Support NeoGAF

[AndyMoogle]

but that will slightly inconvenience me because i log into my friend's xbox to track my frags in halo (which invented fps)

So don't lock your gamertag to your own console. Options are great.

 

[Universaldamps]

Some more funny occurrences. I noticed today after my bank had refunded my money that microsoft also refunded me too. I called them up after I noticed, and the guy was surprisingly helpful. He sent me 500 MS points as an appreciation of my honesty, and said that the double refund was normal and it'd be adjusted (I don't know how they're going to do that, but anyway..)

 

[KevinRo]

Wow there are a lot of people in this thread claiming theft in a very short amount of time…

Microsoft likes to play it down. It's actually scary how many people have their accounts social engineered. I remember AOL use to have a horrible problem with this. Seriously, it's a crime that companies can get away with hiding information like this from authorities to help keep peoples personal information and money safe.

 

[Zoe]

Microsoft likes to play it down. It's actually scary how many people have their accounts social engineered. I remember AOL use to have a horrible problem with this. Seriously, it's a crime that companies can get away with hiding information like this from authorities to help keep peoples personal information and money safe.

You still think this is social engineering?

 

[ArrrrghX]

So after 4 weeks of waiting I called to see what the status on my stolen account was and I was told that I should hear back soon. 10 minutes later I got all of my emails and I am Blink again good to be back.

They even gave me 18 months of live!

 

[Speedymanic]

You still think this is social engineering?

I still think it is. Not enough accounts being hit for if to be a hack.

 

[VeryGooster]

I wrote a post about this a few weeks back because it happened to my friend and a lot of GAF members and I'm trying to get it passed around because seriously, "games journalism lolzz" should actually serve some purpose for a change:

[Link]

To be honest, if this is violating GAF's terms of service then I apologize, but I just want to get this problem made aware as much as possible and maybe GAF can get the word out better than I.

 

[Open Source]

I'm pretty sure that the majority of hacks are a result of hackers getting email and hashed passwords from forums and then using rainbow tables or other means to get the actual passwords.

MS reinstated my account today but without my Gold sub and minus 80 points I had before the hack. I'll give them till Monday then will try to get those back.

 

[Metal Gear?!]

Even though the gaming enthusiast media is deathly scared of covering this, The Consumerist has finally picked it up:

http://consumerist.com/2011/10/i-watched-live-as-id-thieves-spent-my-money-on-xbox-live.html

I received 2 emails from billing@microsoft.com. 1 was for 4000 Microsoft XBOX Live Points ($49.99) and the other for 6000 Points ($74.99). I am sitting at work so I know I didn't make these purchases. Maybe my cat did at home. He is pretty smart.
Thinking this was a scam, I typed in microsoft.com and navigated to their billing page (NEVER CLICK ON LINK IN AN EMAIL THAT LEADS TO LOGGING IN OR GIVING PERSONAL INFO LIKE THIS) and verified that both charges were made to my XBOX Live account and thus charged to my credit card I had on file.

I immediately called XBOX Live Support/Billing and told them about what was happening and the gentleman was very helpful. He immediately locked my account so now more purchases (cash purchases) could be made. However the thief could still spend all the MS Points that were on my account. Also, he said that he put a ticket in and their systems would start tracking the IP address of the thief while he was making the purchases.

This last point doesn't really mean all that much. I am a very knowledgeable computer security individual and know that for someone to do this as quickly as they are, I am sure they are in a hotel under a false name and credit card so it can't be traced back to them.

I was informed that I would need to call Microsoft back when I get home with the Serial # and ID # of all my XBOX's (I have 3) so they can verify that the purchases were not made on my systems... I just hope someone didn't break in to my condo and steal them. Once I give Microsoft that information, they will review it and within 25 days they will refund my money.

I watched from my computer as the account went from 10,680 MS Points down to 70. There is nothing on XBOX Live Market Place that is under 120 points ($.99) so I am sure they left it at that and are moving on to the next victim.

 

[Fortinbras]

I've been reading more and more about these hacks lately. In the past few days some threads popped up in German gaming forums, even a writer for Gamepro Germany lost control over his account:
http://www.gamepro.de/news/spiele/ps3/sport/fifa_12/2561319/fifa_12.html

 

[shadyspace]

Patrick Klepek over at Giant Bomb is looking for people's stories of being hacked. Hopefully he'll give this debacle the coverage it deserves. Email him at patrick@giantbomb.com if you're interested.

 

[Speedymanic]

I love how people are so manner of factly claiming it's a hack when there's absolutely no proof of MS being compromised.

