Hacked Accounts

"

FrodoFraggins wrote:

"

Ruefl2x wrote:

PS: the real problem are people who actualy buy the currency for real money. without them none of this would even happen!

So what? People keep talking about that like it's some great revelation.

Probably 95% of hacks could be prevented by:

1) Not reusing your password ANYWHERE else - prevents a majority of stolen accounts
2) Using a strong password - prevents brute force
2) Don't download maphacks/bots - prevents most trojans/keyloggers

We already know where most hacks come from. It's very very very rare that a games entire account-name/password database gets compromised.

Nice guessing. Let me join you. What about the other probable 5%? Users with unique login/pw, clean systems and proper security habits?

I've already spent countless workhours on my free time reviewing my home network's firewall logs, file access logs (a nightmare on windows server) for the PC I play POE on, searching through password hash databases that could somehow contain my POE pw hash (I don't even use the same login/password anywhere else) and looking for any obscure vulnerabilities I might've missed. I'm actually worried for my security here, but I can't find any problems whatsoever.

All the while support replies are in the vein of "sorry, your fault, we also won't tell you anything" when they're not just a copypasted stock reply. Extremely frustrating.

Welp I just got my shit looted. lost about 5 exalt worth of stuff. I have a strong unique password for this game only. I don't go on strange websites and I don't check email at all on this laptop. No strange downloads as well.

This is actually the first time my account has ever been breached before, and its pretty annoying lol.

"

altaccount wrote:

"

FrodoFraggins wrote:

"

Ruefl2x wrote:

PS: the real problem are people who actualy buy the currency for real money. without them none of this would even happen!

So what? People keep talking about that like it's some great revelation.

Probably 95% of hacks could be prevented by:

1) Not reusing your password ANYWHERE else - prevents a majority of stolen accounts
2) Using a strong password - prevents brute force
2) Don't download maphacks/bots - prevents most trojans/keyloggers

We already know where most hacks come from. It's very very very rare that a games entire account-name/password database gets compromised.

Nice guessing. Let me join you. What about the other probable 5%? Users with unique login/pw, clean systems and proper security habits?

I've already spent countless workhours on my free time reviewing my home network's firewall logs, file access logs (a nightmare on windows server) for the PC I play POE on, searching through password hash databases that could somehow contain my POE pw hash (I don't even use the same login/password anywhere else) and looking for any obscure vulnerabilities I might've missed. I'm actually worried for my security here, but I can't find any problems whatsoever.

All the while support replies are in the vein of "sorry, your fault, we also won't tell you anything" when they're not just a copypasted stock reply. Extremely frustrating.

Its your fault. GGG doesnt save the PW in a form attackers could use it to steal your account.
I am really looking forward to the first banwave (already announced), thats gonna make the forum unusable for weeks :D.

Reading through this (and some of the other threads) has me very on-edge about whether it's safe to log in or not.

It seems to be a recurring theme that the victims are playing, logged out, then come back to a looted account; which, in my paranoid mind, translates into "If I log in, I will be looted". Additionally, some of the other theories in this thread seem to indicate the possibility of a client security issue; somewhat justifying my nervousness.

Am I just being overly paranoid, or is it reasonable to not log in until we see what comes of the security system?

You cant possibly claim that every one of these hacking incidents is nothing but the users fault. This is the first time I have been hacked on anything, ever. I don't use any hacks, didn't buy any currency, didn't go to any websites. The fact that GGG has admittedly poor security, and wont do anything about the hack waves is poor support imo. But I mean, whatever right? Who cares about the people that play your game. They probably don't mind being hacked anyway, it's probably their fault. As long as Kripp doesn't get hacked, its all good.

"

sintflut2012 wrote:

"

altaccount wrote:

Nice guessing. Let me join you. What about the other probable 5%? Users with unique login/pw, clean systems and proper security habits?

I've already spent countless workhours on my free time reviewing my home network's firewall logs, file access logs (a nightmare on windows server) for the PC I play POE on, searching through password hash databases that could somehow contain my POE pw hash (I don't even use the same login/password anywhere else) and looking for any obscure vulnerabilities I might've missed. I'm actually worried for my security here, but I can't find any problems whatsoever.

