Market board - forced to buy an item on the board while not at the market board

[Linkan]

Check wich account place that bone chip for sale for 5m.

Check to see it transfered its account to.

Ban all of them except the said victim.

Now, fixing the issue, all they need to encrypt IDs on log in session, trades, whispers, crafter's name (did you notice it only hit crafters? They name appear on the item).
of course there's more, but that could be a start.

[Linkan]

SE should just start blocking regions where this behavior comes from. Maybe not realistic, but maybe it is a final solution to end this nonsense.

I really hope he lives by your region then.

[geekgirl101]

It seems that on entering a zone with a market board the hacker is constantly pinging the character for purchases of cheap items for 2 or 3 million gil and if you don't have that much gil left then you get the "Insufficient Gil" error. Doesn't matter if your character is currently busy or not, they're able to bypass everything and force you to purchase the items.

btw banning the person who sold the item would only be a temporary measure. My guess is the item being sold doesn't actually exist and is being created when the script or whatever they're using does a successful transaction, and I suspect there's more than one account doing it so when one gets banned they just make a new one to replace it and run the script again. I hope SE figures out how to block it and takes serious disciplinary action against the hacker(s).

[Tyl]

Do they only target "rich" ppl? so everyone who has 1kk+ gil?
Everything else is not worth it i think.

But how can there be such a whole in the code, where this is manipulated so easly from outside

[Darko]

Do they only target "rich" ppl? so everyone who has 1kk+ gil?
Everything else is not worth it i think.

But how can there be such a whole in the code, where this is manipulated so easly from outside

also wow had such holes in code even years after launch.

[Reinheart]

I'm just assuming but for the hackers to get the gil amount, again I'm just assuming but say when someone checks your gear, it sends a query to server to retrieve that players data but in that data I'm guessing it has the players ID, gil amount, and other information that isn't usually displayed on the game screen. The game screen only shows the data that needs to be shown but if the query is pulling ALL the data instead of just the data that's needed this is going to be a major problem. Specially the player ID... if this player ID is something that is not encripted and also used in other DB tables with same name it's going to lead to major security holes imo.

I have no experience in RPG game development so I don't even know how the database stuff works, I only do websites and made some really simple games for my kids to play so I don't know anything, I'm just assuming all this. I'm just curious how they targeted the rich people only. It also doesn't seem like a easy task since they had to test and plan all this out first before taking players gil like this all at once. I remember seeing threads on this forum where players said small amounts of gil and tometones were disappearing so I'm guessing maybe these guys were already testing this in small amounts for some time.

I hope SE's dev, operation team can get the security updated ASAP /cheer

[Taggerung5]

How many of the affected people used a third party app?
It may as well be a timed bomb that started working to steal everything you gained from botfarming.

Think of all the parsers out there. And new ones coming out that people just blindly download and install, then run w/o thinking about it. These programs have access to your FFXIV window, and can run background commands for when you get near a market board. That's the first thing I would do, is stop using them/stop downloading new ones, and updates.

[tonic316]

LOL @ people blacking out their names. Your name is in your post.

[SinAnger]

Server: Behemoth

Retainers selling items such as Beast Blood, Bone Chips, and Tin pieces for more than 1 million gil: Fhayde, Supermarketsweep, and Nawana.

Nawana is mine retainer, i put things with this price hoping that some idiot hacker missclick it. =P Kappa

[YunieAura]

Anyone speak with a GM yet (after receiving e-mail)?