May 25th, 2012Top StoryReport: How Scammers Are Stealing Xbox Live Accounts, and the Few Things You Can Do to Protect YourselfBy Luke Plunkett
At first believed to be the result of hacks in relation to EA's FIFA series, it's now looking more likely to be the result of a widespread scam run by shady types out to either make money or score cheap games. One of the more high profile victims of these "jackings" (not "hacks," we'll get to that in a minute) was Susan Taylor, who wrote an account of her experiences, and which we covered back in January. Having stood up and identified herself as an unhappy victim, Susan soon got something she was probably never expecting: members of the jacking community reaching out to her. Three such types contacted Susan and tipped her off to sites and forums where jackers congregate and trade. They were also, as members, able to access the sites (most are obviously restricted from public viewing) and pass along some of the information contained within, including techniques on how to obtain someone else's Xbox Live account information. You can see one such site, which is publicly accessible, here. On its "black market" forum, you'll see members both selling stolen Xbox Live accounts and making requests, one person looking for an account with good Modern Warfare 3 stats, another selling an account with the presumably desirable name of "One V One". The key distinction between "jacking" and "hacking" is that these guys aren't forcefully circumventing any software protection measures. What they're doing is, in a nutshell, contacting Microsoft, pretending to be the legitimate account holder, and through poor security and a whole lot of bluffing (usually making excuses as to why information was incorrect or why passwords could not be remembered), getting hold of the necessary reference numbers and information they need to then go on and access a stranger's Xbox Live account. Here's an excerpt Susan was able to obtain, outlining one such strategy:
That sounds depressingly simple. Here's another one.
As you can see, if this stuff is indeed the kind of methodology used by jackers, it's a far more serious problem than a flaw in Xbox Live's code or immediate security. That sort of thing can be patched, the holes plugged. What Susan's sources are describing though, that's something else. That's a failure of bureaucracy. Something broken at a systemic and fundamental level of Microsoft's customer service system, a result of under-trained and outsourced staff not knowing the finer details of the service's security framework. Which is a lot harder, and slower to fix. It would also explain why it's been so hard for Microsoft to track down the problem. It's been looking for a problem, something obvious, a chink in Xbox Live's armour. What's being described here, acts of deception carried out on a personal level with customer service staff, wouldn't even come up on their radar. BUT WHY?The raft of thefts reveal that Xbox Live accounts are big business. Definitely worth the trouble of getting hold of. But why? It appears there's a market for all kinds of accounts and the things related to them. The most obvious, and lucrative for the more criminally-minded, are accounts with credit card or PayPal info linked to them. Once loaded up with "free" Microsoft Points, they're then sold off to buyers who get thousands of points for a lot less than they'd normally have paid for them. Another money-saving motivation is free games. If an account has purchased any Games on Demand titles, for example, those games are linked to the account, meaning the new owner can jump onto Xbox Live and download the games "again" for free. Surprise surprise, the most valuable accounts are ones with Call of Duty titles attached. Two other reasons, though, are a little more vain. Some black market buyers want access to "OG" usernames. They don't want, for example, "b08". They want "Bob", or names related to pop culture figures, or movie stars, or dumb shit like "Killer". The more interesting OG handles are thus targets for jackers, and can be sold for hundreds of dollars. The other cosmetic lure is a user's tenure. In the corner of your Xbox Live avatar there's a number. The higher the number, the longer you've been a member. Long-time members—we're talking 5-6+ years—are of course the most valuable, and are a target for jackers who can sell them to people who want to look more seasoned on Xbox Live than they actually are. PREVENTIONIf these reports are accurate, then what can you do to protect your account? It would appear you can't do anything at all. Unlike a phishing scam, which you can head off by changing passwords, these jackers are bypassing the user entirely and going straight to Microsoft support. If they see a gamertag they think can make them money, then they'll pull their support scam, and if they can pull it off (as stated above, often they're unsuccessful) there's not a thing you'd be able to do about it. About the only recommendations would be to do what you should be doing anyway: keep your passwords separate, don't link credit card information to an account and use a dedicated email account for just your Xbox Live, nothing else. At least then you're minimising the damage, cutting down on the possibilities that by stealing your account details these scammers also get access to other online services of yours. Bear in mind that while these reports may seem convincing, given their origin and the fact nobody but Microsoft knows the full extent of how its own support network operates, the means of account "jacking" should be treated as rumour until we're able to confirm them. As such, we've contacted Microsoft, and will update if we hear back. How (And Why) Your Xbox Live Accounts Are Hacked [HackedonXbox]  |
|
No comments:
Post a Comment