Question: hypothetical Hacking of a Gold card protected account

Mate, all due respect, you're high.

love that logic... so because no famous or wealthy person has had their bank account hacked, no bank accounts have ever been compromised? i dont think so.

Lol.. aside from the fact that hacked ain't the same with compromised, maybe you didn't saw that was my reasoning. Nothing forces you to adhere to it, build your own fortress around the computer, until I see a bigshot hacked I won't worry. What, you gonna boil? :laugh:
 
Last edited:
If Ma Records All transactions Between avatars then Why cant they Simply by Ip Address logs Return to the Right full Owner His/Her Stuff. Regardless of Who Now owns it. There is No Reason why not.

It May not be fair to the person who bought the hacked item but then how is it fair to the person who got hacked.

the reason is, how far back do you unravel the sequence of trades. someone sells a adj fap so they can afford to buy a set of tiger that turns out to be from a hacked account. does the adj fap trade get reversed too? how about if one deposited the cash and incurred the fees, is there an instant withdrawal permitted and refund of fees? thats with just one degree of seperation, could be traded 2 or 3 times before a hack comes to light and MA has investigated. Then again, thats how it works in real life, so maybe people would be happy about that. But i dont think they will be and rather than one unhappy customer MA have to deal with a half dozen or more.
 
the Point of this Thread was to Get Individual responses to this "Threat" since it is Real in one way or another. My Secondary goal was to Make this a Real Issue with MA so they can See what You think about this subject. Since it Has to do with Everyones experience being enjoyable inside of EU. Furthermore We all have Invested in some way or form our money with the Promise of it being Removable. End of the Day for some thats what matters Can I get that back.

Some of the Response To this saying "Its your Own Fault it got Hacked" I Really don't agree with. I Don't give a rats ass who says it that Doesn't make it Right Or Acceptable.

Sorry its Not like they Held Out a HUGE ASS sign saying HACK ME.

Truth Is You can Have Everything Secure and Still get Hacked.

If Ma Records All transactions Between avatars then Why cant they Simply by Ip Address logs Return to the Right full Owner His/Her Stuff. Regardless of Who Now owns it. There is No Reason why not.

It May not be fair to the person who bought the hacked item but then how is it fair to the person who got hacked.
If your in possession of Stolen Property In Real Life you can be Arrested for it in most Countries.

in response to vedders post
Yes we should discuss it. Why? It informs us and Reminds us to be Very cautious of what we do choose to download.
Weak Souls Exist one way or another. the Question is what will MA do in such a case. I think the EULA is not clear enough on this subject.

EULA is clear... You get hacked from your fault, you lose your account. Buy a firewall, update your antivirus every day. When you can't log in after a gold card use, login on EU web site and acces the account page where you can edit your address. You need a GC number to go there.

A trojan can edit your host file and make you connect to a malicious site instead of EU... Keep an eye on the spelling of the address, and see if is typed right EVEN IF IS BOOKMARKED.

Don't get infected. Use the best security out there if your account worth something. Best security is 50-60$. Your account can be in some cases several K$...

Keep windows updated. Even if you have firewall and antivirus, if OS is not up to date, you can still have security holes.

Not respecting those will make you a potential victim. That means you can basically lose all you have and MA has no fault. Or anyone else.
 
A statement that they have the "safest virtual universe" is NOT saying "you will never ever ever get hacked"....

It is comparing their virtual universe to others out there and saying that out of the competitors versus MA, MA offers a more secure enviroment (SAFER) then others. STATEMENT IS NOT SAYING IT IS FULL PROOF!

your statement is a bit harsh at the end too... not really necessary to make a point

:lolup::lolup::lolup:
How do you know what they meant with that statement?

That was only your opinion I believe.:)
 
It would not be easy to hack a GC but it certainly is possible. Obviously the GC system is algorithm bas
 
Last edited:
...
Sorry its Not like they Held Out a HUGE ASS sign saying HACK ME.
Truth Is You can Have Everything Secure and Still get Hacked.
...
Well... No. But the problem is you can never have everything completely secure.
Doesn't really matter though: Just get a GC.

...
If Ma Records All transactions Between avatars then Why cant they Simply by Ip Address logs Return to the Right full Owner His/Her Stuff. Regardless of Who Now owns it. There is No Reason why not.
...
I assume the above refers to if an account with GC was hacked. But it's still a bad idea.
If it was common practice for MA to do as you say above, the hackee could be in league with the hacker, and thus some innocent guy loses what he paid for the stolen item, while the hacker get free money and the hackee get his item back.

