1
Forum Settings
       
Reply To Thread

Massively.com Story on FFXI HackingFollow

#27 Dec 17 2007 at 2:00 PM Rating: Good
Kerberoz wrote:
Any tard with a big enough botnet can launch a DDoS attack. Systematically stealing account logins isn't anywhere near the same thing.


if it is a cheap enough account (as in, the admin cant afford lots of bandwidth), you could just do it with a single computer, that has a script to continuously refresh a page of the website.
#28 Dec 17 2007 at 7:26 PM Rating: Decent
Lady Jella wrote:
Yeah, there's no way SE's servers can be hacked into.

I wonder what fleetools those PS2 players who lost their accounts and don't even own PCs were running.

Morons.


dude it is very possible. s smart enough hacker could use the direct connection to PoL to hack into the servers. hard? yes. impossible? no. wherever theres good enough security there is an equally good hacker.
#29 Dec 17 2007 at 8:17 PM Rating: Excellent
Everything can be hacked. It's just a matter of time and patience. This is something that RMT seem to have a great deal of in FFXI; they just keep trying and trying.
#30 Dec 17 2007 at 8:25 PM Rating: Excellent
Something that was mentioned on the BlueGarterLS forums - I'd forgotten about it, though I always do raise an eyebrow (and ignore it) whenever an installer tells me this . . . but the installer for Wings of the Goddess, like all the FFXI PC installers, tells you to disable any antivirus software before installation. Apparently, someone contacted S-E customer support about this in the context of inquiring about the hacked accounts, and was given a "hmmmn, we'll get back to you on this."
#31 Dec 17 2007 at 8:28 PM Rating: Decent
Wow, nice find.
#32 Dec 17 2007 at 8:32 PM Rating: Good
***
1,008 posts
I will agree to some people being at fault for having keyloggers in the computer and SE not being at fault.

Lots of people cheat and go looking at other websites for ways to cheat without using programs like abusing the system.

However, I do blame SE for allowing someone to log into someone's account while they are online and actually kick them off the game.

I will blame them for allowing other people to easily be able to change the password on the account.

I will blame them for not returning account and items to original owners. The game keeps track of every single thing that happens. I don't care if it's returned as an original item or gil.

I will blame them for looking the other way when accounts are not supposed to be sold. If they had made impossible for you to sell your account, then someone else wouldn't be able to steal my account.

It's not hard to lock the account to someone's name and information. Some people here said that they don't own a credit card due to bad credit. However, people can use bank cards which have your name on the account and address. I know people move around but they don't all start moving to another country overnight. If people can't manage to own a bank card then they seriously need to get off the game and solve that first.
#33 Dec 17 2007 at 8:32 PM Rating: Decent
Everyone who thinks the servers and such can't be hacked has obviously not heard of Smiley: um Taj.




He was able to crash clients by sending a certain thing through chat log.

Hacked his way onto Atomos.

Myriad of other things he has done too...


If you think it's so "omg hard" to hack FFXI, take a look at what this guy has done. This is one person. Think of RMT, with their seemingly endless resources.



Edited, Dec 17th 2007 8:33pm by Darkdoom
#34 Dec 17 2007 at 8:46 PM Rating: Good
***
1,912 posts
Darkdoom wrote:
Village Idiot of Derailâ„¢


Yep fits the bill.
#35 Dec 17 2007 at 8:47 PM Rating: Good
Isn't Taj the guy who could force-DC a GM?
#36 Dec 17 2007 at 8:56 PM Rating: Decent
Lady Tasera wrote:
Isn't Taj the guy who could force-DC a GM?
He didn't d/c them, and he could do it to anyone.

He sent a string through the chat log that crashed their client.
#37REDACTED, Posted: Dec 17 2007 at 10:19 PM, Rating: Sub-Default, (Expand Post) I wonder what color it was(refering to the "chat string"). Smiley: ducttape
#38 Dec 17 2007 at 11:34 PM Rating: Good
**
536 posts
ZelgadisXI, Defender of Justice wrote:
I wonder what color it was(refering to the "chat string"). Smiley: ducttape


Seriously. Pics or it didn't happen. I just don't see this as possible. I know he's done other things, but c'mon. Through the chat dialouge? D/cing people? That doesn't make sense.


It can be done. I read an article about how some online games are vulnerable to such attacks - I think it was something to do with not using separate chat servers - but unfortunately I can't remember where I read this.

There's so much anecdotal evidence of people remembering this happening, anyway, there's no reason not to believe he did it.
#39 Dec 17 2007 at 11:39 PM Rating: Good
***
1,142 posts
It was done. And there are screenshots.
(Look for the "Quiting game" thread on BG)

Something along the lines of a null packet as the tell.

