XBL / EA servers compromised ?

zaphod79 · **Joined:** 16th Apr, 2008 **Posts:** 14518

Some links and posts from another forum that there seems to be something dodgy going on with XBL and specifically around FIFA

http://arstechnica.com/gaming/news/2011 ... chases.ars

Quote:

Ars Technica has received a number of reports from Xbox Live customers complaining about hacked accounts, unauthorized purchases, and a slow response from Microsoft itself. The pattern is weirdly specific: gamers notice that unauthorized purchases have been made using their credit card information or existing points, and FIFA Soccer 11 or 12 has been played on their account.

"Yesterday, my live account got hijacked and charged just over $100. Specifically, two large purchases of points followed by the download of FIFA 12, which had 2 achievements unlocked for the game, and every MS point spent on Gold Premium Packs and DLC," one reader wrote. His Xbox was turned off, and he learned of the breach from confirmation e-mails sent to his workplace.

Another gamer blogged about his account being breached:

"Sure enough, all of the Microsoft points that were stored in my XBL account had been spent on in game items for FIFA 11(I don’t own that game… hell, I don’t even like soccer video games) and whoever spent my MS points had then tried to purchase more. Presumably, when that purchase failed, they abandoned my account and went on to steal from some other unsuspecting gamer."

These online reports are becoming increasingly common, and Microsoft's response has been to lock down affected accounts for 25 days while the company investigates the charges. We've e-mailed Microsoft for comment, and have yet to hear back. For now, the best course of action is to keep a close eye on your account, and contact Microsoft if you see any fraudulent charges or notice FIFA-related activity in your achievement points or history.

http://www.eurogamer.net/articles/2011- ... fifa-packs

Quote:

A number of Xbox 360 owners have reported their accounts compromised and credit cards used to buy FIFA-related content.

Reports suggest FIFA Ultimate Team content packs are the target for those who have gained access to accounts.

Eurogamer was first alerted to the issue by reader Speedjack, who on 11th October found his gamertag had been "recovered" to someone else's machine.

"I then find out that I've had 5000 then 500 MS points bought on my credit card. Better yet, all the points including the 120 I had already on my account are gone... all spent on FIFA 12 content packs yesterday afternoon while I was at work.

"Not only that, but my account now has 35 FIFA 12 achievement points on it!!! Never played the game in my life - hate football."

Speedjack spoke to Microsoft support, which suggested there exists an issue with EA's servers that leaves XBL accounts vulnerable.

It is important to note that at this stage there is no evidence to support this claim, and it is unclear exactly how widespread the issue is.

However, Speedjack is not alone in having his XBL account compromised and used to buy FIFA-related items.

A detailed report on the Goosterblog recounts how one user suffered an XBL account hack - also used to buy FIFA Ultimate Team packs.

The report offers a number of explanations, including one specific to FIFA that involves hackers emailing EA support and the EA server then sending over the victim's Xbox and EA account information.

There is also a similar report on forum Facepunch, and multiple users' reports on the Xbox.com forum.

Microsoft support is freezing accounts affected for up to 30 days as it investigates complaints.

EA was unable to comment on the situation when contacted by Eurogamer, but the company did point our readers towards the EA forum, which offers advise on how to protect user accounts.

It contains information on fake emails and copycat websites, phishing, redirects, scare tactics and password integrity.

Microsoft advises any users affected to contact its Xbox support service. Its Account Security page has more information.

Trooper · **Joined:** 4th Mar, 2010 **Posts:** 22396

Yeah, saw that earlier today. It's weird that it is only related to Fifa games though...

TheVision · **Posted:** Fri Oct 14, 2011 17:39

I suppose it's good that Microsoft haven't got my card details.. I think.

myp · **Posted:** Mon Nov 21, 2011 11:25

My Xbox Live account's been hacked. £90 worth of points purchased on the account and then a load of marketplace stuff bought. Will take 25 days investigation and then another 15 days for my refund to be processed. Gah!

Zardoz · **Posted:** Mon Nov 21, 2011 11:33

Bloody hell. That's a pisser.

