Feeds

Attacker grabs gaming tag of Xbox Live policy director

'Predator' reveals own IM list, Facebook account, on YouTube boastvid

5 things you didn’t know about cloud backup

NSFW link Microsoft's director of policy and enforcement for Xbox LIVE has had his Xbox account hijacked by a disgruntled gamer using a social engineering attack on his domain name registrar, Network Solutions.

Stephen Toulouse, who goes by the screen name “Stepto” and owns the domain stepto.com, also lost his email and web hosting accounts.

He tweeted yesterday: "Sigh. please be warned. Network solutions has apparently transferred control of Stepto.com to an attacker and will not let me recover it."

Somebody claiming to be the attacker has uploaded a video to YouTube showing him clicking around Toulouse's Xbox account, while breathlessly describing how he "socialed his hosting company".

The domain and account have since been returned to Toulouse's control.

Toulouse was head of communications for the Microsoft Security Response Center for many years, handling PR during worm outbreaks such as Blaster and Sasser.

Now at Xbox LIVE, Toulouse is, as the attacker put it: "the guy who's supposed to be keeping us safe". He's responsible for enforcing the policies that ban persistent cheats.

Social engineering attacks against domain name registrars exploit human, rather than technological, vulnerabilities. Attackers call up tech support and try to convince them that they are their target.

In this case, hijacking Toulouse's domain name seems to have been a means to control his email account, enabling the attacker to reset Toulouse's Xbox LIVE password and take over his "gamer tag".

The same technique was used to compromise the Chinese portal Baidu.com, that time via Register.com, in late 2009. That resulted in a lawsuit, which was settled for an undisclosed sum last year.

The attacker, calling himself Predator, was apparently annoyed that Toulouse had "console banned" him over 35 times. He said he'd compromised accounts in the past, and offered to do so again for $250.

He seems to have left a fair bit of evidence in his wake. The video shows his instant messaging contact lists and some Facebook information. Commenters have already posted his purported home address.

The video, which shows the immediate aftermath of the attack, can be viewed here. It may not be entirely safe for work, due to some racist language. ®

This story was first published at Domain Incite.

Next gen security for virtualised datacentres

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 10 endpoint backup mistakes
Avoid the ten endpoint backup mistakes to ensure that your critical corporate data is protected and end user productivity is improved.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Rethinking backup and recovery in the modern data center
Combining intelligence, operational analytics, and automation to enable efficient, data-driven IT organizations using the HP ABR approach.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.