City of Heroes: Live Forum Archive

NCsoft Master Account Security Issues

all_hell

By all_hell,
Posted on: 2010-01-02 23:04 in CoH and CoV General Discussions

 

Posted

Quote:
Originally Posted by Forbin_Project View Post
if a person or group of people are trying to take advantage of this bug
Out of curiosity, what if several Customer Support people were actually behind this? How would anyone ever know what they were up to and how long could they keep doing it before getting caught?

 

Posted

Steps to addressing this --

1.) Lock out all master accounts.
2.) Stop charging play-time to players until this is resolved.
3.) Send an email and update the login page notifying players of the temporary lock out, that they are being compensated and need not worry about subscription times running out.
4.) For people trying to create new accounts, post a web page apologizing for the delay in creation and offer a free 7 day subscription code applicable to any new game code or game update code.
5.) Squash the problem.

@Texarkana
@Thexder

 

Posted

LOL, looking to change my password at plaync.com, I got this message:

Quote:
500 Internal Server Error

The server encountered an internal error or misconfiguration and was unable to complete your request.

Please contact the server administrator, you@example.com and inform them of the time the error occurred, and anything you might have done that may have caused the error.

More information about this error may be available in the server error log.
Quality database administration, to be sure

Edit: now it's working, thank goodness.

 

Posted

No, it's not. That's part of the bug. The problem apparently is that there is a tiny chance that instead of that page, you'll be sent to the account page of someone else. Where you can then do anything you want - copy all their contact info, change their email and passwords for everything, possibly even cancel billing on their games. (And once you've changed their passwords, you can login and strip all their characters of anything valuable.)

This is a major security hole, especially since it *doesn't matter* what you do about it as a customer. You can change your password to a 36 character monster that uses ancient Sanskrit instead of the normal alphabet, and it won't help. The bug *bypasses* the normal login. I enter my password, get glitched, and can access *your* account. If it happens, even if they don't touch your account they've got your name, email address, and physical address. All they need to do is find a way to phish a few other pieces of info out of you, and they've got everything they need for ID theft.

 

Posted

Has anyone been able to replicate this yet? I haven't. All that has happened to me is that I either see my account page, or I get an error message (probably because tons of people are hammering the F5 key).

Until I see pics or whatnot, this is just F.U.D. Even Massively.com admits it's still a rumor.

 

Posted

Out of curiosity, is there anything we could do to help bring this issue to the attention of someone that actually cares and can do something about getting it fixed? Since this is a problem with the NCSoft account interface, I don't think filing a support claim through CoH will really do anything - it's not a Paragon Studios problem. (Aside from the fact that it's not their job to handle rumor control, which probably all that this could be considered until after your account has actually been stripped.)

 

Posted

If there is indeed something to be fixed (which is still questionable AFAICT), a PM to a Community Rep such as Niviene or TheOcho would be sufficient.

 

Posted

Quote:
Originally Posted by Obsidius View Post
Has anyone been able to replicate this yet? I haven't. All that has happened to me is that I either see my account page, or I get an error message (probably because tons of people are hammering the F5 key).

Until I see pics or whatnot, this is just F.U.D. Even Massively.com admits it's still a rumor.
Rumor my ***. Guild Wars just added a new "security" feature requiring everyone to enter the name of a character on the account after they enter their password when logging on.

Of course as is typical they aren't going to say the problem lies on their end because people would cancel their accounts if they knew there was such a huge security risk, and what they did say is just vague enough that they can claim they meant by other games and websites that they meant CoH or Lineage, etc.

 

Posted

So, is this affecting CoH players, or only GW players? Has CoH had to update their security or login procedures? I only ask because I only play CoH and not GW.

 

Posted

Quote:
Originally Posted by ShadowsBetween View Post
Out of curiosity, is there anything we could do to help bring this issue to the attention of someone that actually cares and can do something about getting it fixed? Since this is a problem with the NCSoft account interface, I don't think filing a support claim through CoH will really do anything - it's not a Paragon Studios problem. (Aside from the fact that it's not their job to handle rumor control, which probably all that this could be considered until after your account has actually been stripped.)
The GW reps had mentioned that NCSoft Security is already looking into this, which is why the changes were made to the way you change your Master Account password this weekend. The chances of getting the bug were very, very small to begin with, so it may be hard for them to replicate and close. The people taking advantage of it are primarily from RMT companies. It used to be that you didn't have to enter your old password to change it, enabling the people taking advantage of this bug to lock you out of your Master Account entirely. As things stand at the moment, they can change your game account passwords, but not the Master Account password, so they lock you temporarily our of your game accounts, but not your Master, and once they're out they can't get back in unless they happen to get that account again. Not an ideal solution, but a step in the right direction for something that may take them weeks to confirm and fix. Now, if they would changing your game account password also requires the old password, that would be another step in the right direction. As soon as there's no profit in it, the number of people taking advantage of this will probably drop sharply.


 

Posted

It doesn't really matter what NC games you play if anyone can randomly end up on your master account page.

 

Posted

Quote:
Originally Posted by Obsidius View Post
So, is this affecting CoH players, or only GW players? Has CoH had to update their security or login procedures? I only ask because I only play CoH and not GW.
It's noticibly affected GW and Aion players. If the RMT business for CoH were bigger, it would probably hurt us too, but thankfully all the stuff that our devs put in place to combat that seem to have made it less than profitable for them.


 

Posted

I think it's more likely that key loggers and gold buying sites are more likely culprits than PlayNC.com. They're probably looking for accounts that happen to use the same username/ password for their GW accounts as their PlayNC accounts. Once you have the info, it's not hard to do by hand, yet alone through an automated program.