DavPaz · **Joined:** 27th Jun, 2008 **Posts:** 38667

Now's the time to remove your credit card details, chaps!

myp · **Posted:** Mon Nov 21, 2011 12:00

DavPaz wrote:

Now's the time to remove your credit card details, chaps!

I can't, or the refund won't process properly. I'll do it afterwards though.

DavPaz · **Joined:** 27th Jun, 2008 **Posts:** 38667

myp it wrote:

DavPaz wrote:

Now's the time to remove your credit card details, chaps!

I can't, or the refund won't process properly. I'll do it afterwards though.

Anything else have the same combo of email and password? Is so, change that shit!

myp · **Posted:** Mon Nov 21, 2011 12:13

DavPaz wrote:

myp it wrote:

DavPaz wrote:

Now's the time to remove your credit card details, chaps!

I can't, or the refund won't process properly. I'll do it afterwards though.

Anything else have the same combo of email and password? Is so, change that shit!

Nope, but I changed my email password just in case.

MrChris · **Joined:** 1st Apr, 2008 **Posts:** 30498

myp it wrote:

DavPaz wrote:

myp it wrote:

DavPaz wrote:

Now's the time to remove your credit card details, chaps!

I can't, or the refund won't process properly. I'll do it afterwards though.

Anything else have the same combo of email and password? Is so, change that shit!

Nope, but I changed my email password just in case.

I'm sure Davpaz also has some handy tips on how to suck eggs too, if you're struggling with that.

DavPaz · **Joined:** 27th Jun, 2008 **Posts:** 38667

Funny you should say that...

ZOMG Spoiler! Click here to view!

1. The Egg. Acquire an egg. An appropriately sized egg would be a chicken's egg or one similar in volume. This egg should be; a. Not too small, as a small egg might be too fragile, difficult to hold or could unexpectedly be aspirated and lead to choking; and b. Not too large, for too large an egg would require you to suck out too much material. Remember that volume increases in a cube function relationship to dimensional increases along a single axis. A goose egg twice as long as a medium chicken's egg and similar in proportion, therefore would contain about eight times as much suckable material.

2. Egg Purchase. You can pick these up by the dozen at your local grocery. If you think this operation will require practice, perhaps you should buy a full dozen. No recovery action against the Higher HQ is to be taken as a result of this purchase. Excessive purchase requirements may be submitted on the next cyclical.

3. Identification and Marking of the Ends of the Egg. Take an egg carefully in your hand, examine it and identify the smaller end. The smaller end may be identified by measuring the outside diameter one-third of the distance from each end of the egg, the end farthest from the greater cross-sectional circumference will be the "small end." This is the end upon which the sucking will occur. The other end is the large end and, therefore, will be the end furthest from you while sucking. Using a fine tipped felt marker, mark the ends of the egg now to differentiate them later without having to repeat this determination process. Mark the small end with an "S" (for small or suck) and the large end with an "O" (for the other end").

4. Piercing the Egg. Successful sucking of an egg requires that a small hole (see below for recommended sizes) is made in each end of the egg. The following guidance is provided to assist the staff officer in establishing a hole in each end of the egg:

a. Using a small pointed object (pin, pen, unfolded paperclip, staff officer's head, etc.) to make the small holes in each end of the egg

b. Make the "S" hole, through which all egg contents will flow in a short explosive journey, 5 mm in diameter;

c. Make the "O" hole, through which only air will travel, about 2 mm in diameter;

d. Place the holes at the points where the imagined line of the longitudinal axis of the egg would intersect its shell;

e. Do not use too vigorous an action or grip the egg too firmly while effecting the required piercing. Doing so might result in a crushed egg;

f. Ensure you pierce both ends of the egg. If you only pierce the large end, you will be attempting to suck the egg through its unbroken shell. If you only pierce the small end, no air can get into the egg as you suck. You could end up collapsing the egg or unexpectedly trying to swallow it. If you feel that one hole is sufficient, then ensure someone competent in the Heimlich manoeuvre is present.

5. Setting Down the Egg. Place the egg gently on your desk. You will not need it for the next step.

6. Confirming the Ability to Suck. Before actually sucking the egg, it is necessary to confirm that you know the requisite physical actions to effect sucking. Hold apiece of white bond paper vertically in front of your face such that it gently contacts the tip of your nose. Suck! If the paper does not appear to move, but only trembles slightly, you are in fact sucking. If the paper moves noticeably away from your face, you are not sucking, but blowing. This action is inappropriate. Practice sucking until you are able to do it without error. Put the sheet of paper back in the printer, or save it until the next time an egg must be sucked.

