Results tagged “XBox” from SpywareGuide Greynets Blog

All XBox owners have a list of most recently played games set against their profile. As you might have guessed, every game has a unique ID assigned to it so Halo 3 doesn't accidentally show up as The Amazing Adventures of My Little Pony.

Well, like most other things related to the console it can be hexed, modded and generally given a bit of a fiddling. I've seen a few furtive mentions of this in the backroom areas of certain leet forums, so this might not even be doing the rounds yet. But hey, a little advance warning never hurt anyone.

Let's take a look at the scam, it's a pretty clever one.

1) Phisher tampers with their data and makes it look like Modern Warfare 2 - which isn't out until November - shows up in their recent games list. Note the big number "2" in the below image, complete with handy red box just so you know exactly which icon I'm on about.



2) Phisher then trawls around various forums and websites touting access to the "Modern Warfare 2 Beta" - and of COURSE it exists and they have played it, because it wouldn't be in their recent games list if they hadn't. Right?

3) Phisher then asks you for your login details in order to "gain access". All that's actually going to happen is you lose your account to a scumbag.

I've already seen quite a few accounts (including the one above) hit with various degrees of banhammer for altering their recent games list, so hopefully that'll kill a few phishes off before they're even launched. In the meantime, know this: there is currently NO beta planned for this game, and in all probability there won't be one.

Don't be suckered in!

Last week, I spoke at SecTor 2009, on a subject near and dear to my heart: people messing around with videogame consoles in various horrible ways. Before I go any further, I want to say this - in terms of looking after people who turn up to speak, SecTor wins first prize. It might not sound like much, but it is extremely nice to have some dude waiting for you in a pre-paid car to take you to the hotel from the airport at 1AM when your plane has been delayed for seven or eight hours (cockpit windows fell out, or were about to. Long story).

So, large and appreciative hat tip to the organisers. They looked after me and stuffed me with food and I can't ask for anything more than that. You can also see a collection of photographs here. Some of them are even in focus.

As far as my talk goes - hoo boy. Talking about exploiting videogamers always seems to be a touchy subject, as gamers seem to lock themselves into a protective bubble, dismissing everything with "Nothing to worry about, it's only phishing".

Once it's put into a box like that - sorry man, lights out. Whatever gaming network you're talking about is "safe". No "hacking" is taking place. The "only" way someone can get your login - argh, the assumption that the ONLY thing bad people are looking to do on gaming networks is steal your login! - is by convincing you to put your information into a phishing page or handing it over. While the phishing side of things is accurate - nobody is going to get anything unless you GIVE them it, save for when they try to social engineer support staff - there are many, many steps along the way that involve all manner of hexing, hacking and getting around security systems on the console which lead to that phish being more convincing than it should be.

When it gets to that stage, the people who provide you with that gaming network need to sit up and take notice, because it is most certainly NOT just "about phishing". While gamers obsess over being "safe" in their account-not-phished world, the entirety of their gaming network had drowning in a sea of DDoS attacks, network spam and other junk clogging up their intertubes.

Also: this has been on Slashdot and a bunch of other places, and without having seen the talk (and going off the condensed coverage the talk has had) people are either misreading what went down, or going on about things I never mentioned at all (one guy is talking about "compromised XBox consoles being part of a DDoS Botnet" - what?)

It wasn't just about phishing. I showed some pretty pictures of the tools people use to tamper with files. There were paid-for DDoS Botnets, designed to kick people out of games. How about people messing with files so they could get things for free that the rest of us pay for. There was an examination of people getting around swear filters in a manner that allowed them to impersonate videogame developers. And so on.

Everything in my talk boiled down to one of three areas:

1. People who manage to run open source operating systems and old videogame consoles on an XBox360.

2. People who hex edit files in order to gain some advantage, in order to get things for free that everyone else pays for, to gain the upper hand in a game or to make some money when they come to sell their account on the black markets. Or, you know, EBay.

3. People who wheel out all kinds of malicious activities - DDoS, chat spam, phishing and social engineering - in order to give you a bad hair day. Again, winning the game might be the priority - but there are many other reasons. In the same way that it isn't just about stealing logins, it isn't just about winning games either. Many scams flying around the XBox Live network are nothing more than plain old harassment, bugging you for no good reason, flooding your inbox for the purposes of hilarity.....etc.

