NCSoft – Page 28 – MMO Fallout

NCsoft Confirms “Character Hack” Via Packet Manipulation.

The saga of NCsoft account security continues with the confirmation that an existent exploit in NCsoft’s systems. Not too long ago, I reported on Scayth, an Aion player whose account was compromised while it was inactive. The account was looted, and one or more of the characters may have been used for gold farming purposes.

Thanks to Scayth’s ongoing updates over at Aionsource, he was able to procure a reply (finally) from NCsoft over the account issues. The full image is below, but I will summarize:

The majority of accounts compromised have been through social engineering, viruses, fansites, and keyloggers.
The account was never hacked, the individual characters were. The account itself was not in any danger.
The hacker was able to use packet manipulation to access different characters at whim. The process is “very complicated” and did not give them full access.
Few characters can be accessed in this fashion, Scayth just happened to be one of the unlucky few, among 10 others who were also restored.
The process tricked the system into believing that the character belonged to that account.
The servers were hotfixed to prevent this that same day.

What will come next in the NCsoft security saga? MMO Fallout will certainly be here to cover the events.

G-Unit Reports: No Critical Security Issues

G_Unit_pictures — G-Unit doesn't handles account theft.

Our game servers, account databases, and support sites are under constant attack and being probed for any vulnerability. It’s a war that by no means is over.
-Scott Jennings, NCsoft on Aion.

There may not be a fight between gold farmers and developers as intense what is going on between Aion and the gold farmers. Not simply definable as a growing feud, this battle has turned into all-out gang war, with NCsoft going as far as bringing in G-Unit (no, not that G-Unit) to fight off the hoard of bots and spammers. The gold farmers have also stepped up their part of the fight by doing their best to steal as many player accounts as possible, not to mention launching countless attacks against NCsoft’s security systems.

Scott Jennings, in a recent note to the community, affirms players that they are continuing the monitor systems, and have confirmed that there are currently no critical issues with the NCsoft account security. NCsoft will continue to audit their security systems, and players can expect changes to come this year, continuing the security updates Guild Wars and other NCsoft titles received last year.

Following the high profile, and very sobering (as described by Jennings) cyber attack that breached the systems of Google and a host of other companies, it is difficult for players to feel that their information is safe. Unfortunately all we can do is watch and try our best to keep our information safe, while at the same time hoping nothing happens over on the developer’s end.

More on Aion, Security, NCsoft, and more as it appears.

Update: My Inactive Aion Account Logged In

Account stuff — In the latest episode of our continuing drama...

I’ve been keeping an eye on Aion since the whole issue of account theft came to light, with what could potentially turn out to be a major bombshell dropped on NCsoft if allegations of security breaches were true. Originally the story was confined to a lot of people having their accounts stolen, which NCsoft had placed the blame on an unnamed fansite being compromised.

Later, I reported on accounts of inactive accounts being stolen and looted, an act that should be technically impossible as inactive accounts should not be able to log into the game to begin with, much less walk around and trade. I’ve received all kinds of email since then, calls of support from the NCsoft community, wishes of good luck in the not-getting-my-tires-slashed department, and expressions of distrust and hate, and even several accusations that I was working for Blizzard, Funcom (yes), Sony Online Entertainment, and even Aventurine. If so, I’m missing several paychecks and will be contacting the aforementioned companies in the hopes of recuperating such salaries.

It isn’t often I get to drop a proverbial piece of cheese on my own, however, as I reported just yesterday that, while searching through my NCsoft master account, I noticed that my Aion account was still listed as “playable.” I canceled Aion back in November, with the account ultimately going dead in December (although I cannot confirm it actually went inactive). I did confirm through the card I used to purchase the title (I only have one, so figuring out which was not difficult) has not been charged, and the account listing (as shown above) displays no current subscriptions.

