Curse

Chestnut · May 13, 2008, 05:35 PM // 17:35

I am going to attempt to setup this thread so people who have had their accounts hacked in the last 3 months can Compare notes on what they where doing, what they did, and what they do. and how they where "hacked"

Heres some info I'm trying to find out so i'll ask some general questions.

1: Where you online when you got hacked? if so what happend, where were you?

2: Do you use textmod? If you do, where did you download it from?

3: Are you on American or other servers at the time? (And when you loged in what was your location? (Server/Outpost)

4: Do you have your account linked to play NC or use the online store?

There are more questions im sure that will pop up. please keep this thread clean as this thread is only ment to be people who have been hacked, you don't have to post what was stolen, Please keep this thread flame free, no ranting. I'm just hoping if we all place our notes here perhaps we can get to the root of the issue and find out if its just cleint computer based where you just messed up, or if it really is a major flaw in the game itself, I am hoping any info gatherd here will help a.net track down the problem.

Feel free to add any other questions you might have to other people here while we compare notes.

Jetdoc · May 13, 2008, 05:39 PM // 17:39

1: Where you online when you got hacked? if so what happend, where were you?

Yes. I was in Alliance Battles in Grenz Frontier, and was actively battling at the time. I was kicked out in mid-fight, tried to reconnect, and it failed. I then tried to log back in and it told me that my password was invalid.

I had been logged in for about 2 hours when it happened.

2: Do you use textmod? If you do, where did you download it from?

No.

3: Are you on American or other servers at the time? (And when you loged in what was your location? (Server/Outpost)

American. When I logged in, I was in my Guild Hall.

4: Do you have your account linked to play NC or use the online store?

No.

5. Do you use any sort of third party program, such as a bot or an auto-clicker?

No.

6. What Guildwars-related internet accounts do you have?

www.guildwarsguru.com
gwincgamers.com
guildwars.wikia.com
www.guildwars.com/xunlaitournamenthouse

I also have logins at both the guildwarsguru and gwincgamers auction websites, although those are very dormant.

Res Ipsi · May 13, 2008, 06:19 PM // 18:19

Quote:

Originally Posted by Chestnut

Feel free to add any other questions you might have to other people here while we compare notes.

I've not had my account "hacked", but thought of additional questions that might be relevant:
1. Do you use the same email address for the various sites you're registered on?
2. Do any of the email addresses for the sites correspond to one you use for GW?
3. Do you use any part of your ingame name or forum name in your email account for GW?

ETA: Do *not* post your responses on this site. Change your email address and passwords to your GW account in any event. You can access this option when you logon - Click on the Edit Account icon on bottom of the screen, then click on "change password" and "change email". Changing both would be the safest course of action if your account has been "hacked".

Ctb · May 13, 2008, 06:30 PM // 18:30

Requesting a sticky.

Also, some other questions to add for OP:

1. Do you have a firewall and, if so, do you have logs from the time of and some time before the attack?

2. Do you have any other monitoring software on your machine and, if so, logs from the time around the attack?

3. Were you running any other programs such as a webbrowser at the time of the attack? If so, what site/sites were up?

4. Did you receive any odd contacts either via email, in game, or through any other social site (forum PM, instant messaging, etc.) at the time surrounding the attack?

Inde · May 13, 2008, 06:48 PM // 18:48

Quote:

Originally Posted by Res Ipsi

I've not had my account "hacked", but thought of additional questions that might be relevant:
1. Do you use the same email address for the various sites you're registered on?
2. Do any of the email addresses for the sites correspond to one you use for GW?
3. Do you use any part of your ingame name or forum name in your email account for GW?

Res Ipsi, while these are certainly great questions and ones I am wondering about myself... divulging this information puts a user at risk.

fusa · May 13, 2008, 07:03 PM // 19:03

Since everyone might not reply, here's a list to some of the most recent reports to help find something in common.

Quote:

Originally Posted by aotdsyndrome

Hey all! Whats this new craze in hacking accounts exactly? after turning off Guild Wars at around 4pm GMT+1 today, I come back right now (four hours later), and someone has been on my account, been to Temple of Balth int dis1, and has stolen 48 Ectos and 4 black dyes o_O They left everything else it seems (still checking), including 6 maxed armors, a tormented recurve bow, several rare weaps, and 100k.

I'd really like Anet to find out who's doing this, coz ive worked really hard to get those ectos, and its kinda disgusted me of playing for a while.
Goodbye to my FoW armor

So, whats this all about?

ps: yes, i changed my password etc

Quote:

Originally Posted by Lycan X

One of my guildies was hacked last night. You could watch the members page & see him logging on & off repeatedly between 2 names. Told him to try to hurry & change his PW & contact support.

