Feeds

Account pretexters plague Xbox Live

Account thieves numerous and brazen

Securing Web Applications Made Simple and Scalable

After initially denying that the service had been hacked, Microsoft said the company is now investigating the issue, but stressed that the problems seem more to do with pretexting than with a security breach of its systems.

"Recently, there have been reports of fraudulent activity and account theft taking place on the Xbox Live network," the software giant said in a statement sent to SecurityFocus. "Security is a top priority for Xbox Live, and we are actively investigating all reports of fraudulent behavior and theft."

Pretexting - another term for social engineering schemes designed to facilitate access to a victim's account - came to national prominence last September when a member of Hewlett-Packard's board revealed that the company had hired private investigators to uncover a leak and that the investigators apparently used pretexting to get access to board members' and journalists' phone records. Patricia Dunn, the former CEO of the company, was recently cleared of charges in the case.

Microsoft and Bungie have not indicated how widespread their own pretexting issues might be, but anecdotal evidence points to endemic account stealing issues.

Groups other than Clan Infamous have also boasted about their account-stealing capabilities, and victims have posted complaints in both Xbox Live forums and in other sites around the internet.

Finisterre may have gotten off lightly. Other victims have more serious stories to tell.

Mr Jokerz, the online handle used by a 19-year-old college student from Michigan, used to run his own clan, T3am Hazard, for playing Halo 2. The teenager, who asked not to be identified by name, found his team at a disadvantage against the cheats commonly used by abusers such as Clan Infamous. Complaints were immediately met with retribution.

Over a matter of months, Mr Jokerz's account was stolen six times and several thousand dollars worth of Microsoft points charged to his credit card, the teenager claimed. The attackers, which Mr Jokerz identified as Clan Infamous, quickly decimated the accounts belonging to the leaders and staff members of T3am Hazard.

"They go after anybody they want to," Mr. Jokerz told SecurityFocus in an online chat. "They just went after me a lot because I was the overlord (leader) of the clan."

The bullying went beyond the game world as well. From his account, the attackers harvested Mr Jokerz's home address and telephone number and called his house more than 100 times, the teenager said. Eventually, the teenager filed a police report. The Halo 2 player also said he identified the names and addresses of the clan members involved and gave them to both the police and Microsoft, but has heard no response back regarding any investigation. Microsoft could not immediately confirm Mr Jokerz's account.

The apparent lack of action has made Clan Infamous quite brazen. In a statement on the clan's site, they dismissed the efforts of Microsoft and Bungie to halt cheaters and account stealing and threw down the gauntlet in front of the company's investigators.

"You guys can't even freeze our accounts," the clan stated on their site. "You are pathetic, a joke...We aren't afraid of you one bit, so we will continue to steal accounts (and) max out credit cards until you find a way to stop us."

This article originally appeared in Security Focus.

Copyright © 2007, SecurityFocus

The smart choice: opportunity from uncertainty

More from The Register

next story
Mozilla fixes CRITICAL security holes in Firefox, urges v31 upgrade
Misc memory hazards 'could be exploited' - and guess what, one's a Javascript vuln
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
prev story

Whitepapers

Top three mobile application threats
Prevent sensitive data leakage over insecure channels or stolen mobile devices.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.