Massively.com Story on FFXI HackingFollow

I know a few people were asking about getting more eyes on this issue through other media outlets, etc. Massively just posted this story on the issue:

Final Fantasy XI hacked; Square-Enix hides behind policy

It appears to touch on most arguments for why and how this is occurring.

-Ten

It's going to be funny to see what happens when SE gets put on the spotlight.
It's also nice to see that this story has gotten out to several other media outlets, thank you for the link.

I highly doubt WoTG has any connection....

The only thing I can say, it is likely a "DDoS" styled attack..they've done it to SE before (that was more due to Japan vs China issues really though) and its likely happening again, only this time on a more severe level and because SE is literally destroying businesses.

SE will never admit they had a security breach if they really had one. In january they will probably implement something to help players but it's already too late.

SE admitted when they were getting pelted with DDoS attacks, that in a sense is a security breach.

DDoS like Denial of Services?

Because a DoS attack (I dont know what a DDoS is exactly or where the extra D comes from) is just an attempt to slow down or interrupt services. A security breach is when someone successfully get access to private informations like databases or files.

Edit : quote

Edited, Dec 17th 2007 11:46am by KumoKuroki

Hehe ok sorry maybe I read it wrong ;)

I knew RMT's were going to try new ways of making gils, but never expected them to be THAT efficient. I kinda hoped they would migrate to more "popular" games like WoW.

Could you use digg.com to link to that story?

disclaimer: Forgive me if I'm mistaken, I've never actually used digg.com other than to read stories, not share them.

RMTs are more active in games like WoW than they are in FFXI. I believe Lineage II is generally regarded as the RMT mecca, followed by WoW, and then by other games such as FFXI.

You just don't hear about it much because you're not involved with WoW. Blizzard is incredibly pro active when it comes to RMT, but there are still daily hackings and RMT trying to link keyloggers and such to the official web site.

So, RMT are MORE active in MORE popular games such as Lineage and WoW, but it's not like they're going to pass up good money from a game like FFXI, which "only" has half a million subscribers.

Yes, it was pretty speculative. It's nice to have at least one site paying attention to the issue, though, even if I think they are being a little playful with the facts as they stand.

Thanks for the link, it was an interesting read.

Okay, I'm a bit disappointed in the article, nor do I think it will change much. From what I'm understanding in this whole fiasco is that people seem to be blaming SE for a lot more then should (please correct me if I get any of the following incorrect).

Case 1:
"Trusted" (and I use that term loosely) website XYZ has malicious code on it that exploits software holes in user's computer that installs a key logger of some sort that allows ABC malicious party to steal login information.

SE at fault: No
Users at fault: Yes & No (Yes: Install prevention software/updates you ninnies! No: The victim is never at fault, right? It's a double edged sword really, I mean it is a community "trusted" site after all...being naive is blissful).
Users angry: Yes

Case 2:
User installs "third-party" application/utility (the kind that actually allows you to cheat/bots), that could be riddled with malicious code in (such as a key logger) that allows ABC malicious party to steal login information.

SE at fault: No
Users at fault: Yes (stop cheating you bastards)
Users angry: Yes

Case 3:
SE's account retrieval process to prove that you are the actual owner of the account after theft has happend due to case 1 or 2, is lacking greatly.

SE at fault: Yes
User at fault: No
User angry: Yes



Does is capture the correct cases, or did I miss some?

For those of you who think Sqeenix can't be hacked you are wrong, it can be, just as we can be hacked. It's ridiculous to point fingers at anyone because the attacks are many, blended and varied. The most we can do is to stay on top of the problem and the threat is growing everyday. What works one day will be overcome the next so instead of trying to blame any party for this check out this article by Sergey Golovanov of Kaspersky: Online games and fraud: using games as bait

This doesn't mean don't do your utmost to prevent this but we need to be united against it. Trying to find scapegoats to heap scorn on isn't helping anyone.

A DDOS attack can be used to help sniff out passwords.

Let's suppose that SE didn't encrypt their packet for login, (or use a very weak encryption scheme). A DDOS attack can be used in conjunction with a malicious routing table to redirect the traffic intended for FFXI servers.