Spoke to him this morning, everything was gone, did not delete his toons though, just took everything...armor & all. Told him to change his PW & contact support again & to scan his PC. I aksed him if he downloaded anything for GW lately & he said no, I only use (I wont say it, but its a famous virus ridden p2p program).

Quote:

Originally Posted by Kyosuke

Ok, I am furious.

I just went into GW and when I logged in, I thought it was kind of funny that my ranger was the highlighted character because I had been raptor farming last night with my Ele.

Anyway, I click on my ele and then have some things I need to put into storage and behold there's 100k missing from my storage!!! I had exactly 150k and some change in there last night when I logged off and then I log into my account just a few mins ago and there's now only 50k in there.

Also my 36 ectos that I Had were stolen as well.

I am freaking furious as all hell here. There is no one that could have possibly known the password that I use either (and now I've just changed it..) so someone had to of hacked my account....

I logged into my Ranger and it was in the Great Temple of Baltazaar, which I never go into..... so yeah. This is ridiculous.

I mean what the hell can I do. I basically just had well over 200k stolen from me that I have spent the last 2 years working my ass off in game for and now some asshole has taken that away.

This makes no sense and i am so pissed off right now it's not even funny.

What the hell can I do.....

Quote:

Originally Posted by Squawkers

My cousin ws recently hacked but it turned out to be a log in and log out war for an hour or so until all of his characters were wipped. He was on when the hacker got on the first time. He did save like 40k though.

Only good part was the moron hacker decided to pm us in game once he was getting kicked off and we got screen shots. We reported the incident and he hasn't been ingame since...

I truely believe this has something to do with the PlayNC site. It is so vague with information and won't let you change your password from the client. My cousin never gave any information out and he got busted...his account is tied to PlayNC.

But the hacker also pmed us with some of the information from PlayNC...ie address, name, and such. That's where I believe he got the account information but I have no clue as to how...

Sorry for what happened to you. All I can say is report it.

Quote:

Originally Posted by SurareVaera

Something similar happened to me today. I got kicked from game while in town (just thought it was a common internet disconnect), when i logged on later, I noticed that all my ecto and shards were gone, and that my assassin was highlighted in great temple of balthazar (I don't go there except with my main character). Though it was a pretty big hassle to figure out, I finally changed my password through plaync. While I'm thankful I didn't lose my characters (or oddly any cash, rubies, sapphires, dye, etc.), I can't figure out how it happened as I only play with a handful of people, and I created a guild for just me and my brother's account. Somewhat baffled, but losing ~300k in ecto & shards probably isn't as bad as it could have been. I certainly hope plaync is secure after all the trouble I went through changing things.

Quote:

Originally Posted by Lensor

Just want to say that I was hacked/cracked a few months back. And I can honestly say I to this day don't know how it happened. I really don't care what some people say about "you told a friend, you used bots, you bought gold" because I know those things are not true. I know my internet security is extremely up-to-date and that my internet behavior is not risky (don't visit gold sellers etc.) and that my password was strong and only known to me. To be frank, if I can be hacked, then anyone can.

Hacking gaming accounts is big business, grossing a lot of $$$. So is it so hard to believe that some crackers who do this for a living all day every day are able to stay ahead of the curve? Lets be honest, security holes are often plugged AFTER something happen to alert to their existence. (GG mallyx cheat).

(And yes, my account is linked to PlayNC)

Quote:

Originally Posted by Lycan X

Well, add me to the list. They took my Tormented Staff, Tormented Shield, Chaos Gloves, Destroyer Gloves, 33 ectos, 25 shards, 5 rubies, 100k, a Req 9 fellblade. On the toons that had stuff missing there was odd stuff in my inventory, like 83 granite slabs, 72 piles of glittering dust & a half used salvage kit (probably to cover up the trade to make it look "legit"). And they didnt delete any toons.

Quote:

Originally Posted by trist4r

overall 3000k stolen from me ... 100 ecto,fow+chaos gloves salvaged, 1300k from storage+chars, few tormented weps ... NICE ... what kinda idiots do such stuff
im pretty sure some donkey been doin that to me, cause all the chars been in balth american dis 1 .... what a nice joke

Quote:

Originally Posted by gado

Count me in as a victim of robbery
Lost 70e, 50 shards, obsi armor, 2 tormented weapons and over 250p
this is no coincedence.
What happened!!!

Quote:

Originally Posted by Tamgi Sun

What is the matter with people atm?
This hackwave is bugging me.
I've been hacked 5 times in the last 3 weeks due to having the inability to change my PW, maybe i'm not trying hard enough, but PlayNC shouldn't be such damn idiots.

