the base programming of cracking software changes across the board. Also, complex passwords offer no additional security against the more common brute force techniques used today.

Quote:

---

Originally Posted by Deadra

I work in computer security myself. So you received an email supposedly from SE or any other game you play, but it was actually a fake? Again 13 years gaming, only emails I get, come from the actual company. So if you are getting emails, its either a giant coincidence, or you're being tracked. Check you security and cover yourself.

---

Being completely honest, I too work in the security industry. However, I also play many games and am careful with where and how I supply information, and yet (despite never actually having one) still get the occasional email about my non-existent Battle.net account. Yes, we must practice security, but we must also be aware that sometimes breaches of our information can occur outside of our control (as was the case with the Sony hacks mentioned in previous posts). One can be perfect about their security and still be vulnerable due to blind luck, so layering defenses as you've said is always the best plan.

Either way, whether an expert or not it is best we not speak as though we know for a certainty that certain things happen or don't happen, as such a view easily leads into arrogance and complacency.