Curse

Shanaeri Rynale · Dec 18, 2009, 09:30 PM // 21:30

or if you know the user name of someone you can lock it for them for the lolz..

On a more semi serious note, perhaps you can use this to lock your account within Taiwan or Chinese working hours...

Fay Vert · Dec 18, 2009, 10:58 PM // 22:58

So what we are seeing here is a community with a total loss of confidence in the game's security and a customer relations that simply won't respond adequately.

Now we even have a big red note on the login screen telling us to perform an action none of us has any confidence in. Is anyone here trusting the recommendation?

This is a big mess and we're being picked off one by one while FailNet seems to assume it's all our fault.

GW2 sales are not going to be great if GW1 players lose their accounts to hackers. We need a way to protect our key assets.

Gli · Dec 18, 2009, 11:38 PM // 23:38

Quote:

Originally Posted by Fay Vert

Now we even have a big red note on the login screen telling us to perform an action none of us has any confidence in. Is anyone here trusting the recommendation?

I don't really feel the need to go change any of my passwords.

Everything about both my NCMA and GW game login is completely unique and strong. They're tied to different emails, neither of which I've ever used to register at any GW or general gaming sites. They use different, strong passwords that I've never used anywhere else. Nothing anywhere online holds any hint or starting point to derive my NCMA username or registered email, nor the email address that's my GW game login. My character names are also totally unrelated to any information on my NCMA or GW login credentials.

Also, the only time I've ever logged on to my NCMA account, was to add the free anniversary storage, which was 7 months ago. The data I entered into my NCMA account was the bare minimum I needed to proceed and doesn't hold any revealing information that could lead to easy password retrieval or reset.

If my NCMA password is going to be miraculously reset by a gentleman from Taiwan, I'm not going to blame myself.

Xenex Xclame · Dec 18, 2009, 11:47 PM // 23:47

Quote:

Originally Posted by Fay Vert

Now we even have a big red note on the login screen telling us to perform an action none of us has any confidence in. Is anyone here trusting the recommendation?

Nope,I started reading it but ended up ignoring it.

trielementz · Dec 19, 2009, 12:25 AM // 00:25

incident: 091218-000170
password reset: 17th dec, 3pm
my first request to support: 17th dec, 7 pm
subsequent upload of cd keys: 18th dec, 9am
first contact by support, who tells me i'm getting routed: 18th dec, 10.30am

time taken so far to respond to my lock/ reset account request as at 18th dec 4.30pm: 22 hrs and counting.

anybody knows if these support guys work weekends or whether i can expect to wait until monday?

Quote:

Originally Posted by Rinoa Hawkeye

I got access back to PlayNC. Changed all my passwords and security questions. They took care of this a lot sooner than I thought.

Hi Rinoa, what did the GM need to prove your ownership of the account? i've uploaded pictures of my cd keys to preempt their responses. if they require more proof, i'd want to preempt those as well.

sigh.

trielementz · Dec 19, 2009, 12:29 AM // 00:29

Quote:

Originally Posted by Martin Alvito

Five attempts at resetting a password appears to lock an account for twelve hours.

hm. i've tried to force lock my actual guild wars account using this method (multiple wrong passwords) but it didn't happen. bummer.

actually, for those whose ncsoft master accounts have not been compromised, a password change would be more effective i'd think.

Rinoa Hawkeye · Dec 19, 2009, 12:41 AM // 00:41

Quote:

Originally Posted by trielementz

Hi Rinoa, what did the GM need to prove your ownership of the account? i've uploaded pictures of my cd keys to preempt their responses. if they require more proof, i'd want to preempt those as well.

Actually, I searched for that right after I replied to the password reset email. I found this form:

Quote:

Subject:
I believe I have been hacked and cannot log into my NCsoft master account to resecure my account.

Question:
Here is my account information:
NCsoft master account name: ENTER ACCOUNT NAME HERE
First and last name: ENTER FIRST AND LAST NAME HERE
Physical Address: ENTER POSTAL MAILING ADDRESS (not e-mail address) HERE
Date of birth: ENTER DATE OF BIRTH HERE
Serial codes/access keys: ENTER CODES/KEYS HERE
Unique Account ID(s): ENTER UNIQUE ACCOUNT ID(s) HERE

http://help.ncsoft.com/cgi-bin/ncsof...p?p_faqid=3562

I filled it out and pasted it between the green lines of their generic response email in my reply. They didn't ask me for anything else. It was a real hassle to find all my boxes, though!

I hope they resolve it quickly and without any hassle--they did mine in under 24 hours. I got nothing between the generic email response and the resolution, so it was a surprise this morning.