All the while support replies are in the vein of "sorry, your fault, we also won't tell you anything" when they're not just a copypasted stock reply. Extremely frustrating.

Its your fault. GGG doesnt save the PW in a form attackers could use it to steal your account.
I am really looking forward to the first banwave (already announced), thats gonna make the forum unusable for weeks :D.

Actually they do. Its already been established that the hashed password can be copied and used without knowing the real password, and that this password is stored in memory for the entire playsession.
The fact that so many people are getting hit, and that some of those people have a good knowledge of security as well as the means to keep themselves secure suggests that the problem is not, in fact, with the user but somewhere either between GGG and the user or at GGG itself.

As I've said time and time again, GGG are refusing the help their paying customers and in essence taking the side of the hackers.

Yes, it's obviously GGG's fault and because of this all of the high level, very rich players have gotten hacked.

Oh wait...

I used to play an MMO w/ alot of hacking issues. They used a double password system that if your account is accessed by another IP, you needed a secondary password, and the log-in would lock you out for 20 min if you failed 3 consecutive p/w challenges.


Who really needs to play over a proxy? I'd range ban the whole subnet. Esp. annon Hong Kong proxies. These guys are nothing but trouble. I go through my wall watcher logs and see 20 port scans a day (for service ports) from this range.

"

bigpieceofchicken wrote:

I used to play an MMO w/ alot of hacking issues. They used a double password system that if your account is accessed by another IP, you needed a secondary password, and the log-in would lock you out for 20 min if you failed 3 consecutive p/w challenges.


Who really needs to play over a proxy? I'd range ban the whole subnet. Esp. annon Hong Kong proxies. These guys are nothing but trouble. I go through my wall watcher logs and see 20 port scans a day (for service ports) from this range.

+1.

"

TehHammer wrote:

Yes, it's obviously GGG's fault and because of this all of the high level, very rich players have gotten hacked.

Oh wait...

Hackers will likely take WHATEVER they can get. What if their system doesn't let them target just rich players? Besides, if all they did was target those individuals, it would be more obvious that this was the work of a hacking group and not just some users that didn't know what they were doing.

"

Captain_Catface wrote:

Reading through this (and some of the other threads) has me very on-edge about whether it's safe to log in or not.

It seems to be a recurring theme that the victims are playing, logged out, then come back to a looted account; which, in my paranoid mind, translates into "If I log in, I will be looted". Additionally, some of the other theories in this thread seem to indicate the possibility of a client security issue; somewhat justifying my nervousness.

Am I just being overly paranoid, or is it reasonable to not log in until we see what comes of the security system?

I'm a little afraid of it myself.

If they could at least tell me what the safe way was ... I mean, should I just leave the password in there? Should I change it and retype it? Would retyping it possibly jeopardize something?

I'm pretty sure I don't have a keylogger on my system, I don't follow weird PoE links, I don't try to hack the game or run any mod software, or anything like that.

And yet I hear of all these cases from individuals who are obviously not idiots, getting hacked. Somewhere, a lot of people are overlooking the real issue. I think GGG needs to find someone really knowledgeable (if they haven't already) to look into the possibilities much more seriously.

"

Feriluce wrote:

"

sintflut2012 wrote:

Its your fault. GGG doesnt save the PW in a form attackers could use it to steal your account.
I am really looking forward to the first banwave (already announced), thats gonna make the forum unusable for weeks :D.

Actually they do. Its already been established that the hashed password can be copied and used without knowing the real password, and that this password is stored in memory for the entire playsession.

At the VERY LEAST, that HAS to change.

"

The fact that so many people are getting hit, and that some of those people have a good knowledge of security as well as the means to keep themselves secure suggests that the problem is not, in fact, with the user but somewhere either between GGG and the user or at GGG itself.

Well, there's another possibility.

It's possible (read: hopeful) that GGG really are looking into their own systems seriously, and just aren't going to tell us all about it because this is a public forum.