[EDIT] Here is the thread on Alla:
http://ffxi.allakhazam.com/forum.html?forum=10;mid=1170420641322507569;num=145;page=1

Emergency Maint in order to fix the exploit.

Edited, Dec 18th 2007 2:52am by Zenoxio
#40 Dec 17 2007 at 11:50 PM Rating: Default
Quote:
I read an article about how some online games are vulnerable to such attacks -


Quote:
It was done. And there are screenshots.



Well, I'd like to see them.

Maybe it's not hard to hack FFXI. (not client side, SERVER side) But I'd like to think that they would have a little more security on their HARD WIRED servers. (for those that don't know, it's not exactly easy to hack a piece of hardware without first having that person who is using the hardware to put something onto that piece of hardware to allow the hacker inside.)

If I'm proven wrong then these screenshots should be brought to the attention of SE. There are obviously flaws in their system. I thought that's what Taj was all about. Showing SE they're flawed so they can fix themselves.




#41 Dec 17 2007 at 11:53 PM Rating: Good
***
1,142 posts
The exploit was fixed, as I just updated my post. The original thread on BG (over 15+ pages) had various screenshots.

[EDIT] Not the screenshots I originally remember, but this is one:
http://web.archive.org/web/20070204073419/http://euphidime.com/Wow.png

Edited, Dec 18th 2007 3:03am by Zenoxio
#42 Dec 18 2007 at 1:15 AM Rating: Good
Taj Fits the classic definition of script kiddie. He doesn't deserve half the credit anyone gives him for any attack. I know where he got a good 99% of his ideas. Its just unfortunate that i can't link to it. ...i'll just say that there exists the following:

1. an ffxi packet injector, that has been tested and works 100%. Its purpose was NOT for hacking accounts or DCing anyone.
2. knowledge of how ffxi encrypts data, and a program to perform said action, and reverse it
3. knowledge of how ffxi compresses data, and a program to perform said action, and reverse it.

...I have access to all of the above. Taj knows where they can be found, as well. he's on my IRC ignore list for a number of reasons.

Aside from numerous known attacks, he generally has a ****-poor attitude, and was at one point flaunting his hoax of a ffxi private server, which the project i've been keeping my eye on, as well as several members of Wiccaan's IRC suspect is most likely doctored images or done primarily using model viewers.
#43 Dec 18 2007 at 6:05 AM Rating: Good
****
4,148 posts
Massively is probably referring to the some-page ordeal in which case it's not SE that is getting hacked, it's a expliot of a unrelated application (unpatched realplayer) on users computers.

But I do agree with the article that they are HIDING BEHIND THEIR POLICY instead of taking things by the horns and coming up with a excellent system to handle compromised accounts and returning them to their owners.
#44 Dec 18 2007 at 7:23 AM Rating: Good
***
1,912 posts
Pandoraxero wrote:
Taj Fits the classic definition of script kiddie. He doesn't deserve half the credit anyone gives him for any attack. I know where he got a good 99% of his ideas. Its just unfortunate that i can't link to it. ...i'll just say that there exists the following:

1. an ffxi packet injector, that has been tested and works 100%. Its purpose was NOT for hacking accounts or DCing anyone.
2. knowledge of how ffxi encrypts data, and a program to perform said action, and reverse it
3. knowledge of how ffxi compresses data, and a program to perform said action, and reverse it.

...I have access to all of the above. Taj knows where they can be found, as well. he's on my IRC ignore list for a number of reasons.

Aside from numerous known attacks, he generally has a ****-poor attitude, and was at one point flaunting his hoax of a ffxi private server, which the project i've been keeping my eye on, as well as several members of Wiccaan's IRC suspect is most likely doctored images or done primarily using model viewers.


It's amazing how many people don't realize this. I tip my hat in your direction.

I've been writing software for many years now (games/security companies/financial institutions/etc...) in countless langagues (C, C++, Java, Assembler, VB, Perl, the stupid list of languages go on and on) the tools available for ANYONE to find is not hard folks. It's all about knowing how to use them and what to look for. But hey if people want to ride Taj's nut sack, by all means let them. I'll watch them get that salty taste in their mouth, as I sit back and laugh at them.
#45 Dec 18 2007 at 7:41 AM Rating: Excellent
ZelgadisXI, Defender of Justice wrote:
I wonder what color it was(refering to the "chat string"). Smiley: ducttape


Seriously. Pics or it didn't happen. I just don't see this as possible. I know he's done other things, but c'mon. Through the chat dialouge? D/cing people? That doesn't make sense.
Back when GeoCities still existed (before Yahoo bought them), I was a CL/CM for them, and it was quite possible to crash a chat client by sending it a certain string. This wasn't limited to the web browser version, as it crashed the proprietary chat client as well. I remember it happening on ICQ as well at one point.