 

[madmackem]

I love how people are so manner of factly claiming it's a hack when there's absolutely no proof of MS being compromised.

I think people just lob it all in the term hack, people say they get the facebooks hacked all the time when its just social phising and such. I have a feeling this will be along those lines with the email used for live being used for so many other things with it being a live or a hotmail or something along those lines it leaves it open to being "hacked".

 

[Speedymanic]

I think people just lob it all in the term hack, people say they get the facebooks hacked all the time when its just social phising and such. I have a feeling this will be along those lines with the email used for live being used for so many other things with it being a live or a hotmail or something along those lines it leaves it open to being "hacked".

The danger is that if/when sites start to report on this and claim that MS have been hacked and it's found that they in fact weren't hacked, won't those sites be knee deep in a barrel of shit for making erroneous claims?

And I have to agree, as much as people protest that they haven't used the same email anywhere, it's pretty obvious that they did and either forgot about it or don't want to admit that it might, partly, be their own fault.

It's anecdotal, but myself and many others I know haven't had our accounts compromised, but then we were smart enough to use a unique hotmail account and to change our passwords every couple of months.

 

[Metal Gear?!]

I love how people are so manner of factly claiming it's a hack when there's absolutely no proof of MS being compromised.

Yes we know it's technically cracking, not hacking. No one cares.

 

[The Faceless Master]

Even though the gaming enthusiast media is deathly scared of covering this, The Consumerist has finally picked it up:

http://consumerist.com/2011/10/i-watched-live-as-id-thieves-spent-my-money-on-xbox-live.html

you can't really compare the gaming media to consumer advocates like the consumerist staff, it's not fair.

 

[test_account]

And I have to agree, as much as people protest that they haven't used the same email anywhere, it's pretty obvious that they did and either forgot about it or don't want to admit that it might, partly, be their own fault.

While there is a chance for it, i wouldnt say that this is obvious. For some reason it seems to be affecting Xbox Live customers much more than other services. If it was simply the case of people being careless with the use of the same email and password several of places, then i think we would see more stories about abuse on Steam and PSN as well recently.

 

[Speedymanic]

While there is a chance for it, i wouldnt say that this is obvious. For some reason it seems to be affecting Xbox Live customers much more than other services. If it was simply the case of people being careless with the use of the same email and password several of places, then i think we would see more stories about abuse on Steam and PSN as well recently.

It could be related to phising scams where you punch in your details for 'free' points. I've known many a person who should know better to fall for it.

Maybe it's related to hotmail? Who knows, the problem is that there's no proof MS have been hacked, it's wrong and irresponsible to continue to use that word/level those accusations without proof. People will naturally panic when false claims of MS being hacked hit gaming sites.

Yes we know it's technically cracking, not hacking. No one cares.

They should. There's a world of difference between cracking and hacking. Reporting on one won't get you into trouble, reporting on the other without proof will get in you quite a bit of shit.

 

[MrKyle]

I also had my account compromised a couple of days ago. Received an email that I had received two charges: one for $49.99 and the other for $74.99.

Called support and they were very helpful. Still waiting for my credit card company to reverse charges.

I rarely use my 360 too.

 

[matrix-cat]

I had my account hacked a couple of weeks ago, I didn't realise it was turning into a thing. I woke up to some e-mails confirming my purchase of two lots of 6000 points and two 12 month live subscriptions, to the tune of about $330 Australian. I called the number and spoke to an American lady who immediately suspended my account but not a whole lot's happened since then. A couple of days ago the fraud squad from my bank called me to let me know that someone in America has just been straight up buying things with my Credit Card, so that's pretty great.

 

[Speedymanic]

So it looks like it might be a EA server related issue,

A number of Xbox 360 owners have reported their accounts compromised and credit cards used to buy FIFA-related content.

Reports suggest FIFA Ultimate Team content packs are the target for those who have gained access to accounts.

Eurogamer was first alerted to the issue by reader Speedjack, who on 11th October found his gamertag had been "recovered" to someone else's machine.

"I then find out that I've had 5000 then 500 MS points bought on my credit card. Better yet, all the points including the 120 I had already on my account are gone... all spent on FIFA 12 content packs yesterday afternoon while I was at work.

"Not only that, but my account now has 35 FIFA 12 achievement points on it!!! Never played the game in my life - hate football."

Speedjack spoke to Microsoft support, which suggested there exists an issue with EA's servers that leaves XBL accounts vulnerable.

It is important to note that at this stage there is no evidence to support this claim, and it is unclear exactly how widespread the issue is.

However, Speedjack is not alone in having his XBL account compromised and used to buy FIFA-related items.

