People being hacked since the last Server Check.

All the authenticator really does is set up a second password that you never enter directly (thus avoiding keyloggers and such). If they can break into the DB storing your regular PW, they can get the authenticator PW too. It has to be stored on Nexon's end so they can check the authenticator input is right, so if Nexon's the problem...

No. You are thinking of a different kind of device, which I think is generically called a "plug". That device needs to be plugged into your computer, and responds with its (fixed) id when queried, thus giving this "extra password" you mentioned.

The authenticator doesn't work that way. When you ask to log in, a code is generated somewhere and sent to the authenticator, which displays it. You must copy the number and type it into the login screen to prove you're holding the device. The number expires within a few seconds, so even if someone finds it out, it's useless to them.

No. You are thinking of a different kind of device, which I think is generically called a "plug".

Dongle.

No. You are thinking of a different kind of device, which I think is generically called a "plug". That device needs to be plugged into your computer, and responds with its (fixed) id when queried, thus giving this "extra password" you mentioned.

The authenticator doesn't work that way. When you ask to log in, a code is generated somewhere and sent to the authenticator, which displays it. You must copy the number and type it into the login screen to prove you're holding the device. The number expires within a few seconds, so even if someone finds it out, it's useless to them.

Err that's not how the blizzard authenticator works. They're basically PRNGs each with a relatively unique seed. On the blizzards side they store the seed of your authenticator with your account info. When you press the button on your authenticator a pseudo random number is generated using the seed and time. You enter this number to login. Blizzard then use the seed for your account and time to generate the same pseudo random number which is then used to compare with the number you entered. There is no communication between the authenticator and blizzard that can be intercepted which is the whole point.

Obviously if the blizzards database is broken into then hackers can take the seed and use it to log in to your account.

Here's the question though. If the hackers got in a few months ago but was denied access now wouldn't that make sense people who haven't logged in would get hacked? I mean obviously if they have a list of information but it from months ago then changing it recently or even frequently could stop hackers right? I mean if they had full access 24/7 well then we're all fked. I don't know I asked my guild mates to change their passwords frequently and so far the only two that have been hacked haven't logged in for months, other then that no one has been touched.

Here's the question though. If the hackers got in a few months ago but was denied access now wouldn't that make sense people who haven't logged in would get hacked? I mean obviously if they have a list of information but it from months ago then changing it recently or even frequently could stop hackers right? I mean if they had full access 24/7 well then we're all fked. I don't know I asked my guild mates to change their passwords frequently and so far the only two that have been hacked haven't logged in for months, other then that no one has been touched.

Good point. Surely saying that only those who haven't logged in for months were hacked would be stating the false, but probably a large part of them hasn't actually logged for that long.

-didn't really read all pages-

Could it be that the password reset page is causing issues?
Has anyone changed their passwords recently and got hacked shortly after?

-didn't really read all pages-

Could it be that the password reset page is causing issues?
Has anyone changed their passwords recently and got hacked shortly after?

Oh for crying out loud.
"Hi, I didn't read anything and have no evidence of anything whatsoever so I am going to pull a random theory out of an orifice and ask if anyone else can give me anything to substantiate it."

No. Sodomize yourself with a saguaro, no.

Oh for crying out loud.
"Hi, I didn't read anything and have no evidence of anything whatsoever so I am going to pull a random theory out of an orifice and ask if anyone else can give me anything to substantiate it."

No. Sodomize yourself with a saguaro, no.

I haven't laughed this hard since you posted that gif of the guy beating the dead horse.

Oh for crying out loud.
"Hi, I didn't read anything and have no evidence of anything whatsoever so I am going to pull a random theory out of an orifice and ask if anyone else can give me anything to substantiate it."

No. Sodomize yourself with a saguaro, no.

Siggy'd for justice.

Siggy'd for justice.

You're just in awe of my having found the proper use for a versalmas cactus.

I felt this was relevant. >_>

In an actually on-topic but probably more expected note, still no real reply on my support ticket.
Got one of those automated "we didn't forget you, honest" things though.

You're just in awe of my having found the proper use for a versalmas cactus.

The glorious Saguaro has many uses besides celebrating Versalmas and sodomy.
It is used to represent the true 140% of Russians who agree with Putin, for example.

In an actually on-topic but probably more expected note, still no real reply on my support ticket.
Got one of those automated "we didn't forget you, honest" things though.

I have 70 or something of those emails. Means pineapple all.

ok yes eos maed joek still not shenanigans

Earlier today I casually mentioned to a guildie that I care a lot less about the security of my mule accounts compared to my main.

A few hours later I attemped to log in to one of those mule accounts to find that my account was "locked" and I needed to re-activate it from my email. Weird. Logged into my email to see two "Nexon reactivation link" emails. Why would there be two?

http://i131.photobucket.com/albums/p285/...e/derp.jpg

Turns out someone tried to break into my mule account just a couple days ago and failed terribly. I haven't got the slightest clue how someone could have acquired the username and the password..

I got hacked for the first time since I started playing MS 5 years ago. My NL lost all its stars, shoes and claw. I am glad I am pretty much over MS otherwise I will be really upset.

Earlier today I casually mentioned to a guildie that I care a lot less about the security of my mule accounts compared to my main.

A few hours later I attemped to log in to one of those mule accounts to find that my account was "locked" and I needed to re-activate it from my email. Weird. Logged into my email to see two "Nexon reactivation link" emails. Why would there be two?

http://i131.photobucket.com/albums/p285/...e/derp.jpg

Turns out someone tried to break into my mule account just a couple days ago and failed terribly. I haven't got the slightest clue how someone could have acquired the username and the password..

