Potential Xbox Live hacking related to FIFA 12

[Tap In]

What happens if the hacker gets in and set up a "trusted PC" for your account on his end ? Is it possible ? What does the password-less download profile ban25 mentioned do ? Why does one need it ?

the ban 25 comment resets your profile so only the CURRENT console machine you are using allows access to your profile without a password and any other machines that your profile is on is locked without the password.


this other feature below is for recovery of a hacked Live ID acocunt itself that your console is linked to, not your "on console" gamertag per se. so you can take control of your live ID and change your password again including your consoles password

Account recovery – kicking out the hijackers and keeping them out

Spammers traditionally created their own accounts, but as we’ve cracked down on this practice, they’ve resorted to hijacking and exploiting the accounts of legitimate users to send spam. With today’s release, we are taking a step forward by detecting compromised email accounts, those co-owned by the legitimate user and the hijacker. We detect them with high confidence using heuristics based on login and account activity, and stop the abuse by locking the hijacker out and closing back doors they may have set up, like using vacation auto reply messages to send spam. At the same time, we begin working with the rightful owner to reclaim the account, recognizing the urgency of the issue.

The fastest way to get your account back, whether it was locked or you simply forgot your password, is to reset the password using account proofs. Proofs are like spare keys. If you set them up in advance, you can later use them to prove you are the legitimate account owner. Up until now, we’ve offered two proofs, an alternate email address and a personal question paired with a secret answer. However, there were limitations to these. For example, only 25% of people with a secret question actually remembered their answer when needed.







Today, we are introducing two new kinds of proofs for account recovery.

• “Trusted PC” is a unique new proof that lets you link your Hotmail account with one or more of your personal computers. Then, if you ever need to regain control of your account by resetting your password, you simply need to be using your computer and we will know you are the legitimate owner.
• The second new proof option is your cell phone number, where Hotmail will send a secret code via SMS that can be used to reset your password and reclaim your account.

Additionally, today’s release is making account recovery more secure in Hotmail. Before you can add a new proof or change any existing ones, you will need to be able to access at least one existing proof. For example, if your account was already set up with an alternate email proof and you wanted to add a cell phone number as well, you would need to use the alternate email address to do it. This means that even if a hijacker steals your password, they can’t lock you out of your account or create backdoors for themselves. You will always be able to get your account back and kick the hijackers out

http://windowsteamblog.com/windows_...dates-protect-you-from-account-hijackers.aspx

 

[Silent_Buddha]

See, and that's exactly what I have been suggesting was the most likely source of the problem all along: a flaw that allows brute force password attacks. Fuck MS for blaming the victims this whole time.

Eh, on any service anywhere on the net the majority of account hacks are done through phishing schemes. I'm not sure why you are lashing out at MS for that considering EVERY company will also pursue that avenue first in most account hacking incidents.

It's why phone/SMS verification during login is becoming more and more popular with a lot of services. Even if a hacker gets access to your username/password through phishing, they still can't do much since as soon as they try to login it'll ask for the code that was sent to your phone.

Regardds,
SB

 

[Brad Grenz]

I'm lashing out because MS has had. Flip attitude about how it MUST be the customer's fault even though many of us know for a fact we were not phished. And this continued for nearly a year during which they apparently never bothered to investigate alternate possibilities, while allowing thousands of their customers to be stolen from and locked out of Live for weeks at a time.

 

[KongRudi]

They hasn't said it MUST be the consumers fault due to phishing.. They also says there is something wrong with EA's system.. (Like beeing hooked up to the unsecure Live Network).
The only thing that is certain, is that MS isn't hacked, and they've investigated like a million accounts the last year, for 30 days each, and nothing wrong is ever found.

 

[Brad Grenz]

MS investigating a million compromised accounts in a year without discovering this flaw in their login system just speaks to their incompetence and negligence.

 

[Grall]

MS should be more attentive to the pattern of IP addresses that try to log in to your account. Most people likely keep their consoles at home and don't move it around much, so that creates a very predictable pattern when logging in.

If there's a sudden deviation to this combined with a lot of wrong password attempts, alarm bells should start going off over at MS. Apparantly this has not (historically, at least) happened. Blizzard has been a lot more proactive in this area with WoW, and you can't even buy things for real money inside of that game.