The main areas I explored were 2 and 3 - and wrapped up in both of those are two basic ideas: hack yourself, and hack others.

Let's be clear here, because people get way too wrapped up on the word "hack" where consoles are concerned. Spoon fed the idea that consoles are "secure", many people will dismiss any and all activity as "mere phishing". Yes, the ultimate goal for most malicious individuals in console land is to grab your account. Yes, the final roll of the dice when your number comes up (usually) relies on you handing over information to your attacker.

But in the process of obtaining that data, the attacker may well have blended software modding, file hexing and system exploitation to achieve that final headshot. They start with hacking something, and end with phishing. There IS hacking taking place, and it's really irrelevant if the hacking portion comes at the start or the end of the process - all that matters is they gain control of an account. They are hacking the software, the games, getting around the numerous security protocols designed to stop tampering and also using these same techniques to obtain items for free that regular users have to pay for.

I don't know about you, but it certainly sounds to me like someone is hacking something.

 I expand on this a little here, but feel free to keep rolling.

Key areas of console exploitation that I covered in my talk (loosely in the realm of points 1 & 2 above) were:

1) Artificially inflating your Gamerscore, either for kudos from your peers or financial gain by selling on high scoring accounts on various black market sites. If you can bump your own score easily, you don't have to get your feet dirty with that horrible phishing business.

2) Phishing accounts, particularly those with credit cards attached or - of course - those with high gamerscores. Phishes can (of course) be everything from the basic fake webpage, to lame messages sent across the XBox Live messaging system, or those wonderful fake points generator programs. Phishing has become a lot more sophisticated, and nowadays most phishing throw in some file tampering to make the phish more realistic. Speaking of which...

3) Hex editing data created on your console in order to cheat at games, unlock various things you'd otherwise have to pay for (which in many cases ties back to Gamerscore hacking) or perform malicious acts that often form one of the rungs in the phishing ladder. This is a perfect example. As I've said elsewhere, temporarily changing your gamertag in order to assume the identity of a game developer listed on gamerscore rank sites and phish another user is, I think, a pretty smart example of maliciously altering programming in ways it was never meant to be altered, as well as getting around a supposedly rock solid authentication system and throwing in a neat social engineering twist into the bargain.

4) People just want to have fun. And by "fun", I mean "fill up your gaming network with so much junk and rubbish that the whole thing eventually crumples in a heap and starts to cry". I covered Friend Request Spammers, DDoS attacks and a couple of other things such as lag switches that you buy from online stores and glue onto your controller but time was against me. I wanted to also explore things like chain letters (that require you to waste time by inserting a specific game disk to view them!) and other weird / not-so-wonderful items of strangeness, but I guess those will keep for another time.

Why are we at risk?

1) Modern console design is geared towards interactivity, and something working with everything else whether you want it to or not. You can get online with your console via ICS and a hole in the back of your PC, you can wirelessly use Windows Media Center with your XBox, and you can - crucially - take your removable XBox Hard Drive (geared towards digital downloads and eventually buying bigger drives) and use a Microsoft supplied USB wire and plug it into a PC, view all the files on it then start hexing many of them if you're that way inclined.

I'm not quite sure how someone at MS didn't think people wouldn't immediately plug these HDDs into computers and start looking around, but putting features onto gaming consoles that make them resemble mini PCs also makes them rather exploitable. The same features, the same functionality, the same funny shaped holes in the back of them and it all starts to go a bit pear shaped.

2) Dedicated pretexting groups on forums who will happily spend all day phoning Microsoft support reps in attempts to social engineer them into giving them your data. It seems after a number of incidents MS has tightened up in this area; however, people still complain that this has happened to them and these SE groups still exist. Some currently hijack accounts and give tutorials on how to keep them once stolen, which is, uh, a nice touch. I guess.

3) The huge obsession with promoting your gamerscore - an arbitrary numerical value assigned to achievements you earn in a game - as an amazingly cool thing. Witness this guy having a huge hissy fit about me daring to complain about it.

The flipside is that these scores single people out as targets for phishing, social engineering and general abuse. Limited privacy features mean you can only hide your most recently played games and achievements - pointless - but you CAN'T hide your gamerscore.

A common technique for social engineers is to simply go to one of the many sites that provide this data, such as the official XBox forums and make a running total of anybody with a score between 20,000 or 30,000 (or more) on the basis that those accounts will have unlocked more things in the game, or have a higher ranking, or have more shiny blinky things for you to play with.

