• Hey, guest user. Hope you're enjoying NeoGAF! Have you considered registering for an account? Come join us and add your take to the daily discourse.

The Consumerist: Xbox account hijacking on the increase - EA server connection?

The Faceless Master

The Faceless Master

Member
They wrote an article on the upswing in Xbox Account jacking.

http://consumerist.com/2011/10/i-watched-live-as-id-thieves-spent-my-money-on-xbox-live.html

Consumerist said:
I Watched In Real Time As ID Thieves Spent My Money On Xbox Live

It's bad enough to find out you've been the victim of identity theft. It's even worse to sit and watch as the thieves spend the money they acquired with your credit card information.

That's what happened today to Consumerist reader Brian, who could do little but sit and watch as someone else had a good time at his expense.
From Brian said:
I received 2 emails from billing@microsoft.com. 1 was for 4000 Microsoft XBOX Live Points ($49.99) and the other for 6000 Points ($74.99). I am sitting at work so I know I didn't make these purchases. Maybe my cat did at home. He is pretty smart.

Thinking this was a scam, I typed in microsoft.com and navigated to their billing page (NEVER CLICK ON LINK IN AN EMAIL THAT LEADS TO LOGGING IN OR GIVING PERSONAL INFO LIKE THIS) and verified that both charges were made to my XBOX Live account and thus charged to my credit card I had on file.

I immediately called XBOX Live Support/Billing and told them about what was happening and the gentleman was very helpful. He immediately locked my account so now more purchases (cash purchases) could be made. However the thief could still spend all the MS Points that were on my account. Also, he said that he put a ticket in and their systems would start tracking the IP address of the thief while he was making the purchases.
Click to expand...
Click to expand...
i guess it's easier to be a journalist when your paycheck isn't tied up in the story.
 
M

MikeE21286

Member
Brian said:
He immediately locked my account so now no more purchases (cash purchases) could be made
Click to expand...

Missed a word there journalist :p

Anyways. Yeah, for all the grief that Sony got over their breach, I was never wrongfully charged for PSN points. Silver linings I guess...
 
N

Neuromancer

Member
However the thief could still spend all the MS Points that were on my account.
Click to expand...
That sucks.

Still though this guy sent in a tip to the Consumerist specifically; how are other sites supposed to have covered this story?
 
D

Dave Long

Banned
Something is definitely up. There are a lot of reports of this happening to people, including Desslock for those of you who have read his work over the years in various publications and online.

Microsoft really needs to comment.
 
C

Curufinwe

Member
Dave Long said:
Something is definitely up. There are a lot of reports of this happening to people, including Desslock for those of you who have read his work over the years in various publications and online.

Microsoft really needs to comment.
Click to expand...

Desslock who writes the PC Gamer RPG column?
 
G

gofreak

GAF's Bob Woodward
Ars Technica's games editor published an article about it this morning:

http://arstechnica.com/gaming/news/...-hacked-accounts-fifa-11-and-12-purchases.ars

I think it's not being picked up by game journos because most of them are possibly so used to being fed their news from the top down, and MS isn't saying anything about this. This is news coming from the grassroots up and that type of news spread slower. If and when MS comments, you'll probably see a lot more coverage.
 
T

TGMIII

Member
Dave Long said:
Something is definitely up. There are a lot of reports of this happening to people, including Desslock for those of you who have read his work over the years in various publications and online.

Microsoft really needs to comment.
Click to expand...

It's more than likely that someone or a group has got a database of email/passwords from some sort of gaming related site and are running them against everything under the sun that they could abuse. In the small chance that its directly related to microsoft then yeah they've majorly fucked up.
 
N

Neuromancer

Member
So any idea of how widespread this is?

Ars said:
The pattern is weirdly specific: gamers notice that unauthorized purchases have been made using their credit card information or existing points, and FIFA Soccer 11 or 12 has been played on their account.
Click to expand...
I don't know why I find this funny but I do.
 
S

See You Next Wednesday

Banned
Dave Long said:
Something is definitely up. There are a lot of reports of this happening to people, including Desslock for those of you who have read his work over the years in various publications and online.

Microsoft really needs to comment.
Click to expand...

Yeah, I have been seeing more people post about this happening to them recently.

Does anybody here visits black hat/cracking forums to see if there is some kind of break through exploit that thieves have found?

Hope it isn't as bad as what happened to PSN.
 
G

garath

Member
Sleep Arrest said:
Good thing I never left my credit card on my live account.
Click to expand...

