Results tagged “Videogames” from SpywareGuide Greynets Blog

Not so long ago, I wrote about a site called megasecuredownload.com, which faked a bunch of AV scans so you'd download their file, run it and have yourself a very bad day.

There's another site currently being promoted on video sharing sites such as Youtube, aimed squarely at owners of Playstation 3 consoles.

As ever, it's a case of "something for nothing". They're pimping Playstation network $20 generator programs that look like this:

All XBox owners have a list of most recently played games set against their profile. As you might have guessed, every game has a unique ID assigned to it so Halo 3 doesn't accidentally show up as The Amazing Adventures of My Little Pony.

Well, like most other things related to the console it can be hexed, modded and generally given a bit of a fiddling. I've seen a few furtive mentions of this in the backroom areas of certain leet forums, so this might not even be doing the rounds yet. But hey, a little advance warning never hurt anyone.

Let's take a look at the scam, it's a pretty clever one.

1) Phisher tampers with their data and makes it look like Modern Warfare 2 - which isn't out until November - shows up in their recent games list. Note the big number "2" in the below image, complete with handy red box just so you know exactly which icon I'm on about.



2) Phisher then trawls around various forums and websites touting access to the "Modern Warfare 2 Beta" - and of COURSE it exists and they have played it, because it wouldn't be in their recent games list if they hadn't. Right?

3) Phisher then asks you for your login details in order to "gain access". All that's actually going to happen is you lose your account to a scumbag.

I've already seen quite a few accounts (including the one above) hit with various degrees of banhammer for altering their recent games list, so hopefully that'll kill a few phishes off before they're even launched. In the meantime, know this: there is currently NO beta planned for this game, and in all probability there won't be one.

Don't be suckered in!

Last week, I spoke at SecTor 2009, on a subject near and dear to my heart: people messing around with videogame consoles in various horrible ways. Before I go any further, I want to say this - in terms of looking after people who turn up to speak, SecTor wins first prize. It might not sound like much, but it is extremely nice to have some dude waiting for you in a pre-paid car to take you to the hotel from the airport at 1AM when your plane has been delayed for seven or eight hours (cockpit windows fell out, or were about to. Long story).

So, large and appreciative hat tip to the organisers. They looked after me and stuffed me with food and I can't ask for anything more than that. You can also see a collection of photographs here. Some of them are even in focus.

As far as my talk goes - hoo boy. Talking about exploiting videogamers always seems to be a touchy subject, as gamers seem to lock themselves into a protective bubble, dismissing everything with "Nothing to worry about, it's only phishing".

Once it's put into a box like that - sorry man, lights out. Whatever gaming network you're talking about is "safe". No "hacking" is taking place. The "only" way someone can get your login - argh, the assumption that the ONLY thing bad people are looking to do on gaming networks is steal your login! - is by convincing you to put your information into a phishing page or handing it over. While the phishing side of things is accurate - nobody is going to get anything unless you GIVE them it, save for when they try to social engineer support staff - there are many, many steps along the way that involve all manner of hexing, hacking and getting around security systems on the console which lead to that phish being more convincing than it should be.

When it gets to that stage, the people who provide you with that gaming network need to sit up and take notice, because it is most certainly NOT just "about phishing". While gamers obsess over being "safe" in their account-not-phished world, the entirety of their gaming network had drowning in a sea of DDoS attacks, network spam and other junk clogging up their intertubes.

Also: this has been on Slashdot and a bunch of other places, and without having seen the talk (and going off the condensed coverage the talk has had) people are either misreading what went down, or going on about things I never mentioned at all (one guy is talking about "compromised XBox consoles being part of a DDoS Botnet" - what?)

It wasn't just about phishing. I showed some pretty pictures of the tools people use to tamper with files. There were paid-for DDoS Botnets, designed to kick people out of games. How about people messing with files so they could get things for free that the rest of us pay for. There was an examination of people getting around swear filters in a manner that allowed them to impersonate videogame developers. And so on.

Everything in my talk boiled down to one of three areas:

1. People who manage to run open source operating systems and old videogame consoles on an XBox360.

2. People who hex edit files in order to gain some advantage, in order to get things for free that everyone else pays for, to gain the upper hand in a game or to make some money when they come to sell their account on the black markets. Or, you know, EBay.

3. People who wheel out all kinds of malicious activities - DDoS, chat spam, phishing and social engineering - in order to give you a bad hair day. Again, winning the game might be the priority - but there are many other reasons. In the same way that it isn't just about stealing logins, it isn't just about winning games either. Many scams flying around the XBox Live network are nothing more than plain old harassment, bugging you for no good reason, flooding your inbox for the purposes of hilarity.....etc.

The main areas I explored were 2 and 3 - and wrapped up in both of those are two basic ideas: hack yourself, and hack others.

Let's be clear here, because people get way too wrapped up on the word "hack" where consoles are concerned. Spoon fed the idea that consoles are "secure", many people will dismiss any and all activity as "mere phishing". Yes, the ultimate goal for most malicious individuals in console land is to grab your account. Yes, the final roll of the dice when your number comes up (usually) relies on you handing over information to your attacker.

But in the process of obtaining that data, the attacker may well have blended software modding, file hexing and system exploitation to achieve that final headshot. They start with hacking something, and end with phishing. There IS hacking taking place, and it's really irrelevant if the hacking portion comes at the start or the end of the process - all that matters is they gain control of an account. They are hacking the software, the games, getting around the numerous security protocols designed to stop tampering and also using these same techniques to obtain items for free that regular users have to pay for.