Remember the "impersonate a game developer" scam I mentioned earlier? Many of the people trying that scam out would potentially have just gone to a site listing game developer Gamertags under "Celebrities" - like here - then writing down their names for future use.

You can bet a lot of people on that list don't know about the scams that are out there, despite them being game developers. Are we painting a big target on people that really should be a little more anonymous? I would argue we might be - phished game developer accounts would no doubt be able to fool a ton of starstuck game fans.

And we really should have the option to hide the Gamerscore, "celebrity" or not, should we choose to do so.

Conclusion

It's not all bad - Microsoft do ban lots of accounts for cheating and tampering, but I'm not kidding when I say the problem is long since out of control - jump onto Youtube or any other site, and there more cheating / hacking / modding videos there than you could ever hope to wade through in one lifetime. For all intents and purposes, we're all stuck with this until a real solution is found.

As for me, I'm going back to playing on my Atari 7800, where the only danger is that the ancient wiring might blow out and burn down my house.

This is a step above the usual phish attempt we see here, with a number of bits and pieces that build up a pretty convincing fake website. As you probably guessed from the title, the phish involves the upcoming juggernaut that is Call of Duty: Modern Warfare 2, and the endless desire some people have to take part in a beta.

The URL to avoid is

freemw2beta36.tk

and the page itself is hosted at

freemwbeta36.t35.com

Want to take a look? Sure you do.


What does this phish do that sets it a way above other phish attempts? Well, for starters it looks quite professional. Top left, they use the kind of info splash you normally see on an official XBox page. On the right, there's a media section with screenshots you can actually click into. Might not sound like much, but most phishes like this one don't have anything clickable in that whatsoever. Bottom left, they've embedded a real Youtube video that you can watch to your hearts content. Right at the bottom of the page, they've included a copyright notice - something else phishers tend to lose in translation.

All in all, pretty convincing.

The only real flaw with this phish is that there is currently NO public beta planned, and it's highly unlikely there will ever be one. Don't get suckered into handing over your Windows Live ID, as no good will come of it.

A while ago we wrote about multiple friend requests made on the XBox Live network with the aid of PC based spamming tools. Well, if you try any of those shenanigans now you'll see this:

Back in August we reported that individuals were changing their usernames in gaming sessions to impersonate Microsoft staff and game developers, grabbing login details from unsuspecting victims. It seems the problem is not only taking place, but now comes with an interesting addition - the hackers have now found a way to play on the XBox Live network for free while using the above exploit.

Whoops.

The "playing for free" thing is a new one on me, but I'm a little surprised Microsoft haven't fixed the ingame namechanging yet - this has left users open to social engineering for a number of weeks now. Fingers crossed they put this one to bed for good...

Next month - October 6th & 7th - I'll be at the Sector.ca Conference, talking about a subject close to my heart: how lots of rather naughty people are using consoles to both cheat the system and attack other users, via spam, DDoS and account theft. Is it abstract extract time?

I think it is.

Game Over, Man: Gamers Under Fire - Chris Boyd

An exploration of security issues relating to consoles and their risks to both home users and the business environment. This will include issues such as custom built DDoS tools, social engineering of Microsoft support staff, account theft, the risk to businesses and personal tips to keep your own details secure. I'll also examine the trade of stolen Xbox accounts in return for credit cards, how the rewards that companies give gamers make them targets because of inadequate privacy features and how free programs allow hackers to exploit profanity filters, paid content and even the profiles themselves.


As you may know, I've spent a lot of time digging around script kiddy forums. By and large, most of what I see isn't very impressive. However, for a while now there's been an interesting offshoot of hacking forums, with entire sections devoted to console hacks and attacks. There's an impressive amount of technical knowledge and skill going into the creation of hacking tools for consoles, hacking the console itself and doing all sorts of horrible things to the people that use them.

Some of the techniques used to turn an otherwise harmless lump of content restricted plastic - whose very soul is supposedly on the leash of the company who made it - into something you can spend all day annoying somebody with never fails to amaze me.

How many companies now have gaming / recreation rooms with a console just plugged in and left to its own devices? How many parents mistakenly think the worst thing that'll befall their kid is seeing someone get their head blown off on GTA4?

They're all accidents waiting to happen, and the general promotion of consoles as these "unhackable, unsinkable" battleships of gaming is something that needs to be examined in greater detail.

