The Hacker and You: How gilsellers steal your account and advertise in your name.

This afternoon, I logged in to my inn room at The Drowning Wench. All was quiet. I called for my retainer to check my sales, then geared up and ventured out into the world. Immediately, I was hit by a blast of URLs comprised of a swath of irregular unicode replacement characters and the promise of hundreds of thousands of gil in exchange for a few real-world US Dollars. It was happening approximately 1.3 times per second, which meant that anything I tried to say or my friends tried to tell me would be instantly swallowed up. In a haste, I opened my blacklist to add the spammer, and then opened my report window.

A few minutes later, wandering idly around and wondering just how Square-Enix could possibly let this continue, I found her. A level 50 monk, dressed in Foestriker gear, mouth working - silently, as I'd just blacklisted her - and eyes staring, lifeless as the snows of Coerthas. Tuiyani Kusaragi was her name. It was not a string of random characters like RMT are wont to pick. It was not even a name randomly generated at the character selection screen. It was a name deliberated upon by a human being, particularly for the purpose of sounding Japanese-esque, but no less weightily considered. And it was stolen by a dirty gilselling scumbag, forcing their own words into her mouth.

How did this happen? Are hackers somehow magically able to force their way into your accounts? In all likelihood, no. Not only is this sort of tragedy entirely preventable, it's also pretty damn easy, too.

SO:

How do they do it?
People who want accounts - any accounts - do not specifically hack their way in. The effort involved makes this practice unfeasible for anything but personal reasons. Gilselling is a business; they seek to maximize profit and minimize effort. There are two main ways they gain access to your account:
1. They trick you into giving them your password. You might be a customer for their very own RMT services, or you might have registered for one of their fake FFXIV fansites - believe it or not, these are myriad - one way or another, you may have given them your password without even realizing it.
2. They've stolen it from somewhere else. Players who use the same password for many and multiple games are especially at risk - slight variations of the same password only slightly less so. Almost any game community you've ever joined might be a security risk for your one password. Once hacked into, the data extracted does not simply disappear; it is cracked. It is deciphered. It is sold, and it is bought.

What can you do?
Simple enough. Change your password. Not just for Final Fantasy XIV, but for your e-mail account as well. Use a good password. This stops almost all so-called 'hackers' in their tracks. They see that your old username and password didn't work, and move on down their list.

What can Square Enix do?
Also simple: attack the problem at the source.

Today, I read a rather inspiring article about how ArenaNet implemented a mandatory password change. They took a database of every password previously attempted, combined with the most common passwords, and prohibited players from using them. According to hearsay, the rate of hacking dropped to 0.01% and has been further dwindling ever since.

SEGA of Japan has implemented at least one 'change your password' campaign, and rewarded players who changed their SEGA ID password with prizes in Phantasy Star Online 2. Nexon has done several.

I'm not calling people who get hacked out for using gilselling services, or even for not changing their password, but if you're using a recycled password (or perchance haven't changed your password since last you bought gil):

You.
Are.
At.
Risk.

Quote:

---

Originally Posted by Smoey

I like how some mmorpgs use coin lock on your account if you log in from another location. Why not just lock your account (bags, messages, shouting etc..) until you verify your location. Takes 2 minutes.

---

Because what is most often hacked is not your account, at least not directly. This feature is already implemented in Final Fantasy XIV, and is also easily circumvented if the account data stolen or otherwise obtained includes an e-mail address. If you've used the same password for the game and your e-mail, it's game over.

Quote:

---

Originally Posted by Neptune

I have had my account targeted for "suspicious activity" multiple times since release. Every time I change my password and every time it is targeted again for "suspicious activity" and disabled out of precaution by SE. I believe that due to my security token they only hit the maximum allowable attempts before my account was locked out.

And if that's true.. it means it's SE itself that is getting hacked or exploited and not necessarily the users. Sure keyloggers may be one avenue but how does that explain what's happening to me? I've clean installed since 1.0 and I haven't been to any fansites or downloaded any ARR related apps at all. I don't see how I could have a keylogger unless it shipped with the installer itself or the benchmark. Which, for all any of us know, may have been compromised on SE's servers a long time ago.

---

I'm fairly certain that either you have a keylogger or your e-mail is compromised. I don't believe SE would allow anything on their servers without an MD5 hash, which is a code generated to identify a file - if it has been altered, the MD5 changes.

Quote:

---

Originally Posted by Livilda

lifeless as the snows of Coerthas.

---

OBJECTION
The snows of Coerthas are quite alive.
http://i.imgur.com/e3ciIQr.jpg

Quote:

---

Originally Posted by Holyhunter

OBJECTION
The snows of Coerthas are quite alive.
http://i.imgur.com/e3ciIQr.jpg

---

Holyhunter you are a butt. Go back to vinesauce. :P

jk ily <3

Quote:

---

Originally Posted by Livilda

Holyhunter you are a butt. Go back to vinesauce. :P

---

holy shit

who are you

Quote:

---

Originally Posted by Holyhunter

holy shit

who are you

---

I am ████.

