Original URL: https://www.theregister.com/2007/03/23/xbox_live_pretexting/
Account pretexters plague Xbox Live
Account thieves numerous and brazen
Posted in Security, 23rd March 2007 10:38 GMT
When Kevin Finisterre got his virtual guns handed to him in an online game of Halo 2 last Thursday, he called his opponents on their none-too-subtle hacks that skewed the game in their favour and turned the battle into a rout.
His opponents - who rarely died while racking up nearly 100 kills on Finisterre's team - didn't take the accusations well. Among a tirade of name-calling, one player threatened to steal his account, the security researcher told SecurityFocus.
Finisterre did not put much store in the threat until the next day, when he found his girlfriend's account - which he had been using the day before - kicked off the system with a message that someone else was using her gamer tag on Microsoft's service, Xbox Live. Finisterre confirmed that he could no longer log onto the service, and a message on the Account Management page indicated that the account had been suspended.
After more than a half dozen calls to the support staff of XBox Live, which Halo 2 uses to authenticate players, the status of the account is still in limbo.
"There has been no real explanation why we have been banned," Finisterre said. "But it is odd that a day after they threatened to steal the account, someone else is in control."
The ban, originally for two days but now extended apparently indefinitely, is a symptom of account stealing, a tactic used by an up-and-coming breed of gamers that take losing as an affront and hack online game systems to give themselves an overpowering advantage. Research by both Finisterre and SecurityFocus has turned up more than a dozen complaints on online forums of Xbox Live accounts being stolen. And support people that Finisterre spoke with said that a handful of other incidents had happened on the same day.
The players that have stolen accounts are not shy about their activities. Several clans - the teams of players that have banded together to play first-person shooter games - have boasted online about their ability to steal accounts.
"We here at Infamous steal at least 10 accounts a day depending on there (sic) levels," claimed a site belonging to Clan Infamous, which bills itself as "the best account stealing + boosting clan" in Halo 2. "If you talk s**t we will mod on your account until it is banned. If the levels on it are good, we will use the Credit Card on your account to then change the gamer tag."
SecurityFocus made several attempts to contact members of the clan, but without success.
The clan's website, however, does detail the method its members use to steal accounts. Rather than hacking computer servers, the clan's account stealers claim to rely on social engineering to convince support personnel at Microsoft - and its subsidiary Bungie Studios, the creator of the Halo game series - to help the attackers take control of the accounts. To do so, the players spin a story about something going wrong with their account - from a crashed box to a sibling changing the password - and ask for help "recovering" the data.
"You call 1-800-4my-xbox, pretend to be that person, make up a story about how your little brother put in the information on the account and it was all fake," stated the Clan Infamous website. "You might get one little piece of information per call, but then you keep calling and keep calling, every time getting a little bit more information...once you have enough information you can get the password (and) the Windows Live ID reset."
Account hijacking in online games is nothing new. Online gamers have frequently been the targets of password-stealing Trojan horse programs that grab credentials so data thieves can break into a victim's accounts. In December, Chinese authorities arrested a 44-member ring of thieves that had mined stolen accounts for virtual goods to sell online.
In the latest case, grabbing the accounts gives that attackers fodder to boost their own rankings in the Halo 2 grading system. Halo 2 is not the only game plagued by the issues. Victims have also complained about losing accounts for Microsoft's Gears of War and Sega's Phantasy Star Online - the latter a massively multiplayer online role-playing game whose accounts can be mined for virtual items.
After initially denying that the service had been hacked, Microsoft said the company is now investigating the issue, but stressed that the problems seem more to do with pretexting than with a security breach of its systems.
"Recently, there have been reports of fraudulent activity and account theft taking place on the Xbox Live network," the software giant said in a statement sent to SecurityFocus. "Security is a top priority for Xbox Live, and we are actively investigating all reports of fraudulent behavior and theft."
Pretexting - another term for social engineering schemes designed to facilitate access to a victim's account - came to national prominence last September when a member of Hewlett-Packard's board revealed that the company had hired private investigators to uncover a leak and that the investigators apparently used pretexting to get access to board members' and journalists' phone records. Patricia Dunn, the former CEO of the company, was recently cleared of charges in the case.
Microsoft and Bungie have not indicated how widespread their own pretexting issues might be, but anecdotal evidence points to endemic account stealing issues.
Groups other than Clan Infamous have also boasted about their account-stealing capabilities, and victims have posted complaints in both Xbox Live forums and in other sites around the internet.
Finisterre may have gotten off lightly. Other victims have more serious stories to tell.
Mr Jokerz, the online handle used by a 19-year-old college student from Michigan, used to run his own clan, T3am Hazard, for playing Halo 2. The teenager, who asked not to be identified by name, found his team at a disadvantage against the cheats commonly used by abusers such as Clan Infamous. Complaints were immediately met with retribution.
Over a matter of months, Mr Jokerz's account was stolen six times and several thousand dollars worth of Microsoft points charged to his credit card, the teenager claimed. The attackers, which Mr Jokerz identified as Clan Infamous, quickly decimated the accounts belonging to the leaders and staff members of T3am Hazard.
"They go after anybody they want to," Mr. Jokerz told SecurityFocus in an online chat. "They just went after me a lot because I was the overlord (leader) of the clan."
The bullying went beyond the game world as well. From his account, the attackers harvested Mr Jokerz's home address and telephone number and called his house more than 100 times, the teenager said. Eventually, the teenager filed a police report. The Halo 2 player also said he identified the names and addresses of the clan members involved and gave them to both the police and Microsoft, but has heard no response back regarding any investigation. Microsoft could not immediately confirm Mr Jokerz's account.
The apparent lack of action has made Clan Infamous quite brazen. In a statement on the clan's site, they dismissed the efforts of Microsoft and Bungie to halt cheaters and account stealing and threw down the gauntlet in front of the company's investigators.
"You guys can't even freeze our accounts," the clan stated on their site. "You are pathetic, a joke...We aren't afraid of you one bit, so we will continue to steal accounts (and) max out credit cards until you find a way to stop us."
This article originally appeared in Security Focus.
Copyright © 2007, SecurityFocus