Curse

Ku Ku · Mar 14, 2008, 11:08 AM // 11:08

I have been hearing more and more recently of people's guild wars accounts being hacked into... Several guild mates and friends of mine have lost everything in the last few months but acutally what really gets me isn't the theft its the nastiness that goes with it.

For example a friend of mine was collecting every warrior armor in game for her hom. After removing all items and armor from all the other characters on the account they chose to delete one - the warrior.... it makes me question whether these people are angry at those who have worked to be rich or something XD

Ok ranting aside i know there have been lots of calls for a character locks, where they can't be deleted but i think i have a far more simple soultion: Guild wars should pompt us, every 30 days on log in, to change our passwords - the sheer effort of having to log into playncmaster account every few weeks for those that are changing their passwords frequently would be removed and it would help to block the hackers who are simply "getting luckly" and guessing the right combanations - it would also give the chance to those less clued up on hacking etc to do something proactive. As for keyloggers etc, this obviously wouldnt work as well, but then i am under the impression that you have to download one in order to get hacked by one - thus less of a problem for people more aware of the internet's perils?

jackers1234 · Mar 14, 2008, 11:21 AM // 11:21

yea, a limited time set on passwords would make sense, however, it may prove rather difficult to implement in a game with millions of players.

Also, the number of people who genuinely get hacked without the help of a 3rd party program is very small. Most people who are hacked get hacked because they downloaded some form of 3rd party add-on for GW, (i.e bot programs etc). This will mean it is quite low on ANet's list of things to do.

Darkhell153 · Mar 14, 2008, 12:24 PM // 12:24

Gw should have a computer ID tracking system. That way if you report your account to be hacked, provide account name with password, and it finally gets through the mail; then arenanet can possibly log the hacker's computer ID and ban them from the server or report them for hacking.

But all in all, it's just like jackers said. Most hacking comes from idiots downloading third party software.

Sleeper Service · Mar 14, 2008, 01:06 PM // 13:06

Quote:

Originally Posted by Ku Ku

I have been hearing more and more recently of people's guild wars accounts being hacked into... Several guild mates and friends of mine have lost everything in the last few months but acutally what really gets me isn't the theft its the nastiness that goes with it.

For example a friend of mine was collecting every warrior armor in game for her hom. After removing all items and armor from all the other characters on the account they chose to delete one - the warrior.... it makes me question whether these people are angry at those who have worked to be rich or something XD

Ok ranting aside i know there have been lots of calls for a character locks, where they can't be deleted but i think i have a far more simple soultion: Guild wars should pompt us, every 30 days on log in, to change our passwords - the sheer effort of having to log into playncmaster account every few weeks for those that are changing their passwords frequently would be removed and it would help to block the hackers who are simply "getting luckly" and guessing the right combanations - it would also give the chance to those less clued up on hacking etc to do something proactive. As for keyloggers etc, this obviously wouldnt work as well, but then i am under the impression that you have to download one in order to get hacked by one - thus less of a problem for people more aware of the internet's perils?

NO. frequent password changes = MORE risk unless they are randomly generated by Anet themselves (and that is just no good, this is not the Pentagon).

edit: Character locks / timed "fadeout" like in EvE is the simple solution.

Numa Pompilius · Mar 14, 2008, 01:06 PM // 13:06

When you get hacked it's for one of three reasons:

1) You've used an easily guessable password (e.g. username Ku Ku, password Ku Ku).

2) You've downloaded and run a keylogger. Usually these masquerade as cheats or hacks; anyone running crap like that get what they deserve.

3) You've given your password to someone who wasn't trustworthy. Maybe you've told your brother? Maybe you use the same password everywhere? Maybe you have it written down on a post-it next to your computer at work? Maybe you told the "ANet employee" who mailed you and asked for it?

In short, it's quite easy to avoid being hacked. I definitely don't want ANet (actually NCSoft, which is much worse) interfering with my security arrangements.

/unsigned.

Ctb · Mar 14, 2008, 01:10 PM // 13:10

Quote:

NO. frequent password changes = MORE risk unless they are randomly generated by Anet themselves (and that is just no good, this is not the Pentagon).