I intended upon logging in today and replacing the previous article with an “I’m sorry, I made a stupid mistake, the account is not active.” Instead, I went through the process of downloading and installing the game, only to find what is below the break. Please note: The following contains images of Aion. If you are allergic to Korean grinders, subscription based MMOs, or have a general dislike for blue women played by men, please avert your eyes.

Continue reading “Update: My Inactive Aion Account Logged In”

Dear Aion: I Also Accept Checks, Gifts, and Pies

I would also accept a lifetime subscription to City of Heroes instead.

File this under “Odd things I uncover because my short attention span directed me away from the article I’m supposed to be writing about closed betas.” While searching through my PlayNC account to make sure I wasn’t getting charged for, say, the free months of City of Heroes I was given a couple months ago, I decided to check up on my Aion account to see its standing, only to find this:

So my account is paid until January 30, 2010, and I appear to have canceled my subscription. What is the big issue, you ask me, Omali? Well, let’s take a time warp through MMO Fallout’s glorious history, back to December: A month in review, if you will.

“I cancelled Aion before my free month was up, my reason being because the game was actually painful to play. I know that MMOs are essentially a giant can of grind, but Aion is Nyquil minus the sugar, with extra bitter. Aion has a better story than some other MMOs, and the presentation is very well done in the form of cutscenes and other features, and I did not give the game enough time to get me to Player Vs Player combat. The grind to that point was just too painful to play, and my rule is that I cancel when I look at the login in screen and the child inside asks “do I have to?” And no, upgrading my account to collector’s edition for free was not going to keep me. And one last thing, after diving into this game; those testimonials you hear about bots in-game, they are all true.”
-Omali, MMO Fallout, in a Nyquil-addled rant about Aion.

Yes indeed. I cancelled Aion before the free month was even up. Made sure to cancel from the website and everything (as you can see from the above image). For the sake of it, I even checked my bank account to ensure that there weren’t any charges being made to my card. Furthermore, I checked the log my account, and there have been no payments since I originally activated the game.

I’m leaving this up to the MMO Fallout’ers to check into. Is there some welcome back program I passed over? Free game time for inactive accounts? I have absolutely no clue as to how long my account has been in this state, as this is the first time I have checked it since I canceled back in November. Am I going to find a horse head in my bed if I refuse this? Can I get it transfered over to City of Heroes game time?

(Update: I was able to log into Aion on this unpaid account. More information here)

City of Heroes: Keep Your Accounts Safe

2010-01-06 23:07:52 — Ilamo cannot protect from those he cannot see...

Another day, another development in the ongoing NCsoft security issue. Amidst widespread fear of account theft, security holes, and random account logging, with Guild Wars and Aion leading the pack, it was only a matter of time before City of Heroes joined the pack warning users to increase their awareness. The reminder is standard trade: Keep your account safe, don’t share your details with others, change your passwords regularly, and try to stop downloading porn from shady websites.

“After investigating certain claims regarding current account security we discovered no malicious compromises having occurred in the manner described.”

I have an Aion player with an inactive, looted account that would disagree with you, but I do understand that Aion and NCsoft Master Account business is out of the hands of City of Heroes and the Paragaon Studios that develops it. Oddly enough, when snapping the screenshot above, I received a spam email from a gold farming advertiser. The account name: Aion Wars. Awfully convenient.

Oh well. I’m not going to saddle Paragon Studios with an issue NCsoft should be dealing with. Again, best of luck to those whose accounts have been compromised, and more on the 2009 NCsoft Account Issue as it appears.

NCSecurity: Phantom Hacker Steals Aion Account

(Important) Continue reading down to the bottom of the article. There is a follow up link at the bottom to a more recent explanation.

So I’ve been following the recent account thefts over at NCsoft (namely Aion and Guild Wars) pretty closely recently, not only because I play City of Heroes and if this account theft issue bleeds to other games it could affect me (gasp), but because the stories just keep getting stranger and stranger.

