Is this the hack used to exploit Xbox Live accounts? - XboxMB

whiityp · 01-13-2012

Fraud victim appears to work it out.

Last week we asked if Xbox Live had been hacked. We used the detailed account of Xbox Live fraud victim Susan Taylor to suggest that yes, it had.
After publishing the article, Eurogamer was approached by half a dozen other readers who had experienced similar exploitation on Xbox Live.
All the while, Microsoft staunchly denied any such security breach on Xbox Live.

But now we may have discovered how those Xbox Live accounts were broken into.

Eurogamer was contacted recently by "Jason", a man who claimed to know how to hack into Xbox Live accounts. He offered us an explanation via email last night. But our efforts to validate his claims were cut short by website AnalogHype, which today posted an uncannily similar "how-to", based on information provided by a source named Jason Coutee.

The same Jason? Probably.

Coutee and Eurogamer's "Jason" point the finger at Xbox.com - the website. This allows eight password attempts at a Windows Live ID before CAPTCHA is triggered - the system that presents those squiggly words. A simple password-generating script can apparently be used to exploit this system before CAPTCHA kicks in.

The Windows Live IDs come from playing Xbox 360 games online. Gather Gamertags and Google search them in the hope you'll find related email addresses. Try these as Windows Live IDs and the Xbox.com website will let you know if they're valid - "the email address or password is incorrect" - or not - "That Windows Live ID doesn't exist."

Using these methods you can apparently brute force your way into a near-limitless supply of Xbox Live accounts and use their saved banking details to buy Microsoft Points. That's how it sounds. We haven't tested this, naturally.

Eurogamer has contacted Microsoft about this issue. Microsoft is aware of the issue and Eurogamer is waiting for a formal response.

AnalogHype says that Jason Coutee is a network infrastructure manager who had his own Xbox Live account hacked and used to fraudulently buy 8000 Microsoft Points. He called Xbox Support, who offered to freeze his account but couldn't refund him. He declined the offer and investigated himself, eventually stumbling upon the answer.

Since publishing Susan Taylor's account of Xbox Live fraud, Eurogamer has been contacted by half a dozen other people who were victims of similar exploitation. Thank you, those who have written in. And please do keep letting us know if you've had your Xbox Live account fraudulently used.

Lolzorz · 01-13-2012

Not like they can do anything about bruteforcing other than add better password validation.

Smiffy · 01-13-2012

Don't make your password "password" then. Derp.

CLK · 01-13-2012

How Secure Is My Password?

StevieRox · 01-13-2012

So you're going to tell me that everyone who plays Fifa gets bruteforced?

Chuck Testa · 01-13-2012

Quote:

Originally Posted by CLK

How Secure Is My Password?

Exactly.
Mine are very easy on my Gamertags just because I hate typing long ones on the Xbox.
Though I have nothing on my account of use so I am fine.

My default

Quote:

Originally Posted by StevieRox

So you're going to tell me that everyone who plays Fifa gets bruteforced?

No. People are bruteforcing others because of FIFA. They can make real life money off of it.

Toxic Poison · 01-13-2012

Quote:

Originally Posted by CLK

How Secure Is My Password?

Quote:

It would take a desktop PC
About 21 thousand years
to hack your password

I think I'm okay.

StevieRox · 01-13-2012

Quote:

Originally Posted by Totally Trav

Exactly.
Mine are very easy on my Gamertags just because I hate typing long ones on the Xbox.
Though I have nothing on my account of use so I am fine.

My default

No. People are bruteforcing others because of FIFA. They can make real life money off of it.

Damnit.. Penis is in the top 408 most used passwords.
Well that sucks..

And I thought it was that everyone who got hacked recently has played Fifa?
I don't get what's so special about Fifa.. like, don't they buy something like Gold Premium Character? What is that?

Sam · 01-13-2012

Quote:

Originally Posted by StevieRox

Damnit.. Penis is in the top 408 most used passwords.
Well that sucks..

And I thought it was that everyone who got hacked recently has played Fifa?
I don't get what's so special about Fifa.. like, don't they buy something like Gold Premium Character? What is that?

You can buy players and coins. You can then sell them for a lot of money.

Camza · 01-13-2012

Quote:

Originally Posted by StevieRox

Damnit.. Penis is in the top 408 most used passwords.
Well that sucks..

And I thought it was that everyone who got hacked recently has played Fifa?
I don't get what's so special about Fifa.. like, don't they buy something like Gold Premium Character? What is that?

They buy gold premium packs which contains players that the can sell for in-game currency. They then sell on the in-game currency for real cash.