The Xbox Live Security Crisis

The so called “FIFA hacks” plaguing Xbox Live are a story that has spanned months with so many twists and turns it’s even difficult for journalists to keep it all strait. I have endeavored to create a detailed overview of the problem, including a look at all its varied aspects, theoretical causes and potential fixes.

[Christopher]

Great read on the situation.

[N311V]

Yeah and it all makes a lot of sense. I was wondering why this was isolated to the Xbox but now it's clear.

[SaffronCurse]

Quick! Hide Yo KIDS!

[kreate]

Hopefully microsoft takes the sony approach and takes full responsibility.

If u have read the whole article, now u realize ur mighty microsoft likes to give excuses and evade publicizing the issue as well as putting the blame on the gamers instead taking responsibility themselves. Forget about compensation. U'll just get ur account locked.

Although corporations are all liars and care about profit including sony or nintendo. the individual corporations attitude in how they approach certain issues vary from company to company. U should choose the one which is the most gamer/consumer friendly.

Be a fanboy of a game or a console, not a fanboy of a particular company.

[Ravenor]

2 years ago my account was compromised and 500 dollars charged to the account. I was compensated.

As it stands the article just lays out the different theories. The most likely one being a brute force break in of peoples passwords, MS should have had their log in system fixed up years ago and they should use the same system as Steam and PSN for purchases. I agree with all of that.

My problem is the people who are hellbent on the idea that this issue is the same size and severity as the PSN hacks. They aren't the same thing and even though no money was charged my personal information and CC info weren't bared by this either.

[Christopher]

***My problem is the people who are hellbent on the idea that this issue is the same size and severity as the PSN hacks. They aren't the same thing and even though no money was charged my personal information and CC info weren't bared by this either.***

In Microsoft's case, accounts are being transferred and money is being spent.

In Sony's case, account data was accessible but there have been zero signs of it being decrypted and used to this day.

I think 'severity' is easily overlooked in one case over another. The media had a field day with Sony's issues and made it worse than it really was. In order for the data that could have been accessed, even Sony said they were unsure if it was, they would have had to decrypt all of the data and, even then, would have had only partial information. Then they might have been able to steal someone's identity and would not have been able to make any charges on a credit card or similar payment method as all the data needed was not in the database that was made accessible by their intrusion.

[WrAiTh Sp3cTr3]

Lol, the differences between the two is one is a hack while the other isn't. One affected every owner of a particular console while the other console has an episode or occurrence here or there. People are naive to think MS situation is on the level of Sony's.

Edit: the media made it worse than what it really was? Like how it's doing with Live right now? That's the only similarity I see with those two networks, lol. The media was just reporting about people complaining to them about how they couldn't connect to PSN or was always being disconnected from PSN--and that's when Sony pulled the plug on the entire network...for 4 weeks. My money is still with me and I'm on Live every couple of hours gaming to my hearts content. So how is this on Sony's level again?

[kneon]

Well in Sony's case there was only the potential to be defrauded using your account info, and so far there is no evidence that this has ever happened. In Microsoft's case people are actually being charged real money. Not some hypothetical situation, they are actually being charged.

Now I think it's premature to call this a crisis as we don't know the extent of the problem but I'm sure there has already been more fraud due to this situation than the PSN hack.

[Gazondaily]

I fail to see how this can be described as a crisis when, the scale of this 'problem' isn't even known yet and there is of yet, no real evidence to suggest that this is an issue regarding hacking as opposed to people falling prey to phishing scams.

Either way, it needs to be resolved as soon as possible.

"If u have read the whole article, now u realize ur mighty microsoft likes to give excuses and evade publicizing the issue as well as putting the blame on the gamers instead taking responsibility themselves. Forget about compensation. U'll just get ur account locked."

I have read the whole article and it makes complete sense not to induce panic and publicise the issue at such an early stage where you cannot determine how these so called hacks are taking place. If you read the article properly, you would realise that the account is locked whilst an investigation takes place.

We just don't know what's going on yet. If its mere phishing scams, it would be silly to reward the user's stupidity in the way of compensation and could open the floodgates for other leeches hoping to exploit any goodwill.

But ultimately, we do not know for sure. This is all conjecture, and the article realises this.

[bradgrenz]

I can't prove it's not phishing. All I can say is my account was hacked and I know for a fact I did not fall for a phishing scam. I also believe that other prominent victims, including Pachter, Keighley, Dean Takahashi, Patrick Klepek, Desslock and Tom Chick did not fall for a phishing email either. If Microsoft wants to insist that phishing is the cause, it is incumbent upon them to offer some proof.

In any case, how the accounts are accessed doesn't even matter. No one is asking to be rewarded. And this is no longer the "early stage" of the problem. Right now Microsoft just needs to institute PSN or Steam-style payment/account verification whenever a purchase is attempted from a new system. People won't keep breaking in if there is nothing worth stealing.

[MorningStar]

@cgoodno The data that was stolen due to the PSN hacks was in plain text format. It was not encrypted. Know about the situation before you comment.

