Feeds

Account pretexters plague Xbox Live

Account thieves numerous and brazen

Seven Steps to Software Security

After initially denying that the service had been hacked, Microsoft said the company is now investigating the issue, but stressed that the problems seem more to do with pretexting than with a security breach of its systems.

"Recently, there have been reports of fraudulent activity and account theft taking place on the Xbox Live network," the software giant said in a statement sent to SecurityFocus. "Security is a top priority for Xbox Live, and we are actively investigating all reports of fraudulent behavior and theft."

Pretexting - another term for social engineering schemes designed to facilitate access to a victim's account - came to national prominence last September when a member of Hewlett-Packard's board revealed that the company had hired private investigators to uncover a leak and that the investigators apparently used pretexting to get access to board members' and journalists' phone records. Patricia Dunn, the former CEO of the company, was recently cleared of charges in the case.

Microsoft and Bungie have not indicated how widespread their own pretexting issues might be, but anecdotal evidence points to endemic account stealing issues.

Groups other than Clan Infamous have also boasted about their account-stealing capabilities, and victims have posted complaints in both Xbox Live forums and in other sites around the internet.

Finisterre may have gotten off lightly. Other victims have more serious stories to tell.

Mr Jokerz, the online handle used by a 19-year-old college student from Michigan, used to run his own clan, T3am Hazard, for playing Halo 2. The teenager, who asked not to be identified by name, found his team at a disadvantage against the cheats commonly used by abusers such as Clan Infamous. Complaints were immediately met with retribution.

Over a matter of months, Mr Jokerz's account was stolen six times and several thousand dollars worth of Microsoft points charged to his credit card, the teenager claimed. The attackers, which Mr Jokerz identified as Clan Infamous, quickly decimated the accounts belonging to the leaders and staff members of T3am Hazard.

"They go after anybody they want to," Mr. Jokerz told SecurityFocus in an online chat. "They just went after me a lot because I was the overlord (leader) of the clan."

The bullying went beyond the game world as well. From his account, the attackers harvested Mr Jokerz's home address and telephone number and called his house more than 100 times, the teenager said. Eventually, the teenager filed a police report. The Halo 2 player also said he identified the names and addresses of the clan members involved and gave them to both the police and Microsoft, but has heard no response back regarding any investigation. Microsoft could not immediately confirm Mr Jokerz's account.

The apparent lack of action has made Clan Infamous quite brazen. In a statement on the clan's site, they dismissed the efforts of Microsoft and Bungie to halt cheaters and account stealing and threw down the gauntlet in front of the company's investigators.

"You guys can't even freeze our accounts," the clan stated on their site. "You are pathetic, a joke...We aren't afraid of you one bit, so we will continue to steal accounts (and) max out credit cards until you find a way to stop us."

This article originally appeared in Security Focus.

Copyright © 2007, SecurityFocus

Mobile application security vulnerability report

More from The Register

next story
Yorkshire cops fail to grasp principle behind BT Fon Wi-Fi network
'Prevent people that are passing by to hook up to your network', pleads plod
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Mozilla fixes CRITICAL security holes in Firefox, urges v31 upgrade
Misc memory hazards 'could be exploited' - and guess what, one's a Javascript vuln
NEW, SINISTER web tracking tech fingerprints your computer by making it draw
Have you been on YouPorn lately, perhaps? White House website?
BMW's ConnectedDrive falls over, bosses blame upgrade snafu
Traffic flows up 20% as motorway middle lanes miraculously unclog
LibreSSL RNG bug fix: What's all the forking fuss about, ask devs
Blow to bit-spitter 'tis but a flesh wound, claim team
Attackers raid SWISS BANKS with DNS and malware bombs
'Retefe' trojan uses clever spin on old attacks to grant total control of bank accounts
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
prev story

Whitepapers

Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Reducing security risks from open source software
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.