I don't know about you, but it certainly sounds to me like someone is hacking something.

 I expand on this a little here, but feel free to keep rolling.

Key areas of console exploitation that I covered in my talk (loosely in the realm of points 1 & 2 above) were:

1) Artificially inflating your Gamerscore, either for kudos from your peers or financial gain by selling on high scoring accounts on various black market sites. If you can bump your own score easily, you don't have to get your feet dirty with that horrible phishing business.

2) Phishing accounts, particularly those with credit cards attached or - of course - those with high gamerscores. Phishes can (of course) be everything from the basic fake webpage, to lame messages sent across the XBox Live messaging system, or those wonderful fake points generator programs. Phishing has become a lot more sophisticated, and nowadays most phishing throw in some file tampering to make the phish more realistic. Speaking of which...

3) Hex editing data created on your console in order to cheat at games, unlock various things you'd otherwise have to pay for (which in many cases ties back to Gamerscore hacking) or perform malicious acts that often form one of the rungs in the phishing ladder. This is a perfect example. As I've said elsewhere, temporarily changing your gamertag in order to assume the identity of a game developer listed on gamerscore rank sites and phish another user is, I think, a pretty smart example of maliciously altering programming in ways it was never meant to be altered, as well as getting around a supposedly rock solid authentication system and throwing in a neat social engineering twist into the bargain.

4) People just want to have fun. And by "fun", I mean "fill up your gaming network with so much junk and rubbish that the whole thing eventually crumples in a heap and starts to cry". I covered Friend Request Spammers, DDoS attacks and a couple of other things such as lag switches that you buy from online stores and glue onto your controller but time was against me. I wanted to also explore things like chain letters (that require you to waste time by inserting a specific game disk to view them!) and other weird / not-so-wonderful items of strangeness, but I guess those will keep for another time.

Why are we at risk?

1) Modern console design is geared towards interactivity, and something working with everything else whether you want it to or not. You can get online with your console via ICS and a hole in the back of your PC, you can wirelessly use Windows Media Center with your XBox, and you can - crucially - take your removable XBox Hard Drive (geared towards digital downloads and eventually buying bigger drives) and use a Microsoft supplied USB wire and plug it into a PC, view all the files on it then start hexing many of them if you're that way inclined.

I'm not quite sure how someone at MS didn't think people wouldn't immediately plug these HDDs into computers and start looking around, but putting features onto gaming consoles that make them resemble mini PCs also makes them rather exploitable. The same features, the same functionality, the same funny shaped holes in the back of them and it all starts to go a bit pear shaped.

2) Dedicated pretexting groups on forums who will happily spend all day phoning Microsoft support reps in attempts to social engineer them into giving them your data. It seems after a number of incidents MS has tightened up in this area; however, people still complain that this has happened to them and these SE groups still exist. Some currently hijack accounts and give tutorials on how to keep them once stolen, which is, uh, a nice touch. I guess.

3) The huge obsession with promoting your gamerscore - an arbitrary numerical value assigned to achievements you earn in a game - as an amazingly cool thing. Witness this guy having a huge hissy fit about me daring to complain about it.

The flipside is that these scores single people out as targets for phishing, social engineering and general abuse. Limited privacy features mean you can only hide your most recently played games and achievements - pointless - but you CAN'T hide your gamerscore.

A common technique for social engineers is to simply go to one of the many sites that provide this data, such as the official XBox forums and make a running total of anybody with a score between 20,000 or 30,000 (or more) on the basis that those accounts will have unlocked more things in the game, or have a higher ranking, or have more shiny blinky things for you to play with.

Remember the "impersonate a game developer" scam I mentioned earlier? Many of the people trying that scam out would potentially have just gone to a site listing game developer Gamertags under "Celebrities" - like here - then writing down their names for future use.

You can bet a lot of people on that list don't know about the scams that are out there, despite them being game developers. Are we painting a big target on people that really should be a little more anonymous? I would argue we might be - phished game developer accounts would no doubt be able to fool a ton of starstuck game fans.

And we really should have the option to hide the Gamerscore, "celebrity" or not, should we choose to do so.

Conclusion

It's not all bad - Microsoft do ban lots of accounts for cheating and tampering, but I'm not kidding when I say the problem is long since out of control - jump onto Youtube or any other site, and there more cheating / hacking / modding videos there than you could ever hope to wade through in one lifetime. For all intents and purposes, we're all stuck with this until a real solution is found.

As for me, I'm going back to playing on my Atari 7800, where the only danger is that the ancient wiring might blow out and burn down my house.

This is a step above the usual phish attempt we see here, with a number of bits and pieces that build up a pretty convincing fake website. As you probably guessed from the title, the phish involves the upcoming juggernaut that is Call of Duty: Modern Warfare 2, and the endless desire some people have to take part in a beta.

The URL to avoid is

freemw2beta36.tk

and the page itself is hosted at

freemwbeta36.t35.com

Want to take a look? Sure you do.


What does this phish do that sets it a way above other phish attempts? Well, for starters it looks quite professional. Top left, they use the kind of info splash you normally see on an official XBox page. On the right, there's a media section with screenshots you can actually click into. Might not sound like much, but most phishes like this one don't have anything clickable in that whatsoever. Bottom left, they've embedded a real Youtube video that you can watch to your hearts content. Right at the bottom of the page, they've included a copyright notice - something else phishers tend to lose in translation.

All in all, pretty convincing.

The only real flaw with this phish is that there is currently NO public beta planned, and it's highly unlikely there will ever be one. Don't get suckered into handing over your Windows Live ID, as no good will come of it.