What amazes me is that it seems to be the same ISP and possibly person responsible for a couple of hackings that have been posted about. I'm assuming there are a limited amount of accounts that are directly receiving the stolen items from hacked accounts.

trielementz · Dec 19, 2009, 12:53 AM // 00:53

Quote:

Originally Posted by Rinoa Hawkeye

Actually, I searched for that right after I replied to the password reset email. I found this form:

http://help.ncsoft.com/cgi-bin/ncsof...p?p_faqid=3562

I filled it out and pasted it between the green lines of their generic response email in my reply. They didn't ask me for anything else. It was a real hassle to find all my boxes, though!

I hope they resolve it quickly and without any hassle--they did mine in under 24 hours. I got nothing between the generic email response and the resolution, so it was a surprise this morning.

What amazes me is that it seems to be the same ISP and possibly person responsible for a couple of hackings that have been posted about. I'm assuming there are a limited amount of accounts that are directly receiving the stolen items from hacked accounts.

Thank you. Seems I've done all I can then. my only consolation is that the last log in on my toon was 1 day ago. wonder how long it took to expert salvage 4 sets of fow.

Rinoa Hawkeye · Dec 19, 2009, 01:09 AM // 01:09

Quote:

Originally Posted by trielementz

Thank you. Seems I've done all I can then. my only consolation is that the last log in on my toon was 1 day ago. wonder how long it took to expert salvage 4 sets of fow.

From what my fiance told me (he checked the guild roster), between the password reset and when they were through (or at least set to offline) was about 2 hours. I emailed NcSoft Support about 20 minutes after the hacker reset my password.

There is a support group for hacked players over on the Player Match-up Forum on GW Incgamers forums--other players are being very generous and understanding about those of us who've had our accounts hacked. I can't imagine how you must feel with 4 FoW armor sets. It took me forever to get one, and it's gone, and with 4, I can't imagine.

JimmyNeutron · Dec 19, 2009, 01:10 AM // 01:10

Quote:

Originally Posted by trielementz

hm. i've tried to force lock my actual guild wars account using this method (multiple wrong passwords) but it didn't happen. bummer.

actually, for those whose ncsoft master accounts have not been compromised, a password change would be more effective i'd think.

You must be doing something wrong because my own account is locked out still.

I click on the Forgot Your Password link and enter the correct username, and I believe I enter the correct or fake B-Day and tried to get my password email to me, but instead, ended up locking myself out.

As of now, I'm still lock out.

trielementz · Dec 19, 2009, 01:24 AM // 01:24

Quote:

Originally Posted by Rinoa Hawkeye

There is a support group for hacked players over on the Player Match-up Forum on GW Incgamers forums--other players are being very generous and understanding about those of us who've had our accounts hacked. I can't imagine how you must feel with 4 FoW armor sets. It took me forever to get one, and it's gone, and with 4, I can't imagine.

thanks. maybe i'll mosey over...

Quote:

Originally Posted by JimmyNeutron

You must be doing something wrong because my own account is locked out still.

I click on the Forgot Your Password link and enter the correct username, and I believe I enter the correct or fake B-Day and tried to get my password email to me, but instead, ended up locking myself out.

As of now, I'm still lock out.

i believe what you've described locks out the ncsoft master account. my guild wars game account has already been compromised, so there's really no point in me locking out my master account since he knows the actual game account password.

i wanted to lock up my guild wars game account (hence the multiple login attempts on my game client), since support has not responded to my request.

Tullzinski · Dec 19, 2009, 02:43 AM // 02:43

Quote:

Originally Posted by Rinoa Hawkeye

There is a support group for hacked players over on the Player Match-up Forum on GW Incgamers forums--other players are being very generous and understanding about those of us who've had our accounts hacked. I can't imagine how you must feel with 4 FoW armor sets. It took me forever to get one, and it's gone, and with 4, I can't imagine.

That is a very nice thing being done for victims of stolen accounts.

However, ANET and NCsoft should be totally ashamed that their game has spawned an actual support group for this. That has to be the saddest thing I have heard yet.

Chthon · Dec 19, 2009, 04:45 AM // 04:45

Quote:

Originally Posted by Tullzinski

That is a very nice thing being done for victims of stolen accounts.

However, ANET and NCsoft should be totally ashamed that their game has spawned an actual support group for this. That has to be the saddest thing I have heard yet.

No kidding...

obastable · Dec 19, 2009, 06:40 AM // 06:40

it's just a matter of time before someone here at GWG with some legal knowledge points out that gamers are protected by their federal/state/provincial/whichever (wholly depends on where you live) laws.

here in ontario my consumer protection act governs all agreements, including eula's, and if my gw account were hacked, looted, and not restored i'd chase after anet with a lawsuit based on unconscionable representations and trespass on chattels.

it wouldn't even be a landmark or precedent setting case. others have done it for precisely the same thing: hacked & looted account that the game company refused to restore.

the great part of this story: they won.

clean up your act, anet. it's just a matter of time before someone gets fed up with the backhanded way you treat your customers.