7. Picking up the Egg. Pick up the egg. Make sure you have picked up the prepared egg with the two end holes, marked "S" and "O".

8. Bringing the Egg in Contact with the Lips. Place the pierced egg against your lips, centering the "S" hole on an opening in your pursed lips. Ensure the lips are pursed or you may end up trying to brace the shell on your teeth with undesirable results.

9. Canting the Egg. Tilt the egg upwards to ensure all of the internal material tends to drain toward the lower hole in the small end of the egg.

10. Advise on Preparing to Suck. Ensure that you use an inward sucking action. Inadvertently blowing outwards will not be successful. "Blowing" could result in your workspace, or a watching fellow staff officer, being coated with albumen and yolk. You might end up with the requisite empty shell, but you have failed to follow issued direction and been left with a sticky mess. If you happen to "blow" the egg out of you grasp, you will not even be left with the empty shell.

11. Sucking the Egg. Suck!

12. What to do With a Mouthful of Albumen and Yolk. Swallow.

13. Result of the Successful Suck. If you have correctly selected your egg and followed the above instructions, you should now be left with one empty eggshell and a bad taste in your mouth.

myp · **Posted:** Mon Nov 21, 2011 23:24

myp it wrote:

My Xbox Live account's been hacked. £90 worth of points purchased on the account and then a load of marketplace stuff bought. Will take 25 days investigation and then another 15 days for my refund to be processed. Gah!

And I've got this as a response:

Quote:

Dear Xbox LIVE Customer,

We wanted to let you know that your report of unauthorised access to your Xbox LIVE account was reviewed by our fraud investigations team, and we didn't find any evidence of unauthorised access to your account.

If there are additional details that you think we should consider, please call Xbox Support and mention this Service Request Number: xxxxxxxxxxxx. We're happy to help resolve any problems with your Xbox LIVE account. We keep a record of all unauthorised access claims and their resolutions.

Our fraud investigations team also reviewed your billing history and didn't find any fraudulent purchases. To check the charges on your Xbox LIVE account please see: Learn how to check your Xbox LIVE bill.

At this time, your Xbox LIVE account is unlocked and ready for use.

If you've forgotten your Windows Live ID password, please go to accounts.live.com and click Forgot your Password?

To learn how to protect your Xbox LIVE account from unauthorised access, go to xbox.com/security. We strongly recommend that you follow these account security recommendations.

Thanks again for your understanding and patience, and thanks for being a member of Xbox LIVE!

What the everloving fuck? And no, no it's not unlocked and ready for use.

Alberto · **Joined:** 28th Jan, 2011 **Posts:** 1198

What the cunting arsefuck?!

WTB · **Joined:** 27th Mar, 2008 **Posts:** 14497

I'm a bit late because I don't read the nay thread, but my sympathies to Grim... I basically echo everything said above and I hope you're doing alright. You and your family. Thinking of you, man.

myp, hahahahahahahahahaha!

myp · **Posted:** Mon Nov 21, 2011 23:43

Yeah, fucking hilarious.

flis · **Joined:** 26th May, 2008 **Posts:** 3333

How the hell do they think almost £100 of points being purchased is 'normal activity'...?

What can you do now? Complain like fuck and hope for the best? It was shit when it was going to take so long but this is rather taking the piss.

Hope you get it sorted, fella.

WTB · **Joined:** 27th Mar, 2008 **Posts:** 14497

Aw I'm sorry I was just kidding. I know how frustrating dealing with them can be. Back when I wanted a refund for Quake Live (that I never did get by the way), I was on the phone to them for literally an hour, during which I had them calculate my total XBLA spend (over £700 at the time) to demonstrate my loyalty and how much of a value customer I was and that a refund was in their best interests. It was like talking to a wall. 'I am not authorised to refund.' Nor would she pass me onto someone who was. I nearly threw my phone at a fucking wall.

myp · **Posted:** Mon Nov 21, 2011 23:53

WTB wrote:

Aw I'm sorry I was just kidding. I know how frustrating dealing with them can be. Back when I wanted a refund for Quake Live (that I never did get by the way), I was on the phone to them for literally an hour, during which I had them calculate my total XBLA spend (over £700 at the time) to demonstrate my loyalty and how much of a value customer I was and that a refund was in their best interests. It was like talking to a wall. 'I am not authorised to refund.' Nor would she pass me onto someone who was. I nearly threw my phone at a fucking wall.