Tinfoil hat possibility:
Home intrusion. While you're away, burglar hackers break in (unnoticeably, naturally, for example by "bumping" the lock of your front or back door), turn on your xbox - which probably is set to auto-login to your account, and buy all the shit they want and change all the options they desire that way. Then they sneak out again, without actually stealing anything.

 

[Shifty Geezer]

They hasn't said it MUST be the consumers fault due to phishing.

No, but they've repeatedly said it isn't their fault, and yet people being able to brute-force a password clearly is MS's fault as everyone else has the sense to lock out an account or add a bot deterrent after a few wrong tries. Shifting the blame onto the users is just burying their head in the sand. Yes, they can proudly claim Live! hasn't been hacked, but they've complacently let thousands of accounts get hacked because they didn't identify and fix the faults when people were trying to bring it to their attention. If putting in a little web code to stop mass password tries could have saved thousands of customers hundreds of bucks, what's the defense for MS in not finding that or implementing it?

 

[Acert93]

MS investigating a million compromised accounts in a year without discovering this flaw in their login system just speaks to their incompetence and negligence.

There were a million compromised accounts last year?

 

[Brad Grenz]

There were a million compromised accounts last year?

I don't know. I was just repeating Kong's (hyperbolic?) number.

 

[I.S.T.]

http://www.hackedonxbox.com/

 

[bkilian]

MS investigating a million compromised accounts in a year without discovering this flaw in their login system just speaks to their incompetence and negligence.

I seriously doubt the number is anywhere near that, if only because it would entail investigating 2740 accounts a day, and we just don't have that big a staff. Let's say for argument's sake it's 10000, which would be like 30 a day and I think would still be high. That's 0.025% of our userbase. Even at 100000, it's a quarter of a percent.

The only flaw in the login page I see is that it returns a different error for account not found and incorrect password. I did a little test and it takes about half a second to return with the error. At 2 passwords a second, brute forcing is unfeasible. If they used a whole botnet for it, that would be behaviour easily spotted and I suspect it's watched for.

 

[Shifty Geezer]

At 2 passwords a second, brute forcing is unfeasible. If they used a whole botnet for it, that would be behaviour easily spotted and I suspect it's watched for.

The AnalogHype website is down so I can't check, but I thought this Jason chap actually managed to brute force a password? I can't see how brute-forcing an internet password is possible on any moderately secure system, because someone having to guess a thousand times is clearly a bot. After however many attempts, lock the account and require a password reset or whatever. But the original claim was that you could brute force the Xbox website. I don't think there's been any independent corroboration yet. EG reported the story claiming they were approached by someone called 'Jason' but before they could investigate, the AnalogueHype article went up.

 

[Brad Grenz]

I seriously doubt the number is anywhere near that, if only because it would entail investigating 2740 accounts a day, and we just don't have that big a staff. Let's say for argument's sake it's 10000, which would be like 30 a day and I think would still be high. That's 0.025% of our userbase. Even at 100000, it's a quarter of a percent.

The only flaw in the login page I see is that it returns a different error for account not found and incorrect password. I did a little test and it takes about half a second to return with the error. At 2 passwords a second, brute forcing is unfeasible. If they used a whole botnet for it, that would be behaviour easily spotted and I suspect it's watched for.

Apparently MS did a stealth update to the site shortly after the news broke, so you were probably testing the fixed system.

http://www.eurogamer.net/articles/2...d-xbox-com-security-secretly-tightened-report

 

[Shifty Geezer]

Good that it's fixed, but pretty underhanded by MS. No-one can prove they were ever at fault, despite an appalling security failing that has possibly been accountable for considerable harm to their customers. Well, I suppose if hacking stories diminish then we have circumstantial evidence. MS's handling of this has been terrible though. Head in the sand denial, and messing customers about, only to apparently have been to blame but to fix it on the sly and hope nobody noticed. And given their historically terrible security across their OS department, they score a very low trust rating with me.

