WTF? another hacked account?

Darkobra

Darkobra

Forge Runner

Join Date: Aug 2006

Scotland

Type like an idiot, I'll treat you like an idiot

E/Me

Quote:
Originally Posted by Lensor
(And yes, my account is linked to PlayNC)
If the others are, we may have found the source.

Malice Black

Site Legend

Join Date: Oct 2005

Quote:
Originally Posted by StormDragonZ
I see your point.

Nonetheless, this hacker seems to only steal Ecto and Dyes. Apparently, someone thinks they're the only thing worth something in Guild Wars.
Ecto and dyes can't be traced, and are easier to sell then most golds.

Lady Lozza

Lady Lozza

Forge Runner

Join Date: Dec 2005

Oz

Angel Sharks

Me/N

I think you will find many accounts are linked to PlayNC, they have to be to access the store.
The first instance of accounts being hacked due to NCSoft security holes was not too long after character slots became available for buying - and GW accounts became linked to PlayNC accounts. Part of the problem initially was that the email had to be the same (not sure if it still does) in order to link accounts. Brute force attacks are not that difficult. It wouldn't surprise me if with all the closing of security holes and bot crack downs that Anet have been doing that at least some RMT might turn to brute force hacking accounts for their gold supplies.

A hacker wouldn't necessarily clean an account out. And if they really are just in it for the cash, why bother wiping an account clean when they (already having a vaild account name) can come back and hack it later for more?

Foe

Foe

Banned

Join Date: Mar 2006

NCSoft isnt exactly N.O.R.A.D, why is it so hard to believe theres a server side cracker out there. Unlikely...but far from impossible.

Malice Black

Site Legend

Join Date: Oct 2005

I agree. Hacking into a big game company like NCSoft isn't going to be easy. A pro hacker isn't going to be worried about some lame ass pixels, from some computer game.

a-kyle

Krytan Explorer

Join Date: Apr 2008

A/R

Quote:
Originally Posted by enxa
Lucky for me i dont have any ectos.

or not. :|


I hope ANet support can track down your ectos through IP logs and trade logs, if such a thing exists, and return them. Or at least delete them so the hacker doesnt profit.
they most likly will track it down through trade and Iplogs

NoXiFy

NoXiFy

Wilds Pathfinder

Join Date: Aug 2007

★☆٭Ńēŵ~ŶờЯК٭☆★

The Benecia Renovatio [RenO]

Mo/Me

lol track down his ecto and get them back... thats funny. he's never seeing any of that stuff again.

SonofGrenth

Academy Page

Join Date: Apr 2006

The Netherlands

N/

Big chance he won't delete your characters, so he might come back later and get some stuff you have been trying to get back.

Foe

Foe

Banned

Join Date: Mar 2006

Quote:
Originally Posted by Malice Black
I agree. Hacking into a big game company like NCSoft isn't going to be easy. A pro hacker isn't going to be worried about some lame ass pixels, from some computer game.
those pixels can be easily monetized and your thinking hollywood. There are legions of teenagers w/ the technical abilities and motive. Its usually a human that gets "cracked" and provides the needed info anyway. Or some textmod qq i dunno, just saying dont rule it out

gone

Guest

Join Date: Jan 2007

I was wondering why I had to submit my info for the sweepstakes a few times...only thing suspicious that i've done in a few days.

Polgara Val

Wilds Pathfinder

Join Date: Apr 2007

TSR

Mo/Me

A friend of mine had everything stolen from his account or sold, deleeted, this includes about 35 + minis worth around 5 million plats, all his gold rare weapons, a collection of gree items and his rare crafting materials.

Understandably hes a bit annoyed about this hacker and lo and behold ANET has said and can do nothing about it, so yes gg Anet thus far on this.

Pol

Dylananimus

Dylananimus

Lion's Arch Merchant

Join Date: Mar 2007

The Eternal Champions

W/Mo

As for the hacking...I'm wondering if there is a spate of it at the moment, or if it's always been this way? I mean...are we only just now getting people talking about it, or is it a new problem/exploit/something dodgy going on?