Tramp · Dec 19, 2009, 07:11 AM // 07:11

Wow, it can not be more clear than this. So a simple question to Regina and Gaile, or preferably, a programmer at the company would be this:

Do you think that the points listed below are possible security vulnerabilities in the NCSoft account or not?

If you answer no, then we know it is pointless even continuing this thread. If you say yes, then follow up with how much time exactly it will take to fix the items below that are risk factors and when we can expect them to be finished (not some general, generic answer, just the best estimate you can relay from an actual programmer who has looked at these factors.)

This is very simple and will end the thread. Risk factors or not? How much time to fix or not fix?

Quote:

Originally Posted by Chthon

I hate being drawn into this conversation again, but I cannot let that go by unchallenged.

We've seen, and debunked, this same flawed reasoning before. Accounts are stolen in multiple ways. The fact that ~45% of accounts are definitely not stolen via the NCSoft account in no way means that accounts are not, or cannot be, stolen through the NCSoft account.

By way of metaphor, your argument (which was Gaile's before you) is essentially that of an automobile maker, whose door locks and ignitions can be easily picked with a paperclip, arguing that your crummy locks are not a risk factor in car theft because ~45% of cars are stolen at gunpoint. It's ludicrous. Continuing to repeat it after it's been debunked is a sign of either stupidity or dishonesty.

Moreover, even if accounts were not being stolen through weaknesses in the NCSoft account (and all evidence available to us strongly suggests that they are), the documented vulnerabilities mean that somebody could start doing so at any time. Isn't that reason enough to fix them?

Now, I'm going to re-post a summary of vulnerabilities just to make clear how shoddy the NCSoft site is and how easy it would be to fix.

How to steal GW accounts via the NCSoft master account:

Step 1: Generate a list of NCSoft usernames.
Systematically run all character strings against the NCSoft site's username field. It will respond differently to real usernames and non-usernames. Save the list of real usernames.
Easy Fix: Give the same error message regardless of whether the entered string is a real username.
Step 2: Reset the NCSoft password.
Brute force the security questions. Many have small enough search spaces to be guessed quickly. The default birthday question is particularly easy, since you can frontload your search with birthdays in more likely age ranges for players. So is the car color question. (How many color words are there?) Skip accounts with difficult questions. When you guess only one question correctly, the site will notify you which one. You get 5 tries on each account every 12 hours. Each account will take a few months to crack. Maintain adequate yield by working on many accounts in parallel.
Easy Fix 1: Do not notify user if they guessed a question correctly.
Easy Fix 2: Only offer questions with large search spaces.
Easy Fix 3: Require all account holders to use a "write your own question" question.
Easy Fix 4: Lock out account and notify support and e-mail account holder after repeated failed password-reset attempts.
Easy Fix 5: Blacklist IP's making multiple failed password-reset attempts to multiple accounts. (While attackers could mask IP's, this would add time to every iteration and slow down their attack.)
Step 3: Obtain the newly-reset NCSoft password.
I don't know how this is done. Based on the fact that the attackers seem to be bypassing the user, I have 3 theories I'd like to test.
Step 4: Copy GW username fromthe NCSoft site.
It's there. Copy it.
Easy Fix: Do not display GW username in the NCSoft account.
Step 5: Change GW password to whatever you like.
There is no further security to stop you.
Easy Fix: Require the user to enter the current GW password and/or respond to a confirmation e-mail before allowing the user at the NCSoft site to change the GW password.
Step 6: Log in the to GW account and loot it.

Also, the NCSoft account appears to have no countermeasures at all against brute forcing the NCSoft password. Apparently you can try over and over without getting the account locked out, or getting IP banned, or even getting a delay between login attempts. This is probably (?) slower than brute forcing the password-reset questions because of the comparatively larger answer space.
Easy Fix 1: Lock out account and notify support and e-mail account holder after repeated failed login attempts.
Easy Fix 2: Blacklist IP's making multiple failed login attempts to multiple accounts.

Responsible Short-Term Fix While Resolving Other Issues: Disable the ability to reset GW password through NCSoft account.
Put it back if/when it's not so easy to get into NCSoft accounts.

Would you mind resetting your password several more times and recording some things for me?

hallomik · Dec 19, 2009, 02:57 PM // 14:57

As a person who was hacked last Sunday and finally had my account restored last night (Friday - 5 days later), I can tell you what to expect from the process:

I tried to log in on Sunday morning on my main account multiple times with no success. I could log into my linked secondary account, which used a similar password, so I suspected my main account had been compromised.

I then checked my email and there was a confirmation from NCSoft saying my password had been changed at my request. Obviously, I did not make that request.