 

[bkilian]

The AnalogHype website is down so I can't check, but I thought this Jason chap actually managed to brute force a password? I can't see how brute-forcing an internet password is possible on any moderately secure system, because someone having to guess a thousand times is clearly a bot. After however many attempts, lock the account and require a password reset or whatever. But the original claim was that you could brute force the Xbox website. I don't think there's been any independent corroboration yet. EG reported the story claiming they were approached by someone called 'Jason' but before they could investigate, the AnalogueHype article went up.

He did? Since it should take many millions of attempts to brute force even a simple password, how long did it take this 'Jason' chap? Even if the site is blazing fast and returns in 50 ms, that's still only 20 passwords a second. Brute forcing any password that isn't a simple dictionary word would take years. At 2 passwords a second, it's not worth the time you'd put into it.

Apparently MS did a stealth update to the site shortly after the news broke, so you were probably testing the fixed system.

http://www.eurogamer.net/articles/2...d-xbox-com-security-secretly-tightened-report

Irrelevant to my calculations really, although if I were them, I'd wait 2-5 seconds before returning a failure. Wouldn't hurt legitimate users, but would destroy any brute force system.

As for locking the account, I'm not sure giving someone else the ability to denial-of-service your account any time they want to is a nice thing to do. I did it to myself a couple of times, and it was pretty annoying.

Edit: A simple calculation using my XBL password as an example (8 characters, letters and numbers, upper and lower case, not based on any dictionary word at all), indicates it would take 1x10^14 tries on average to brute force it (half the total password space). At 20 passwords a second, that comes to 173 thousand years. And that's with the attacker knowing the length and the character set I used. If I used special characters and he didn't know the length, it balloons into millions of years. With a 10000 machine botnet all attempting to force it simultaneously (And trust me, this would be noticed), it would take 17 years on average. And that's assuming the website delivers 20 failures a second to all the clients.

I _really_ don't think brute forcing Live was the method they were using to grab people's passwords.

 

[Shifty Geezer]

He did? Since it should take many millions of attempts to brute force even a simple password, how long did it take this 'Jason' chap? Even if the site is blazing fast and returns in 50 ms, that's still only 20 passwords a second. Brute forcing any password that isn't a simple dictionary word would take years. At 2 passwords a second, it's not worth the time you'd put into it.

I stand corrected. The AnalogHype article is back, and it doesn't say that he actually gained access to an account; only that it was possible to automate:

Now with a simple script, hackers can brute force their way into your Xbox Live account. The script would batch run a list of potential password, which anybody can find online with a simple Google search...

As you say, brute forcing would be damned slow unless a lot of passwords are common enough to feature in a list of 100 or 1000 or whatever, which is what he's suggesting. That places considerable blame on the users for not using secure passwords, although a system that allows so many attempts in an unnecessary weakness.

Considering brute-forcing probably isn't the actual hacking vector, I recind my rant on MS somewhat. An update to their login is just part of their general revision and tightening, rather than a sly fix. What remains troubling is users with good passwords still getting hacked. As guesswork can't find those, it means the passwords are getting out somehow, whether on their computer or off some 3rd party. As Live! is commonly accessed through multiple services, a hole could be anywhere. I wonder though if the email part that this Jason chap found, the fact that the login tells you if it's a valid id or not, provides info used elsewhere?

 

[hoho]

Even if the site is blazing fast and returns in 50 ms, that's still only 20 passwords a second.

You do realize that one PC can have more than one request in flight at any given time?
Though I agree, it still would take ages to hit an actually working password.

 

[KongRudi]

I seriously doubt the number is anywhere near that, if only because it would entail investigating 2740 accounts a day, and we just don't have that big a staff. Let's say for argument's sake it's 10000, which would be like 30 a day and I think would still be high. That's 0.025% of our userbase. Even at 100000, it's a quarter of a percent.

The only flaw in the login page I see is that it returns a different error for account not found and incorrect password. I did a little test and it takes about half a second to return with the error. At 2 passwords a second, brute forcing is unfeasible. If they used a whole botnet for it, that would be behaviour easily spotted and I suspect it's watched for.

Well, I obviously don't know how many victims there are, since I'm not doing it..
My number is just a wild guess..

Let's assume this all is one person, with a copy of your script.