A detailed report on the Goosterblog recounts how one user suffered an XBL account hack - also used to buy FIFA Ultimate Team packs.

The report offers a number of explanations, including one specific to FIFA that involves hackers emailing EA support and the EA server then sending over the victim's Xbox and EA account information.

There is also a similar report on forum Facepunch, and multiple users' reports on the Xbox.com forum.

Microsoft support is freezing accounts affected for up to 30 days as it investigates complaints.

EA was unable to comment on the situation when contacted by Eurogamer, but the company did point our readers towards the EA forum, which offers advise on how to protect user accounts.

It contains information on fake emails and copycat websites, phishing, redirects, scare tactics and password integrity.

Microsoft advises any users affected to contact its Xbox support service. Its Account Security page has more information.

http://www.eurogamer.net/articles/2011-10-14-xbl-accounts-hacked-to-buy-fifa-packs

 

[Ben Sones]

Maybe it's related to hotmail? Who knows, the problem is that there's no proof MS have been hacked, it's wrong and irresponsible to continue to use that word/level those accusations without proof. People will naturally panic when false claims of MS being hacked hit gaming sites.

Here's an anecdote from a friend of mine that got hit. I've known him for over ten years, and he's written for various gaming publications since the 90s. So I consider him a reliable source of information.

He had an Xbox Live account that had only ever been used/accessed from the console. Strong password, and one that was unique to the account--never used on PSN, or anywhere else. And yet, his account was compromised, same MO as all the various reports in this thread. I find it wildly unlikely that crackers are brute-forcing strong passwords, and he insists that the only place he's ever typed the password is on his console. He's never played FIFA. He, at least, is convinced that there is a security hole on Microsoft's end. His (and other people's) stories were enough to convince me, as well. I called Microsoft last week and cancelled my Gold account so that I could remove my CC info from my account.

BTW, how crazy is it that you have to call MS customer support to cancel your Gold membership and edit payment information, and yet someone from China can log onto a North American Xbox Live account and start spending points willy-nilly, and the service doesn't even bat an eye? There's a pretty damning story here even if you avoid drawing any conclusions about hacking. My personal prediction: There's a scandal brewing that will end up being at least as bad as the RROD fiasco.

 

[Speedymanic]

Here's an anecdote from a friend of mine that got hit. I've known him for over ten years, and he's written for various gaming publications since the 90s. So I consider him a reliable source of information.

He had an Xbox Live account that had only ever been used/accessed from the console. Strong password, and one that was unique to the account--never used on PSN, or anywhere else. And yet, his account was compromised, same MO as all the various reports in this thread. I find it wildly unlikely that crackers are brute-forcing strong passwords, and he insists that the only place he's ever typed the password is on his console. He, at least, is convinced that there is a security hole on Microsoft's end. His (and other people's) stories were enough to convince me, as well. I called Microsoft last week and cancelled my Gold account so that I could remove my CC info from my account.

BTW, how crazy is it that you have to call MS customer support to cancel your Gold membership and edit payment information, and yet someone from China can log onto a North American Xbox Live account and start spending points willy-nilly, and the service doesn't even bat an eye? There's a pretty damning story here even if you avoid drawing any conclusions about hacking. My personal prediction: There's a scandal brewing that will end up being at least as bad as the RROD fiasco.

Looks like it's a fault on EA's end. It might not be Fifa related, maybe their servers are just unreliable? (still unconfirmed though, but it does look like that's where the breach has taken place)

And I absolutely agree. It's very depressing MS doesn't employ some kind of IP checker every time you log on. At the very least they should temp freeze an account until you've confirmed that you logged in from China, Russia, etc.

I don't know about any of the tech that they'd need, but surely it exists and it can't be that expensive in comparison to how much they earn from XBLG and the potential losses if they were to ever the subject of a mass hack like PSN was.

 

[Zoe]

Looks like it's a fault on EA's end. It might not be Fifa related, maybe their servers are just unreliable? (still unconfirmed though, but it does look like that's where the breach has taken place)

How would EA servers have access to Xbox login info though?

 

[Grecco]

How would EA servers have access to Xbox login info though?

IIRC EA Servers need your email/xbox account. With those 2 things you can social engeneer the password.

 

[Ardenyal]

Looks like it's a fault on EA's end. It might not be Fifa related, maybe their servers are just unreliable? (still unconfirmed though, but it does look like that's where the breach has taken place)

If EA really was breached wouldn't there be reports of similar activity on PSN? I don't think there would be much of a difference with how EA stores their customers accounts whether it's on XBL or PSN.

 

[Grecco]

If EA really was breached wouldn't there be reports of similar activity on PSN? I don't think there would be much of a difference with how EA stores their customers accounts whether it's on XBL or PSN.

You mean something like this? http://popwatch.ew.com/2011/10/12/playstation-network-hacked-sony/

 

[Zoe]

IIRC EA Servers need your email/xbox account. With those 2 things you can social engeneer the password.

There are many places where people could find email addresses. Why would EA be the one?

 

[Speedymanic]

If EA really was breached wouldn't there be reports of similar activity on PSN? I don't think there would be much of a difference with how EA stores their customers accounts whether it's on XBL or PSN.

There are reports of PSN being hacked, no idea if it's related.

And I'm pretty sure it's different with PSN, to buy content with a CC, you need to enter your 3 digit security pin every time...XBL doesn't have that requirement which makes it easier for those who've compromised the accounts to buy content.

 

[Grecco]

There are many places where people could find email addresses. Why would EA be the one?

Not many places where you would have the XBL tag + Email

 

[Ardenyal]

You mean something like this? http://popwatch.ew.com/2011/10/12/playstation-network-hacked-sony/

We don't know if that hack is related to this, could be that Sony has improved their security and they could prevent the charges made on CC or it's an unrelated hack.

 

[gcubed]

It could be related to phising scams where you punch in your details for 'free' points. I've known many a person who should know better to fall for it.

Maybe it's related to hotmail? Who knows, the problem is that there's no proof MS have been hacked, it's wrong and irresponsible to continue to use that word/level those accusations without proof. People will naturally panic when false claims of MS being hacked hit gaming sites.



They should. There's a world of difference between cracking and hacking. Reporting on one won't get you into trouble, reporting on the other without proof will get in you quite a bit of shit.

highly doubtful. Haven't seen anyone get in "quite a bit of shit" last week

 

[AndyMoogle]

I believe that you can choose any email that you want to associate with EA on PS3, but on 360 you have to use the same email as your gamertag is using.

At least that's how I remember it, but I might be wrong.

 

[Zoe]

And I'm pretty sure it's different with PSN, to buy content with a CC, you need to enter your 3 digit security pin every time...XBL doesn't have that requirement which makes it easier for those who've compromised the accounts to buy content.

Only the first time. And they actually didn't require it before the store was revamped, IIRC.

 

[Iadien]

A friend's xbox account was hacked a few weeks ago, over $200 was spent.

 

[Ramma2]

Add my name to the list. Got hit with an email yesterday that a 6000 point purchase failed since my card was incorrect (numbers had changed when I got a new card). I logged in and changed my Live password.

I do have an EA account but for Mass Effect, never have played FIFA.

Edit: Apparently I had Mass Effect, Dragon Age, and NFS Hot Pursuit on my EA account. Changed my password there as well.

 

[drizzle]

Jeff, over at giantbomb.com, does a Premium Video where he talks about user questions. In the middle of the video, he received a SMS message and went all "hmm... interesting..." looked at the camera "I'm not gonna say what that said.... look out for your xbox live accounts... uhm... some weird stuff with the Fifa Ultimate Team.. it started anecdotaly with some people saying "hey, somebody stole my account" and it became more and more widespread"

Back in July my account was hacked and used to buy a shitload of Fifa stuff. Microsoft gave me back my account in two weeks, refunded my CC and MSPoints. I wonder if these are related. I already changed my password and everything, should I do it again?

 

[alr1ght]

ars technica covering it
http://arstechnica.com/gaming/news/...-hacked-accounts-fifa-11-and-12-purchases.ars

Ars Technica has received a number of reports from Xbox Live customers complaining about hacked accounts, unauthorized purchases, and a slow response from Microsoft itself. The pattern is weirdly specific: gamers notice that unauthorized purchases have been made using their credit card information or existing points, and FIFA Soccer 11 or 12 has been played on their account.

"Yesterday, my live account got hijacked and charged just over $100. Specifically, two large purchases of points followed by the download of FIFA 12, which had 2 achievements unlocked for the game, and every MS point spent on Gold Premium Packs and DLC," one reader wrote. His Xbox was turned off, and he learned of the breach from confirmation e-mails sent to his workplace.

Another gamer blogged about his account being breached:

"Sure enough, all of the Microsoft points that were stored in my XBL account had been spent on in game items for FIFA 11(I don’t own that game… hell, I don’t even like soccer video games) and whoever spent my MS points had then tried to purchase more. Presumably, when that purchase failed, they abandoned my account and went on to steal from some other unsuspecting gamer."