Malice Black

Site Legend

Join Date: Oct 2005

My account is linked to the PlayNC site too. They'll have no luck with my acount though as I gave all my stuff to a guildie. Come the 20th May I won't be back.

Th Fooster

Frost Gate Guardian

Join Date: Apr 2008

Twice Dawns The Day[WoT]

Mo/

ok i would like to pooint out third party programs.
i remember a few weeks ago, there was one in ToA forming a group to UW.
he wrote an exploit that would alow an over sized party.Meanigng if you download his little exploit you should load in a map with 8 humans and each would have 3 heros, for a party of 32/8. This kid got us all on vent, and proved that his exploit worked but mapping out and loadn in with his own extra 3 heros to make the party11/8,and then gave the link once everyone was all fascinated by how he did that.. i did not trust it so i asked question.
he chalenged us al to scan it with anti virus. and i imedialey thought... hmm key loggers arent virsues and will not show up. i asked about this and he said i would just have to "trust" him. Then was kicked from the group once i refused to download his exploit. Because he was taking the risk of exposure by doing this with pugs.. i assumed he was already operating with a stolen account, and did not report due to the fact that anet has automated bots that handle reporting issues and tehy rarley even reach human eyes, an automated response is all i have ever gotten when i reported bugs and other isssues. Anyhow this happened and i know it does not indicate that he is the thief, but ANY third party programs are risky.Anet wil not have much mercy on you if they discover a third party program used on your account prior to your theft.You will simply get banned. You and anyone else that stole your stuff.

Anyone who is clever and knowlagable to write thier own hack like that would NOT use his own account to steal with, and i would not trust anyone with a third party program not one bit!
ever! i dont care how clevr and undetectable you think some of them are.As a result i have never been hacked in 3 years of play. So DONT let anyone convice you with techno babble talk on ho its suposed to be good. The more persistent they are the more they are shady.Like the pushy salesmen that tries to manipulate your impulses.

Kamatsu

Kamatsu

Moderator

Join Date: May 2005

Australia

A few points:

#1. If you think a post in in breach of the rules, is offensive, etc please use the "Report a Bad Post" link that each post has, a moderator will review the post and take action as deemed needed.
#2. If you have any question's about a moderator's action's, please either PM the mod, if you know their name, or another mod if you don't know the name and ask them that way. Do not ask about it publically.
#3. If you have an issue with a moderator's action's, you should PM the mod and discuss it with them, or pm a forum admin and they will look into it.
#4. Public discussion of moderator action's is against the Forum Rules
#5. Please take the time to review the rules, thank you:

http://www.guildwarsguru.com/content...nes-id2030.php

Aba

Aba

Wilds Pathfinder

Join Date: Dec 2006

Vancouver,Canada

I herd this guy is a mad hacker.


<----------------------

krypt1200

krypt1200

Banned

Join Date: Jul 2006

Atomik Fear [aF]

W/E

Maybe I left...i mean, the hacker left your other stuff in there because he doesnt want you to be discouraged in playing the game, he wants you to farm more ectoh for him. As well, maybe hes stupid, and thought stealing little by little from you wouldnt be as obvious, but 42 ectos is quite a bit

R_Frost

Lion's Arch Merchant

Join Date: Jan 2006

California

Me/

could be the thing in common is this site. 2 weeks ago going from the main website page to the forum pages all the damn pops up dumpped a bunch of trojans onto my computer. took a week of work to get them all out. they got by the internet security software i had, installed a different one, found a bunch of threats, then used 2 other programs to get rid of everything. changed my game password as soon as i got my machine cleaned up.

Age

Age

Hall Hero

Join Date: Jul 2005

California Canada/BC

STG Administrator

Mo/

I have checked other Guild Wars Boards and I haven't seen any threads like this one and the one from yesterday.I have only seen it atleast the English speaking ones.

Unlucky Slayer

Unlucky Slayer

RAGE INCARNATE

Join Date: Apr 2006

Sitting at The Guild Hall 2, being happy.

