NCSoft security hole. Aion account logged on and stripped while subscription inactive

Scayth

Pre-Searing Cadet

Join Date: Jan 2010

05 Jan 2010 at 01:22 - 1
Quote:

Game Account Expired‏
From: NCsoft Support ([email protected])

Sent: Mon 11/23/09 2:42 PM
To: xxx

Your game account g****** for Aion has expired due to payment failure or cancellation.

If you would like to continue playing, you may reactivate using Account Management at http://us.ncsoft.com.

We hope to see you again soon!

- NCsoft Team



Aion Account Activated!‏
From: The Aion Team ([email protected])

Sent: Mon 12/21/09 7:15 PM
To: xxx

Congratulations! You have successfully activated your Aion game account.

Your Aion game account is: g******



You are currently on the 1 Month plan.

Your next payment is due Jan 22, 2010.

Your account is currently set to autorenew.

Soon you can spread your wings and take flight, exploring the celestial world of Atreia's breathtaking beauty and playing a pivotal role in restoring balance to a land shattered by cataclysm.




Discussion Thread
Response (XXX) 01/04/2010 04:58 PM
Hello,

The item theft took place between December 19th and 21st. Some characters were looted on the 19th and others were looted around 1AM on the 21st. I'm sorry for the delay in getting this all sorted out for you, which was due to an unusually high volume of support requests, and I can give you 15 days of free game time. You can add the following game time code to your Aion account using our account management website:xxx

Regards,
GM XXX
Customer (XXX) 01/03/2010 02:29 AM
Thank you for restoring my items and kinah. I am impressed. Everything was returned right down to the vendor trash I had in my inventory.

Now, there are still two things I need. The first is to have 12 days of game time added to my account to compensate me for the paid time I have been unable to play. The second is for you to tell me the exact date on which my items were stripped.
Not sure if something similar may be happening with GW accounts, but thought you guys should be aware of NCSoft's security breach.

Edit: This is what I have posted on Gaile's Wiki page, and should make things a little clearer.

Quote:
This pertains to Aion and not GuildWars directly, but as both are NCSoft games,and the current hacking incidents are occuring in both, I thought this information might be relevant to you. My Aion account was hacked last month and 4 of my characters were stripped of their gear and currency. I am aware of the current investigation concerning the NCMA page, but this goes way beyond that. You see, my account was logged in and stripped while my subscription was inactive. This was verified by NCSoft Support. My incident # is 091222-001044. I asked the GM who restored my items on what date the items were stripped. He responded that it occurred on Dec 19th and 21st, at which time my account was inactive. This clearly indicates that at least SOME of the hacks that are occuring are NOT the fault of the user being keylogged or phished, and are a direct result of a security hole either in NCSoft's servers, or their staff. I am fully willing to forward to you the relevant support ticket from my email if you cannot access it directly, as well as my activation/cancellation emails from NCSOFT. Scayth 03:04, 5 January 2010 (UTC) Scayth

Mustache Mayhem

Wilds Pathfinder

Join Date: Aug 2005

BEN

R/N

05 Jan 2010 at 01:37 - 2
I haven't been hacked and have other games on my ncaccount like lineage (inactive).. just wondering if it's something in common like a popular guildwars tool or other app alot of people use and noone bothered to check it for a backdoor

if everyone would list the apps they installed that relate to ncsoft games.. we might be able to narrow it down to something specific..

if it's just a ncsoft screwup or database leak, there's not much we can do as players beyond changing our passwords.. that could be why they asked us to do it.. could have been a database leak

Kattar

Kattar

EXCESSIVE FLUTTERCUSSING

Join Date: Mar 2007

SMS (lolgw2placeholder)

Me/

05 Jan 2010 at 12:07 - 3
This might be new, but it might not affect GW accounts.

As there's too much gray area, I'll open this back up for now.

Scayth

Pre-Searing Cadet

Join Date: Jan 2010

05 Jan 2010 at 12:12 - 4
Thank you, Katsumi. I should have been more detailed in my original post.

Scayth

Pre-Searing Cadet

Join Date: Jan 2010

06 Jan 2010 at 03:38 - 5
**NCSoft Support's Response**


Quote:
Discussion Thread
Response (X) 01/05/2010 08:44 PM
Hello,

We are already aware of what you described, but thank you for taking the time to mention it. If you have any other questions, please let me know.

Regards,
GM X

Customer (X) 01/05/2010 02:46 PM
Thank you very much for providing the information I requested and for the game time. It is much appreciated.

The reason I asked for the date on which the hacking occurred is because I suspected (for various reasons) that it had happened while my account was inactive, as you have just confirmed. If you check my account you can verify that my account went inactive on November 23rd due to non-payment/cancellation, and was not reactivated until the evening of December 21st. This means that the hacker was somehow able to log into my account on the live servers while I did not have an active subscription. I would suggest that you pass this information along to your superiors, as it is evidence of a major security breach at NCSoft. If you cannot verify what I have stated, please let me know, and I will help in any way I can. Thanks.

Response (X) 01/04/2010 04:58 PM
Hello,

The item theft took place between December 19th and 21st. Some characters were looted on the 19th and others were looted around 1AM on the 21st. I'm sorry for the delay in getting this all sorted out for you, which was due to an unusually high volume of support requests, and I can give you 15 days of free game time. You can add the following game time code to your Aion account using our account management website: x

Regards,
GM X

Customer (X) 01/03/2010 02:29 AM
Thank you for restoring my items and kinah. I am impressed. Everything was returned right down to the vendor trash I had in my inventory.

Now, there are still two things I need. The first is to have 12 days of game time added to my account to compensate me for the paid time I have been unable to play. The second is for you to tell me the exact date on which my items were stripped.


My interpretation:

Ok, so, the GM who responded to my latest ticket update is the same one who gave me the date/time that my account was stripped. Now, I think we can safely assume that the first thing he did when reading this was to re-check the logs to make sure he had not made a mistake. (Actually, that check was most likely made before I even updated my ticket. Why? Because I made sure it would be.) I believe we can also assume that if he had made a mistake, he would have let me know immediately. So, I am taking this as confirmation that the dates supplied originally are correct and that my account was accessed somehow while my subscription was inactive.

Let me repeat it, just to be clear. No amount of keylogging, phishing, or "user error" is going to allow a hacker to log in my character on the live servers while my subscription is inactive.

Any questions?

Smarty

Smarty

Krytan Explorer

Join Date: Mar 2008

England

Me/

06 Jan 2010 at 09:12 - 6
Not really anything anyone can say in response to this, other than to express amazement that it's even possible to access an inactive account. HOW?! It boggles the mind. Well spotted, thanks for posting it, and uhhh halp pl0x NCsoft? I hope it's just Aion accounts that are vulnerable to whatever the hell this security problem is - they have the option of full character restoration, GW accounts don't.

Aleta

Frost Gate Guardian

Join Date: Jan 2006

California

TTP

R/E

06 Jan 2010 at 15:15 - 7
Quote:
Originally Posted by Mister Smartypants View Post
Not really anything anyone can say in response to this, other than to express amazement that it's even possible to access an inactive account. HOW?! It boggles the mind. Well spotted, thanks for posting it, and uhhh halp pl0x NCsoft? I hope it's just Aion accounts that are vulnerable to whatever the hell this security problem is - they have the option of full character restoration, GW accounts don't.
Nope as a hacked account person it's GW also. And does GW account restoration impossible or they just don't want to do it.