Feeds

Account pretexters plague Xbox Live

Account thieves numerous and brazen

Top 5 reasons to deploy VMware with Tegile

After initially denying that the service had been hacked, Microsoft said the company is now investigating the issue, but stressed that the problems seem more to do with pretexting than with a security breach of its systems.

"Recently, there have been reports of fraudulent activity and account theft taking place on the Xbox Live network," the software giant said in a statement sent to SecurityFocus. "Security is a top priority for Xbox Live, and we are actively investigating all reports of fraudulent behavior and theft."

Pretexting - another term for social engineering schemes designed to facilitate access to a victim's account - came to national prominence last September when a member of Hewlett-Packard's board revealed that the company had hired private investigators to uncover a leak and that the investigators apparently used pretexting to get access to board members' and journalists' phone records. Patricia Dunn, the former CEO of the company, was recently cleared of charges in the case.

Microsoft and Bungie have not indicated how widespread their own pretexting issues might be, but anecdotal evidence points to endemic account stealing issues.

Groups other than Clan Infamous have also boasted about their account-stealing capabilities, and victims have posted complaints in both Xbox Live forums and in other sites around the internet.

Finisterre may have gotten off lightly. Other victims have more serious stories to tell.

Mr Jokerz, the online handle used by a 19-year-old college student from Michigan, used to run his own clan, T3am Hazard, for playing Halo 2. The teenager, who asked not to be identified by name, found his team at a disadvantage against the cheats commonly used by abusers such as Clan Infamous. Complaints were immediately met with retribution.

Over a matter of months, Mr Jokerz's account was stolen six times and several thousand dollars worth of Microsoft points charged to his credit card, the teenager claimed. The attackers, which Mr Jokerz identified as Clan Infamous, quickly decimated the accounts belonging to the leaders and staff members of T3am Hazard.

"They go after anybody they want to," Mr. Jokerz told SecurityFocus in an online chat. "They just went after me a lot because I was the overlord (leader) of the clan."

The bullying went beyond the game world as well. From his account, the attackers harvested Mr Jokerz's home address and telephone number and called his house more than 100 times, the teenager said. Eventually, the teenager filed a police report. The Halo 2 player also said he identified the names and addresses of the clan members involved and gave them to both the police and Microsoft, but has heard no response back regarding any investigation. Microsoft could not immediately confirm Mr Jokerz's account.

The apparent lack of action has made Clan Infamous quite brazen. In a statement on the clan's site, they dismissed the efforts of Microsoft and Bungie to halt cheaters and account stealing and threw down the gauntlet in front of the company's investigators.

"You guys can't even freeze our accounts," the clan stated on their site. "You are pathetic, a joke...We aren't afraid of you one bit, so we will continue to steal accounts (and) max out credit cards until you find a way to stop us."

This article originally appeared in Security Focus.

Copyright © 2007, SecurityFocus

Internet Security Threat Report 2014

More from The Register

next story
'Kim Kardashian snaps naked selfies with a BLACKBERRY'. *Twitterati gasps*
More alleged private, nude celeb pics appear online
Home Depot ignored staff warnings of security fail laundry list
'Just use cash', former security staffer warns friends
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
UK.gov lobs another fistful of change at SME infosec nightmares
Senior Lib Dem in 'trying to be relevant' shocker. It's only taxpayers' money, after all
Who.is does the Harlem Shake
Blame it on LOLing XSS terroristas
Snowden, Dotcom, throw bombs into NZ election campaign
Claim of tapped undersea cable refuted by Kiwi PM as Kim claims extradition plot
Freenode IRC users told to change passwords after securo-breach
Miscreants probably got in, you guys know the drill by now
THREE QUARTERS of Android mobes open to web page spy bug
Metasploit module gobbles KitKat SOP slop
BitTorrent's peer-to-peer chat app Bleep goes live as public alpha
A good day for privacy as invisble.im also reveals its approach to untraceable chats
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.