Case in point: An Aion account that was reportedly stolen, and looted of all of its items. The password was not reportedly changed, but the account was cleared of all items. In itself, this story doesn’t sound very exciting. Hundreds of accounts over a variety of MMOs get the same treatment every month. The account theft took place on December 19th and 21st, but take a good look at the account subscription history:

Analysis after the break…

Continue reading “NCSecurity: Phantom Hacker Steals Aion Account”

Your NCsoft Master Account: A Ticking Time Bomb?

I’ve been sitting on this article for a while now, and it seems like the best time as ever to put it forward. NCsoft is currently investigating heavy allegations of massive security holes in the master account system. As I’ve reported before, the number of stolen Guild Wars and Aion accounts has gone up dramatically in the past few months, which NC originally pointed towards a compromised fansite as the source of the theft.

Definitely the most serious, and frightening, of the allegations posted on Guild Wars Guru was that it doesn’t take any skill to hack an NCsoft master account. In fact, according to users, all it takes is spamming log in/log out, and eventually (through the process of happenstance and timing) you may find yourself logged into someone else’s account, able to change passwords, jot down personal details, and clean out accounts without ever being detected.

More after the break…

Continue reading “Your NCsoft Master Account: A Ticking Time Bomb?”

Dungeon Runners: What Happened

“Dungeon Runners just isn’t cutting the mustard. If she were a ship, she’d be taking on water. Yeah, she’s been taking on water for a long time now. Are my cryptic references too hard to decipher? The game just isn’t profitable. And, the first rule of business is to be profitable!”
-Stephen Nichols, NCsoft, on Dungeon Runners.

Today marks the first day of a new year, as well as the death of two MMOs: Dungeon Runners and Metaplace. Dungeon Runners shut down earlier this morning following an event that saw a giant bomb explode in the game’s main city: Townston. Here at MMO Fallout, “What Happened” has to be my least favorite section as, despite popular opinion, I don’t get my jollies from watching companies fall.

Continue reading “Dungeon Runners: What Happened”

Guild Wars Vs Account Theives: Aion To Follow Suit

With 16,000 accounts gone, less queues! — you must be this tall to buy gold.

No, not as in lawsuit. NCsoft’s Guild Wars has been taking several measures to protect accounts from theft, including their most recent venture: Requiring you to name one character on your account in order to log in (meaning I just lost access to my account). Aion, also published by NCsoft, is taking a similar run of reminding players to keep their accounts secure, although for slightly different reasons. Guild Wars has fansites being hacked to worry about, while Aion is more focused on irritated gold farmers.

Aion bans thousands of accounts on a weekly basis and as you can expect, such a move can get pretty costly for gold farmers. The result? Using your accounts to gold farm. It saves cash, and there’s nothing to clean up when the ban hammer drops. Aion has released a security warning to players regarding in-game links being used to phish accounts, as well as the possibility of NCsoft master account theft.

I don’t think players should need to be reminded to be wary of what they click on, but here we are.

New Security Feature: Guild Wars

“one of the trading sites associated with Guild Wars may have experienced a security breach and its account database (including user names and passwords) may be in the hands of hackers.”

This message by ArenaNet earlier this year is the message that players never want to hear, and as history tends to repeat itself, this message came alongside a tidal wave of lost accounts. For the past couple of months, ArenaNet has been working tirelessly to boost the security of the system, and the first changes are finally making their way in-game.

Those of you who log into Guild Wars will notice that there is a new option to fill in. Aside from your username and password, you will have to correctly name one of the characters on your account. ArenaNet is continuing to formulate methods of keeping accounts secure, so this new field is not the only change to come.

Although the new field will help with brute force exploits, it won’t do anything to help one of the leading causes of lost accounts: key loggers. Blizzard had a good idea by introducing the security dongle that changes your password every couple of seconds. As long as you don’t lose the dongle, your account is essentially theft-proof.

More on people with poor account security (using the same password for a game and its much more hack-prone fansite) as it appears.

Spread It:

Spread It:

Spread It:

Spread It:

Spread It:

Spread It:

Spread It:

Spread It:

Spread It:

Spread It: