XBox Live account hacked


Sugarfix

Sugarfix

Member
Joined
Mar 7, 2011
Messages
240
I thought I'd warn people of what's just happened to me...


Like many people here, I own a multitude of consoles the PS3 and the 360 amongst them. I'm sure anyone who owns a PS3 and went through the panic over whether their credit card details were compromised during the great Sony Hacking fiasco, only to find that nothing came of it would have been quite relieved.


However, last night I received an email (2 in fact) from Microsoft, thanking me for my purchase of 5000 points at a cost of £45 (twice)


Now, I've not been on my 360 for months (I had 890 MS points on my account) so I fired it up to find that I needed to recover my gamertag. I then found I needed to recover my password too.


Alarm bells are now ringing...


I recover my account to find I'm booted after a couple of minutes. My account has immediately been recovered to another console and the password changed.


I recover both again. In the process I change the method of password recovery to an SMS to my phone. I also change my password immediately on my Xbox to something random thus ruling out any keylogger on my PC (I was also by this time using the on-screen keyboard on my PC to added security)


By this point my account had gone from 890 points to 10890 points and down to 6010 when I called it a night thinking that all seemed well and my account was secure... or so I thought.


I tried to log on again this morning to find I needed to recover both my password and gamertag again. When I got in I had just 10 MS points left, a bunch of DL content for Fifa 12 had been purchased and anything worth having transferred out.


I spoken to MS who have suspended my account pending an investigation and also to my bank to have the charges refunded to me, which they can't do until they show on my account. yes, I was that fast.


Microsoft claim to know nothing about this, but reading up on blogs and forums this is a known vulnerability exploit going back to Fifa 11 and EA and MS can't seem to plug this hole!


So, my advice for you:


If you've got an XBox live account, remove your automatic subscription to Gold and then remove your credit card details. If you're going to use it, just buy enough points for what you need on prepaid cards and use it that way.


Be safe out there people.
 
Is there any good side to this micropayment fuelled DLC bullshit? Bar the cash that publishers are now raking in.


That it's even possible for someone to use my account to buy shit in a game I don't even own and send it to themselves without it being obviously traceable is madness.


For starters, wont they have logged onto *their* Xbox with *your* account? Thus making it clear as crystal which Xbox should subsequently be permanently banned from Xbox Live. Not to mention, if they've logged onto their personal account with that Xbox, then the only account without suspicious activity or reports of theft is logically theirs. If that has any personal information within it, it should be used to nail them to the wall for fraud.
 
Quite so.


I pointed out to the MS rep on the phone that they could just look at my account, see that I've never played Fifa 12 (or any Fifa game) on my Console ID (they needed my console serial number and the console ID) and simply refund the money to my bank account and my missing MS points.


Apparently, that takes up to 25 days...


If that process takes up to 25 days, how many investigations do you think they're handling of a similar nature? A quick Google of - xbox live fifa 12 account hack point stolen - would suggest thousands.
 
Microsoft should take a page out of Steam's book, and prevent logging into Xbox Live on a new console until a verification code, which is emailed or TXTed to you, is entered.


Or, alternatively, Battle.net's Authenticator solution.


The benefit of this on the Xbox is the unique console IDs/serial numbers mean you wouldn't have to keep re-authenticating your own Xbox.


Also, any credit card purchase should require re-entry of password. I'm amazed how Google get away with tying credit cards to Android phones without any password prompt.


I had an Xperia Play in for review, and had bought several things from the store (thinking it was primed with a review account) before realising that someone had left their account details on the phone.


I dislike anything that taps directly into my credit card; this is one of the reasons why I wont use Onlive yet; no paypal support. Yes, paypal sucks and all that nonsense, but it's completely disconnected from my *real* finances, so I can't get so totally screwed.
 
Gadgetoid said:
Microsoft should take a page out of Steam's book, and prevent logging into Xbox Live on a new console until a verification code, which is emailed or TXTed to you, is entered.


Or, alternatively, Battle.net's Authenticator solution.
Click to expand...
That's exactly what I told them today!


If you text me to reset my password, why not do the same to recover my gamertag?
 
I think it's safe to say that Microsoft wouldn't know security if you dropped a bank vault on their heads.