This.

If you force people to change their password all the time, ESPECIALLY if you also institute complexity rules like a lot of businesses do, you'll just irritate people into picking easy passwords because they'll get fed up with always having to stop and think of something new.

Passwords should be encouraged to be strong from the start so there's no NEED to change them.

Also, this needs to be merged with the dupe.

Ku Ku · Mar 14, 2008, 02:14 PM // 14:14

Quote:

Originally Posted by Numa Pompilius

When you get hacked it's for one of three reasons:

1) You've used an easily guessable password (e.g. username Ku Ku, password Ku Ku).

2) You've downloaded and run a keylogger. Usually these masquerade as cheats or hacks; anyone running crap like that get what they deserve.

3) You've given your password to someone who wasn't trustworthy. Maybe you've told your brother? Maybe you use the same password everywhere? Maybe you have it written down on a post-it next to your computer at work? Maybe you told the "ANet employee" who mailed you and asked for it?

In short, it's quite easy to avoid being hacked. I definitely don't want ANet (actually NCSoft, which is much worse) interfering with my security arrangements.

/unsigned.

There is a 4) to this however as the example of the friend i used above had a number, letter, punctuation combo, downloaded nothing and kept the p/w to herself as has two more people i know of. I'm talking of the hackers that get hold of a email address and sit for hours randomly generating password guesses.

Ctb · Mar 14, 2008, 02:21 PM // 14:21

Quote:

Originally Posted by Ku Ku

There is a 4) to this however as the example of the friend i used above had a number, letter, punctuation combo, downloaded nothing and kept the p/w to herself as has two more people i know of. I'm talking of the hackers that get hold of a email address and sit for hours randomly generating password guesses.

If the password is strong, "hours" is not the right timeframe for a dictionary attack: centuries is.

Short of pure, stupid luck on the part of the attacker, a sufficiently long and complex password will take years, decades, centuries, even potentially millenia to crack at current PC speeds.

If she lost her account even with a strong password, she very likely did have some sort of malware executing a "man-in-the-middle" attack that saw the password pass unencrypted. With the continued insecurity of Windows and the frequency of attacks made against Windows software (not just Microsoft - all sorts of applications can be exploited), it's entirely possible she was subject to an attack she didn't notice and didn't explicitly bring on herself. Even just viewing a compromised flash ad on a legitimate website can be enough if the right combination of software and patch levels is present on a machine.

Meat Axe · Mar 14, 2008, 02:33 PM // 14:33

Quote:

Originally Posted by Ctb

If the password is strong, "hours" is not the right timeframe for a dictionary attack: centuries is.

Short of pure, stupid luck on the part of the attacker, a sufficiently long and complex password will take years, decades, centuries, even potentially millenia to crack at current PC speeds.

Just to enforce this point, I'll point out how many combinations of characters a password can contain. Even with only lower case characters, a five letter password will have 11881376 (26^5) possible combinations. If you have an eight letter password, it will have 2.09x10^11 possible combinations. That is quite a lot. Even if you use a word that is in the dictionary... well, I don't know how many words there are in the dictionary. I know there are a lot though.

The Way Out · Mar 14, 2008, 02:35 PM // 14:35

Quote:

Originally Posted by Numa Pompilius

When you get hacked it's for one of three reasons:

1) You've used an easily guessable password (e.g. username Ku Ku, password Ku Ku).

2) You've downloaded and run a keylogger. Usually these masquerade as cheats or hacks; anyone running crap like that get what they deserve.

3) You've given your password to someone who wasn't trustworthy. Maybe you've told your brother? Maybe you use the same password everywhere? Maybe you have it written down on a post-it next to your computer at work? Maybe you told the "ANet employee" who mailed you and asked for it?

In short, it's quite easy to avoid being hacked. I definitely don't want ANet (actually NCSoft, which is much worse) interfering with my security arrangements.

/unsigned.