A while ago we wrote about multiple friend requests made on the XBox Live network with the aid of PC based spamming tools. Well, if you try any of those shenanigans now you'll see this:

Back in August we reported that individuals were changing their usernames in gaming sessions to impersonate Microsoft staff and game developers, grabbing login details from unsuspecting victims. It seems the problem is not only taking place, but now comes with an interesting addition - the hackers have now found a way to play on the XBox Live network for free while using the above exploit.

Whoops.

The "playing for free" thing is a new one on me, but I'm a little surprised Microsoft haven't fixed the ingame namechanging yet - this has left users open to social engineering for a number of weeks now. Fingers crossed they put this one to bed for good...

Next month - October 6th & 7th - I'll be at the Sector.ca Conference, talking about a subject close to my heart: how lots of rather naughty people are using consoles to both cheat the system and attack other users, via spam, DDoS and account theft. Is it abstract extract time?

I think it is.

Game Over, Man: Gamers Under Fire - Chris Boyd

An exploration of security issues relating to consoles and their risks to both home users and the business environment. This will include issues such as custom built DDoS tools, social engineering of Microsoft support staff, account theft, the risk to businesses and personal tips to keep your own details secure. I'll also examine the trade of stolen Xbox accounts in return for credit cards, how the rewards that companies give gamers make them targets because of inadequate privacy features and how free programs allow hackers to exploit profanity filters, paid content and even the profiles themselves.


As you may know, I've spent a lot of time digging around script kiddy forums. By and large, most of what I see isn't very impressive. However, for a while now there's been an interesting offshoot of hacking forums, with entire sections devoted to console hacks and attacks. There's an impressive amount of technical knowledge and skill going into the creation of hacking tools for consoles, hacking the console itself and doing all sorts of horrible things to the people that use them.

Some of the techniques used to turn an otherwise harmless lump of content restricted plastic - whose very soul is supposedly on the leash of the company who made it - into something you can spend all day annoying somebody with never fails to amaze me.

How many companies now have gaming / recreation rooms with a console just plugged in and left to its own devices? How many parents mistakenly think the worst thing that'll befall their kid is seeing someone get their head blown off on GTA4?

They're all accidents waiting to happen, and the general promotion of consoles as these "unhackable, unsinkable" battleships of gaming is something that needs to be examined in greater detail.

It's not just PCs under fire anymore...

Finding dumps of stolen logins is a common occurrence round this neck of the woods; if it isn't a bunch of XBox logins, it's 5000+ EBay / Paypal accounts. Well, here we have roughly 86 Windows Live ID accounts taken without permission, via a phishing page.

Windows Live IDs can be used to access everything from Hotmail and MSN to XBox Live and Zune. Grab a Live ID, and the amount of ways you can ruin someones day increases in spectacular fashion.

In this case, the target was XBox Live gamers, by way of a fake "Get Microsoft points for free" phish.

What I found particularly interesting here is that the collected data reveals the (borderline desperate) greed on the part of the victims - allow me to explain. Many of the most popular XBox phishes involve the site creator pretending to be an ex Microsoft employee, who just so happens to have a magical way to create "free" Microsoft points (which otherwise cost money, and are used for digital videogame transactions and Zune marketplace purchases).

Here's a typical example of said fakery:



There's normally a dropdown box (bottom right), asking the victim to select a fictional amount of points while they throw away their login details. More often than not this information isn't included in the phish dump, because the phisher couldn't care less how many points the victim is after. This is what you normally end up with:


Click to Enlarge

...as you can see, nothing more than the Live ID, the password and the date.

Here, however, each stolen account in the data dump looks like this:

Logged IP address: xx.xx.xx.x0 - Date logged: Monday 20th 2009 of July 2009 09:17:27 PM
Email=xxxxxx@xxxxxxxxxx.com
Password=xxxxxxxxxxx
Points=20000
submit=Go!

For some unknown reason, the phisher decided to log the points the victim tried to obtain for free. This means we can gather up some data about the level of frenzied button mashing the victim goes through over a period of days.

Days? You bet. More on that later - for now, let's take a quick look at the amount of points the victims were dying to get their hands on. The stolen logins have been in circulation on forums for a while, and based on comments we've seen all of them have either been locked down or leeched but we've notified Microsoft anyway. All of the below were phished between Monday the 20th of July and Tuesday the 28th:

500 MS Points ($6.25 / 4.25 GBP) - 17 requests
1000 MS Points ($12.50 / 8.50 GBP) - 8 requests
2500 MS Points ($31.24 / 21.25 GBP) -  8 requests
5000 MS Points ($62.48 / 42.50 GBP) - 23 requests
10000 MS Points ($124.95 / 85.00 GBP) - 10 requests
20000 MS Points ($249.90 / 170.00 GBP) - 92 requests

In total, there were 167 attempts to get free points, with 9 misfires (which means the victim didn't pick an amount on the dropdown box, resulting in a "-Select-" left in the relevant data field). Roughly 86 individual Live IDs were phished, and the rest of the 167 attempts were repeated requests for points from the same handful of people - sometimes stretching over the full timespan from Monday 20th July to Tuesday the 28th.

One person made 24 requests over the eight days (at one stage making eleven requests for points in three minutes!), with 17 tries for the maximum amount of 20,000 MS points. That works out at 340,000 points not including his smaller requests, which means this person attempted to collect over FOUR THOUSAND DOLLARS worth of digital downloads for nothing.



