Slashdot Mirror
Hackers Targeting Xbox Live
darthcamaro writes "Windows isn't the only piece of Microsoft technology that hackers are attacking anymore. During a presentation at the SecTor security conference in Toronto, a Facetime security researcher revealed numerous methods by which Xbox users are being hacked today. 'Though the Xbox doesn't have the number one market share, it is the top target for hackers,' Boyd said. 'Xbox Live has 17 million plus subscribers, and that service requires payment.'"
That explains why these 12 and 13 year-old kids keep pwning me in Halo. Damn hackers.
According to Boyd, the friend request DoS has been minimized in recent months as a result of Microsoft actions. Microsoft has now limited the number of friend requests a user can send, so there is now a time delay that mitigates the DoS risk.
Not if the attacker is using a botnet, unless TFA means the number of friend requests a user can receive.
One way that attackers enumerate their targets is by way of information that is easily publicly accessible. Xbox users gain points during gameplay, which leads to a gamerscore metric. The higher the gamerscore, the more valuable the gamer account. Boyd noted there is no easy way to keep a gamerscore private.
"If you go into the Xbox privacy settings, you can't block the gamerscore," Boyd said. "All you can do is hide your list of most recently played games."
Boyd added that sites like Mygamercard.net promote users' gamerscores, in effect painting a big target for attackers.
Typical, and depressing.
Free Martian Whores!
'Though the Xbox doesn't have the number one market share, it is the top target for hackers,
This phrase says everything.
I'm so glad I went with the PS3, I'll never have to worry about hacking if my firmware doesn't even work!
"Our goal each year should be to increase the number of goals we set for ourselves!"
Don't be confused. They're not hacking your hardware or the Xbox Live servers. They're using social engineering and any publicly available information (courtesy of things users choose to divulge in their profiles) to attempt to get passwords.
Big difference between hacking & phishing. Moreover, there's nothing particularly unique to the XBox Live service & this phishing, either.
Or it could be that the Wii has the biggest market share, but its online presence is... well, lame, and since xbox live is definitely the place for online console gaming with a successful online store model so it's a better target?
Microsoft bashing is all fun and good, but at least think a little bit about what you've written before posting.
No, that link you posted to a web comic we've all seen a hundred times is not "obligatory."
The "researcher" who is quoted in this article comes off like a moron.
He complains that there is no way to hide one's gamerscore. NO SHIT. It is called social networking. GAMERSCORE = (imagined) PENILE LENGTH INCREASE. You don't farking hide it, the entire point is to show it off.
Next up, sending someone a message "g1ve me urz PW and I'll givez you 1,000,000 gamerscores!!" is not hacking. It is exploiting people's greed. There is a big difference.
Likewise wussies DOS'ing a game server to get back at the people who kicked their wimpy arse is also not new, it happens WAY more often in PC games, since the majority of PC games have dedicated servers whereas only a few (but popular) Xbox 360 titles use dedicated servers.
In summary, these are not "hackers targetting Xbox Live". 99% of them don't even rank as script kiddies.
Need help treating your acne? Come here!
My account was stolen. It sucked. It took me months and way, way too many phone calls to get it back. The asshole who hacked it had changed so much information, including the gamertag, that they didn't even want to talk to me on the phone at first. Xbox customer support is absolute shit. Their reps are totally unhelpful, refusing to deviate from the script despite the fact that "account stolen" is apparently not in the script. There was not one that I called that was comprehensible in English.
Oh and this whole thing started because I found over $100 worth of Xbox points charged to my credit card. To this day I have no idea whether that person actually got my CC number or figured out how to charge without it. I executed a chargeback on that $100, and have yet to see another fraudulent charge.
Not really right, no.
Xbox does have the number one market share in active online players (excluding the PC "open market"). Especially notable considering the annual fee.
Nintendo has the number one share in consoles currently sold. Online support on the Wii is basically neutered by the friend code system. Many games don't even try to do online multiplayer, and no financial information is stored on the system or your "profile" which really isn't a profile in the same sense.
TFA is pretty vanilla on the details and doesn't offer much new information to anyone actually familiar with XBL. DoS attacks are hardly a surprise for Microsoft, and mainly it's social engineering. That's so old news the Major Nelson podcast practically includes a weekly disclaimer now, that giving out your password is always a scam. But a kid looking for $50 of free purchasing points may be willing to take the chance.
TFA does not mention any virus. In fact, the bulk of the attacks it mentions are social engineering attacks. There's nothing the OS can do about that. Some OSes may allow you to do things in a "smarter" way, but, to the best of my knowledge, there are none that can prevent you from being stupid.
if you RTFA, what you basically see is this
- Xbox LIVE accounts are worth something, and often have CC info embedded in them
- all of the techniques are for getting control of an XBOX live account or DOSing an XBOX live user
- all of the non-DOS techniques are SOCIAL engineering "attacks"
The XBOX Live network is actually pretty solid, with IPsec between endpoints and servers. The successful "attacks" at the network layer are essentially ping-floods or traffic stoppages [i.e. the Halo bugs where you could turn off your cable modem and thus disconnect without killing your ELO ranking].
Finally, regarding the point about market share / attractiveness to hackers: this is stupid.
XBOX Live has more paying customers than any other console gaming network. Looking at # of consoles sold is not the same thing as attractiveness for phishers/scammers.
So, Mod the Article (-1: Epic Fail)
My opinions are my own, and do not necessarily represent those of my employer.
RTFA, there is no hacking being done. It's all DoS attacks, social engineering, and phishing scams. These methods are all independent of the hardware and in most cases the services being offered.
Also, while the xbox may not have the largest marketshare I would argue that it is very likely to have the largest and most active online community. The article is about "hacking" account information, not the hardware or software itself.
Despite what the article might lead one to believe, the Xbox hardware isn't being hacked. User accounts are being compromised. The accounts aren't be compromised due to weakness in the software, authentication mechanisms, or by virii/malware. They are being compromised by social engineering and phishing. The only slightly disturbing subject mentioned involves introducing latency into game connections by way of DoS attacks and botnets. That sucks for people who play the games, but that isn't a weakness limited to the Xbox. Any internet connected device is susceptible to DoS attacks in some way.
Comment removed based on user account deletion
It's possible to only buy Nintendo Points cards, too
This is true of Xbox Live as well. You can subscribe and have your credit card charged automatically, but you can also survive on membership/points cards that you buy at the corner store instead.
Visual IRC: Fast. Powerful. Free.