It's not just PCs under fire anymore...

Remember this spamming program? It seems someone decided they really needed MORE SPAM EVERYWHERE. With that in mind, a modified version of that application now lets you send infinite spam messages to up to four people at once.


Click to Enlarge

I've heard somebody devided to go one better, and there's now a tool that spams five lucky individuals. Wonder when we'll hit double figures...

Today we're going to look at a malicious program that seems to take its cue from the Facebook Freezers I've written about previously. In those cases, the aim is to get a Facebook account banned by repeatedly entering an incorrect password into the login form. Here, the intent is to make using your XBox the most annoying thing in the world.

Here is the program in question:

Finding dumps of stolen logins is a common occurrence round this neck of the woods; if it isn't a bunch of XBox logins, it's 5000+ EBay / Paypal accounts. Well, here we have roughly 86 Windows Live ID accounts taken without permission, via a phishing page.

Windows Live IDs can be used to access everything from Hotmail and MSN to XBox Live and Zune. Grab a Live ID, and the amount of ways you can ruin someones day increases in spectacular fashion.

In this case, the target was XBox Live gamers, by way of a fake "Get Microsoft points for free" phish.

What I found particularly interesting here is that the collected data reveals the (borderline desperate) greed on the part of the victims - allow me to explain. Many of the most popular XBox phishes involve the site creator pretending to be an ex Microsoft employee, who just so happens to have a magical way to create "free" Microsoft points (which otherwise cost money, and are used for digital videogame transactions and Zune marketplace purchases).

Here's a typical example of said fakery:



There's normally a dropdown box (bottom right), asking the victim to select a fictional amount of points while they throw away their login details. More often than not this information isn't included in the phish dump, because the phisher couldn't care less how many points the victim is after. This is what you normally end up with:


Click to Enlarge

...as you can see, nothing more than the Live ID, the password and the date.

Here, however, each stolen account in the data dump looks like this:

Logged IP address: xx.xx.xx.x0 - Date logged: Monday 20th 2009 of July 2009 09:17:27 PM
Email=xxxxxx@xxxxxxxxxx.com
Password=xxxxxxxxxxx
Points=20000
submit=Go!

For some unknown reason, the phisher decided to log the points the victim tried to obtain for free. This means we can gather up some data about the level of frenzied button mashing the victim goes through over a period of days.

Days? You bet. More on that later - for now, let's take a quick look at the amount of points the victims were dying to get their hands on. The stolen logins have been in circulation on forums for a while, and based on comments we've seen all of them have either been locked down or leeched but we've notified Microsoft anyway. All of the below were phished between Monday the 20th of July and Tuesday the 28th:

500 MS Points ($6.25 / 4.25 GBP) - 17 requests
1000 MS Points ($12.50 / 8.50 GBP) - 8 requests
2500 MS Points ($31.24 / 21.25 GBP) -  8 requests
5000 MS Points ($62.48 / 42.50 GBP) - 23 requests
10000 MS Points ($124.95 / 85.00 GBP) - 10 requests
20000 MS Points ($249.90 / 170.00 GBP) - 92 requests

In total, there were 167 attempts to get free points, with 9 misfires (which means the victim didn't pick an amount on the dropdown box, resulting in a "-Select-" left in the relevant data field). Roughly 86 individual Live IDs were phished, and the rest of the 167 attempts were repeated requests for points from the same handful of people - sometimes stretching over the full timespan from Monday 20th July to Tuesday the 28th.

One person made 24 requests over the eight days (at one stage making eleven requests for points in three minutes!), with 17 tries for the maximum amount of 20,000 MS points. That works out at 340,000 points not including his smaller requests, which means this person attempted to collect over FOUR THOUSAND DOLLARS worth of digital downloads for nothing.



In fact, he's still trying to get free points on the 28th despite not having actually received anything from the moment he tried way back on the 20th. The phisher who collected these logins deserves nothing but scorn; however, it's increasingly difficult to feel any sympathy whatsoever for some of the people caught up in the above data log.

Is the only real solution to throw both phisher and victim into a bear pit, filled with angry bears who themselves hold an irrational hatred of both bear pits and bear pit trespassers?

Why yes. Yes it is.

A common warning in relation to many phishing attacks is "Look for the .com in the URL, because that's the official site domain - if you see that you know it's the real thing".