Thank you! That was all very useful information :)

Hopefully, enough people will read this to spread the word and help keep us all safe.

I like how some mmorpgs use coin lock on your account if you log in from another location. Why not just lock your account (bags, messages, shouting etc..) until you verify your location. Takes 2 minutes.

While we're on the subject, has anyone with a security token had their account hacked?

I have had my account targeted for "suspicious activity" multiple times since release. Every time I change my password and every time it is targeted again for "suspicious activity" and disabled out of precaution by SE. Has anyone else been getting those emails? Even while you're logged into the game?

I believe that due to my security token they only hit the maximum allowable attempts before my account was locked out.

And if that's true.. it means it's SE itself that is getting hacked or exploited and not necessarily the users. Sure keyloggers may be one avenue but how does that explain what's happening to me? I've clean installed since 1.0 and I haven't been to any fansites or downloaded any ARR related apps at all. I don't see how I could have a keylogger unless it shipped with the installer itself or the benchmark. Which, for all any of us know, may have been compromised on SE's servers a long time ago. If something that big went down, it would explain the aggressiveness of the gil sellers since this would be an opportunity not to miss.

Quote:

---

Originally Posted by Livilda

Snip.

---

Thank you for posting. Timely, well thought out and fair. Very much appreciated.

../bow

Quote:

---

Originally Posted by Smoey

I like how some mmorpgs use coin lock on your account if you log in from another location. Why not just lock your account (bags, messages, shouting etc..) until you verify your location. Takes 2 minutes.

---

what i dont understand is, before the head start, if anybody logged into your game from a new IP it would lock the account. It doesnt do this anymore and im not sure why.

Honestly, I don't see why people are even registering at these fan sites. Most of them are just wikis, no need to create an account to peruse a wiki.

Quote:

---

Originally Posted by Gilraen

Honestly, I don't see why people are even registering at these fan sites. Most of them are just wikis, no need to create an account to peruse a wiki.

---

a lot of people really just have no sense of how things on the internet works. I know people who are amazing at playing games, but clueless about much else on the internet aside from facebook.

Quote:

---

Originally Posted by Sadique

what i dont understand is, before the head start, if anybody logged into your game from a new IP it would lock the account. It doesnt do this anymore and im not sure why.

---

Because prior the the head start was beta and, IIRC, logging into the game from another IP was considered a violation of the NDA unless it could be proven otherwise.

Quote:

---

Originally Posted by Livilda

OP Snip.

---

Nice try attempting to sound like u know what you are talking about, but you are wrong, and if u become one of the 1000s of compromised accounts you will realize it. It actually appears to be a security hole in the FFXIV program.

Our Free Company Leader was locked out because of having their account compromised. They never actually had an RMT literally take over their account,or if they did it was for under 30 minutes after the leader last logged off,and the 'compromiser' logged off within that same 30 minute timeframe. The literal hacked accounts stay online much longer than that. Appears taht even if ppl unsuccesfully hack your account you are put just like everyone else on the 1 week minimum lock-out, and if you dont go to se support ur perma-banned.

Quote:

---

Originally Posted by Moth

I've heard that just simply visiting any of the RMT sites can put your computer at risk of being infected with key-logger virus. A way to prevent this is to of course get a security token. Also you can always type your pass somewhere other than the log-in screen then copy and paste it when you go to log-in. That way there is no way to keylog what you are typing, since it is just key-logging whats on the XIV screen.

Also make sure the e-mail you use for XIV is always different than your regular pass, because you will always have to verify the new IP address being used via your e-mail.

---

Only way your 1st part is true is if xivpads is triggering this. And it's not a local pc keylogger issue in the 1st place. And it's happening with accounts using security tokens. And on Pcs/LANs that are clean and secured.

I've heard that just simply visiting any of the RMT sites can put your computer at risk of being infected with key-logger virus. A way to prevent this is to of course get a security token. Also you can always type your pass somewhere other than the log-in screen then copy and paste it when you go to log-in. That way there is no way to keylog what you are typing, since it is just key-logging whats on the XIV screen.

Also make sure the e-mail you use for XIV is always different than your regular pass, because you will always have to verify the new IP address being used via your e-mail.

Quote:

---

Originally Posted by ReaperT

Because prior the the head start was beta and, IIRC, logging into the game from another IP was considered a violation of the NDA unless it could be proven otherwise.

---

this makes sense i suppose, they should have just left it on though. It was a big inconvienient but this wouldnt be a problem if they had unless the hackers can guess your secret question

SE have taken some action on RMT. Personally I think they have done more than just banning RMT spammers. I discover why the game is design this way I think.


The retainer is feature is not to avoid AFK market because it can be fix with just and Auction House. The retainer is there so that it keeps whoever is making the most money in the market anonymous to protect players risking being hacked and gold stolen.