...
in response to vedders post
Yes we should discuss it. Why? It informs us and Reminds us to be Very cautious of what we do choose to download.
...
We can discuss security measures without going into details about how the hacking could be performed.

Threads have been locked before, when the hacking method descriptions became too detailed.
 
What will MA Do in this Case since the GC system is supposedly secure.

Scenario Clean Installed comp with Normal apps a EU player will use such as Xfire, Vent, TS,

Player has a valuable account Never has Shared the Account Gold card protected. the account has a Seldom used Email address.

Said Player logs in and finds all Skill items stolen the account wiped completely

player does the usual support case to MA.

the method used to Hack the account is beside the point yes there are many possibilities. For the sake of RE securing the GC system MA would need to know how But what Would MA do period.

REMEMBER THIS IS A FICTIONAL CASE ONLY.

I would love to have an MA official Respond to this thread. Official Info Much appreciated in This scenario.

The above statement can't happen. The cost of the 'hack' far outweighs the gain. i.e. the gain is nothing, the prisontime is ass-destroyerrific, an the cost to design a system to guess the goldcard spline-32 hash fp requires knowledge of each individual gc (they would operate on their own algorithm checksums)

i.e. you can hack one GC at a time and the equipment required would be phenomenally expensive (equipment being , 600k U$).

The GC's themselves have failsafes (like eftpos reading systems) that would mean a loss of data if you try to tamper with it).

If someone who thought to get the GC from a person (otherwise known as grandtheft) and run their algorithm checker over it, AND somehow got the password from the person who owns the avatar... well that hypothetical is ridiculous because 'hacking' the GC requires possession of the GC....
alternatively, they could try and crack the MA database... hmmm which is more illegal?
 
Many good things said here. It is a real threat. MA's answer would be case by case.

IMO the only way MA will ever reverse trades/withdrawls is by having evidence with out a doubt that the "hackie" is not involed. Which would be next to imposable even with a chat log. I also belive that MA keeps track of the suspected criminals activities, meaning they know who the perpetrators are and are working on proving it to themselves. You might not get your stuff back but some where along the line they will get busted.

Also what was said about the banks I agree with, probably easier to get into the bank acount than a GC acount.
 
The above statement can't happen. The cost of the 'hack' far outweighs the gain.

the op doesnt specify any attack vector. rather than attack the GC technology, the hack could come from a trojan attack. what happens once an account has been compromised is the point, regardless of method.
 
the op doesnt specify any attack vector. rather than attack the GC technology, the hack could come from a trojan attack. what happens once an account has been compromised is the point, regardless of method.

Ok... erm... but you have to have the GC in your hand (or the MA server) to access it ... unless you could somehow read and unsplice the GC algorithm (in which case... if you're unsplicing 128bit cryptology (or whatever I'm not a cryptologist or up todate with what GC algorithm they use) I think EU isn't going to be the place to hack (why not go after c/card companies....). My point is that someone who had powers to hack a GC also has powers to take down civilization :scratch2: if that makes sense....so why would they choose to smite EU...
 
Why choose to Hit EU???
EU would Merely be a stepping stone to a Larger corporation such as a credit card company. Remember that the tech used in the GC system is used by Banks as well. Ther is only 3 ways to make EU Truely Secure DNA cryptology, Fingerprint Readers , Retna scanner of which are Linked to your account

When MA chose this system it was cutting edge. and Pretty Secure Still is untill some Idiot breaks it.

What I and a lot of others who don't have a GC yet want to know is what Benefits Does a GC system Provide. Other than the Obvious Additional Random number PW for our accounts and EU website security enhancements to Sensitive info areas.

Please Keep in Mind I DO OWN A GOLD CARD SYSTEM.

On a Plus note the Question submitted to MA is being looked at. im hoping to hear from them soon.
 
Last edited:
Ok... erm... but you have to have the GC in your hand (or the MA server) to access it ... unless you could somehow read and unsplice the GC algorithm (in which case... if you're unsplicing 128bit cryptology (or whatever I'm not a cryptologist or up todate with what GC algorithm they use) I think EU isn't going to be the place to hack (why not go after c/card companies....). My point is that someone who had powers to hack a GC also has powers to take down civilization :scratch2: if that makes sense....so why would they choose to smite EU...