All well and good, but sometimes people find a way to place a ".com" in there anyway.

Here's a fake XBox.com phishing page - note the URL:


Click to Enlarge

Amazingly enough, it's

xbox.com.au.tp

The problem here is that we're so conditioned in relation to "Look for the .com" that many people will see this domain and think, well, it HAS to be legit - completely disregarding the "au.tp" part that comes after it.

Unfortunately, it isn't real in the slightest. How did they get the above domain to look the way it does? Well, a .tp domain is the top level domain for East Timor. You can't actually get them anymore (due to it being replaced by .tl), but you can get various subdomains through resellers. A quick jump over to Tipdots.com, and....

"Achievements are really just slaps on the back with an assigned point value; the amount of points isn't truly what's important, but it's nice to see." - Ten Achievement Commandments

When Microsoft released their XBox360, they came up with the idea of "Achievements" - unlockable badges that display your prowess in a game. Kill 50 bad guys? Achievement! Run through six levels without dying once and throw the final boss off a cliff with your eyes closed? Achievement! Press the start button? Achievement! (No, seriously).

Some would say it all went horribly wrong when Microsoft decided that achievements should come with "Gamerscore points". These entirely useless numbers assigned to achievements traditionally give little else other than bragging rights and....um....that's it.

However, an unforeseen consequence of gamerscore points is this:

1) Accounts with high gamerscores (generally anything over 30,000GS) become valuable targets for hackers & phishers - a high score generally means lots of valuable ingame items / bonuses are associated with the account such as Level 50 Halo 3 characters, unlocked rare items & skills, high ranking Call of Duty multiplayer characters etc. You can then sell or trade these accounts for other accounts, credit cards or anything else you feel like. Here's an example of someone getting ready to sell a tampered account with a Gamerscore that weighs in over 130,000k:

2) It's incredibly easy to find people with high gamerscores and make them a target - you simply need to browse the official XBox forums and see who has what, or jump over to a site such as Mygamercard or similar sites where it's the easiest thing in the world to line up your bullseye painted victims. If gamerscores didn't exist, it'd be a lot more time consuming to dig out profiles that had a large amount of achievements attached to them because there would be no obvious signifier that the account was worth pursuing.

3) This also means that any method of artificially inflating your gamerscore means a fast track to selling (what appears to be) a high scoring profile. There has been dabbling in this area for some time (here's an article from 2006 where the first shots are being fired by Microsoft in response to cheating; here's another from 2008) and programs used for this cheating have been (for the most part) kept close to the chest of those using them.

One reason for this is that the programs that actually work cost a lot of money - there's one program that can go for anything from $150 to $200 in the right circles.

However, that's all changed in the last month or so as one of the most well known programs (that apparently sells for around $50) has been cracked and made available to all and sundry, for free. It's no coincidence that Youtube is suddenly awash with videos offering Gamerscore tampering services and that EBay sellers are popping up with auctions like these:

Want to see some of the auction details? Of course you do.

"Why pay someone else to do it when you can do it yourself and when you have these programs you can sell 40,0000+ gamertags on ebay and make ????????"

...oh dear. We'll be paying the above EBay seller a visit a little later on, so keep "Da1truehomie" in mind.

The program currently being thrown all over the place on underground sites (and poorly worded EBay auctions) would be this one:

Editing the gamerscore & achievements is simply a case of hooking the XBox up to the PC (with a transfer cable you can obtain free from Microsoft...whoops) then tampering with the data using the required programs.

Once you go looking on sites away from the underground such as Youtube & other video sites, it's clear that this problem is now going mainstream. Is there anything Microsoft can do to stop this? Who knows, but people determined to alter their profile details should know the following:

1) Microsoft are very good at spotting tampered profiles, and swinging the appropriate banhammer. You might get away with it for a while, but eventually it's going to go horribly wrong. Remember EBay seller "Da1truehomie"? Here is his XBox profile, note the message at the bottom:

He can expect to have his score reset and be hit with a possible ban. On reflection, perhaps having the same username for both his XBox and EBay accounts wasn't a smart idea.

2) The program that so many people are sending around went a bit bonkers when it was cracked and made available for everyone to download. Namely, it doesn't unlock the achievements correctly, labels online specific achievements as having been unlocked offline and various other things that fairly scream "shenanigans".