Now imagine if Quake Live cost you £90.

WTB · **Joined:** 27th Mar, 2008 **Posts:** 14497

Well yeah, exactly. At least we're giving @xboxsupport something to think about on Twitter!

Cras · **Joined:** 30th Mar, 2008 **Posts:** 49244

It's irritating that they're not acknowledging that there's an issue, even though it's clearly a flaw in EA account linking that's letting this happen.

myp · **Posted:** Tue Nov 22, 2011 10:06

Craster wrote:

It's irritating that they're not acknowledging that there's an issue, even though it's clearly a flaw in EA account linking that's letting this happen.

Worst case scenario: I instruct my bank to charge back and I lose my gamertag and all that entails.

At that point I will be selling it and buying a Playstation - they're good with personal data, yeah?

markh · **Joined:** 13th Oct, 2008 **Posts:** 903

Mine has been hacked too, the shits. Just had an email that someone tried to buy 6k of points, thankfully my card is out of date on file - and it's staying that way....

DavPaz · **Joined:** 27th Jun, 2008 **Posts:** 38667

What's the new vulnerability? Something to do with EA?

myp · **Posted:** Tue Nov 22, 2011 10:46

http://www.thesun.co.uk/sol/homepage/ne ... fraud.html

ApplePieOfDestiny · **Joined:** 17th Dec, 2008 **Posts:** 8293

Not XBL fraud, but I was mightily pissed off when I bought a 12 month prepaid card and didn't apply it immediately, my auto-renew then failed as I had let my card run out of date, and they won't let you enter a code redeem until you have paid up the shortfall due to the auto renew fail. Which means that I now have 24 months of XBL Gold, so I haven't 'lost' money, it is just a fucking ridiculous policy.

DavPaz · **Joined:** 27th Jun, 2008 **Posts:** 38667

myp it wrote:

http://www.thesun.co.uk/sol/homepage/news/3950691/Gamers-caught-in-Xbox-cyber-fraud.html

Are you admitting to falling for that?

myp · **Posted:** Tue Nov 22, 2011 11:14

DavPaz wrote:

myp it wrote:

http://www.thesun.co.uk/sol/homepage/news/3950691/Gamers-caught-in-Xbox-cyber-fraud.html

Are you admitting to falling for that?

It mentions password hacking as well as phishing - and no, I didn't fall for that. I've only given my password details to EA and they forced me to do that so I could play Battlefield 3 properly.

Anyway, spoke to an Irish guy called Keith and he says he's never heard of an investigation taking only three hours and must be a mistake. He's opened a new case for me.

Thread split, maybe?

DavPaz · **Joined:** 27th Jun, 2008 **Posts:** 38667

myp it wrote:

Thread split, maybe?

Indeed.

myp · **Posted:** Tue Nov 22, 2011 11:26

Now someone from the Nottingham Post wants to speak to me about it.

zaphod79 · **Joined:** 16th Apr, 2008 **Posts:** 14518

Although theres a similar thread here : viewtopic.php?f=3&t=7850

Microsoft have never (as far as I can see) said its anything other than phishing / using compromised credentials however there were a lot of queries over it being linked to EA servers and games

Quote:

"We do not have any evidence the Xbox Live service has been compromised. We take the security of our service seriously and work on an ongoing basis to improve it against evolving threats.

"However, a limited number of members have contacted us regarding unauthorised access to their accounts by outside individuals. We are working with our impacted members directly to resolve any unauthorised changes to their accounts.

"As always, we highly recommend our members follow the Xbox LIVE Account Security guidance provided at http://www.xbox.com/security to protect your account."

Telegraph are basically copying The Sun story

http://www.telegraph.co.uk/technology/v ... -case.html

Quote:

British console users have had an average £100 taken from their accounts but some customers have lost more than £200, it was claimed.