Lost so far:
86 Ecto
9 Obsidian Shards
100k gold.
200k+ worth of assorted gold weapons.
Tormented Earth Staff.
2 White Dyes.
2 Black Dyes.
6 Elite Tomes.
5-7 Lockpicks.
Elite Kurzick Armor dyed Black.
200 Party Items.

Still got the rest of my armor, that's hidden from the buggar.

Just glad he hasn't disbanded EMP and deleted all my characters.

Can anyone help me out on changing my account details please?

I've tried:
'Change Password' option, says they'll send me an e-mail with new PW. No e-mail came through, been 2 weeks now.

Contacting PlayNC. They're bloody useless...... Just got an automated reply with a bunch of different FAQ links...

I went to put in my Product Keys & my NF & EotN ones were invalid apparently

My login ISN'T a [email protected]' login, it's a standard e-mail address.
My account is 21 months old.
I haven't purchased anything off of the PlayNC sight thing.

I am pretty sure I have all my account keys, only found 2 of them so far, but I'm sure I will be able to find the rest.
My first campaign was Factions.

That's all the information I have...

Please please help me because it's really getting on my nerves now...

Thanks in advance for your help & replies.

~S O F Sin Reject~
(James)

Quote:

Originally Posted by The Arching Healer

Someone hacked me aswell, well on Guild Wars fansites. And he pmd me in Guild Wars sending me inlog names + passwords from other people (yes from the game itself). Offcourse I didnt use the info etc and ignored him. I think he hacked me aswell but I kept changing my password 3 times a day for ~4 days. Good for me no money / ecto's etc were missing

. Good to hear the accounts are banned.

Quote:

Originally Posted by Hajimesaitou

Everything seemed fine friday when i was playing, went home for mothers day weekend and after i got back and logged on i find 1.350k in my storage as opposed to the 350 something k i had. It is weird because i never goto any bull crap sites or dl anything that would give some punk access to my account. i dont care that much as it is just a game but is still kinda pisses me off since all those hours of play are just wasted on some prick.

Quote:

Originally Posted by laurana half elf

Great. Logged on to my account this afternoon only to realize that 114 ectos 450k and my monks FoW gauntlets were missing. Just great. I have no idea how this could have happened because i have never purchased gold online, downloaded a third party program or given out my information.. I have an idea that some how someone got my email adress and guessed my password as it wasn't hacker proof. I realize all there is to do now is dress my wounds and continue on playing but to make sure this never happens again i want to change the password to my account. I followed the directions and it brought me to the PlayNC site. I did not have an account there so i made one. Once i registered i clicked on manage games or something like that (the one to change passwords) but it told me i had no games active or something like that.

What do i have to do to change my password?

Quote:

Originally Posted by gado

I've been hacked between the 29th of april and the 1st of may.
I reported this at gw support.
all my valuable things are gone. More then 250p, tormented shield and bow, 70ecto, 50 shards, obsidian armor.
Have some others experienced this too and how did you handle this?
it rly sucks and now get thinking of quiting GW because all the things i worked hard for is all gone!!!
Plz want some more answers and experience from others who've been robbed!
TY

arcanemacabre · May 13, 2008, 07:17 PM // 19:17

Quote:

Originally Posted by Inde

Res Ipsi, while these are certainly great questions and ones I am wondering about myself... divulging this information puts a user at risk.

Totally agree. They are important questions to consider, at least. So it would be best to just consider them instead of posting. If any are a "Yes" for anyone, I would suggest a change in habit. Personally, the email address I use is completely different than the email address I use anywhere else. That would probably be ideal for all players.

IlikeGW · May 13, 2008, 07:24 PM // 19:24

Your account email address is in fact your most secure password, don't ever link it to anything or give away anything about your identity on GW-related sites, so that they might figure it out on other sites. It's a shame cracking is so effective, but it does seem to just fly right through once they get your account name.

Balan Makki · May 13, 2008, 07:57 PM // 19:57

A Net might want to add a 5 strikes on password entry, causing password to reset for 24 hours, or requires some other emailed verification. Seems GW will need to start rolling back hacked characters, once confirmed.

Another question for Hacked. Do you have MoDs for other games installed? MoDs from other popular games are rampant with keyloggers, etc. Doesn't have to be GWs MoD, can be any MoD for any game.

Chestnut · May 13, 2008, 08:21 PM // 20:21

Thank you Fusa for the work you did finding all the recent hacked people on guru, great job, that will help the thread, as maybe we can get some clues as to some common terms between the hacking.

MODS* Please feel free to clean up this thead from any non-on topic postings.

Hajimesaitou · May 13, 2008, 08:23 PM // 20:23

So I just learned what happened. I had made a post saying that all my gold was stolen, I saw that everyone said they had a toon in balthazars temple and so when i saw my necro there i checked it out. turns out that the hacker went on and didnt steal my gold, he just used it all for z keys and then opened a grip load of chests. I find firewaters and brules in my inventory but no golds (he prolly took all the expensive crap) and I am now rank 1 in the zaishen stupid thing. Then only way my acct could have been hacked is through my plaync account or here on guru as I was stupid enough to use same e-mail n password (which have since been changed on both guru and the game). any thoughts would be nice, but why would hacker just buy keys instead of take straight cash which was probably worth more than the crap he got (350k).

zamial · May 13, 2008, 08:24 PM // 20:24

If this is useful to help catch the dirty buggers, if not then remove this as not to inspire more. If all the accounts that are being "hacked" are plaync accounts. It is possible to set up a "auto mailer" to send e-mails to [email protected] and see what e-mails get delivered, by using a brute force attack on the address. Once you have valid E-mail address that = a valid user account. Then it is as simple as cracking the password. If this is how it is being done I do not know. I do not hack/crack or support it, I am an IT professional, just trying to help.

Patsrule711 · May 13, 2008, 08:43 PM // 20:43

1: Where you online when you got hacked? if so what happend, where were you?

No, I woke up and the next day I was missing all money in storage and all the rest of the money my warrior was holding. No items were missing thats it.

2: Do you use textmod? If you do, where did you download it from?

I have never downloaded it

3: Are you on American or other servers at the time? (And when you loged in what was your location? (Server/Outpost)

I was in an italian district 5 in kamadan

4: Do you have your account linked to play NC or use the online store?

nope

R.Shayne · May 13, 2008, 09:23 PM // 21:23

Care to add another question.

5. Do you play pvp or pug with unknown people?

Hope this is not related but should be looked into.

NoXiFy · May 13, 2008, 11:20 PM // 23:20

Quote:

Originally Posted by R.Shayne

Care to add another question.

5. Do you play pvp or pug with unknown people?

Hope this is not related but should be looked into.

irrelevant. unless your completely retarded and someone says "omfgwtf" and your like "LOL THATS MY PAsSWORD!!1! LOL". Besides that, theres nothing. They cant look into your account information or anything from just playing with you.

Lady Lozza · May 13, 2008, 11:40 PM // 23:40

9/10 I'm willing to place a bet that the points Res raised are the most likely cause of the hacks - not worms, trojans, or keyloggers. While game packets might be more difficult to intercept, web pages - particularly fansites - are not always known for their security, and account information for them is particularly easy to get a hold of especially if you use public computers (libraries and internet cafes) to access sites like Guru.

However with the hack recently, and the number of times Guru gets an "I got hacked" thread, and the number of times people here have spewed forth security measures - I would think even those who find reading hard would know not to use the same email as their game account, though to be honest it doesn't help that Guru no longer accepts Hotmail accounts. I understand the reasons, but as one of the largest providers of free web-based accounts it does severely limit the options players have if they wish to become a posting member on this site.

I wish you luck in trying to narrorw down where the security flaw is via this thread. Goodness knows with the amount of hacking going on I think a lot of people will be watching it hoping it is something that can be fixed either by our own measures - or by Anet's.

Inde Edit: Just a heads up, Lady Lozza, but that was months ago. We have accepted hotmail addresses for quite a time now. We stopped the accpetance of hotmail email address for registration for only 3 weeks.

I Can Cure Cancer · May 14, 2008, 12:10 AM // 00:10

The only thing I can see common in the past hacked accounts is that they all logged on with their characters in GToB and that previous to being hacked most of them were fairly rich, none having less than 100k.

Res Ipsi · May 14, 2008, 12:43 AM // 00:43

Quote:

Originally Posted by Inde

Res Ipsi, while these are certainly great questions and ones I am wondering about myself... divulging this information puts a user at risk.

I didn't expect anyone to reveal this information on the forum (by responding yes), but to consider these additional points when sorting through possible reasons for being targeted. My apologies for causing alarm.

super strokey · May 14, 2008, 12:45 AM // 00:45

Looks like guildwars has been totally busted open. Last nail in the coffin?

Xx_Sorin_xX · May 14, 2008, 12:46 AM // 00:46

Quote:

Originally Posted by Inde

Res Ipsi, while these are certainly great questions and ones I am wondering about myself... divulging this information puts a user at risk.

then perhaps the opening post should say to not answer these, but are question worth thinking to yourself. they may be the problem.