Can they really have their heads buried so far in the sand that they're not able to learn from observation!?
 
Are you sure you didn't give your account information to some kid you were playing Viva Pinata with?


(Sorry it is always dicey if you try out a joke online, no offense)


Yeah that is really good advice, about taking your self off the re-log me with gold subscription. Yeah i'm getting a bit weirded out with having my credit card on these things any more. I say I will keep checking my accounts but I just get a bit lazy and I don't want to get cleaned out for a month and then try to refute the charges. Well I hope it all works out for you, I use the pay for the 25 digit key code cards just to keep it secure.


Thx for the heads up!
 
Just out of curiosity (having read some of the worrying number of similar reports lately) - do you also have a PSN account or any other EA games? MS seem to be very slow pinning this one down.
 
I do have a PSN account and I do play *some* EA games (Burnout Paradise mainly) but my PSN account has a separate email address to my Xbox Live account and neither of them are my regular email account.


I fail to see what more I could have done to ensure my account was secure.
 
There's a lot of it about, dozens of different theories from replying to in-game invites to raptr accounts to EA game exploits. MS not saying anything, it'll probably take legal threats to make them offer an explanation - as they are dealing with access to people's credit cards it may take a major card issuer getting concerned to force the answer to surface.


http://whatthegeek.n...x-live-account/


You'd have to wonder though, if the problem is on their end they could surely have identified and shut down the vulnerability for their own sakes by now - that they appear to be dealing with it on a case by case basis gives the impression it's something happening to targetted users somehow.
 
Last edited by a moderator:
Boy, there's a wonderful reason to not get a 360.


I really hope your situation gets resolved. If it doesn't, I would take it to the media and get some attention drawn to the subject. There is no excuse for exploits like that. It has a very real effect on legitimate customers and should never happen.
 
Last edited by a moderator:
One comment on the ArsTechnica site may explain why EA/Fifa shows up on so many of these cases:


http://arstechnica.com/gaming/news/2011/10/xbox-live-users-experiencing-hacked-accounts-fifa-11-and-12-purchases.ars?comments=1&start=40#comment-22162643

built into FIFA 11 & 12 is a kind of card trading mini-game called Ultimate Team.

Within the game there are gold, silver and bronze player cards available to trade to other users in an in-game marketplace. They can either be bought with in-game earned currency or with MS points.


What the hackers appear to do once they have access to an account is to buy as many of these card packs (which each contain a number of player cards) as possible with the MS points available in that account, then they immediately make the cards within that pack available on the in-game marketplace and then presumably buy them using another Live account.
Click to expand...

Sounds like the ball is very much in MS's court, and something - for some time now - has compromised Live IDs.
 
Well if fifa being completely wank still isnt enough of an insentive not to buy hopefully this is.


Pro evo all the way the only decent football game on modern consoles
 
You don't need to own Fifa for this to happen to you - you just need to have an EA account so the hackers can spend your points on Fifa crap themselves to sell on.


MS & EA are sticking to the line that this is all caused by 'social engineering'. Finding enough information to link to your gamertag either by phishing or checking out your over effusive facebook page or online chat, they contact EA and request a change of password or account transfer etc, then spend spend spend before you are alerted.
 
This sounds like something that a bunch of kids found they could do and rapidly spread it around their friends. I can only imagine that it's kids being stupid enough to not realise how easily they would be caught/cheap enough to not buy their own points.


Honestly though, surely it has to be extremely simple to catch them? Presumably the accounts that are being transferred to are their own, and there must be an easily traceable trail from your account to theirs. I would like to at least imagine that it's not this simple to defraud honest people and get away scott free.
 
Last edited by a moderator:
You must log in or register to reply here.

Similar threads

Garrett
Is PS4 account sharing safe?
Replies
1
Views
3K
Jumpman
Jumpman
Mr_Loon
Steam has been Hacked
Replies
10
Views
2K
Prometheus
Prometheus
T
Outrun 2 - Xbox Live Demo
Replies
18
Views
3K
Twinbee
T
Shaun
Xbox 360, Tits-Up
Replies
4
Views
975
Shaun
Shaun
S
Board login issue
Replies
0
Views
983
sweetlilmre2
S
Back
Top