How are these Russians getting a hold of my game accounts?

Nebell

[H]ard|Gawd
Joined
Jul 20, 2015
Messages
1,643
So a year or so ago some Russian guy got a hold of my Ubisoft account, which I recovered.
Then a few weeks ago another Russian guy got a hold of some of my other account, can't remember which.
Today, I got an email from EA and The Old republic that my email was changed to some email address ending in .ru.

First I thought, weak password, but I don't use weak passwords, I always have at least letters and numbers. EA also forces you to use at least one capital letter and numbers.
Besides, it's ONLY my gaming accounts that keep getting hacked. I use a lot of other online services like Facebook, Paypal, [H] and so on and on, and they never get hacked, which leads me to believe that these gaming companies either have piss poor security or they are targeted by hackers more often (although they can get a lot more from hacking my FB or Paypal account).
 

cageymaru

Fully [H]
Joined
Apr 10, 2003
Messages
19,849
Enable 2 factor authentication on your accounts. Stop using browser plugins as the original authors sell them off to companies that then exploit the trusting customers. Same with your phone apps. No flash allowed. Malwarebytes or an equivalent.
 

bigdogchris

Fully [H]
Joined
Feb 19, 2008
Messages
17,999
Also make sure the email accounts attached to the accounts is good password wise (recently changed and secure). If they have access to your email they can get into your game account and change the password with ease. They delete the PW reset notifications that you get in email so you don't notice.
 

Nebell

[H]ard|Gawd
Joined
Jul 20, 2015
Messages
1,643
They are not getting inside my email adress. That's why I know they are making updates on my game accounts. I get email notifications.
2 factor authentication is annoying as I often swap ROMs on my Android phone.
What's MFA?
 

Araxie

Supreme [H]ardness
Joined
Feb 11, 2013
Messages
6,404
Pirated/cracked games? Those are the first entrance of hackers to gaming accounts, as their Crack tend to emulate steam or origin archives with some locked .API files that you don't know what have inside..
 

bigdogchris

Fully [H]
Joined
Feb 19, 2008
Messages
17,999
They are not getting inside my email adress. That's why I know they are making updates on my game accounts. I get email notifications.
2 factor authentication is annoying as I often swap ROMs on my Android phone.
What's MFA?
How do you know they are not getting into your email? Does your email provide you with a logon history and login IP?
 

Nebell

[H]ard|Gawd
Joined
Jul 20, 2015
Messages
1,643
How do you know they are not getting into your email? Does your email provide you with a logon history and login IP?
Outlook does give you that option. I have a bunch of unsuccessful at tempts to log in from all over the world. Not a single one from Russia though, mostly Asian countries like China, Japan, Taiwan, Nepal, India and SA like Brazil.

Pirated/cracked games? Those are the first entrance of hackers to gaming accounts, as their Crack tend to emulate steam or origin archives with some locked .API files that you don't know what have inside..
Nope, I buy my games.
 

MavericK

Zero Cool
Joined
Sep 2, 2004
Messages
29,346
They are not getting inside my email adress. That's why I know they are making updates on my game accounts. I get email notifications.
2 factor authentication is annoying as I often swap ROMs on my Android phone.
What's MFA?
Multi-factor authentication (same thing as 2-factor in this case).

It's inconvenient, but do you want your shit to be secure or not? That's what it comes down to.
 

Armenius

Fully [H]
Joined
Jan 28, 2014
Messages
21,371
Multi-factor authentication (same thing as 2-factor in this case).

It's inconvenient, but do you want your shit to be secure or not? That's what it comes down to.
Indeed. An extra 30-60 seconds is better than spending up to a month trying to get your stuff back.
 

Ebernanut

[H]ard|Gawd
Joined
Dec 15, 2010
Messages
1,149
They are not getting inside my email adress. That's why I know they are making updates on my game accounts. I get email notifications.
2 factor authentication is annoying as I often swap ROMs on my Android phone.
What's MFA?
I don't use any of the companion apps to secure my game accounts but I do give them my phone number so they send me a text with an authorization code when I try to make any major changes. It has worked for me so far and shouldn't be affected by changing roms.
 

cageymaru

Fully [H]
Joined
Apr 10, 2003
Messages
19,849
They are not getting inside my email adress. That's why I know they are making updates on my game accounts. I get email notifications.
2 factor authentication is annoying as I often swap ROMs on my Android phone.
What's MFA?
Got an old Android phone laying around? Use it for 2 factor authentication. Just remember to charge it from time to time so that you can login. ;)
 

cageymaru

Fully [H]
Joined
Apr 10, 2003
Messages
19,849
Pirated/cracked games? Those are the first entrance of hackers to gaming accounts, as their Crack tend to emulate steam or origin archives with some locked .API files that you don't know what have inside..
That's why I stopped messing with No-CD cracks on games that the DRM just won't allow me to play, but I legitimately bought. Too much teen angst among the groups that release the stuff. ;)
 

ecmaster76

[H]ard|Gawd
Joined
Feb 6, 2007
Messages
1,150
Outlook does give you that option. I have a bunch of unsuccessful at tempts to log in from all over the world. Not a single one from Russia though, mostly Asian countries like China, Japan, Taiwan, Nepal, India and SA like Brazil.
Botnets know no borders, just sayin
 

bigdogchris

Fully [H]
Joined
Feb 19, 2008
Messages
17,999
Outlook does give you that option. I have a bunch of unsuccessful at tempts to log in from all over the world. Not a single one from Russia though, mostly Asian countries like China, Japan, Taiwan, Nepal, India and SA like Brazil.
Someone who has access to your email that can allow them access to your game accounts would not show up as an invalid login attempt. If they have your password it would work the first time.

It's probably a good idea to change your email password and verify your phone number is still listed correctly for recovery.
 

Nebell

[H]ard|Gawd
Joined
Jul 20, 2015
Messages
1,643
Someone who has access to your email that can allow them access to your game accounts would not show up as an invalid login attempt. If they have your password it would work the first time.

It's probably a good idea to change your email password and verify your phone number is still listed correctly for recovery.
But they would show up as a successful login. The only successful logins are from my place.
 

Armenius

Fully [H]
Joined
Jan 28, 2014
Messages
21,371
Someone who has access to your email that can allow them access to your game accounts would not show up as an invalid login attempt. If they have your password it would work the first time.

It's probably a good idea to change your email password and verify your phone number is still listed correctly for recovery.
With Gmail, at least, you can see a history of the devices that have attempted to access your account. I have only 3 devices that I access my Gmail with, so if anyone tries to fuck with it it will stick out like a sore thumb. You can even have alerts sent to your secondary e-mail and/or phone when an unrecognized device tries to login.
 

Yippee38

[H]ard|Gawd
Joined
Apr 21, 2000
Messages
1,842
How secure are your passwords? You have letters, numbers and at least one capital. How long are your passwords?

Get yourself a password manager program, use long, secure, random passwords on everything.
 

cageymaru

Fully [H]
Joined
Apr 10, 2003
Messages
19,849
Well to be honest some years ago I had a WoW account that got hacked and was bot mining 24/7. This was BEFORE you could pay for game time with in game gold. It had one of those Blizzard key chain authentication units attached to it so that you HAD to use the authentication on the key chain to log into the game. I hadn't paid for game time in I guess a year or more, but the hackers were still playing. I contacted Blizzard because I couldn't get into my account to play one of their new expansions I had purchased.

Blizzard victim blamed me and sent me a nasty message about it was my fault for illegal account sharing which of course I hadn't done. I explained that I hadn't paid for the game or logged into the game for over a year; how was anyone playing my account? They later on admitted that they had gotten hacked; not sure if it was this instance or another as it was quite awhile ago. I accepted their apology and played 2 weeks of the expansion before shutting down my account again. ;)

So yes these companies do get hacked and accounts compromised. But most of the time it is the user that has a virus somewhere that is compromising their login information. I would look at my PC and consider wiping it as it is helluva annoying to get your account back.
 

ob1

2[H]4U
Joined
Apr 17, 2000
Messages
2,274
Honestly, if you have been affected this many times, you should consider all possibilities of compromise. If I was in that situation, I would probably completely format my system and start over. Before that though I would change every password I could think of, including email, forum accounts, game accounts, etc, to a password series that is 12 to 16 characters with letters, numbers, special characters, caps, etc. Something like Th1rsday!bl0w@! or something with variations for each place you use it. Then the format, and watch. If the problem comes back immediately, someone else is compromised, but if it comes back in a few weeks, then you are doing something to compromise yourself.
 

m3talc0re

n00b
Joined
Feb 11, 2016
Messages
31
Some Russian twat got into my Origin account once. I hadn't even been on it in a while and out of nowhere, I started getting emails from Origin in Russian. I was like, dafuq? So I get my account back and find out that he used cheats on BF3 and got my BF3 account GUID banned. Contacted punkbuster and EA, neither would do anything about it. This was back when BF3 was still the latest BF game. I could no longer play it online after spending $100+ on the game and their premium bullshit. I don't use weak passwords, either.
 

ob1

2[H]4U
Joined
Apr 17, 2000
Messages
2,274
I have found that the most exploited systems seem to be email servers and forum accounts, where people tend to use simple passwords that never get changed over the course of years. For instance, my complex [H]ardforum password that was setup in April of 2000, was drastically under-powered for todays environment. There were many sites and email servers that would not even let you use special characters or long passwords back then. So over time, you have to go in and update your old accounts, not just the "important ones" like game accounts, but email servers and forum accounts. Just a PSA....
 

Matthew Kane

Supreme [H]ardness
Joined
Dec 1, 2007
Messages
4,233
My RS GTA V acc was hacked and email changed to some random gibberish. I confronted the fucker that as I emailed him and turns out he bought my acc for very low $ from some Russian website. So it turns the Russian's and Ukrainian's are hacking into game accounts for many various games and selling them off for money.

This was also after RS' account details were leaked onto the public somehow.
 

Simmonz

2[H]4U
Joined
May 14, 2008
Messages
2,506
Yeah my Ubisoft account also had an unwanted Russian guest a few years ago. Surprisingly they didn't change the password or anything, only reason I knew someone had gotten in was they changed the language for the account to Russian. I use Uplay so little that for all I know they were playing my Ubisoft games more than I was haha. Had to Google translate the menu so I could put it back to English and then I changed the password and turned on two-factor authentication. Haven't had an issue since.
 

Nytegard

2[H]4U
Joined
Jan 8, 2004
Messages
3,162
Other people have already given good advice on how to protect yourself. The main thing you need to understand though is that no matter how paranoid and secure you are, you're really only as strong as the weakest link, and that includes the game companies. I've had logins & accounts stolen that I only ever logged onto with a computer that had only ever been used for logins (never downloaded any files, didn't have flash installed, etc.). Big companies get hacked, it's a fact of life. No matter how many intelligent people work there, Google, Microsoft, Apple, etc. aren't immune to these problems. If someone really wants that data, they're going to get it. And unfortunately, personal information and accounts, yes, even video game accounts, are currency.
 

MrAgmoore

[H]ard|Gawd
Joined
Jun 5, 2008
Messages
1,982
Use both ESET Nod 32 and Malwarebytes. Doesn't it seem obvious that you have a keystroke logger on your computer?
 

Matthew Kane

Supreme [H]ardness
Joined
Dec 1, 2007
Messages
4,233
The problem goes further than a keylogger on the users end its always a problem on the game companies end managing and holding user data.
 

MMitch

Gawd
Joined
Nov 29, 2016
Messages
807
Well to be honest some years ago I had a WoW account that got hacked and was bot mining 24/7. This was BEFORE you could pay for game time with in game gold. It had one of those Blizzard key chain authentication units attached to it so that you HAD to use the authentication on the key chain to log into the game. I hadn't paid for game time in I guess a year or more, but the hackers were still playing. I contacted Blizzard because I couldn't get into my account to play one of their new expansions I had purchased.

Blizzard victim blamed me and sent me a nasty message about it was my fault for illegal account sharing which of course I hadn't done. I explained that I hadn't paid for the game or logged into the game for over a year; how was anyone playing my account? They later on admitted that they had gotten hacked; not sure if it was this instance or another as it was quite awhile ago. I accepted their apology and played 2 weeks of the expansion before shutting down my account again. ;)

So yes these companies do get hacked and accounts compromised. But most of the time it is the user that has a virus somewhere that is compromising their login information. I would look at my PC and consider wiping it as it is helluva annoying to get your account back.
Same thing happened to me with PSN... some guy made his PS4 my "main PS4" and because of this my guest couldn't play my digital games using his PSN ... (Not sure how long he was using my account but that event made me dig...).
Upon contacting SONY/PSN, I was hung up on the phone multiple times... and blamed for sharing my PW which I didn't... (Yes I use numbers/letters/caps & characters)... I had to make a complaint to the BBB to get this solved and enabled 2FA after that but tbh, I trust that as much as I would trust a knife in a gun fight ;)

I find it amazing that companies that admitted in the past that they were hacked (or willfully omit to say they were) blames us, the victims of their inactions... (fyi, SONY admitted this a few years back... and even compensated us peasant...)
2FA needs to be enforced and mandatory as much as possible... and before that, companies need to be accountable of their poor decisions...
 
Top