I click on your profile here..
See that your gamertag is MHolmesIV, and then i go to google, type in 'MHolmesIV email'

I get up:
Handfasting Info :: Home | Statistics & News at ZitetrendZ.com
www.zitetrendz.com/handfasting.info/ - USA - Oversett denne siden
14 Nov 2011 – Admin Email:mholmesiv@gmail.com. Billing ID:FAST-16079766. Billing Name:Bryan Kilian Billing Organization: Billing Street1:609 S 29th pl ...

I don't know if it's you or not, but I suspect it is..
This works on allmost everyone, including me..
It's not easy to hide on the web, unless you're gonna do something shady, most people don't take the effort either.

So I do that procedure and finds 5 e-mails, wich is x-box users.

I set up your script to run 5 sessions of the script simultanously, I then get 10 tries each second, on 5 email-adresses.

In a minute, I have tried 600 password on those 5 e-mails, and a hour later, I have tried, 36000 passwords on those 5 emails, after a day I have tried 864000 passwords on 5 emails, and now I might have gotten a hit from one dude, even if he didn't use a easy to guess password, i.e. pass1234.

When the Xbox-password is found, it get's logged in password.txt.
So I could use that and go on a shopping spree when I felt like it..
Also, if I were the one doing it, I might have tried to do it slowly, especially if the victim were previously a Fifa-customer, I would try to siphon out money without the user noticing it, so I could do it over a longer period of time.

And that's why think it's important that account get's denied after x-amuonts of failed login, or atleast that you can't try to log in unlimited amounts of time.
As long as the user can unlock it, by e-mail, I think the annoyance is well worth it, for added security.

Anyway, enough about that..

I first started reading about incidents like this in November (I think) two years ago, when the family live Gold packs came around, I don't know how long it's been going on,
But it escalated alot when Fifa came around, maybe it's a hotter commodity, or you can earn more by getting the top players.. I dunno. :-/

I don't know if it's a million people or 100.000, I just feel that MS is trying to shuffle things under the rug, I don't think it's as bad as the previous thing they tried to shuffle under the rug, i.e. the RRoD - things break.
I don't expect that the service will be completely secure, and incidents won't happen.
But when it's as bad as it seems to be, I think they need to concider sending out e-mails, warning people that it might be a good idea to change their passwords, every once in a while, atleast until they can pin down the problem.

And they should also find a way to stop letting people use the stolen goods.
i.e. they clearly track who gets a family-subscription, but when the account is reported hijacked because there were bought X family-subscriptions.
And it's a month lockdown for investigation, it can't be that serious investigation when the victim see the person who were granted a family-subscription on his friends list, talking about where he bought it used, and how awesome the service were.
That's just cultivating the market for those stolen properties, those accounts should be locked immeadiately.
To me it allmost seems like the 30-day lockdown, is more punishment for reporting the theft, rather than an investigation :-/

 

[Silent_Buddha]

What remains troubling is users with good passwords still getting hacked. As guesswork can't find those, it means the passwords are getting out somehow, whether on their computer or off some 3rd party. As Live! is commonly accessed through multiple services, a hole could be anywhere. I wonder though if the email part that this Jason chap found, the fact that the login tells you if it's a valid id or not, provides info used elsewhere?

Phishing is the obvous vector. Assuming their password really IS good. Rather than they think it's good just because it has a number or two. Especially if they do something I see regularly, replacing letters with their common numberical analog. Like replacing "e" with "3".

As for brute forcing. If this is anything like the adult website cracking scene, most brute force attempts on websites first use a list of common or frequently used passwords which have been aggregated into lists over the years. Some of those are technically "good" passwords featuring upper and lower case letters as well as random numbers. Interestingly enough many of the passwords on the lists were first gained through phishing and made it into the list as they ended up being somewhat commonly used.

Heck if even 1% of Xbox live users are using common passwords, it wouldn't take too long to psuedo brute force it using password lists combined with the ability to determine a users e-mail address through what was described by that AnalogHope website if they are using a botnet.

Regards,
SB

 

[hoho]

Judging by the password leaks we've seen last year using a dictionary attack against such services would give you plenty of useful username/PW combos.