In fact, he's still trying to get free points on the 28th despite not having actually received anything from the moment he tried way back on the 20th. The phisher who collected these logins deserves nothing but scorn; however, it's increasingly difficult to feel any sympathy whatsoever for some of the people caught up in the above data log.

Is the only real solution to throw both phisher and victim into a bear pit, filled with angry bears who themselves hold an irrational hatred of both bear pits and bear pit trespassers?

Why yes. Yes it is.

A common warning in relation to many phishing attacks is "Look for the .com in the URL, because that's the official site domain - if you see that you know it's the real thing".

All well and good, but sometimes people find a way to place a ".com" in there anyway.

Here's a fake XBox.com phishing page - note the URL:


Click to Enlarge

Amazingly enough, it's

xbox.com.au.tp

The problem here is that we're so conditioned in relation to "Look for the .com" that many people will see this domain and think, well, it HAS to be legit - completely disregarding the "au.tp" part that comes after it.

Unfortunately, it isn't real in the slightest. How did they get the above domain to look the way it does? Well, a .tp domain is the top level domain for East Timor. You can't actually get them anymore (due to it being replaced by .tl), but you can get various subdomains through resellers. A quick jump over to Tipdots.com, and....

Here's a rather worrying exploit on the XBox Live service that opens users up to profanity and (more seriously) the possibility of being socially engineered by people who appear to be official Microsoft representatives and / or people working for videogame companies.

What are they doing?

When you have an XBox Live account, you have a Gamertag - in other words, your username. Microsoft have things like profanity filters in place to ensure your username isn't full of swearwords, and it costs money to change your gamertag so in general it's unlikely someone is going to keep changing their gamertag simply to hassle someone. As a result, people who do hassle others on XBox Live are fairly easy to keep track of and hit with the banhammer when needed.

However - in the last few days, it seems an exploit (previously kept secret) has been leaked on a number of forums, and now it's rapidly spreading across the interwebs (or the gaming portion of it, anyway). As with all of these XBox related problems, it stems from being able to connect the console to the PC, edit data then place it back onto the console.

Without going into too much detail, you use a combination of this:

....and this:



....and then thoroughly hexing your data. Once this is done, your gamertag (when in a game) will temporarily look like whatever you placed into the edited data. Those of a nervous disposition sensitive to copious amounts of swearing might want to look away now:

Amazingly, you're not supposed to be able to do that.

However, this exploit not only allows you to call yourself Sweary Mc Swearword, it also allows you to leave the name space entirely blank, which results in much confusion and a decrease in the possibility of you being reported for bad behaviour. As you can see, these fake names filter through to services associated with XBox Live, so Bungie (creators of the Halo franchise) quickly end up with swears and / or blank names on their statistics pages. Here's a blank name:

"Achievements are really just slaps on the back with an assigned point value; the amount of points isn't truly what's important, but it's nice to see." - Ten Achievement Commandments

When Microsoft released their XBox360, they came up with the idea of "Achievements" - unlockable badges that display your prowess in a game. Kill 50 bad guys? Achievement! Run through six levels without dying once and throw the final boss off a cliff with your eyes closed? Achievement! Press the start button? Achievement! (No, seriously).

Some would say it all went horribly wrong when Microsoft decided that achievements should come with "Gamerscore points". These entirely useless numbers assigned to achievements traditionally give little else other than bragging rights and....um....that's it.

However, an unforeseen consequence of gamerscore points is this:

1) Accounts with high gamerscores (generally anything over 30,000GS) become valuable targets for hackers & phishers - a high score generally means lots of valuable ingame items / bonuses are associated with the account such as Level 50 Halo 3 characters, unlocked rare items & skills, high ranking Call of Duty multiplayer characters etc. You can then sell or trade these accounts for other accounts, credit cards or anything else you feel like. Here's an example of someone getting ready to sell a tampered account with a Gamerscore that weighs in over 130,000k:

2) It's incredibly easy to find people with high gamerscores and make them a target - you simply need to browse the official XBox forums and see who has what, or jump over to a site such as Mygamercard or similar sites where it's the easiest thing in the world to line up your bullseye painted victims. If gamerscores didn't exist, it'd be a lot more time consuming to dig out profiles that had a large amount of achievements attached to them because there would be no obvious signifier that the account was worth pursuing.

3) This also means that any method of artificially inflating your gamerscore means a fast track to selling (what appears to be) a high scoring profile. There has been dabbling in this area for some time (here's an article from 2006 where the first shots are being fired by Microsoft in response to cheating; here's another from 2008) and programs used for this cheating have been (for the most part) kept close to the chest of those using them.

One reason for this is that the programs that actually work cost a lot of money - there's one program that can go for anything from $150 to $200 in the right circles.

However, that's all changed in the last month or so as one of the most well known programs (that apparently sells for around $50) has been cracked and made available to all and sundry, for free. It's no coincidence that Youtube is suddenly awash with videos offering Gamerscore tampering services and that EBay sellers are popping up with auctions like these:

Want to see some of the auction details? Of course you do.

"Why pay someone else to do it when you can do it yourself and when you have these programs you can sell 40,0000+ gamertags on ebay and make ????????"

...oh dear. We'll be paying the above EBay seller a visit a little later on, so keep "Da1truehomie" in mind.

The program currently being thrown all over the place on underground sites (and poorly worded EBay auctions) would be this one:

Editing the gamerscore & achievements is simply a case of hooking the XBox up to the PC (with a transfer cable you can obtain free from Microsoft...whoops) then tampering with the data using the required programs.

