Slashdot Mirror
Xbox Live Fraud Probed By Microsoft
Several outlets are reporting on Microsoft's investigations into the possibility of hacking and fraud on the Xbox live service. After customer service complaints, rumours of hacked accounts, and allegations of mis-used credit card information, C|Net reports that the Microsoft has opened an investigation. At the very least, this will reassure frustrated customers. Kevin Finisterre has kept a log of his discussion with the 1-800-MY-XBOX folks and the service's ongoing problems. "Security researcher Kevin Finisterre was playing Halo on a recent night with several friends when some of their opponents threatened to steal their accounts, he said. 'Literally the next day my girl's account was locked out,' Finisterre wrote in an e-mail Tuesday. 'I received a message on my Xbox that said: "We are sorry we must log you out of Xbox Live because someone else is using your Gamertag."' The account was banned."
Just like the adage: if you can see it or hear it you can copy it, If a network can be accessed a network can be hacked.
My humor is probably your flamebait
How many lock outs are from false positives?
After wandering around the links, I came across the following website; http://www.oinfam0uso.moonfruit.com/
:)
And since they're charming people, I have no qualms about posting their method here;
Now you may be wondering HOW do we get your information? its easy, you call 18004myxbox pretend to be that person make up a story about how your little brother put in the information on the account and it was all fake, blah blah blah you might get one little piece of information per call but then you keep calling and keep calling everytime getting a little bit more information every time. once you have enough information you can get the Pasword on the windows live ID Reset, they may tell you they cant but its bull shit. people at bungie CAN and WILL reset your password. believe me
So, sounds like a classic social engineering scheme, as opposed to 'hacking the system'. Even so, you have to wonder if phone reps really are giving out information, even if it is a small amount. Anyone tried getting information out of the phone reps yet?
... don't include this "feature" when you update your on-line to be more like XBox Live! :)
This space for rent. All reasonable inquiries will be entertained at proprietors discretion.
Accounts for all sorts from MMOs to bank accounts to ebay get hacked online, I'd argue however that MS has an even tougher job than usual here as console users are probably often even less security-literate than PC users.
I doubt this is much different from the trojans that target WoW accounts or the organised crime financed hackers that go for people's bank, paypal and ebay accounts.
It is highly improbable that Microsoft's servers were compromised. Administering their own network is one of the few things they do relatively well.
Schwab
Editor, A1-AAA AmeriCaptions
I just hope I'll be able to download Symphony of the Night when I get home.
I find that highly unlikely. Let's say the only thing you need to reset password is the name. How would you possibly ever get this information no matter how many times you called? Do you call them and say hi I'm the owner of this ID but I'm not sure what name I wrote down?
Read the very post you responded to. The caller is askign exactly that, with the excuse that a brother or kid created the account with false info... in that context it sounds reasonable to ask what name they put on the account. I can easily see this tactic working.
"There is more worth loving than we have strength to love." - Brian Jay Stanley