Why choose to Hit EU???
EU would Merely be a stepping stone to a Larger corporation such as a credit card company. Remember that the tech used in the GC system is used by Banks as well. Ther is only 3 ways to make EU Truely Secure DNA cryptology, Fingerprint Readers , Retna scanner of which are Linked to your account

Hehe, here we go with the wild theories again...
Noone will be stupid enough to attack this part of the system to get into EU...
There is no need for any "test system" to crack it, just go download the specs of it from ISO, and start working :)
As noted, its much easier to try circumvent it.

BTW, both "DNA cryptology" (whatever that is, but lets shorten it to "DNA") and fingerprint readers are a lot easier to fool then the GC system...

The GC you have locked in, your DNA and your fingerprints you spread around daily and is quite easy to pick up and re-use... (MythBuster for example showed how you could trick very expensive fingerprint readers with the help of some carbon powder, a scanner, and a laser printer)

And just the verification system doesn't solve the insecure line problem you have when communicating with MA from your computer.
That part is excellently solved by the standard GC is based on, it was invented to solve this type of problem.

Lets stop discussing spagetti monsters and get back to real issues...

- Yes, you can theoretically still be hacked if you have a GC
- Not having it makes it extremely much easier though, and can be done by any novice programmer
- If you were hacked with the GC, what happens will depend on the exact nature of the hack.
- MA will of course launch an investigation to find out exactly why it happened.
- The result of that investigation will decide if you get your stuff back or not
- Without (real) details its impossible to predict the outcome.
- Having the GC gives you a lot better chance then not having it.
 
Why choose to Hit EU???
EU would Merely be a stepping stone to a Larger corporation such as a credit card company.

Man, you saw too many stupid movies with hackers using a computer which has as loading screen "hacking sequence initiating".
 
Ok... erm... but you have to have the GC in your hand (or the MA server) to access it ...

bugger it, too much info putting too many ideas out there and we've done this issue before.... live in denial if you wish.

long and short, very few "secure" systems really are, unless you control the complete end to end transmission of data.
 
Last edited:
Kredit Cards are being hacked every day... it's rather simple... but for credit cards, banks usually take full responsibility unless you have been very bad at preserving security. If you card gets hacked while shopping (Skimed) and later abused, you are usually not made liable. MA should behave the same if you get hacked using gold card.

That said, it's possible to hack you, while using the gold card (fake login) but it's highly unlikely that the gold card itself get's hacked. That's hell of a logarithm to hack ... ;)
 
One could probably be able to hack an GC protected account if one had a key-logger on for long enough and had the intelligence or software to figure out the algorithm that generates new codes...
 
One could probably be able to hack an GC protected account if one had a key-logger on for long enough and had the intelligence or software to figure out the algorithm that generates new codes...
There's no algorithm.
It's just a looooong sequence of numbers.
 
There's no algorithm.
It's just a looooong sequence of numbers.

I suppose that makes it a bit harder to hack ;)

well, not really true.
In principle, the card contains a psedo random generator, that generate the next number in the sequence based on the previous number, the card id, and (I think) a secret id.

Has the advantage that you can never "run out of numbers".

So yes, there is an algorithm.

And it can theoretically be brute forced... If you have a couple of millions of years to spend...
 
Last edited:
There's no algorithm.
It's just a looooong sequence of numbers.
well, not really true.
In principle, the card contains a psedo random generator, that generate the next number in the sequence based on the previous number, the card id, and (I think) a secret id.

Has the advantage that you can never "run out of numbers".

So yes, there is an algorithm.
...
Afaik, there's no algorithm at all.
Just (pseudo) random numbers in a long sequence. You can't compute the next number from the previous.

MA ofc has the same list of numbers, so they can keep track of where in the list the card is, and verify that the number sent is correct.
 
Afaik, there's no algorithm at all.
Just (pseudo) random numbers in a long sequence. You can't compute the next number from the previous.

MA ofc has the same list of numbers, so they can keep track of where in the list the card is, and verify that the number sent is correct.

Go read the spec...

A long list of numbers isn't practical, would need a lot of storage space on the card, and make it a lot more expensive.
Plus.. you will run out of numbers.

pseudo random algorithms are deterministic.
They work such that you input a "seed" and then you get a number in the sequence.
It will then store the result and use it in the calculation of the next number in the sequence.
Thats how they work...