Nerd Clan [NK]

R/

Quote:
Originally Posted by R_Frost
could be the thing in common is this site. 2 weeks ago going from the main website page to the forum pages all the damn pops up dumpped a bunch of trojans onto my computer. took a week of work to get them all out. they got by the internet security software i had, installed a different one, found a bunch of threats, then used 2 other programs to get rid of everything. changed my game password as soon as i got my machine cleaned up.
If you have any information about what it was and where exactly you were looking at when your computer was infected and all that fun stuff please post it here: http://www.guildwarsguru.com/forum/s...php?t=10283360

$neekie

Academy Page

Join Date: Jun 2006

Netherlands

R/

I was wondering, in a game like bf2 there is alot of account spoofing/hacking. What they do is download a little software(freely avalible tru google), open sertain files replace there own pid number with the targetplayers, and go nuts with the account, using cheats, statpad,ect so the target account gets reset by ea or gets banned by PB. I know apples and oranges, because gw is mostly serverside, but still. Could this be done in GW? or something similar.

I surprised me that some files are so easy to acsess, same with the dat file thread here on guru. It surprises me that they allow that.

mzzls

Haskell

Ascalonian Squire

Join Date: Oct 2007

There is a reason why you should update your OS, Adobe Flash(!), your browser, use adblockers etc.

If the database of one of the big fansites would get leaked... well, let's say it would not be very nice. It's a good guess that around 5% of all regged users here have the same mail-account and pw in the forums as in the game. And enough of them would have a pw that is easy enough to be reversed (and no - 'computer1' is not a good pw). Now, this site here is hosted by people who have a clue - but how many are regged on guild-forums hosted on some private root-server by people that update their stuff once every 2 years... anyone remember ULGG? Yeah, yeah...

Knight O Cydonia

Knight O Cydonia

Frost Gate Guardian

Join Date: Apr 2007

No Goats No Glory [BAAA]

Me/

IMO No way would a hacker have a 'guilty conscience' to leave your cash, but take your ectos, they're scumbags pure and simple. Maybe he has maxed out storage from breaking into numerous accounts. I feel for your plight sir.

JR

JR

Re:tired

Join Date: Nov 2005

W/

Quote:
Originally Posted by Inde
2nd report of this in 2 days. Interesting. Only thing that makes it unusual is that people still have access to their accounts. Something to keep an eye on but the response is still the same, report it to Guild Wars support.
You can't change someones account info without their PlayNC details, right?

Shai Lee

Shai Lee

Krytan Explorer

Join Date: Aug 2006

Somewhere

As far as I'm aware, GW accounts linked to PlayNC are redirected to the PlayNC website for changes to GW account info.

Most players don't trust PlayNC security at all. Imagine the amount of players that don't make purchases from the online store because of that reason. Maybe if the company worked on player perception, in regards to PlayNC, they could remedy that.

As it stands, we haven't heard further on any type of security tests/monitoring/changes at PlayNC, so when we hear about hacked accounts we'll think it's due to PlayNC's poor security. Might not be true, but the company hasn't done much to alter this perception or to try to regain customer faith.

JR

JR

Re:tired

Join Date: Nov 2005

W/

Quote:
Originally Posted by Shai Lee
As it stands, we haven't heard further on any type of security tests/monitoring/changes at PlayNC, so when we hear about hacked accounts we'll think it's due to PlayNC's poor security. Might not be true, but the company hasn't done much to alter this perception or to try to regain customer faith.
I would assume that the recent spate of hackings are to do with keyloggers or the Guild Wars client, due to account info not being changed. It seems far more likely that the hacker couldn't get access to the related PlayNC accounts, or s/he could have just taken the whole account and stripped it bare, without the original owner able to log back in.

L|S >+>+G+<+<

L|S >+>+G+<+<

Krytan Explorer

Join Date: Jul 2006

sorry to hear about this mate, I had mine hacked at xmas time, the bitch took everything I had & deleted every char except one that I'd been working on for 2 years...I have a good idea of who it was.
Also one of the redeeming things (i think) is that anet should be able to see the ip address of your pc when logged in.

the hacker will have a different ip & so hopefully will get banned like the asshole should be.

my condolances on your loss, it sux royally but the fact they left your 100k in storage makes me wonder if it was a friend of yours or g/f / b/f that you gave your p/w too....

anyway, hope it gets resolved soon & NEVER give out your password - that last bit goes to everyone

Riot Narita

Desert Nomad

Join Date: Apr 2007

Don't know if this is relevant, but I checked my firewall logs a little while ago, and two things were weird:

a) it was blocking (yay) outgoing attempts to connect to a particular IP address. "whois" identified that IP address as belonging to "Lewt Inc." and Googling that name revealed them to be exactly what they sound like - a gold selling site (and I might add, I have never used or visited any gold selling sites).

b) My firewall was blocking repeated attempts to connect to my PC, from an IP Address that appeared to be PlayNC.com. I suspect this to be a spoof, since why would PlayNC attempt to connect to my PC? Perhaps the hope is that I will trust PlayNC and let them through my firewall (Yeah right. As if. Like even)

I run a truly absurd amount of security, anti-virus, anti-spyware, anti-rootkit, anti-suspicious behaviour, anti-everything software... always on, and multiple full scans per day. Nothing is detected. I use texmod downloaded from a "trusted" source, and Ventrillo for voice chat - but I've never used any other 3rd party software for GW. I've never visited or used any gold selling sites.

So why am I seeing a) above? My suspicion is malware on GW related sites/forums eg. adverts -

b) is worrying because it suggests someone knows I have a PlayNC game, and I am on a hitlist of people to be specifically targeted.

Is anyone else seeing similar activity?

Oukanna

Oukanna

Lion's Arch Merchant

Join Date: Apr 2007

Ancient Shaolin Guardians

E/D

Since i don't actually type anything in, when i load up guild wars to log in...does that make me safe from key loggers????
Just wondering, maybe if that is the case, everyone should get themselves a shortcut that allows them to just log straight in without typing anything.

Chrono Re delle Ere

Chrono Re delle Ere

Jungle Guide

Join Date: Jul 2006

The Land of Hyrule

[GoE]

W/

Uhm Oukanna I don't really know about it, but those info you use for the shortcut are saved somewhere on you pc, so I believe you can still be hacked. By the way, I don't really think that the hack comes from SoftNC side, I mean it would take too much effort (maybe) to hack into their server and steal info.

About the pop up thing on guru, some days ago a load of pop ups showed up for me as well, but Antivir didn't recognize any trojan or other kinds of malware. The only weird thing was that untill now FireFox did lock all pop ups on guru, dunno why he didn't that day....

Oukanna

Oukanna

Lion's Arch Merchant

Join Date: Apr 2007

Ancient Shaolin Guardians

E/D

Shame i don't know more about hacking-_-

Though, i would of thought if they use key logging, that only records inputted data, not searches through files?? but then again if they can put a key logger on your pc then i guess a program that can look through certain files would be simple.

You know, it could be as simple as the hacker gets random email addresses from perhaps guild wars guru (some people here have their email address showing, and everyone here plays guild wars) Then using a password hacker/key gen thing, that randomly tries combinations unitl it fits???

yishin

Frost Gate Guardian

Join Date: Jun 2007

Isle of Meditation

N/

Horrible.
About the NCsoft password issues, as far as I am concerned they fixed it. My GW account is linked to NCsoft. Before this meant you couldnt change your GW password. But a couple of months ago I found out by trying that it was already made possible to change GW password via NCsoft.
Hopefully ANet will make it more difficult/impossible to delete a toon, since that (think about experience, progress ingame and titles) is worth more than ectos or armors......

snodaard

snodaard

Jungle Guide

Join Date: Jun 2006

Holland

[Uni]

Mo/

I also got hacked, they stole all stuff on my monk and deleted it.
This hacking thingy costed me around 1.5 mil so...