Once you go looking on sites away from the underground such as Youtube & other video sites, it's clear that this problem is now going mainstream. Is there anything Microsoft can do to stop this? Who knows, but people determined to alter their profile details should know the following:

1) Microsoft are very good at spotting tampered profiles, and swinging the appropriate banhammer. You might get away with it for a while, but eventually it's going to go horribly wrong. Remember EBay seller "Da1truehomie"? Here is his XBox profile, note the message at the bottom:

He can expect to have his score reset and be hit with a possible ban. On reflection, perhaps having the same username for both his XBox and EBay accounts wasn't a smart idea.

2) The program that so many people are sending around went a bit bonkers when it was cracked and made available for everyone to download. Namely, it doesn't unlock the achievements correctly, labels online specific achievements as having been unlocked offline and various other things that fairly scream "shenanigans".

I still say Microsoft should remove Gamerscores altogether, however. For the tiny amount of worth they bring (not much), it's greatly outweighed by the desire of scammers to both obtain it by phishing and inflate it by hacking. Stolen XBox profiles are now big business, and you can typically expect to pick up an account with a credit card attached to it for as little as $4.

The act of Gamerscore tampering also pretty much makes legitimate gamerscores even more worthless than they are now - spent three years building up your total via hours of gameplay? Too bad, that large collection of guys over there unlocked six billion points in a week. It also presumably makes it much more difficult for game developers to keep track of statistics such as these (stats which many companies often use to tweak difficulty settings in future releases), so everybody loses out.

Bragging rights - who'd have thought they'd cause so much trouble?

There's a Windows Live ID phish doing the rounds at the moment, aimed at XBox gamers and their overwhelming desire to obtain FREE STUFF. Namely, XBox Live points. Here's the site, which is located at mspsite.t35.com:

It contains the usual nonsense designed to make the victim sit around doing nothing while the phisher changes their login information:

"This website uses an exploit found on the xbox live website. Using this exploit correctly means you can edit your amount of microsoft points on your account. As the flaw is on the Singapore websites, People living outside of singapore may need to wait up to 24 hours for there points..."

Once you enter the info, your account is as good as gone along with anything you have attached to it. If you think people don't fall for things like this, here's the proof:


Click to Enlarge

Chalk up one victim to the above site. There's bound to be more...

Today I had a guest column published over at TechRadar. The subject? Fake virus warnings on the Playstation 3 console. A very bizarre example of how PC related shenanigans can easily cross over into areas that really have no business being deluged with fake virus warnings...

Not so long ago, I wrote about XBox Live Chain Letter Spam, and how it suddenly seemed to be the cool thing to do. Well, here's an interesting example of how unfounded rumours + pretty pictures = hours of wasted fun for all the family.

Halo 3 is one of the biggest titles on the XBox console - if you've never heard of the game, click here while the rest of us wait for you.

All done? Good.

One of the most intriguing features of the game is the ability to save screenshots & videofiles to allocated storage space provided by the game maker, then share those files with other gamers. It didn't take long before people started to abuse this system through a combination of believing anything they were told and the desperation produced by wanting something (almost) nobody else has.

The rare item in question here would be Halo 3's mythical "Recon Armor" - an insanely rare item given only to Bungee employees and people who perform near miraculous (or just stupidly impressive) feats ingame. To give you an idea of how coveted this ingame item is, here's a 583 page thread (!) dedicated to finding out how to get your hands on it.

Anyway.

It didn't take long before some jokers decided to make this armor the "feature" of endless chain letter spam taking advantage of the file sharing functionality.

Your XBox Live account can send and receive messages to other users, much like the PM system of a forum. Quite a lot of people - those who play Halo 3 all the time and those who have never touched it in their lives - will have been sent a message like this over the past couple of months, entirely out of the blue:

Note at the bottom it says "Check out this film clip". If you hit the "Go to" link, you'd sit through thirty seconds of pointlessness and wonder why you'd bothered, or (if the link was for an image) you'd be left with a pretty (but pointless) picture.

What were the film clips? Well, I can't show you those but I *can* show you the image spam, and once you see them this will all make sense:

"If you recommend this to 50 people, you get Recon Armor".

As you probably already guessed, spamming these images to 50 people does NOT get you recon armor. It does, however, make you remarkably unpopular. There are a lot of variations on these image spam messages, here's another one:

"Recommend this to 100 people to get Crystal Armor".

Well....as long as it's crystal.....

It seems an endless wave of chain letter messages are starting to annoy people.

You'd think it would be pretty easy for Microsoft to block communications with "900" in them, but apparently not...

If you use Facebook, Myspace or any other Social Networking site you'll no doubt be familiar with messages like this and this. typically, they all involve sending them to an endless stream of participants, lest you suffer bad luck in the form of being hacked, losing your job, dying horribly or being stalked by vengeful ghosts for the rest of eternity.

Of course, it's all nonsense.

Well, illustrating that you're not safe from these kind of chain letters regardless of which digital domain you happen to use, here we have multiple instances of chain letters making their way to the XBox Live gaming network.

Over the past few days, large amounts of people are reporting being sent messages from both friends and complete strangers over the XBox Live messaging system that contains nothing other than this:

If you have a Wii console, you're probably aware that you can purchase games online. What you might not be aware of is the growing popularity of entirely fake "points generators", all of which do little more than dump lots of horrible files onto your PC. Keylogging and Trojans are the order of the day.

XBox points generators have been around for a while, but Wii generators seem to be a little newer. They're certainly nice to look at:


Click to Enlarge

Here's a bunch of people complaining about stuff on the Internet.


Click to Enlarge

What are they complaining about? The "art" of lag switching, which is where someone playing a game online uses a special "switch" to make the game....surprise....lag. Doing this can kick other people out of the game, make their connection drop, give you an edge as you "magically" appear behind their characters and shooting them into oblivion.

All in all, it's pretty cheap.

However, some people seem to be doing quite well out of it all. I was somewhat surprised to see this:


Click to Enlarge

That's right, for $15 (plus $7 shipping) you too can cheat your way out of the trickiest situations with a custom built lag switcher, lovingly delivered to your doorstep via the USPS. I love the quotes on the site:

"This is one of the easiest switches on the market.
Set unit on the floor, tap button with foot to create lag.
Quickly tap (only once) to create 5 seconds of lag,
wait 5 seconds, tap again to lag 5 more seconds.

Our favorite: Wait until you see your opponent,
tap the button, run next to that same opponent
& start shooting, tap again at the next opponent"

.....yes, wonderful.

Let's take a look at

Mygamesfile.com

....a website that promises much, and delivers little.

You may have seen these adverts in circulation on ad networks recently:

This is pretty bizarre. Here, we have a social networking site asking for pretty much every type of login you can imagine and getting a fair amount of criticism for it in the process. The way they go about it is somewhat peculiar, and though I don't think it was malicious on their part, it illustrates how what somebody thinks is a good idea can go horribly wrong very quickly.

The site in question is Playfire.com, a social networking site for people interested in videogames.

What were they doing? Well,it seemed messages were being sent to people on your XBox Live friends list, "reserving" a page for that username then presenting that individual with the below page:


Click to Enlarge

Note that it asks for your XBox Live login. At that point, according to numerous complaints on forums, those friends would then receive a message on XBox Live that appeared to have come from you, recommending Playfire.

A Playfire employee has been busy posting to this blog post, and also this forum thread on the subject. From the last link:

"It looks like Microsoft's legal team has triumphed. According to Large Jaguar, Xbox.com Development Manager, "PlayFire is no longer collecting WLID credentials for people's Xbox LIVE accounts."

Again, I don't think there's anything malicious going on here - but it's a good example of how a few poorly chosen "features" can seriously damage your reputation.

When you're a new site, that's really the last thing you need...

Click to Enlarge

In the past few weeks, we've noticed a steady increase in posts like this and this. Everywhere you look, people are suddenly curious as to how you "boot" someone from online videogames. They're not entering this rather famous joypad combination to do it - rather, they're dabbling in somewhat more sinister methods of tampering with gamers playing on XBox Live.

Namely - Botnets. In a big way too, from the looks of things.

What is XBox Live?

Xbox Live is an online multiplayer gaming and digital media delivery service created and operated by Microsoft Corporation. Pay for a Live account, and you can shoot other gamers online all day long on Halo 3, or maybe download some premium content such as movies, trailers etc.

Live has long been the subject of social engineers and hackers - fooling people into handing over their logins and making fake Points generators stuffed with Trojans and keyloggers to steal login info has been going on seemingly forever. There is another area of Live exploiting that's not been looked into much - that of "booting" other players from games via external means.

How is this done?

Well, typically someone will connect their XBox to their PC via a crossover cable (or via their wireless connection), join a multiplayer game then sniff the traffic (you can see a tiny example of that from the first screenshot at the top of the article). They might use this method to grab ip addresses (though it can be a little over complicated for the wannabe hacker), or they might resort to social engineering tactics away from the gaming environment. However they go about it, they need an ip address if they intend to boom, headshot their victim.

In this case, we have something rather interesting that's quickly becoming mainstream after spending a long time in the underground - combining custom made tools to create Botnet drones, specifically created to knock XBox Live gamers out of whatever game they happen to be playing at the time.

The bundle currently doing the rounds is pretty slick, and combines two tools distributed in a single AIO - it actually sits in the system tray (first icon on the left) until you feel like exploring it further.



Here's the two applications that work the "Magic" in this particular package, when you get tired of looking at the nice icon in your system tray:


Click to Enlarge


Click to Enlarge

Both of these programs pretty much do the same thing - facilitate the ability to DDoS people from the XBox Live network (note the default port for both programs is 3074, which is required to be open for XBox Live to function).

How do they do it?

Well, the bundle comes with two "vanilla" Bots:



...although really, the Bots can be anything you like. You don't have to use the supplied files, though of course this is designed to be a DIY-in-minutes kit (humorously, both files point to a pre-existing Botnet so anyone foolish enough to run these EXEs while trying to create their Botnet empire is going to find themselves a drone for the original creator).

After creating a host with a service such as no-ip.info that points to your own ip address, you insert that host into the ready-to-roll code in the Bot file. At that point, all you need to do is send your victims the EXE, convince them to run it on their PC and they'll start reporting back to your Booter program as willing DDoS drones. Here's a (somewhat blurry) screenshot lifted from a popular Youtube video currently in circulation of an attack in progress on an XBox gamer:



As you can see, the attacker "only" has four bots, but the instructions that come with the programs tend to advise "between forty and sixty". This is now, as you might imagine, all the rage.

The big incentive here, of course, is money. There seems to be quite a lucrative market for angry gamers looking to get revenge on whoever happened to headshot them the day before - we have some screenshots of sites where these "XBox DDoS Botnets" can be created from scratch for paying customers, along with a nifty price list to get things moving.

As I said earlier, some of these tactics and techniques have been around for some time - but you only need to take a quick look around hacking forums and sites such as Youtube & Yahoo Answers to see this is rapidly becoming more and more interesting to angry 14 year olds with too much time on their hands.