The biggest problem is the hoops you have to jump through to remove a credit card. You have to call support, get approval from a supervisor and then wait 30 days for it to be removed.

It's beyond ridiculous.
 
N

Nexus Zero

Member
I had my account hacked two months ago, Microsoft did refund my pennies but I still don't have my gamertag back. Considering the amount of money I've spent on DLC and that you can't transfer save games between accounts, it's really fucking annoying. Every time I call up to complain I just get some hapless pratt telling me they don't have any contact with the fraud department (I'm sure they don't) so they can't tell me why things are taking so long.
 
H

HTuran

Member
Hm, the prevalence of FIFA is really, really strange. Especially since it's not just one game, but both FIFA 2011 and 2012.
 
S

Sleep Arrest

Banned
garath said:
The biggest problem is the hoops you have to jump through to remove a credit card. You have to call support, get approval from a supervisor and then wait 30 days for it to be removed.

It's beyond ridiculous.
Click to expand...

That's MS for you.
 
D

Dave Long

Banned
Curufinwe said:
Desslock who writes the PC Gamer RPG column?
Click to expand...
There can be only one!

He posted a thread on Quartertothree.com about it in the last month. Others started coming forward saying the same had happened to them. I have to say I'm a little worried, but I also have no valid credit cards associated with my account right now, either.

That ship sailed a long time ago with their auto-renewal bull where they apparently try various expiration dates until one works! Sony, Microsoft and Nintendo will only ever get codes from plastic or cardboard cards from me anymore. Too risky to have a credit card tied to these game consoles. They're just too big a target for hackers.
 
S

Sealda

Banned
Fifa? Must be chavs.

1077669-chav_super.jpg
 
H

Huff

Banned
If there is some kind of a breach, you would think MS would have learned from Sony that being coy and not saying anything doesn't go over well.
 
M

MikeE21286

Member
AgentOtaku said:
Hardly if ever touch my Xbox but my card is indeed on there. Is it easy to remove billing info?
Click to expand...

IIRC you need a CC on file to be a gold member on Xbox Live, regardless if you use the cards.

edit: wrong
 
S

Speedymanic

Banned
garath said:
The biggest problem is the hoops you have to jump through to remove a credit card. You have to call support, get approval from a supervisor and then wait 30 days for it to be removed.

It's beyond ridiculous.
Click to expand...

Not true at all.

You do have to call them up, but they remove it almost instantaneously. Sounds like you were unfortunate enough to get a shitty CS rep.

MikeE21286 said:
IIRC you need a CC on file to be a gold member on Xbox Live.
Click to expand...

Nope.
 
diffusionx

diffusionx

Gold Member
garath said:
The biggest problem is the hoops you have to jump through to remove a credit card. You have to call support, get approval from a supervisor and then wait 30 days for it to be removed.

It's beyond ridiculous.
Click to expand...

This sort of thing really should be illegal. It's my credit card, why is MS allowed to hold it hostage like this?
 
A

androvsky

Member
awwyeahgurrl said:
It's more than likely that someone or a group has got a database of email/passwords from some sort of gaming related site and are running them against everything under the sun that they could abuse. In the small chance that its directly related to microsoft then yeah they've majorly fucked up.
Click to expand...

According to Sony, that's exactly what's going on:
http://blog.eu.playstation.com/2011...rom-sonys-chief-information-security-officer/
We want to let you know that we have detected attempts on Sony Entertainment Network, PlayStation Network and Sony Online Entertainment (“Networks”) services to test a massive set of sign-in IDs and passwords against our network database. These attempts appear to include a large amount of data obtained from one or more compromised lists from other companies, sites or other sources. In this case, given that the data tested against our network consisted of sign-in ID-password pairs, and that the overwhelming majority of the pairs resulted in failed matching attempts, it is likely the data came from another source and not from our Networks. We have taken steps to mitigate the activity.
Click to expand...

So what are the chances the hackers running the ID/password combos tested just PSN and not Live?
 
N

NathanMcMahon

Banned
I think part of the problem with an investigative news story like this is that the gaming press for the most part is comprised of blogs and that format does not favor a real writer or reporter spending their time tracking a story down. They need to produce content at a ridiculously fast pace for the clicks. Sometimes reporters can spend a lot of time on a story like this and end up with nothing at all. A blog type media outlet probably feels (justly or unjustly) that they donlt want to spend money on it.
 
T

toythatkills

Member
All they have to do is close FIFA Ultimate Team and the hackings stop dead. Unfortunately it's probably a bit too much of a cash cow for them, even if all that cash is actually stolen.