Only a few bucks for selling drops from mobs, quest reward gill, no gill from mobs etcs. Generally preventing easy farming gill so that it's hard for RMT to farm gold. (I know it makes our life a living hell in the game but i like i. It gives the money value instead of how many 0's do u have after the 9). But guess now how are they making gill ? From the market and hacking.

I just want to say that as a community in this game, we have some responsibility too. SE have a lot to deal with not just RMT. So why don't we help out? They gave us the "Report cheat" feature"

For example today I just farm 10,000 shards + ore. I'm leveling my G.Smith + Weaver and I'm a 34 MNK. It took me 10+ hours to do it (I took break in between of course). There's this one guy I saw that is farming as long as I'm even more efficient that I'm. I checked his profile and he's a 10 PUG with 16Miner. I think he farmed atleast 100k worths of shards if he mananged to sell them (30g per piece currently in my server). I don't think anyone would do that for 10hours straight others than you need it for your proffession. Even if you wanted to get some quick gill from market I
ll understand. But 10hours ? Level 10? Really ?? I just reported him with a sincere suspicion.

As a community we have to keep an eye out for farmer, what is selling greatly in the market, and who's farming em. Not saying whoever farm is a farmer, but 10 hours, you guys know who to suspect and whos not anyway lol. They hurt the market too... really..

Quote:

---

Originally Posted by GomE

ll understand. But 10hours ? Level 10? Really ?? I just reported him with a sincere suspicion. .

---

There was a post on reddit from a guy who admitted to botting gathering skills. He lets it run constantly when he's not doing other stuff. He was unapologetic, bragging, and so deserving to be banned. His excuse for why it wasn't wrong was "square makes it possible, so it's not exploiting". He even used the "if you don't lock your door, you deserve to be robbed" 'logic'.

Using password/login combinations from other sites is bad, you can buy huge lists of stolen ones, for pretty cheap, and do with them what you like. People seem to not believe this, and blame Square, but notice how this really started when people started talking about how popular the game is, and how many people are playing. Not to mention how hard it is for most players to make gil at cap, while bots can farm over and over. They saw a market, and pounced.

There are plenty of stuff you can do to keep hackers out of your account, one is get a security token. (Wish my WoW one worked with FFXIV) If you have smart phone or another phone or device, you can get it free, or cough up a few dollars and get one. Other mesurements are, change your password every month, you don't have to, but it makes them harder to hack. Second use a more secure browser like Chrome or Firefox. DON'T use IE, worse security ever! download addons like No Script (FF)/Not Script(Chrome) and Ad block plus. this minimizes the chance to get keyloggers, and virus. Also get a good free Virus program like AVG or Avira, in fact I've known Avira picks up viruses better than programs you can by like McAfee's. Also update your windows every patch tuesday and keep your windows defender up to date as well. Even this won't give you 100% protection, but 99% of the time I never got a virus.

Well if he ever walk on a street and get shot dead, I should reply with his theory ^^

Great OP! (It's computer (in)security, plain and simple)

This is what I would do to prevent this:

Secure your browser/computer first. (Uninstall Java if you don't need it, update flash/browsers/programs/Windows, run as limited user, stop using IE, ad/javascript blockers)

I also would strongly recommend using a secure password generator, like one built into a secure password manager. (And change them if you think that they are at risk of being compromised)

I would also strongly recommend using 2 factor authentication (software/hardware tokens) on your email addresses/other game accounts if at all possible. (Google makes one for Apple devices and Android devices called Google Authenticator, Microsoft makes one for Windows Phone).

But yeah, one last thing.... If you think your computer is infected, DON'T TRY TO LOG IN! (Disinfect that sucker!)

Stay secure guys!

Edit: Didn't realize someone already talked about all of this in a previous post...

Quote:

---

Originally Posted by GomE

I checked his profile and he's a 10 PUG with 16Miner.

---

Coincidentally my main char in ARR is 12 ARC with 18 BTN. Made a promise with my other half to not level without her. So I'm stuck in Gridania without leves... At least I got all the woods!

</derail>

Account stealing is serious business. Give 'em hell!

Quote:

---

Originally Posted by ShinrinCole

There are plenty of stuff you can do to keep hackers out of your account... SNIP.

---

And everything u just posted is already confirmed to have absolutely no help in protecting accounts against the Game Clients security hole.

And what is up with a known memory leak (since Phase 3 and still persistent) coming from the server client to all local clients

I know that's why I use the keyword "suspect" lol :) No offence though

Yeah, they do need to fix that exploit sometime soon!

Don't forget that you can go to a completely legitimate 3rd party site and get a keylogger. You don't have to go to a RMT site at all. It's very easy to pick up a keylogger from an ad on pretty much any website. Most websites sell that ad space to large advertising clearinghouses, and those services may not actually vet the ads they put up in their stream. Mouse over a compromised ad on an unsecured computer, and you probably have a keylogger.

A variance in a username is important too. Use an unique Username if possible too.