What can you do about it?Well, sadly for now the answer is "not a lot". You can never be sure when playing online just who has their finger on the trigger ready to nuke you from orbit with a Botnet DDoS. The problem will only get worse as money keeps changing hands and suddenly every rage fuelled gamer who had a dream of really getting even suddenly has the power to do so even after the "Game Over" screen has flashed up.

Perhaps the best solution is just to let that annoying fourteen year old claim his headshot and go back to playing chess...

Writeup: Chris Boyd, Director of Malware Research
Additional Research: Chris Mannon, Sr. Threat Engineer

This XBox Live phish attempt caught my eye:


Click to Enlarge

It's a lot better looking than many of the others I see, and the phisher took the time to make a fake screenshot to impress you with all the fake money he (doesn't) have. The most interesting thing about it for me is that it references another domain ("Runeflux.com"). Usually they're pretty anonymous.

Anyway, I decided to check out the domain - there's nothing there, could it have been taken down? Well, a quick search later and we have this (rather well edited) Youtube video. Apparently the domain simply hosted the same phishing page, so yes - it's a fair bet someone had it taken offline.

The important part is when you check out the profile of the person who owns the account:




Yes, our phishing friend is only 14. I've had quite a bit of experience researching people at the younger end of the age spectrum involved in this sort of thing, and I have to say the basic mechanics of "how to phish" are all in place with this kid.....slick websites, Youtube promotion, little touches like fake screenshots....it's all there.

Worrying, isn't it?

Anyway, the URL to avoid here is

h1.ripway.com/microsoftpointsgen/

There are many Microsoft XBox Live scams out there - many involve increasingly sophisticated "fake points generators" (which claim to produce "free" Microsoft points used to purchase downloads and other items, only to steal your login details).

However, some are so amazingly breathtaking with regards what they ask the end-user to do, it's somewhat miraculous anybody would actually fall for them.

This is one such scam, currently doing the rounds on Youtube. Our video begins:

We've heard reports of a couple of these websites currently doing the rounds - they call themselves "Microsoft Points Heaven", and usually sit on free hosting domains. They promise you "free" Microsoft points, then ask you to enter your Live login details. At that point, your data has been stolen.


Click to Enlarge

If you check the code, you can see you're not "signing in to XBox Live" at all - you're entering your information into a standard submission form, which will send the information you enter directly to the site owner.



The last URL we saw this scam residing at was

microsoftpointheaven.weebly.com

which is now offline. It will no doubt resurface somewhere else, so be on your guard...

These are currently being sent to random people on the Microsoft XBox network:


Click to Enlarge


Click to Enlarge

"Hello we are a company called Microsoft Rewards. We have an overstock on Xbox Microsoft points. We are now giving them out but hurry because everyone on Xbox Live will be getting this message.

If you want points all you have to do is send us your username, email and password. After that we will log in and give you the points."

As you might have guessed, it's a scam...

As many of you probably know, I like my videogames. I also really like videogames where you get to shoot thousands of crazed zombies in the face, with a pump action shotgun. With that in mind, I was particularly interested in a collection of files that surfaced about a week or so ago, in relation to the popular videogame Left 4 Dead.

See, in theory it's supposed to be extremely difficult to mess around with XBox videogames. You might be able to exploit a few glitches here or there, but actually altering the game itself? Sorry, no can do.

Except....it's not quite that straightforward. Someone decided to hook their PC up to their XBox360, take files from the XBox Hard drive, patch them with custom-built software that looked like this:




......and then put the altered files back onto the XBox Hard Drive. Once this was done, the game was open to all sorts of abuse. You could make the characters giants, spawn thousands of guns, generate an endless amount of zombies, fly.....you name it, it was probably do-able. The exploit was quickly fixed, and the files are now supposedly useless.

However.

The bit that really interested me was that in many threads on unrelated forums, some people were claiming that using these programs on their PC had resulted in Steam accounts being stolen.

Despite testing these various programs for what seems like an age, I'm no closer to having my Steam account stolen than I was last week. It's possible that people are having their Steam account taken via an unrelated method, and in the rush to work out the cause this hack / mod is taking the fall. With that in mind, if anyone reading this tried the above hack (or knows someone that did) and you think your account details for Steam were taken as a result of using these files, please leave a comment and let us know exactly what happened.

If you like shooting zombies in the face - and who doesn't - then you may well have already purchased Left 4 Dead, a videogame pitting four survivors against a relentless zombie horde.

Well, it appears to be a popular target for scammers. An EMail popped up in my mailbox over the weekend, claiming I'd received a "guest pass" that would let me play the full game "for a limited time". Here's the mail in question:


Click to Enlarge

"The steam support has invited you to use a free guest pass for Left 4 Dead on Steam, the leading digital distribution platform for PC games.

Once you've installed Steam (or if you already have an account) click here to accept steam supports invitation to a full game of Left 4 Dead."

Of course, the link for the "guest pass" doesn't take you to an official site - it takes you to

steampovvered.co.cc (note that's steampo v v ered, NOT steampowered)

At that point, if you enter your Steam password, you've potentially lost it for good. The site is currently offline, presumably because it's already been reported ("This domain is under examination at the moment, it will be finished within 24 hours"). However, there are probably more Phishing scams out there attempting to capitalise on the popularity of this particular game.

Now if you'll excuse me, I have to prepare for the coming Zombie Apocalypse...

This is a particular favourite of Phishers - a page claiming to give you free Microsoft Points for XBox Live, only to take your login and do what they want with it (which could range from using the credit card stored against your account to buy lots of games you don't actually want to just trashing your gamer profile).