 

Posted

Quote:
Originally Posted by Obsidius View Post
I think it's more likely that key loggers and gold buying sites are more likely culprits than PlayNC.com. They're probably looking for accounts that happen to use the same username/ password for their GW accounts as their PlayNC accounts. Once you have the info, it's not hard to do by hand, yet alone through an automated program.
That is probably where most of them are coming from, but the bug has been documented by Aion players since around October. No reliable reproduction steps have been found though. *shrugs* There have been accounts hacked of people who don't use RMT, don't bot, and take all the recommended security precautions. Am I saying all of the accounts hacked are like that? No, far from it, but there is a large enough number that are to be concerned. In Aion in particular the team is very, very thorough in investigating and banning accounts that RMT or bot, so I have no doubt that NC has a better idea of what may be happening than we do, now that they're finally looking into it.


 

Posted

Good points. Forbin's screenie didn't really answer anything in regards to PlayNC.com specifically, and although I don't see any proof so far that anything is happening, that doesn't mean there might not be a problem... just one that's very hard to replicate. Still, there's no doubt that NCSoft is probably looking into any potential exploit on PlayNC.com, especially now that Massively.com is reporting on the rumor.

 

Posted

KillTenRats is run by a guy who was my old Everquest guildmate. (Or maybe it's just one of the writers, I forget.) ^_^ The Grove, Test Server, R.I.P.

Studying their author list, there are several people. I know Julian and Oz were guildmates. Maybe some of the others are going by names different from what I knew them by.


my lil RWZ Challenge vid

 

Posted

I hope that, since they're looking into vulnerabilities anyhow, they start letting us use non-alphanumeric characters for passwords. I have a really strong password I like to use that involves theses characters and can use it on other secure sites... but not for my main NCSoft account, for some bizarre reason.

 

Posted

Quote:
Originally Posted by Obsidius View Post
Good points. Forbin's screenie didn't really answer anything in regards to PlayNC.com specifically, and although I don't see any proof so far that anything is happening, that doesn't mean there might not be a problem... just one that's very hard to replicate. Still, there's no doubt that NCSoft is probably looking into any potential exploit on PlayNC.com, especially now that Massively.com is reporting on the rumor.
All I can say for certain that I my GW and main CoH account are both on my PlayNC Master account, and anyone getting into my master account will have access to both my games.

I'm assuming that people with just CoH accounts may be safe from the bug, because it seems to be affecting people with Aion and GW accounts. Which may be why we haven't heard much on this topic.

 

Posted

Which still leaves me as potentially doomed if the bug is real. I have a GW account, and I tried the Aion beta before it went live. The Aion account is therefore seriously dead, but there's no way to delete it or remove it from the rest of the account.

 

Posted

At this point, if you at least have some evidence that its your account you will at least have something to take to NCsoft CS if things go wrong.

 

Posted

Quote:
Originally Posted by ShadowsBetween View Post
Which still leaves me as potentially doomed if the bug is real. I have a GW account, and I tried the Aion beta before it went live. The Aion account is therefore seriously dead, but there's no way to delete it or remove it from the rest of the account.
At this point, you wouldn't be "potentially doomed". Your master account password can no longer be changed without the old password, so your whole account can't be hijacked the way they were doing it. They may be able to temporarily change your game account passwords, but as long as your master account is still intact that can be fixed. They seem to be leaving CoH game accounts alone, and the recent changes to GW will keep a password change there from doing them any good.


 

Posted

Quote:
Originally Posted by Darkfaith View Post
At this point, you wouldn't be "potentially doomed". Your master account password can no longer be changed without the old password, so your whole account can't be hijacked the way they were doing it. They may be able to temporarily change your game account passwords, but as long as your master account is still intact that can be fixed. They seem to be leaving CoH game accounts alone, and the recent changes to GW will keep a password change there from doing them any good.
Being able to login onto your game is the least of your problems. They are still getting access to vital personal information that they need to steal your identity. All kinds of crimes can be committed with stolen identities.

 

Posted

This just happened to me in march. Took 4 days to get it straightened out again. Apparently it's not over yet.

Spines/ D A lvl 50 Scrap, stone/wm lvl 50 tank, Kat/reg lvl 50 Scrap
Grav/Kin lvl 50 Cont, Fire/Enegry lvl 50 Blast
Warshade lvl 50, PB lvl 39, nightwidow lvl 50, crab lvl 42
plant/thorns lvl 50 dom, ice/fire lvl 40 dom, grav/nrg lvl 41 dom

 

Posted

Just yesterday I got the automated email saying someone had changed the contact info on my Aion account. I don't even have an Aion account! What's up with that??

Quote:
Greetings!

This is an automated notification regarding your Aion account. Some or all of your contact information was recently modified through the Account Management website.

*** If you made recent account changes, please disregard this automatic notification.

You can login to Account Management at the following link to review your account settings:
http://secure.ncsoft.xxx/cgi-bin/plaync_login.pl

*** If you did NOT make any changes to your account, please contact support immediately at support@ncxsoft.com.

Spines/ D A lvl 50 Scrap, stone/wm lvl 50 tank, Kat/reg lvl 50 Scrap
Grav/Kin lvl 50 Cont, Fire/Enegry lvl 50 Blast
Warshade lvl 50, PB lvl 39, nightwidow lvl 50, crab lvl 42
plant/thorns lvl 50 dom, ice/fire lvl 40 dom, grav/nrg lvl 41 dom

 

Posted

Sounds and looks like a scam, I wouldn't click on the link or anything and just report it to NCsoft.


Paragon Unleashed Forums
Twitter: @Alpha_Ryvius