It remains unclear how many customers have been affected or how much money was stolen by the online gangs behind the "phishing" attacks.

But The Sun claimed that “thousands” of customers of the popular entertainment console were hit in 35 countries. Criminals were said to have made “millions of pounds” by tricking customers into disclosing personal vital information.

On Tuesday, executives from Microsoft, which operates Xbox Live, were investigating the cyber thefts, the newspaper reported.

The "phishing" gangs were thought to have stolen small amounts of money from credit cards over several weeks, which made it harder to detect the fraud.

As part of their scam, the gangs sent emails to players directing them to fake websites offering free Microsoft points that can be used to buy games.

Duped victims then entered their personal details, which allowed criminals access to their accounts and valuable credit card information.

They also reportedly befriend players online and convince them into volunteering personal details.

Paul Thompson, 29, of Essex, had £84 stolen from his account. "People need to know this is happening,” he told the newspaper.

The Sun said Xbox staff were working to protect users from more attacks. Company owner Microsoft has reportedly offered refunds to users who prove they did not give passwords away. It also warned customers to change their passwords.

Xbox is the latest video games firm to be targeted by hackers this year.

Valve, the firm behind Steam, a distribution network for major PC titles including Call of Duty and Skyrim, was hit earlier this month.

Codemasters suffered a security breach in June, and Sony was forced to shut down the PlayStation network for almost three weeks in April and May after the personal details of more than 70 million users were illegally accessed.

A Microsoft spokesman was unavailable for comment on Tuesday.

DavPaz · **Joined:** 27th Jun, 2008 **Posts:** 38667

zaphod79 wrote:

Although theres a similar thread here : viewtopic.php?f=3&t=7850

Merged

BikNorton · **Joined:** 30th Mar, 2008 **Posts:** 10174

ApplePieOfDestiny wrote:

Not XBL fraud, but I was mightily pissed off when I bought a 12 month prepaid card and didn't apply it immediately, my auto-renew then failed as I had let my card run out of date, and they won't let you enter a code redeem until you have paid up the shortfall due to the auto renew fail. Which means that I now have 24 months of XBL Gold, so I haven't 'lost' money, it is just a fucking ridiculous policy.

Too late now, but I had that last month - half an hour on the phone to a German in Xbox support got the Gold and outstanding charge cancelled, and gamertag unlocked, so I could bang in a code. It was 3 weeks after the fact too.

And make sure you go into your account on xbox.com, disable auto-renew and delete the credit card so it doesn't happen again.

Grim... · **Posted:** Tue Nov 22, 2011 11:44

myp it wrote:

Now someone from the Nottingham Post wants to speak to me about it.

Mention the URL!

Pundabaya · **Joined:** 30th Mar, 2008 **Posts:** 5016

Grim... wrote:

myp it wrote:

Now someone from the Nottingham Post wants to speak to me about it.

Mention the URL!

Look, we've told you, we're not pimping http://www.nakedposhoffroader.com

KovacsC · **Posted:** Tue Nov 22, 2011 11:51

Pundabaya wrote:

Grim... wrote:

myp it wrote:

Now someone from the Nottingham Post wants to speak to me about it.

Mention the URL!

Look, we've told you, we're not pimping http://www.nakedposhoffroader.com

would this be :hat:

or

TheVision · **Posted:** Tue Nov 22, 2011 11:55

How on earth do you prove that you haven't given your password away?

Zardoz · **Posted:** Tue Nov 22, 2011 12:04

TheVision wrote:

How on earth do you prove that you haven't given your password away?

You need a letter from a Policeman.

ApplePieOfDestiny · **Joined:** 17th Dec, 2008 **Posts:** 8293

BikNorton wrote:

ApplePieOfDestiny wrote:

Not XBL fraud, but I was mightily pissed off when I bought a 12 month prepaid card and didn't apply it immediately, my auto-renew then failed as I had let my card run out of date, and they won't let you enter a code redeem until you have paid up the shortfall due to the auto renew fail. Which means that I now have 24 months of XBL Gold, so I haven't 'lost' money, it is just a fucking ridiculous policy.