With that in mind, then, here's the offering for today:

freemspoints4all.blackapplehost.com


Click to Enlarge

The "3.1" in the bottom right hand corner is particularly humorous. Anyway, hit "Click here" and you're taken to a standard fake Live login page:


Click to Enlarge

If the unwary visitor should enter their details, some code in a .php file will stash the login for the Phisher to grab later while immediately redirecting you to the following (entirely fake) message on a blank page:


Click to Enlarge

If you get to the stage where you see this message, you should be thinking about logging in as quickly as you can and changing your password. Top tip for the day - any website that offers "Free Microsoft points" should be avoided like the plague. I've yet to see a genuine one, and I think I can safely say I'll be waiting for quite some time before I do...

I recently posted about this, regarding videogamers inexplicably spamming a moneymaking link to all their friends.

The same site is being posted to everything from Reddit to Digg, and assuming this isn't the grandest "hack every type of account known to Man and post autospam from it" scam I've ever seen (which is unlikely), we have to draw one conclusion - half the Internet has taken leave of their senses in the mad rush to see some incredibly tame pictures of a semi-naked woman.

It's a conclusion that has a fair amount of evidence lying around to back it up - here's an explanation from someone who posted it to a forum, only to have their original post edited by a Mod:



Click to Enlarge

"I'm just really shallow and want to see the rest".

...amazing that people are so eager to post this everywhere when if they really wanted to, they could see as much naked flesh as they want in about three seconds or less. Apparently it's easier to annoy your friends with spam and ruin your reputation on forums you've been on for a long time.

Whoever came up with this idea must have a swimming pool filled with money.

Someone, somewhere has decided to make a lot of money and apparently use gamers to achieve that goal. How are they doing this? Well, the last couple of days a certain weblink has been appearing on numerous gaming websites and forums.


Click to Enlarge

"Rumour has it "Sexy" Emilie is being cast as a fifth character replacing one who will die for new downloadable content already planned for 2009! Her site even has a story on it!

sexyemilie.com"

There are two strange things about this spam. The first is that it's not the usual "Click here for pills" spambot speak - it's relevant to the forum it's been posted to, a real live person has sat down and typed it out. The second is that it isn't "one post and you're banned" spam accounts posting the link - in most cases, it's people who have been on their respective forums for some time (the person posting above is on the official XBox forums, and has a high gamerscore and reputation).

The accounts haven't been hacked - people are willingly posting this link up. Each time the link is posted, people are attaching an affiliate link which is even more suspicious. Visit the site, and we see some rather clever tactics being employed. At first, it looks like any other "Check out these pictures of my ex-girlfriend" porn website:


Click to Enlarge

However, scroll down and you see eight of these boxes:


Click to Enlarge

And this, which gives the game away:


Click to Enlarge

If you want to "see more", you have to send the link to as many people as possible. According to the text, more pictures will be unlocked as people click your link to reach the page - however, this is where it all starts to fall apart. It doesn't matter how many times you click the link from any of the sites it's been posted to - the counter that tells you "how many of your friends already clicked the link" always said zero for us when testing. Regardless of what the page says, you can hit F5 as many times as you like and it never goes up.

Despite this, there's a counter at the bottom of the page that says the number of people who've been there today is "204,781".



Over two hundred thousand people have been there, and not one person has arrived via these spammy affiliate links? Does that sound plausible?

Of course not. The gimmick is that the creator of the site is hoping people don't want to wait for pictures that will likely never actually reveal themselves (they certainly won't when the counter registering clicks doesn't seem to work), and phone up a $2.50 1-900 number to get a "special access pass".



Interestingly, when we visited the page via a proxy, we were randomly presented with a page displaying all ten images - presumably this is the page shown to the user if they're willing to phone and pay up.

Also of note is the following:

"Hot tip:  If you use ICQ, MSN, AIM, and other instant messengers to send your personal link to your friends, you will have the video in no time!"

If you see this site sent to you via a friend on Instant Messaging, don't worry - they haven't been hacked, they've just been convinced that sending this URL to all their friends is a good idea. The reality is that someone, somewhere decided to exploit gamers to go spread this link virally, and they're practically falling over themselves to promote it.

"After all, I am a member of the press and therefore have received some preferential treatment on this matter" - Dan Hsu, IGN

Well, that might explain why he had the police and the FBI all over his stolen XBox Live account. Definitely worth a read though, and the Top Seven Tips make up for the whole "preferential treatment" thing:

1. Don't answer your secret question with the real answer. Instead, select something completely unrelated (for example, First Pet = Will Tuttle) that you can remember, effectively giving you a second password.
   
2. In the "address 2" line of your profile, put down: "XBOX SUPPORT DO NOT ASSIST WITH ACCOUNT RECOVERY" to help automatically raise a red flag when a customer support rep looks up your account.
   
3. If you're planning on gaming away from your default console, put your account on a memory card or move it with your hard drive, as opposed to recovering it on another machine.
   
4. Never reveal any personal details about yourself while gaming over Xbox Live.
   
5. On that same note, go ahead and leave your profile's bio blank. No need to tell everyone where you live.
   
6. Limit the amount of information you put out there for everyone to see on social networking sites...or any website for that matter. Especially ones where you also have your Gamertag listed.
   
7. Create an Xbox Live passcode if you haven't already. To do this, select "My Xbox" on the Xbox dashboard and go to your profile, then go to "Account Management" then "Xbox Live Pass Code."