Oh boy, this is interesting; they failed to steal your stuff? Give us more details! Sure, it's possible it was some random and not the real hackers, but hey, anything helps, and at worst this kind of placebo effect would be nice so people don't constantly feel like, "hey, I'm going to lose my stuff soon so why even bother playing".

Around 1 month ago one of my mule accounts got hacked.

Abstract: Account was inactive had pretty useless junk on it I would think no one in their right mind would go through the trouble to hack for what was taken.

The strange part was that it was an account that I had not logged on to since around March, the account was originally made to store items long ago but was no longer used for that, additionally no one had the info other than myself. I logged on to it for the 1st time since then when the sidekick event started- to receive the welcome back ring. The highest level on the account at that time was 50 (f/p), I deleted I then used the ring to help level friends and in return got to do the sidekick exp leech for fun (didn’t impact their exp until it got to around 90ish); at that point I just played around on the character for a while until it was 110- then helped friends @ LHC. By this point I decided to give it some better equips, I provided it with a 3rd unwelcome gest wand and a 2nd unwelcome guest shied for the intention of occasionally helping attack @ LHC despite incredibly tiny range, just for fun . I was on it for one of the 2x events on a Sunday, logged on it the Monday after that, around the time people were starting to talk about items disappearing randomly. I noticed at logon that my shield and wand were missing... my initially reaction was ha-ha guess the items disappeared like people were describing- until I actually logged on where I found myself in the FM. Which is a place I will only go if I had a gun to my head, hate FM don’t want to be near FM hate everything to do with the fm. So that was what clued me in that something was very wrong. Looked at inventory and nothing, my junk items were there only my weapon and shield missing (both unscrolled really don’t care about the items at all easily replaceable). Then I noticed that a mastery book was missing- although it was a junk mastery book I remember having it. Mesos were untouched... as I only had around 400k if I remember correctly- no nx taken because it had none . By this point- it was pretty much assured that yup I’ve been hacked. Proceeded to check other characters- they were seemly untouched, not in FM and their junk equips still all present and accounted for.

Now the part that disturbs me the most is that up until the sidekick event had anyone hacked the account they would have found pretty much nothing- I play the account a little and it gets hacked, I'm not trying to suggest that there is a direct correlation here but it all seems too convenient. For all the accounts out there why this one- I simply would have thought the account as a waste to anyone’s time to hack into. A little more background on the account the password was Alpha-numeric contained no symbols- and had not been updated since early spring of 2011. Computer is very clean- many scans run, if it was a keylogger I’m sure they would have been more interested in draining my bank accounts than hacking a maple account (also I've loged on other accounts).

Since then I have been watching this thread very closely to see if anyone had a similar experience- and it would seem so. I didn't want to post because I was concerned of the typical absent minded responses to anyone being hacked. "shared info?, Keylogged?, put yourself at risk?" But seeing how this has been an on-going problem I have been really hoping to be fixed by some miracle patch which I fear may never come- I caved and posted. Even though this was only a mule It worries me increasingly that typical standards of security no longer hold- database leaks, these hackings that no one has identified the method or the cause and lack of any acknowledgement by nexon. It also worries me that of the increasing amount of acceptance by people that this is "normal", I am quite worried at this time every time. Every time I log on now say to myself "let's see if I got hacked today".

On a side and likely off topic- I have been considering moving to a desolate world, so that I can actually enjoy maple again (even if this is just an illusion of safety)- maybe play w/o fear. Getting tired of seeing hackers everywhere- taking people chs, and these "SALE OMG FM 1 CH18 GO GO GO" - just means some poor person in maple just got hacked and they are selling off the goods. People wonder how they can sell NX cheaper than face value- chances are is that it’s stolen from people like you and I. If there was a way to track NX I would not at all be surprised to see that 1 arrow people buy for all their NX winds up being sold to the people who actually buy from them - which directly supports the hackers and the continuing of account hacking. I cannot prove what I just said only a theory: however it seems that it would be very easy for the hackers to sell something of "no real world value" for less than "accepted real" value. I would like to see Nexon support some way to authenticate computers that you wish to play- similar to how iTunes works, but of course make this optional because I know many people (including myself) do not have access to some of the E-mail accounts that were used with the nexon account.

Oh boy, this is interesting; they failed to steal your stuff? Give us more details! Sure, it's possible it was some random and not the real hackers, but hey, anything helps, and at worst this kind of placebo effect would be nice so people don't constantly feel like, "hey, I'm going to lose my stuff soon so why even bother playing".

They got: Username, password, email address.

They didn't get: Email password, PIC

I'm guessing there's a way to dig up the password somehow because the password I use for my Nexon account is a solid mix of random letters/numbers. Or maybe it was brute forced. My email uses a different password, though.

They got: Username, password, email address.

They didn't get: Email password, PIC

I'm guessing there's a way to dig up the password somehow because the password I use for my Nexon account is a solid mix of random letters/numbers. Or maybe it was brute forced. My email uses a different password, though.

I guess now the question is, how many people use the same password on their email as their nexon account? Not that I would ask, because nobody would ever admit to doing something that dumb, lol.
Time to increase the length of my PIC; if it's one of the holding buffers, might as well max it out.

I guess now the question is, how many people use the same password on their email as their nexon account? Not that I would ask, because nobody would ever admit to doing something that dumb, lol.
Time to increase the length of my PIC; if it's one of the holding buffers, might as well max it out.

A lot of people probably do that. Easier to keep track of, especially if you're running multiple accounts. I'm willing to wager that if everyone had used alternate passwords for their email addresses, there would be far less hackings going around.

The email account is the key to complete control over the Nexon account, after all =\ You lose that, you lose all your stuff.