If you want to see where your money's going, search eBay for "FIFA Ultimate Team" and look for all the auctions selling coins. These people hack accounts, buy shitloads of coins with your money, and then sell the coins on eBay. Easy money.

That's why it's always FIFA they play, it's because the Microsoft Points they steal can be effectively turned into cash (and then heroin). FIFA UT is unique in allowing this to happen.
 
N

Neuromancer

Member
toythatkills said:
All they have to do is close FIFA Ultimate Team and the hackings stop dead. Unfortunately it's probably a bit too much of a cash cow for them, even if all that cash is actually stolen.

If you want to see where your money's going, search eBay for "FIFA Ultimate Team" and look for all the auctions selling coins. These people hack accounts, buy shitloads of coins with your money, and then sell the coins on eBay. Easy money.

That's why it's always FIFA they play, it's because the Microsoft Points they steal can be effectively turned into cash (and then heroin). FIFA UT is unique in allowing this to happen.
Click to expand...
Crazy, absolutely crazy

One sock + free 100000 coins for fifa ultimate team xbox 360

Brand New Ink Pen + optional free 10,500 coins (360 fifa ultimate team 12)
 
P

Pakkidis

Member
Last year I lost 2000 pts from my account and I have no idea why. My account page just said -2000 pts. I called M$ and they couldn't give me an explanation.
 
V

venne

Member
toythatkills said:
All they have to do is close FIFA Ultimate Team and the hackings stop dead. Unfortunately it's probably a bit too much of a cash cow for them, even if all that cash is actually stolen.

If you want to see where your money's going, search eBay for "FIFA Ultimate Team" and look for all the auctions selling coins. These people hack accounts, buy shitloads of coins with your money, and then sell the coins on eBay. Easy money.

That's why it's always FIFA they play, it's because the Microsoft Points they steal can be effectively turned into cash (and then heroin). FIFA UT is unique in allowing this to happen.
Click to expand...

Dat allard laundering!
 
J

jiggles

Banned
Speedymanic said:
Eurogamer are reporting the issue is with EA servers
Click to expand...

That's a bizarre conclusion to make, given the guy they're quoting says he hates football and would never play FIFA. How the fuck, then, would his account have been hijacked using a vulnerability with FIFA?

My money's on the accounts being sold on a FIFA forum or something.
 
H

HTuran

Member
The report offers a number of explanations, including one specific to FIFA that involves hackers emailing EA support and the EA server then sending over the victim's Xbox and EA account information.
Click to expand...
Haha, no way is this true. EA can't store Xbox account information without breaching the Data Protection Act.
 
S

Speedymanic

Banned
HTuran said:
Haha, no way is this true. EA can't store Xbox account information without breaching the Data Protection Act.
Click to expand...

They can store gamertags.

Jigglywiggly said:
That's a bizarre conclusion to make, given the guy they're quoting says he hates football and would never play FIFA. How the fuck, then, would his account have been hijacked using a vulnerability with FIFA?

My money's on the accounts being sold on a FIFA forum or something.
Click to expand...

I've found people tend to exaggerate or outright lie in cases like this. Take his words with a pinch of salt.
 
M

MYeager

Member
jigglywiggly said:
That's a bizarre conclusion to make, given the guy they're quoting says he hates football and would never play FIFA. How the fuck, then, would his account have been hijacked using a vulnerability with FIFA?

My money's on the accounts being sold on a FIFA forum or something.
Click to expand...

Not a vulnerability with FIFA. If you have an EA account, which could've been created from playing any number of EA games and someone steals that information, then you could be in trouble if you used the same username/password combo as your EA account (IF someone has indeed hacked into the EA account database).
 
You must log in or register to reply here.

Similar threads

BT customers unknowingly charged for Xbox Game Pass
Business Cringe Platform 2 3
140
7K
foamdino replied
IGN: Phil Spencer Has Now Been Head of Xbox for 10 Years; We Look Back at His First Decade
Opinion Analysis 2 3
130
7K
ZehDon replied
VGC: "Phil Spencer, for so long cast as Xbox’s saviour, may ultimately be remembered as the man who killed it.”
Opinion Business 2 3
142
9K
March Climber replied
[Jez Corden] OPINION: This week's big Xbox drama showcases how little people trust Nadella's Microsoft — a legacy forged in the death of Windows Phone
2 3 4
164
12K
Rosoboy19 replied
Phil Spencer interview - Says that their intent is for all Xbox games, including Call of Duty, to be available on Xbox Game Pass Day One
2 3
102
6K
Kenneth Haight replied
Top Bottom