With the GC, you can't use only the previous number you use for login, you have to find the id of the card, and the secret id too, and those are the ones you have to brute force to "hack" it.
You need two numbers after each other in the sequence, and then you just have to run the publicly available algorithm with different card ids and secret ids until you generate number two from number one...

Me and a soc mate once calculated how long time it would take to brute force it (and we used quite generous assumptions on computer speed and availability), and came up with a couple of million years...

Plus, you can't be entirely sure you have the right sequence even if you get a match on two numbers. Might be another sequence that just happens to have these numbers next to each other.
Having three numbers should make it less probable you hit a false one though, but will double time it takes to brute force...
 
Hi,
What will MA Do in this Case since the GC system is supposedly secure.
My guess:

MA would carefully check the cause, and if there's no possibility to blame you (i.e. if it is a clear hacking of the GC system) they'd present you with a non disclosure paper.
By a hard penalty clause you'd promise not to tell anybody about it, and having signed MA would fully compensate your loss.

This is how things like this are usually handled, and I'm quite sure the non disclosure waits on MA's desk because it was in use more then once already. Don't has to be GC fraud, could be users of exploits or similar, too ... Things MA doesn't want to see the light of the day.

Thoughts about GC hacking:

Guess it wouldn't be this hard - I'd attack a forum.
These often have vulnerable forum software - and I wouldn't start with EF or one of the other big ones, I'd attack a Soc forum. These are often placed by free hosters, and compromising such wouldn't be this difficult maybe.

A lot of ppl still use IE (or other older browsers), or have JS activated, or are still close to dementia when it comes to click "promising" links - and this way the forum hack would poison their PC.

Then a man-in-the-middle attack. As soon as the victim has authorized the log in, crash his entropia.exe, and take over the session, pretending to be the victim to the server. Bingo.

It's not this simple, I know. I don't want to give a how-to-do to wannabe hackers, I just want to point to a rather easy way to bypass even a system like the GC. Things similar to what I have described are happening every day, and they very often get regulated then in a way as I described above.

It all comes down to the one before the monitor - is she/ he able to use a computer in a responsible way? Since I often have to do with IT security issues I'd say most are not. By far the most people are constantly catching trojans, worms and virii, they click anything that isn't on the tree when counted to three, they are too lazy and penny-pinching when it comes to things like a good AV, a NAT-capable hardware router with firewall, even to installing and configuring a browser & EMail client that refuses to install all & anything.

Your EU account is perfectly safe if you keep the needed minimum of IT security level, even without gold card. But it takes some thoughts, a little effort, and very little money. Too much for many. For these a GC may add some little more security, but don't think it will help against a dedicated attack.

I know what I'm talking about, it's part of my job to participate in some sinister forums, too - I need to know what "they" are doing to help protecting my customers. "They" wouldn't bother using brute force attacks, much more easy to push kind of root kit to your machine ...
Don't try this at home, they are full of traps. But my machine is clean like a freshly changed baby's behind, for years now. I don't even have a personal firewall running on my computer - would be just another gate for attack.

Feel free to try to hack me - my IP is 127.0.0.1,
Have fun! ;-)))
 
Alh is right, it's a logarithm.. that's how these kind of cards work. Banks use the same system.. ;)
 
Go read the spec...
Ehm... Yeah, seems I should have. :D

...
A long list of numbers isn't practical, would need a lot of storage space on the card, and make it a lot more expensive.
Plus.. you will run out of numbers.
...
Numbers could just "wrap" at an odd bit or something...
But true that 1M numbers would still take up much more storage space on the card. Not much compared to space on PCs etc, but I guess it'd be enough to increase the price on cards.

...
pseudo random algorithms are deterministic.
They work such that you input a "seed" and then you get a number in the sequence.
It will then store the result and use it in the calculation of the next number in the sequence.
Thats how they work...
...
Yeah, I know how it works... Just didn't think they used that.

Thx for enlightening me. :tiphat:

Alh is right, it's a logarithm.. that's how these kind of cards work. Banks use the same system.. ;)
Ok ok... I'm convinced. :laugh:
 
Geez there's this idiot simple option to random login on 1st, 2nd or 3rd number from gc, you're still in sync with the server and no keylogger in the world or number generator can help a presumitive hacker.

Wth so much discussion on a 99,99% impossible situation?
 
Back
Top