These online reports are becoming increasingly common, and Microsoft's response has been to lock down affected accounts for 25 days while the company investigates the charges. We've e-mailed Microsoft for comment, and have yet to hear back. For now, the best course of action is to keep a close eye on your account, and contact Microsoft if you see any fraudulent charges or notice FIFA-related activity in your achievement points or history.

 

[Vilix]

Like Sony, Microsoft will never EVER admit there's a problem until this becomes way more wide spread, and common knowledge. <_<

 

[madmackem]

I believe that you can choose any email that you want to associate with EA on PS3, but on 360 you have to use the same email as your gamertag is using.

At least that's how I remember it, but I might be wrong.

Nope mine is different from my live email account and you can change it anytime in an ea game, infact when you first boot up an ea game it will ask you if this email is still the right one. Its the way i got my ea account back that was using an email account i no longer had access too.

 

[sixghost]

To anyone that's had this happen to them, Patrick Klepek from GiantBomb put out the call for emails from people who've been hacked on his twitter. It's possible he's going to do a story on it.

patrick@giantbomb.com

 

[drizzle]

I just emailed him my story, even tho he asked for "Recently" and my account was stolen back in July. However, the MO is the same as the hacks happening now.

A friend of mine who just had his account compromised two days ago also. We are pretty sure that our passwords were the same as the PSN passwords we used (we both don't really have a PS3, so we never use our PSN accounts and we can't quite remember what our passwords were at the time of the hack). So maybe the PSN password list has been released? I don't know.

We'll see what's Patrick's story

 

[xemumanic]

I'm pointing a finger of blame at EA for a lot of this. They should have NEVER been allowed to run their own Xbox Live servers. I remember when everyone was saying how stupid it was that MS wanted sole control of them. Now look at this BS that's going on.

I'm not saying that MS can't possibly be to blame for whats going on, none of us really know the truth, but the more details I see, the more I think EA is at fault here.

 

[NG28]

This just happened to one of my friends about 2 weeks ago. They purchased 10,000 ms points and downloaded a bunch of DLC. MS must be getting really good at cleaning this up by now because he got his account back in about a week and was refunded the money. He said he gets to keep all the stuff that was purchased too. Just to tie this into that EA server thing, he does play a lot of Madden.

 

[chubigans]

So...whats in it for the hackers exactly when they spend all this money on marketplace DLC?

 

[xemumanic]

So...whats in it for the hackers exactly when they spend all this money on marketplace DLC?

Not very well thought-out. Thing is, a lot of these hackers are kids (younger than 18). They don't really see the consequences.

It doesn't explain all of them, but yeah, there's little logic in any of this. Reminds me of the one GAFer whose account was stolen, and someone who claimed he bought it CALLED him. That he'd be an asshole if he had it banned.

 

[drizzle]

So...whats in it for the hackers exactly when they spend all this money on marketplace DLC?

If it's the same thing that happened to me, picture Trading Cards.

FIFA has a thing where you can buy (with money) some Trading Cards. It's random what you get, but you can get rare players for your soccer team. Those cards can then be traded with other players (as far as I know).

Now imagine if somebody hacked into somebody elses account, used their points to buy a shitload of those cards (it was 44 purchases on my account), and then sell/trade those cards away?

That's what happened on my account, I believe.

Disclaimer: I don't play FIFA, never did, so I don't know. All I know is that Fifa 10 had that mechanic, just like Fifa Free has it on PC.

 

[Danexmurder]

So...whats in it for the hackers exactly when they spend all this money on marketplace DLC?

They're selling Fifa coins on ebay.

 

[A Twisty Fluken]

So...whats in it for the hackers exactly when they spend all this money on marketplace DLC?

My guess is it's a two part equation. The account is compromised, then sold for earth dollars to another person, who redeems the points as if they were their own. There are several sketchy marketplaces on the Internet where these kinds of transactions could take place, and for the person on the ultimate end of this, they're spending a few dollars and getting a pile of points.

 

[drizzle]

My guess is it's a two part equation. The account is compromised, then sold for earth dollars to another person, who redeems the points as if they were their own. There are several sketchy marketplaces on the Internet where these kinds of transactions could take place, and for the person on the ultimate end of this, they're spending a few dollars and getting a pile of points.

That's another thing. That's when they steal somebody elses account, charge a buncha points in it, share that account to somebody else, then that person can buy whatever they want in the marketplace wit hthose points.

That account later gets reclaimed, but the person that bought the games still has them on their HD and they're the full version of the game. They can't ever delete them, but they already got them.

It's not the same thing and somebody hacking your account and buying millions of fifa coins/trading cards