I still say Microsoft should remove Gamerscores altogether, however. For the tiny amount of worth they bring (not much), it's greatly outweighed by the desire of scammers to both obtain it by phishing and inflate it by hacking. Stolen XBox profiles are now big business, and you can typically expect to pick up an account with a credit card attached to it for as little as $4.

The act of Gamerscore tampering also pretty much makes legitimate gamerscores even more worthless than they are now - spent three years building up your total via hours of gameplay? Too bad, that large collection of guys over there unlocked six billion points in a week. It also presumably makes it much more difficult for game developers to keep track of statistics such as these (stats which many companies often use to tweak difficulty settings in future releases), so everybody loses out.

Bragging rights - who'd have thought they'd cause so much trouble?

Click to Enlarge

We're seeing quite a lot of fake websites at the moment that claim to offer "free" Microsoft points in return for you logging in with your account details. You know the drill. It's unusual to see so many appear in a short space of time, so one would guess there's a bit of a group effort taking place here. Here's a list of some of the sites we've seen so far, we'll keep updating as we get them:

freemicrosoftpoint5.blackapplehost.com/signin.php
cbeezy09.blackapplehost.com
mspgiveaway.blackapplehost.com
dakhaoskiller.t35.com
undergroundpoints.t35.com
mspoints4nout.t35.com
freexblmsp.weebly.com/index.html
star3461.webs.com/mspoints.htm
mdc2u.net/Xbox/
freewebs.com/free1600micros2/form.htm
h1.ripway.com/microsoftpointsnow/
h1.ripway.com/liamh/test.php
h1.ripway.com/live4free/login.html
loginlivebbtxt.t35.com/login.2rboombang/login.srf.htm
4000-msp.blackapplehost.com

In all cases, someone "found an exploit", or "came up with a script", or "created a program" - my favourite so far is this one:

Not so long ago, I wrote about XBox Live Chain Letter Spam, and how it suddenly seemed to be the cool thing to do. Well, here's an interesting example of how unfounded rumours + pretty pictures = hours of wasted fun for all the family.

Halo 3 is one of the biggest titles on the XBox console - if you've never heard of the game, click here while the rest of us wait for you.

All done? Good.

One of the most intriguing features of the game is the ability to save screenshots & videofiles to allocated storage space provided by the game maker, then share those files with other gamers. It didn't take long before people started to abuse this system through a combination of believing anything they were told and the desperation produced by wanting something (almost) nobody else has.

The rare item in question here would be Halo 3's mythical "Recon Armor" - an insanely rare item given only to Bungee employees and people who perform near miraculous (or just stupidly impressive) feats ingame. To give you an idea of how coveted this ingame item is, here's a 583 page thread (!) dedicated to finding out how to get your hands on it.

Anyway.

It didn't take long before some jokers decided to make this armor the "feature" of endless chain letter spam taking advantage of the file sharing functionality.

Your XBox Live account can send and receive messages to other users, much like the PM system of a forum. Quite a lot of people - those who play Halo 3 all the time and those who have never touched it in their lives - will have been sent a message like this over the past couple of months, entirely out of the blue:

Note at the bottom it says "Check out this film clip". If you hit the "Go to" link, you'd sit through thirty seconds of pointlessness and wonder why you'd bothered, or (if the link was for an image) you'd be left with a pretty (but pointless) picture.

What were the film clips? Well, I can't show you those but I *can* show you the image spam, and once you see them this will all make sense:

"If you recommend this to 50 people, you get Recon Armor".

As you probably already guessed, spamming these images to 50 people does NOT get you recon armor. It does, however, make you remarkably unpopular. There are a lot of variations on these image spam messages, here's another one:

"Recommend this to 100 people to get Crystal Armor".

Well....as long as it's crystal.....

It seems an endless wave of chain letter messages are starting to annoy people.

You'd think it would be pretty easy for Microsoft to block communications with "900" in them, but apparently not...

If you use Facebook, Myspace or any other Social Networking site you'll no doubt be familiar with messages like this and this. typically, they all involve sending them to an endless stream of participants, lest you suffer bad luck in the form of being hacked, losing your job, dying horribly or being stalked by vengeful ghosts for the rest of eternity.

Of course, it's all nonsense.

Well, illustrating that you're not safe from these kind of chain letters regardless of which digital domain you happen to use, here we have multiple instances of chain letters making their way to the XBox Live gaming network.