This is not necessarily true, although I agree with you an some of them. There are currently a ton of hackers out in China that are injecting code into valid websites that are linked to many mmos out there (WoW, GW, LoTR, etc...). People are logging into sites and signing into site, that are then redirecting them to compromised sites. Your information is then stolen. People are actually victims in this case.

http://www.pcworld.com/article/id,14...s/article.html

Is an article talking about LoTR. Hope this sheds a little light into how this sometimes happens even if you didn't give out your info or download things you shouldn't.

Numa Pompilius · Mar 14, 2008, 02:51 PM // 14:51

Quote:

Originally Posted by Ku Ku

I'm talking of the hackers that get hold of a email address and sit for hours randomly generating password guesses.

Forget it. Doesn't happen. *

Quote:

Originally Posted by The Way Out

People are logging into sites and signing into site

Not with Guildwars, though. Unless you use the same password everywhere. Which is point 3).

* OK, I should clarify that. OK, yes, it can happen, if you use a common password, or any password likely to be in a dictionary, like, say, "banana" or a variant like "b4n4n4". If you have a mixed-case 9 letter or longer pw with digits and punctiation, however, you're highly unlikely to ever get brute-forced. At one attempt per second they'll be spending months trying to get in, and exponentially longer the longer the pw. There are plenty of guides on the net to how to create secure nonsense passwords which are still easy to remember; if you're worried about getting hacked, follow the advice of one of those guides.

The Way Out · Mar 14, 2008, 03:00 PM // 15:00

Quote:

Originally Posted by Numa Pompilius

Forget it. Doesn't happen.

Not with Guildwars, though. Unless you use the same password everywhere. Which is point 3).

If I have your MSN account I can do it. "Most" people use a common email address for most things they do. I don't, however, I work in network security and understand how MSN/X-fire are highly vulnerable programs that give me a little too much info and cut the time needed to nothing.

Once someone has your account and gets in, they normally leave the guild they are in, and join a new guild. One of the first things a hacker does in GW is ask for everyone's MSN account (lol) and they also start asking about prices. Some even start giving away free things that normal player wouldn't, saying that they are quitting GW or never playing again.

I, so far, have had three people in my guild get hacked. I try to caution everyone I play with to be careful of certain things. I give suggestions about what to avoid.

Passwords are irrelevant when it comes to most things. Attack at the weakest link. If I redirected people that connect to this site, I bet I would have about a hundred accounts in a matter of days. My only advice is to be careful. However, even then bad things happen. You can't always blame people for things that are out of their control.

Numa Pompilius · Mar 14, 2008, 03:14 PM // 15:14

Quote:

Originally Posted by The Way Out

If I have your MSN account I can do it.

Huh? You can hack my Guildwars account if you have my MSN account?

The Way Out · Mar 14, 2008, 04:16 PM // 16:16

Quote:

Originally Posted by Numa Pompilius

Huh? You can hack my Guildwars account if you have my MSN account?

You MSN account does a couple things for me. One, it gives me an email address of yours. Two, it is like a home beacon for finding your pc on the net. Three, if you are not fully updated, you suffer from exploits through MSN. Same as X-Fire. Most Identity theft starts with the compromise of one password.

I should start a thread on dumb things people do that hurt them in the end...

Example... when you forget your password or want to change it... you ask anet or any other company to send you an email so you can "reset" your password. Most people don't delete the emails and the links can remain active for a period of time....

Anyway, yes, I can normally hack people who give me their MSN account... or yahoo... or err... easiest is myspace. Anyway, sounds like it can't happen, however, everyone leaves footprints on the net.

A suggestion for people in the future is don't use your GW account's email and password on other sites.

Keep a separate email for GW only...
Keep a separate email for just signing up for things...
Keep a separate email for banking...
Keep a.... do you get it now?

Update your systems, especially your browsers and any third party software that you use. You are never fully protected. For that you would have to take a pair of scissors to your cat5 cable.

Tarun · Mar 14, 2008, 04:54 PM // 16:54

Hack a Guild Wars account with an MSN/Hotmail/Live/.NET address? I call BS. It can be possible, though not as much as claimed.

Suffering from exploits through MSN and XFire? A "home beacon" for finding the user's pc on the Internet?I'd like to hear about these "exploits" and how it's a beacon.

Quote:

Originally Posted by Numa Pompilius

When you get hacked it's for one of three reasons:

1) You've used an easily guessable password (e.g. username Ku Ku, password Ku Ku).

2) You've downloaded and run a keylogger. Usually these masquerade as cheats or hacks; anyone running crap like that get what they deserve.

3) You've given your password to someone who wasn't trustworthy. Maybe you've told your brother? Maybe you use the same password everywhere? Maybe you have it written down on a post-it next to your computer at work? Maybe you told the "ANet employee" who mailed you and asked for it?

Numa has summed it up nicely.

As I mentioned it's often done by someone who you know and they know you. People don't realize their secret questions for their hotmail is often something that even their friends might know, or can ask and find out that easily.

Your best protection is knowledge. I'm quite confident in my knowledge about computers and the Internet. Even my boss seems to think so, as I'm the head technician at my workplace. I'm so confident in my knowledge of computers and how things work that I don't run an anti-virus at all. I choose to run a firewall because I prefer to see where the programs I use are going to online.

The Way Out · Mar 14, 2008, 05:12 PM // 17:12

Quote:

Originally Posted by Tarun

Hack a Guild Wars account with an MSN/Hotmail/Live/.NET address? I call BS. It can be possible, though not as much as claimed.

Suffering from exploits through MSN and XFire? A "home beacon" for finding the user's pc on the Internet?I'd like to hear about these "exploits" and how it's a beacon.

Numa has summed it up nicely.

As I mentioned it's often done by someone who you know and they know you. People don't realize their secret questions for their hotmail is often something that even their friends might know, or can ask and find out that easily.

Your best protection is knowledge. I'm quite confident in my knowledge about computers and the Internet. Even my boss seems to think so, as I'm the head technician at my workplace. I'm so confident in my knowledge of computers and how things work that I don't run an anti-virus at all. I choose to run a firewall because I prefer to see where the programs I use are going to online.

There are actually a couple tutorials on how to hack msn accounts on you tube. Also, you can call BS all you want, however, it happens. I deal with stuff like this all the time. I am a white hat, though. I am in security. It is important for me to know the how and why. I am not trying to come off like I am some uber hacker... because there is a common misconception with people that are script kiddies and people that understand networking and security. Lastly, I am not deterring from Numa's posts. I am adding that not everyone that gets hacked is to blame. Some people are just victims.

Guild Wars has a small underground culture of people that are very tech savy. One of the runs this forum. Lastly, I personally know over ten people that were packet hacking awhile back. I think they fail, however, they were into a lot of shady crap. Anyway, I am going to shut up. Apparently I don't know what I am talking about and people are just going to jump to conclusions here.

Tamuril elansar · Mar 14, 2008, 05:49 PM // 17:49

just don't download key loggers and don't tell you're password to anyone.
thats one simply solution to hacking.

The Way Out · Mar 14, 2008, 05:51 PM // 17:51

Quote:

Originally Posted by Tamuril elansar

just don't download key loggers and don't tell you're password to anyone.
thats one simply solution to hacking.

That is misinformation

Musei Karasu · Mar 14, 2008, 06:00 PM // 18:00

Quote:

Originally Posted by Tarun

I call BS.

I don't. Would you like to compare credentials?

Seeing as how I can think of how to do it right now without really working hard on the thought I'm very positive it can be done, although not as easily as The Way Out is suggesting. It would take a bit of work. It's very scary what someone can do to you with just a tiny little bit of information.

Ekelon · Mar 14, 2008, 06:02 PM // 18:02

Surprisingly, Guild Wars is the one game where I don't hear much about people being hacked. There is rumor about recent hackers using the "easy password" method, where, once they obtain your e-mail account, they will try all common passwords, and if it doesn't work, move on to the next e-mail account. My suggestion is, don't share accounts, and don't have an easy password (use 8+ letters and use both numerals and alphabet letters).