[YourFlyness]

@MorningStar emails and passwords were in plaintext, CC info was not, and even that was just partial CC info.

by the way I wasnt the one who disagreed with you

[GribbleGrunger]

cgoodno is right for goodness sake. it doesn't matter how people on here spin it. yes PSN did get hacked and yes millions of accounts were compromised, but NO money was stolen. no matter how small this appears in the light of the word 'millions', people have had money stolen.

compromised = quite serious
money stolen = very serious

[DragonKnight]

@Septic: "I have read the whole article and it makes complete sense not to induce panic and publicise the issue at such an early stage where you cannot determine how these so called hacks are taking place."

Kinda like how Sony didn't come forth right away and everyone crucified them for it?

"We just don't know what's going on yet. If its mere phishing scams, it would be silly to reward the user's stupidity in the way of compensation and could open the floodgates for other leeches hoping to exploit any goodwill."

Except it's likely that MS will categorize all of these as phishing scams so that they don't have to compensate anyone. And since no one can actually prove otherwise, MS will hold pretty much no accountability unless they are transparent about everything, and they won't be until there is a real demand that they are.

Don't get me wrong, I'm not accusing you of being one of those people that made a big deal out of the PSN issue and now are conveniently coming to MS' defense over a similar problem. I'm just stating what is historically and presently obvious.

@MorningStar: "The data that was stolen due to the PSN hacks was in plain text format. It was not encrypted. Know about the situation before you comment."

Really?

[Christopher]

***@cgoodno The data that was stolen due to the PSN hacks was in plain text format. It was not encrypted. Know about the situation before you comment.***

I do. The only info that wasn't encrypted was username, password and e-mail. Other data was in fact encrypted. This is also why everyone was required to change their password once PSN was back up, but no one could log in and make any purchases when PSN was down.

What you're talking about is that one CFW in which a person was able to gather the data from a data stream, but that only worked with other CFW users, not with regular users who weren't using CFW.

In both cases, none of the info was enough to use one's CC for making purchases. The personal data made available is already available on more than a few sites who collect and compile this data (names, addresses, e-mails, phone #s, etc.).

[ZippyZapper]

kreate your comment is filled with so much hypocrisy and contradictions my eyeballs hurt.

[hazelamy]

i've been saying for a very long time, ms have a backwards idea about security.

you can spend unlimited amounts with no checks, it's only when you want to stop paying them they get all security conscious.

frankly, i'd say ms have been criminally negligent in their handling of this.
they are legally obliged, at least in the uk, to keep their customers information secure, they failed.

[PirateThom]

It's pretty disturbing that when I mentioned that it wasn't phishing but brute force attacks on another article, I got a ton of disagrees and was told "it would take too long" and, yet, every single article says the same thing... basically, Microsoft messed up their Xbox.com security and even though Live its self wasn't hacked, the end result was the same, unauthorised access to accounts and money stolen. Really, stop burying your heads in the sand, companies have an obligation to protect our details.

[yesmynameissumo]

I'm still shocked people think Microsoft are some sort of security wizards. From their perspective EVERYTHING is an isolated case. Even if it's been happening for 4+ years.

[ZippyZapper]

That's because it still is just phishing.

Wake me when Live goes down for a month due to a "real" hack like PSN.

[YourFlyness]

??? Brute Force attacks is not Phishing.

As far as PSN hack, I would gladly take that over have my money actually being stolen

[Sprudling]

"it is not unreasonable to suspect hackers are using the email addresses and passwords pilfered elsewhere"

Wrong. It's very unreasonable, because noone in their right mind would store passwords as clear text. Passwords are always hashed, and there's really no practical way of reversing a hash into the original text. And with practical I mean a way which doesn't take years.

Everything else was great reading.

[bradgrenz]

I meant only that a lay person might reasonably think there could be a connection As you point out, and as I also concluded in the story, there are good reasons to discount that particular theory.

[disturbing_flame]

I don't feel via the media it's a crisis.
People are not talking about it, seems like none cares.

I don't see so much articles on N4G when there were thousands for the PSN issue. Everyone wanted its PSN hack article.

So i dont't feel Live is running to a crisis.
Actually it's very strange. People are acting differently this time. Would i say it's surprising ? No i would not.

Different context, different people. Make sense.

[bradgrenz]

Just because Microsoft is having a lot of success sweeping the problem under the rug and deflecting media attention doesn't mean there isn't crisis.

[arnyftw]

What I dont understand is that why doesnt ms bother to change some code for xbox.com, does it seriously take this long to change the login on the website? All they have to do is add captcha boxes to it.

[urwifeminder]

Happend to me on steam,omg steam crisis they really need to make some steamworks cards like psn and xbox i may buy something then it seems this is over inflated nonsense.

[miDnIghtEr20C_SfF]

So many SDF are hoping this is a problem on the level of all of PSN being hacked and brought to it's knees and shut down.

This isn't even close.

But keep dreaming PS3 fanboys. Keep dreaming that it will happen. Because it will not. These aren't the same thing.

[PirateThom]

More money has been taken from these Live accounts than everyone on PSN.

Discuss.

[Hicken]

You're right in saying it's not the same: Sony didn't take months to respond after initially blaming consumers, and no money was ever reported as being stolen.

But you're wrong about a few things, such as PSN being "brought to it's knees and shut down," or PS3 fanboys wanting this to happen to anybody. It's more a matter of "PS3 fanboys" saying "Open your eyes and see what's happening right in front of you."

It's not phishing. Do you guys really think Pachter would fall for that? Or any/all of the OTHER high-profile names that have been hit with this?