The NCSoft password change email had arrived less than an hour earlier, so I hoped I might be able change my password back to prevent further damage. I quickly sent a reply email to NCSoft saying I did NOT request a password change and to please lock the account from futher access. I then attempted to log into my NCSoft account on the website. My password there had also been changed including all of my security information (mother's maiden name, street I grew up on, etc.) that might allow me access back in.

I checked my email again, and saw the automated response from NCSoft saying they had received my request, and asked for some standard, additional information that I provided.

About two hours after the first password reset request, I received another email from NCSoft saying the password on my Secondary account had now been reset. I, of course, immediately sent an email saying this second password change was also not authorized by me.

The next day (Monday), I received an email from NCSoft saying that my case was being "elevated."

Two days later (Wednesday) I received an email form NCSoft requesting information to confirm I was the owner of the account. For example, what was the mailing address I used when I opened the account, what were the access keys, etc.

Two days after that (Friday), I received an email with a reset password. I used this last night to change my passwords and security information, and see what had become of my accounts.

Neither account had been accessed again since the original Sunday. The thieves appear to be very efficient and only requred about an hour or two with each account.

None of the characters had been deleted. The only armor that had been destroyed was my FOW armor on my Mesmer - presumably salvaged for ectos and shards. Curiously, the only runes that seem to be missing are the Vigor's. They appeared to use perfect salvage kits because no armor was destroyed (other than the FOW) but the sup vigors are all gone.

All gold was gone. My chest was maxed and each of 10 characters had about 70k each, so I estimate 1.7 million in gold alone was taken. Most rare materials were cleaned out (they left the silk and charcoal). Most common materials were not taken (they took all iron). All Party, sugar, and alcohol were removed. I had around 2,000 sugar points (rock candy) and about 20-25 stacks of alchohol plus 5 kegs.

All weapons in storage were removed, but no weapons on my characters were taken. All tomes were taken. All "books" were left. None of my equipment packs were taken (I have 4 heavy). Some mini-pets were removed and some were left. They seemed to know the valuable ones.

Nothing was taken from my pre-searing character. The only gold to my name now is the 16k he has.

It is actually kind of amazing that the amount of stuff I had was processed so quickly. I suppose that most everything could be converted to ecto's pretty fast, but all those tomes, sugar items and alcohol items take up quite amount of space. They only needed an hour to remove a lot.

It also seems strange that they in no way crippled my ability to continue to play. My characters have all their armor and weapons including heroes (minus vigors and my FOW, naturally), and I have plenty of storage space now. On the one hand, that is good. Nothing "vindictive" was done. It was all very "professional." My full HOM is still there. No one in my guild was "kicked." On the other hand, I feel that if I play now, I will be just acquiring stuff for the next time hackers come to clean me out. Unless something significant is done to restore my confidence in the game's security, I do not intend to play Guild Wars again.

Gli · Dec 19, 2009, 03:56 PM // 15:56

Quote:

Originally Posted by hallomik

It is actually kind of amazing that the amount of stuff I had was processed so quickly. I suppose that most everything could be converted to ecto's pretty fast, but all those tomes, sugar items and alcohol items take up quite amount of space. They only needed an hour to remove a lot.

Sad. Their efficiency is probably testament to how often they've pulled that crap.

I've jokingly suggested before that the rising ecto price might have more to do with all the stolen gold that is turned into ecto at the material trader than any changes to the UW. I'm rather surprised they're also taking huge amounts of items that can't be converted as easily. They can't have any of that stuff sitting around on any account for long, because they'd lose it all when ANet goes after accounts that systematically receive stolen goods. That points to either them having a very efficient infrastructure that can turn anything to gold or ecto in very little time, or very slow and lacking GM action. Or both of course.

I'm sorry for your loss.

Daesu · Dec 19, 2009, 03:59 PM // 15:59

This should be in the options but it is not!

Use an industrial strength authentication system! For example, Microsoft LiveID and let somebody else worry about the securty of your accounts.

JimmyNeutron · Dec 19, 2009, 04:44 PM // 16:44

I can only hope that all those who account are being hack have never bought anything from these RMTs. If you did, than you deserve to be hack because you're helping the RMTs stay in business.

powercozmic · Dec 19, 2009, 05:43 PM // 17:43

Ok... All my 3 guild wars accounts got hacked last night and I'm still not able to login to any of them. Still waiting on NCSoft support to get back to me. They hacked my master account on NCSoft's site to do this.

4 Fow armors, 12 characters all with elite armors and all with sup vigor runes, a bunch of ectos, several q9 weapons including 2 q9 celestial compasses, a q9 frog scepter, several q9 chrysocola, moldavite, astral staves, 1 tormented staff, q9 storm daggers all being looted right now as I type this.

I vote for every security measure right now.