Over the past few days, large amounts of people are reporting being sent messages from both friends and complete strangers over the XBox Live messaging system that contains nothing other than this:

Today we came across a collection of approximately 270 sets of login details that have apparently been Phished via a fake XBox Live login page. The list, some 27 pages long in Word format, would allow people to access stolen XBox Live accounts, some of which may have credit card details stored against them (along with other forms of personal information, of course).


Click to Enlarge

The list itself is actually around 300 or so entries, but it seems some of it is duplicate and / or obviously fake data, entered by people annoyed at the Phishers the list has come from (as a side note, I should add it's never a good idea to enter fake info on Phishing pages - it not only makes it harder for people who wade through this info looking for victims to contact, it also opens you up to potential retaliation attacks from the Phishers).

An additional "bonus" of grabbing Live ID data is that you can use it to check out EMail accounts associated with it - not a great situation, and one of the reasons I've never been too keen on "one login to rule them all" situations. We've already seen some people boasting on forums about the info they've pulled from various EMail accounts associated with the list - how quickly "stolen XBox account" becomes "stolen everything else".

This list seems to be in circulation on a number of hacking forums; the majority of the accounts were phished between November and December of last year. Despite the relatively long time that's elapsed since the data was first collected, a lot of the accounts still seem to be accessible based on comments we're seeing on those underground sites. It seems someone might have put their personal stash on "general release" to gain some kudos with others.

We've passed the stolen data onto Microsoft, and we're sure they'll move swiftly to lock down the accounts involved.

Click to Enlarge

In the past few weeks, we've noticed a steady increase in posts like this and this. Everywhere you look, people are suddenly curious as to how you "boot" someone from online videogames. They're not entering this rather famous joypad combination to do it - rather, they're dabbling in somewhat more sinister methods of tampering with gamers playing on XBox Live.

Namely - Botnets. In a big way too, from the looks of things.

What is XBox Live?

Xbox Live is an online multiplayer gaming and digital media delivery service created and operated by Microsoft Corporation. Pay for a Live account, and you can shoot other gamers online all day long on Halo 3, or maybe download some premium content such as movies, trailers etc.

Live has long been the subject of social engineers and hackers - fooling people into handing over their logins and making fake Points generators stuffed with Trojans and keyloggers to steal login info has been going on seemingly forever. There is another area of Live exploiting that's not been looked into much - that of "booting" other players from games via external means.

How is this done?

Well, typically someone will connect their XBox to their PC via a crossover cable (or via their wireless connection), join a multiplayer game then sniff the traffic (you can see a tiny example of that from the first screenshot at the top of the article). They might use this method to grab ip addresses (though it can be a little over complicated for the wannabe hacker), or they might resort to social engineering tactics away from the gaming environment. However they go about it, they need an ip address if they intend to boom, headshot their victim.

In this case, we have something rather interesting that's quickly becoming mainstream after spending a long time in the underground - combining custom made tools to create Botnet drones, specifically created to knock XBox Live gamers out of whatever game they happen to be playing at the time.

The bundle currently doing the rounds is pretty slick, and combines two tools distributed in a single AIO - it actually sits in the system tray (first icon on the left) until you feel like exploring it further.



Here's the two applications that work the "Magic" in this particular package, when you get tired of looking at the nice icon in your system tray:


Click to Enlarge


Click to Enlarge

Both of these programs pretty much do the same thing - facilitate the ability to DDoS people from the XBox Live network (note the default port for both programs is 3074, which is required to be open for XBox Live to function).

How do they do it?

Well, the bundle comes with two "vanilla" Bots:



...although really, the Bots can be anything you like. You don't have to use the supplied files, though of course this is designed to be a DIY-in-minutes kit (humorously, both files point to a pre-existing Botnet so anyone foolish enough to run these EXEs while trying to create their Botnet empire is going to find themselves a drone for the original creator).

After creating a host with a service such as no-ip.info that points to your own ip address, you insert that host into the ready-to-roll code in the Bot file. At that point, all you need to do is send your victims the EXE, convince them to run it on their PC and they'll start reporting back to your Booter program as willing DDoS drones. Here's a (somewhat blurry) screenshot lifted from a popular Youtube video currently in circulation of an attack in progress on an XBox gamer:



As you can see, the attacker "only" has four bots, but the instructions that come with the programs tend to advise "between forty and sixty". This is now, as you might imagine, all the rage.