Too late now, but I had that last month - half an hour on the phone to a German in Xbox support got the Gold and outstanding charge cancelled, and gamertag unlocked, so I could bang in a code. It was 3 weeks after the fact too.

And make sure you go into your account on xbox.com, disable auto-renew and delete the credit card so it doesn't happen again.

Aye, did that afterwards. I know I could probably get the stuff dealt with, but I've paid for 2 years gold at 2011 price, I'll probably have saved money by the time this all runs out, but it is mischeivous to do the auto-renew block under the "we didn't want to discontinue your service" mantra, and hence potentially lock in higher renewal cost.

myp · **Posted:** Tue Nov 22, 2011 13:31

Spoken to the Nottingham Post. I even managed to shoehorn a car analogy in, just for Dimmerz.

BikNorton · **Joined:** 30th Mar, 2008 **Posts:** 10174

Yeah, it's properly twatty. Especially the way the Xbox asks if you want to turn auto-renew on, and answering no results in... auto-renew still being on.

They must be taking legal-advice-type stick about it now, with the changes to undo it over the phone and adding auto-renew-off and card-delete on xbox.com. They really should fix the console bit and stop turning it back on when you tap in a code though.

Bobbyaro · **Joined:** 18th Apr, 2008 **Posts:** 11898

How do you remove your CC details, it won't let me, it says,
"This payment option cannot be removed at this time. Go to the Payment method information page to view services associated with this payment option."

There is no obvious info there. Do you HAVE to have a CC to use XBL?

myp · **Posted:** Tue Nov 22, 2011 14:14

Microsoft Deny Hacking

Of course they would.

DavPaz · **Joined:** 27th Jun, 2008 **Posts:** 38667

Bobbyaro wrote:

How do you remove your CC details, it won't let me, it says,
"This payment option cannot be removed at this time. Go to the Payment method information page to view services associated with this payment option."

There is no obvious info there. Do you HAVE to have a CC to use XBL?

You can't remove it until your current Live gold sub has expired.

myp · **Posted:** Tue Nov 22, 2011 14:17

DavPaz wrote:

You can't remove it until your current Live gold sub has expired.

Which is patently absurd, considering you've already paid for it.

DavPaz · **Joined:** 27th Jun, 2008 **Posts:** 38667

myp it wrote:

DavPaz wrote:

You can't remove it until your current Live gold sub has expired.

Which is patently absurd, considering you've already paid for it.

Agreed. My gold is up on christmas day. To celebrate the birth of our saviour, I shall be yanking my CC details off the xbox. Amen.

KovacsC · **Posted:** Tue Nov 22, 2011 14:24

Had an email form MS, my family subscription get renews on 21st December for £69.99

metalangel · **Posted:** Tue Nov 22, 2011 14:29

I have changed all my passwords relating to this, just in case, and removed my CC details from Xbox Live. Unfortunately, the way I got myself those 36 months of Live means I also have my Paypal on my Live too and for some reason it won't let me remove that (something to do with it being tied into my £1 for 1 month of Gold thing) so bleh.

It wasn't helped by Dimrill casually mentioning on TA that myp and been jumping on and off Live... and so had I! It transpired I did it 'once, maybe twice' 'last night', last night being Sunday when I came home, turn on the 360 and immediately (almost) engaged 'appear offline' so I could use Last.fm without people messaging/inviting me. Still, whew, eh?

Poor myp. And FUCK EA for their idiotic insistence on their separate fucking servers that nobody wants.

NOBODY WANTS BATTLELOG. NOBODY WANTS AUTOLOG. NOBODY WANTS AN EA/ORIGIN ACCOUNT. FUCK OFF.

myp · **Posted:** Tue Nov 22, 2011 14:33

Zardoz · **Posted:** Tue Nov 22, 2011 14:39

Is this only effecting folk who made an EA BATTLELOG account thingy?

myp · **Posted:** Tue Nov 22, 2011 14:44

Zardoz wrote:

Is this only effecting folk who made an EA BATTLELOG account thingy?

No, it's affected anyone who's signed up to an EA account in order to play one of their games online. Fifa 12 was affected too.

Be Excellent To Each Other

XBL / EA servers compromised ?

Who is online