Data security has improved a lot since then, but in theory the same rule of thumb applies: if it can be hacked into, there is someone out there who knows how to do it, and has done it before.

It seems pretty apparent to me that Square isn't very focused on security. If you want to continue believing that they're the Fort Knox of data security, and that all those PS2 users who got their accounts stolen must've been doing something illegitimate, then by all means, go ahead. Someone always has to be the sheep.
#46 Dec 18 2007 at 7:44 AM Rating: Default
**
536 posts
Errors wrote:
It's amazing how many people don't realize this. I tip my hat in your direction.

I've been writing software for many years now (games/security companies/financial institutions/etc...) in countless langagues (C, C++, Java, Assembler, VB, Perl, the stupid list of languages go on and on) the tools available for ANYONE to find is not hard folks. It's all about knowing how to use them and what to look for. But hey if people want to ride Taj's nut sack, by all means let them. I'll watch them get that salty taste in their mouth, as I sit back and laugh at them.


To be honest, it sounds more like you're going to sit back and get all upset that nobody knows how smart you are.
#47 Dec 18 2007 at 8:12 AM Rating: Good
***
1,057 posts
Crashing clients is no where near the same level as hacking a database, if SE had a security breach we'd know because it would be a lot worse than this.

This is really just a large group of rmt hacking MMO-related websites and putting keyloggers everywhere (the keylogger hacked ffxi players have been finding on their computers the same keylogger that has been massively stealing accounts on WOW recently).

Oh and I have never seen a single installer that does NOT say "close all other running programs" and often I see "...including any antivirus and firewall programs" tacked on the end of that sentence as well. The only reason for this is that many antivirus/antispyware programs prevent changes to the registry which, are needed in order to install most software.

IMO people are getting a bit paranoid over this situation (not that I blame them much considering SE's terrible account recovery policies).
#48 Dec 18 2007 at 8:25 AM Rating: Decent
***
1,912 posts
stavrosian wrote:
To be honest, it sounds more like you're going to sit back and get all upset that nobody knows how smart you are.


Ah, the good old, "You spoke in a negative manner up you must be jealous!" comment. Whatever helps you sleep at night, let me know once you've graduated past the 2nd grade. I give a rats *** what happens to Taj, what he does, but I find it funny people blindly follow him around because they don't understand what he did isn't that spectacular. It's like magic! Well, thinking about it twice I guess I am jealous, jealous of the fact I don't nearly have enough free time to waste as he does. Woe me, pity me! /rollseyes

Edited, Dec 18th 2007 10:26am by Errors
#49 Dec 18 2007 at 8:34 AM Rating: Decent
**
536 posts
Errors wrote:

Ah, the good old, "You spoke in a negative manner up you must be jealous!" comment. Whatever helps you sleep at night, let me know once you've graduated past the 2nd grade. I give a rats *** what happens to Taj, what he does, but I find it funny people blindly follow him around because they don't understand what he did isn't that spectacular. It's like magic! Well, thinking about it twice I guess I am jealous, jealous of the fact I don't nearly have enough free time to waste as he does. Woe me, pity me! /rollseyes


Again, sounding a lot more like you are annoyed by the lack of hero-worship being laid at your door than you are amused at people kissing Taj's ***.
#50 Dec 18 2007 at 8:37 AM Rating: Decent
***
1,912 posts
stavrosian wrote:
Errors wrote:

Ah, the good old, "You spoke in a negative manner up you must be jealous!" comment. Whatever helps you sleep at night, let me know once you've graduated past the 2nd grade. I give a rats *** what happens to Taj, what he does, but I find it funny people blindly follow him around because they don't understand what he did isn't that spectacular. It's like magic! Well, thinking about it twice I guess I am jealous, jealous of the fact I don't nearly have enough free time to waste as he does. Woe me, pity me! /rollseyes


Again, sounding a lot more like you are annoyed by the lack of hero-worship being laid at your door than you are amused at people kissing Taj's ***.


/em smacks his forehead.

Some people are just thick.
#51 Dec 18 2007 at 8:41 AM Rating: Decent
**
536 posts
Errors wrote:
/em smacks his forehead.

Some people are just thick.


They sure are. Some of them even think that anybody who finds them objectionable must be stupid.

Imagine having to deal with people that thick from way up here on our pedestals!
Reply To Thread

Colors Smileys Quote OriginalQuote Checked Help

 

Recent Visitors: 441 All times are in CST
Anonymous Guests (441)