Also anet couldn't help me at all, so i am abit disapointed right now...

Ctb

Desert Nomad

Join Date: Apr 2006

W/

Quote:
So why am I seeing a) above?
Could be any number of things as malicious as a trojan to as inoccuous as an image ad, iframe text ad, etc. Close out all of your applications, including any launchers (iTunes, Adobe, Office, etc.) and see if you still get them.

Quote:
from an IP Address that appeared to be PlayNC.com. I suspect this to be a spoof,
Spoofing an IP is generally impractical. If they spoofed the PlayNC IP, all the responses from your machine would be sent to PlayNC which would just send back a RST packet (or ignore you) because it wouldn't know what the hell your machine was talking about.

It COULD be a man-in-the-middle attack, but that also seems unlikely. Again, close out all your applications and check again for them.

inf3st

Frost Gate Guardian

Join Date: Apr 2007

Tennessee

The Mirror Of Reason [Snow]

Mo/Me

I feel the hacking deal is an issue. I just spoke with a guy a couple days ago that had and r2/3 koabd character and sever other max characters. He told me he logged in one day and had nothing. No characters no cash no nothing.

Imo. I think it's got to do with anets security.

Martin Alvito

Martin Alvito

Older Than God (1)

Join Date: Aug 2006

Clan Dethryche [dth]

Quote:
Originally Posted by Oukanna
Since i don't actually type anything in, when i load up guild wars to log in...does that make me safe from key loggers????
Just wondering, maybe if that is the case, everyone should get themselves a shortcut that allows them to just log straight in without typing anything.
You've traded one vulnerability for another. Instead of being vulnerable to a keylogger, you're vulnerable to having the information read from the file where the password is stored.

Arguably, your practice is superior because it is not a common practice (to my knowledge). However, it is easier to remotely read your files than it is to trojan a keylogger onto your system (though not by a wide margin if you protect your computer properly).

Star Gazer

Star Gazer

Wilds Pathfinder

Join Date: Nov 2005

Zerohour Enterprises [ZHE]

W/

i just use command line passwords....no typing

sorry to say, it sucks that this has happened to you. but reports of 2 accounts being hacked is no reason to say the sky is falling...yeah it sucks, but out of the millions accounts, 2 is rather small. again, sorry this happened to you man

Dylananimus

Dylananimus

Lion's Arch Merchant

Join Date: Mar 2007

The Eternal Champions

W/Mo

Quote:
Originally Posted by Star Gazer
i just use command line passwords....no typing

sorry to say, it sucks that this has happened to you. but reports of 2 accounts being hacked is no reason to say the sky is falling...yeah it sucks, but out of the millions accounts, 2 is rather small. again, sorry this happened to you man
See, that's what I was wondering. Is the sky falling - or something a little less dramatic? Or is this just 'normal' amounts of hacking going on.

I wonder if anybody from Anet could come let us know if they are getting more reports of hacking or not. It would be helpful to know, so we can all be extra vigilant, and change passwords and stuff more regularly (if there seems to be a problem somewhere).

I wouldn't care about ingame money that's made easily enough again, but I would be a little pissed if my main character went bye bye :/

MagicWarrior

Lion's Arch Merchant

Join Date: Jan 2007

Quote:
Originally Posted by R_Frost
could be the thing in common is this site. 2 weeks ago going from the main website page to the forum pages all the damn pops up dumpped a bunch of trojans onto my computer. took a week of work to get them all out. they got by the internet security software i had, installed a different one, found a bunch of threats, then used 2 other programs to get rid of everything. changed my game password as soon as i got my machine cleaned up.
Yes, the popups and stuff from GWG now have been causing problems here too.

luin_gunners

luin_gunners

Academy Page

Join Date: Apr 2007

Australia Land

Happened to a mate last year. He was silly enough to use his same email and password for GW and some other GW related website. Things stolen is gold and ectos, everything else lefted as is.

So...to OP...are you on the same silly boat as him?