The big incentive here, of course, is money. There seems to be quite a lucrative market for angry gamers looking to get revenge on whoever happened to headshot them the day before - we have some screenshots of sites where these "XBox DDoS Botnets" can be created from scratch for paying customers, along with a nifty price list to get things moving.

As I said earlier, some of these tactics and techniques have been around for some time - but you only need to take a quick look around hacking forums and sites such as Youtube & Yahoo Answers to see this is rapidly becoming more and more interesting to angry 14 year olds with too much time on their hands.

What can you do about it?Well, sadly for now the answer is "not a lot". You can never be sure when playing online just who has their finger on the trigger ready to nuke you from orbit with a Botnet DDoS. The problem will only get worse as money keeps changing hands and suddenly every rage fuelled gamer who had a dream of really getting even suddenly has the power to do so even after the "Game Over" screen has flashed up.

Perhaps the best solution is just to let that annoying fourteen year old claim his headshot and go back to playing chess...

Writeup: Chris Boyd, Director of Malware Research
Additional Research: Chris Mannon, Sr. Threat Engineer

This XBox Live phish attempt caught my eye:


Click to Enlarge

It's a lot better looking than many of the others I see, and the phisher took the time to make a fake screenshot to impress you with all the fake money he (doesn't) have. The most interesting thing about it for me is that it references another domain ("Runeflux.com"). Usually they're pretty anonymous.

Anyway, I decided to check out the domain - there's nothing there, could it have been taken down? Well, a quick search later and we have this (rather well edited) Youtube video. Apparently the domain simply hosted the same phishing page, so yes - it's a fair bet someone had it taken offline.

The important part is when you check out the profile of the person who owns the account:




Yes, our phishing friend is only 14. I've had quite a bit of experience researching people at the younger end of the age spectrum involved in this sort of thing, and I have to say the basic mechanics of "how to phish" are all in place with this kid.....slick websites, Youtube promotion, little touches like fake screenshots....it's all there.

Worrying, isn't it?

Anyway, the URL to avoid here is

h1.ripway.com/microsoftpointsgen/

There are many Microsoft XBox Live scams out there - many involve increasingly sophisticated "fake points generators" (which claim to produce "free" Microsoft points used to purchase downloads and other items, only to steal your login details).

However, some are so amazingly breathtaking with regards what they ask the end-user to do, it's somewhat miraculous anybody would actually fall for them.

This is one such scam, currently doing the rounds on Youtube. Our video begins:

"After all, I am a member of the press and therefore have received some preferential treatment on this matter" - Dan Hsu, IGN

Well, that might explain why he had the police and the FBI all over his stolen XBox Live account. Definitely worth a read though, and the Top Seven Tips make up for the whole "preferential treatment" thing:

1. Don't answer your secret question with the real answer. Instead, select something completely unrelated (for example, First Pet = Will Tuttle) that you can remember, effectively giving you a second password.
   
2. In the "address 2" line of your profile, put down: "XBOX SUPPORT DO NOT ASSIST WITH ACCOUNT RECOVERY" to help automatically raise a red flag when a customer support rep looks up your account.
   
3. If you're planning on gaming away from your default console, put your account on a memory card or move it with your hard drive, as opposed to recovering it on another machine.
   
4. Never reveal any personal details about yourself while gaming over Xbox Live.
   
5. On that same note, go ahead and leave your profile's bio blank. No need to tell everyone where you live.
   
6. Limit the amount of information you put out there for everyone to see on social networking sites...or any website for that matter. Especially ones where you also have your Gamertag listed.
   
7. Create an Xbox Live passcode if you haven't already. To do this, select "My Xbox" on the Xbox dashboard and go to your profile, then go to "Account Management" then "Xbox Live Pass Code."

If you have an XBox Live account, be on the lookout for this.

In every case I've ever seen, when someone offers you "free" goodies for something related to XBox live you should give it a very wide berth unless it's something official from Microsoft. I personally don't even bother with official third-party offers - I go straight to Microsoft for anything, and if they don't have the particular amazing offer that I happen to see available directly from them, well, too bad for me.

Here's an example of something you should avoid entirely unless you want your account details stolen.

Called the "Microsoft Point Generator", the end-user is fooled into thinking they can create their own Microsoft Points by simply entering their Windows Live ID and Password into the sections provided: