Warning to all. The ffxi account hijackings are real.Follow

Hi all, It's me, and I just wanted to share with you a personal warning to not take the account hijacking threads that have been appearing so lightly. My story below..

I knew that recently several people have been posting to various threads that they have been having their account stolen from under their noses while they were logged in, but I never gave it much heed. The general response to all the threads is always "stop downloading hacks" and "stop watching ****", which I would have attested as the cause, or at least until yesterday when something similar to me happened.

I was logged in on my main account on Melphina when all of a sudden I got kicked off my game and the login error "You have been disconnected: The current content ID was used to log in of a different terminal" appeared. I knew what that meant and thankfully I have a spare computer which I had turned on to the ffxi login screen for my brothers account. I quickly got on that computer and logged in and changed my playonline password safely, actually on both accounts to be safe. I changed it later to something more secure, but now I wonder how it happened. I havent had any login attempts made to my account since but I know it happened and as such I'm taking precautions. So I did some research and the findings below are a summary of what I have gathered from others who have had similar occurences.

--There have been several people who have had their account taken from right under their noses even while logged in. Accounts of such occurences are on both BG form and KI. The links to the KI thread is here, and another one to it happening on BG is here. Normally a few isolated occurences wouldn't be something I would consider worth concern, but the eye witness accounts continue to grow, and I am now one of them. Before anybody asks I'll get the formalities of interrigation out of the way

---I play on the PC version on windows XP
---I have fraps but only the fully liscenced official version from the official site that I paid for and have had for the past year or so.
---I have no speed hacks or cheat prgrams from any of the underhanded sites.
---I have never bought gil or associated with RMT web sites.
---I have norton internet security and Webroot spysweeper that I use to keep my PC safe by sweeping regularly.
---Yes I have used the ffxi windower (no I'm not going to lie about it)

Of the above the only thing that has any remote possibility of being the culprit would be the windower, but I don't believe that to be the case. Reasoning below.

First off, far too many people play on the windower that it would probably have been a much much wider spread occurance. Not only that, but witness accounts state that many people who play on only playstation 2 or X-Box 360 have also fallen victim to the account loss. I can't believe that all of the people who have claimed to play only ps2 or x-box 360 are lying, especially when some of them have linkshell members backing up the claim that they have said they play on the consoles ever since they started.

I believe it is an RMT operation. I don't know how they are doing it but I believe the RMT are accessing user accounts without authorization. If you click the link on BG form you will see an eye witness account (with screenshots) of one such occurence where one person was in a merit party and disconnected. He then was logged in after and his linkshell watched helplessly as he ran to the city and traded all of his stuff to a lvl 1 character. One account on KI indicates that the CC info was not changed and the GM were able to reset his password and he logged into a stripped account.

Furthermore, there have been suspicions that ffxi related online community web sites may have been infected with malware. Ffxiah.com is one such site that has been thrown under suspicion, and some people claim that when they went to the site it attempted to download malware to their system. It is assumed if this IS the case it may be hidden in one of the banner ads on the web site.

Now one more thing that SCREAMS RMT operations is the sudden appearance of two extremely suspicious sellers across the servers. I don't recommend going to ffxiah.com if you have no protection to look up the names but the following characters have been spotted with extreme RMT like activity.

One character named Moonbank
Servers Moonbank appears on:
Bahamut
Sylph

Vaelfor
Alexander
Odin
Ifrit
Diabolos
Quatzlcotyl
Unicorn
Gilgamesh
Garuda
Cerberus
Kujata
Bismark
Lakshami
Fairy
Hades
Remora

the second susppicious seller just NOW appearing

Sunbank:
Sunbank appears on only the following servers

Sylph
Vaelfor
Pandemonium
Cerberus
Seraph

Now the reason these characters are suspicious is that they do NOTHING but sell very large quantities of extremely valuable goods, all varied greatly. And by this I mean they are selling hauby =1, scorpion +1, peacock charms, elemental rings, e-bows etc etc.

None of these characters have anything being sold of a value less than 200k, and the worst was one that sold a Kraken Club for 20 million gil. The typical sales on the moonbanks in the viewable history averages between 15-35 million and there are no exceptions on any of the servers. Sunbank is following similar trends and is brand new. Sunbank only appeared about 3 days ago whereas moonbanks histories span the past few weeks.

Now in addition to this I call into light the fact that RMT have made prior attacks on the playerbase. S-E has hit the RMT so hard that they have no way of generating gil to sell in game so they have resorted to personal attacks on the ffxi userbase. A short while ago there were RMTs who sent tells to everybody in game with a bogus story and a web link, which those who clicked downloaded a keylogger with some weird extension. Furthermore the link to this same keylogger was posted to many online message boards, including allakhazam here. The admins were having a hard time keeping up with the keylogger links by characters with low post count and they would often strike at the worst time, like 2 am when everybody was asleep.

It is of my personal belief that the RMT are hurting SO badly they are resorting to hacking our accounts to sustain their business. It is common knowledge that many of the RMT farming companies exist overseas in asia, and that the countries associated with these ""gill collecting places" are knopwn for their hackers... very very GOOD hackers. It would not be far fetched at ALL to believe that the overseas RMT farming organizations have resorted to hiring script kiddies to take our gil... and characters from us by force.

Now in addition to this I read somewhere that a possible cause may be the ffxi-linkshell community web site itself. The ffxi community site requires us to enter our login information to access the linkshell community, and if we don't enter our current login information we cannot access it. It is directly linked to our content ID and password in game. It has been surmised that if a certain someone could hack into a well known ffxi cheat program site and post the list of every subscribed user, and this same someone could hack into a ffxi information database web site and expose a coverup scam, in addition to a certain online monetary payment site, that the RMT could hack into the linkshell community web sitee and plant a bug. it's not a definite but the fact that people who ONLY play on Ps2 and X-Box 360 are being compromised as well points to it being a possibility. if one such person has a computer or visited an internet cafe and entered their playonline info on the linkshell community should it be bugged it would affect their game on the consolde toom as the account info is identical.

Finally to warp up my post I offer a warning. I won't lie to you, this frightens me. The fact that the numbers of accounts of theft happening has increased is a sign that SOMETHING is wrong. And S-E has a user agreement policy thats @#%^8NG BRUTAL. I took the liberty of reading s-e's user agreement and I was horrified. The link to the agreement is below and I urge you to understand that if you get hacked its game over forever. The link to the agreement is

RIGHT HERE!!

To quote a few of the lines that hit hardest

S-E holds the right at their sole disgression to ban or suspend an account without prior notice. Any breach of any of the rules is warrent for immediate suspension.

You are solely responsible for the security of your account. if you get compromised whether by fault of yourself or someone else tough. They will not be held liable nor will they help you with recoveery even if you are an innocent victim.

(this one is a good one) --- you may not in any way record or reproduce any converstions with s-e or any of its representatives.

In other words those people who FRAPS GM conversations and post them online are breaking the TOS.

Should you have a problem with s-e or any of its affiliates tough. You agree to defend s--e in the court of law and indemnify them from any and all damages caused by your losses.

You are not entitled to recieve damages from s-e should you get screwed due to the agreement. If you dont like it tough.

This one deserves a durect quote



This one needs quote too


And finally



Yup, they're even protected against acts of God O.o.

Case in point, be extremely careful with your account information now. If you lose your account even if you are an innocent victim it's not recoverable. S-E has a policy of guilty until proven innocent according to their user agreement, and the GM not being able to help you is actually an enforcement of what s-e themselves has us agree to every time we click "play".


Melphina is safe for now.... Thankfully I had a backup PC logged in on the login screen for my spare account. But I ALMOST lost her and I don't know how. I don't download anything, and I believe the RMT have found SOME way to render our account info from us.

So for now I'm not gonna be logging in for a tad. I'm gonna look into getting a new PC (my old one is garbage anyways). If it's something stored locally it woudl have been on my main computer which no longer has the software. I changed the password on a different unit but I'm not chancing it. I've put too damn much woork into Melphina dn Goldie to lose it all now, and I advice you guys to take similar precautioons.

RMT are out there, and they have turned their focus on us. I can't find this coincidence by any small factor.

Edited, Sep 13th 2008 8:07pm by Darqflame

If I could rate you up, I so would. Very well written and case made... Will be updating my Account User Name when I get home!

Yeah, I also mentioned that:

FFXIAH
FFXI-Atlas

are targets and have been targeted (aka keyloggers/virus writers)so those are also 2 sites that I know could likely cause a problem.

Apparently some people got a trojan from visiting taj's sites before..

Kind of sad now though..

I agree that the current trend is quite worrying, and I'll be sure to look over the ToS for us EU clients and report back if the ToS is actually legal (we have very strict laws on data protection).

One thing I would point out, the Act Of God clause. Almost every insurance policy has an Act Of God clause, its not because they don't want to pay out trillions if Armageddon appears tommorow, its just a general get out clause incase of a massive natural disaster. Say tomorrow a volcano appeared under Washington DC and errupted, they could attribute that as "an act of God".

If you read your insurance details (in America) you will probably find that you will not be covered if the US is invaded tomorrow and your car is blown up by the invading force (act of War). We know its not really likely that Russia will invade the US tomorrow, but clauses like this are quite common.

Anyhow I'll go read the EU ToS and tell you if it holds water ;)

If you must visit the targeted sites, and you use firefox make sure to use:

Ad-Block Plus
No-Script

And any other add-ons you think would be good.

You are the first person I've seen mention anything of this sort.

HOWEVER, a couple months back Taj did hack into the Linkshell community site by way of brute-force (which basically means having a program just run through all possible combinations) and a number of people were listed on his site (I think this was just before the FFXIApp hacking he did) as having really poor passwords. He listed these people out and told them to change their password, as it would be easy to hack them. I don't know how many people saw that list, but Taj did show that the LS community site was vulnerable, as well that some people have really poor passwords.

Now, I wouldn't put it past Taj to be the one behind some of these hackings, but most likely it's either unrelated, or someone got an idea for hacking people in a similar manner or just people on Taj's list for this.

I happen to agree with you. Out of all the people I have see, read, or know been hack, SE has always been of no help. Even right now on Asura forum a person is warning people that his account was stolen.

SE should make some changes. What changes... I have no idea, not that smart!

Pintpot, the EU contract is governed by English Law, the US is by California law, and the Japanese by Japanese Law. The English one, doesn't appear to have "Act Of God", not sure why, possibly because SE would't really be able to serve him a summons to appear in court and be asked "Was this really an act by you?"

The ToS though, well, I did read it and to me it does seem reasonable. The only one which may be a bit off is the ability to change the ToS without warning. If SE were to change it in such a way as to cause a huge detriment to the Client, the Client would have a legal 30 day's to cancel their contract without loss.

The "Data" one appears to refer to statistics, not actual character Data, but even with that SE state they have to take reasonable precautions with it, so if it were to be deleted by some new support staff who hit a "DO NOT HIT ME!" button, SE would be liable (under their own ToS).

SE are under no obligation to assist a person who has broken the ToS either, which is reasonable, if you use a hack, its at your own risk, and if it has a keylogger, then SE can say "nope, your fault, tough"

I think the main principle that SE have to legally uphold is reasonable duty of care, they have to make sure that your data is secure enough, so that no random person can get hold of it. So PS2 users without a PC, if they lost their accounts could have recourse in claiming SE have not upheld their duty of care, PC owners with every hack under the sun, would be outta luck.

So since we are looking at the TOS, have an interesting question! What if you given an account by a friend, and that friend tried to get it back?

I think this is one of the issues SE faces when it comes to hacks stealing peoples accounts. How does SE know that a player hasn't given his account to someone else or sold it. I know SE doesn't allow people to sell accounts, but we are aloud to give them away. If SE did return accounts back to people, what would stop then from selling accounts, only to get them back for free by reporting them stolen?

Just wondering....

Mel, may i ask...?

Do you use any passwords on other websites such as FFXIAH, KI, allakhazam and the likes that you use for your POL ID as well?

It may very well be something like this. However, it is truly frightening ._.

The thought that it may happen to any of us at any given time...

This makes me want to change my password to something a little more secure. If I do that, should I uncheck the save password to be safer, or would it not matter?

Ok since I can't sleep I decided to get up for the day, being Sunday, and see if I could crash later tonight.



yes my old password was similar to ones I use on online things such as e-mail, although it isn't now even anything remotely close. However the password alone isn't enough, they also need my account ID to get at me. The fact that they logged me in tells me they had not only my password but the corresponding ffxi user ID too, which is two pieces of information, and one supplied by S-E.



It's best to manually enter your password every time. If you click the "save [password" so that you automatically log in every time you open playonline viewer what happens is the computer creates a small script that stores your password locally on your computer. Every time you log in your password has to be sent to the s-e servers, and by setting it to auto save you put that information onto your computer. The computer then accesses the mini script every time you tell it to log you in and uses that source.

If someobody got ahold of your computer and decoded the script it would actually be EASIER for them to take over your account NOT harder. Using the "save my password so I don't have to enter it manually" is actually a liability not a strength.

If its a keylogger then the script would still be logged just as if it were actual keystrokes, there is no difference. I type my password in manually for this very reason.


And on the bank account information: Thankfully the credit card data is stored server side. I checked my billing info and it was unaltered, but the only thing you see on playonline is the last 4 digits of your CC ingo, the first 12 are coded as asterisks and as such your CC info should still remain safe/ Your account info however wouldnt be so lucky..

And with that I'm gonna try and log in on my alternate pc. I never visited any sites on that one, so in theory it should be safe. Since I changed the password over there if its infected it would be too late anyway. heres to hoping.