Recently in Videogames Category

Since the highly publicised wave of console bans for anybody found pirating XBox games (and, to a lesser extent cheating on the XBox Live network) there seems to be a rather popular item appearing all the time on sites such as EBay.

Shall we see what it is?

Let's fire up EBay, and see how early a suggestion appears for the item we're looking for:

xboxwar1.jpg

...oh dear. Why would people buy a warranty sticker for a games console? Simple:

4xboxwar0.jpg

Nobody is going to take your console as a "broken" return from the place you bought it when the warranty is screaming "leet hax", right? Warranty sticker sale waves seem to come and go on trading / selling sites, but they seem to be coming back into fashion at the moment. Here's a few samples:

4xboxwar3.jpg

As you can see, a reasonable moneymaker for the seller. I particularly like the text on this one:
xboxwar2.jpg
Click to Enlarge

That's right, a sticker for your COLLECTION! I guess these are the new Pokemon cards.

Here's one final batch - appearently these are the newer type of warranty sticker, which greatly increase your chances of getting a new console out of the store you bought it from (instead of them hitting you with the "cheater" stick and chasing you out of the building).

xboxwar4.jpg

I'll stick with Pokemon, I think...

I've talked about Botnets used to kick gamers out of sessions before, but I thought it might be interesting to check out some of the current pricing, along with a few other things.

Botnets and Gaming - wha?

People have been using various means to lag people out of games for many years, but it had always been a PC thing. The moment online console gaming took off, somebody realised most console gaming sessions were peer to peer (which meant IP addresses were easy to grab), combined Botnets with moneymaking and rolled out an unstoppable army of teabagging and headshottery.

How?

It all depends on the game. Most online console games offer up rewards for progressing through the ranks, be it additional items, weapons, outfits and / or levels.

Stolen high level accounts in games such as Halo themselves fetch a tidy sum on the black market (would anybody have seriously thought a stolen gaming account could pull in as much as $25 a few years ago?) but the art of "host booting" has turned into a bit of a money spinner.

There are three main types of lagging a game out, and depending on how the game works various types will be deployed or blended to ensure the attacker wins the game and levels up.

1) Lag switching. A lag switch can be picked up for around $20, and if you've ever been in a game that appears to be frozen while the other team happily runs around shooting you this is likely the culprit. Quite common, unfortunately.

2) Host forcing. More often than not, many games come down to who happens to be hosting it. To ensure the hosting advantage (which may or may not be debated endlessly by those who refute being pwned by something as basic as "my connection wasn't as good") the art of "host forcing" was born. Typically, a combination of various programs are used such as Zone Alarm, Commview and custom built programs such as this one:

ekksbawks2.jpg

....to discover the IP addresses of the players, and start throwing them into various "Trusted zones" (which then leads to the not-entirely-sophisticated process of, er, waggling sliders up and down rapidly in Zone Alarm. Nobody ever said this was an elegant solution). That "ION" program has been around since the days of Halo 2, by the way.

Once you have the host, the theory is that you have a slight advantage over the other players because you have no lag. However, this isn't enough for the cheaters so what they'd do is hit the "standby" button on their router and when the game would come back (after lagging all over the place) everybody bar the host would still be lagging. This would result in lots and lots of headshots with a fair amount of swearing from the others in the session.

Worse, in addition to single players doing this, whole teams can bridge their connections and attempt a "team standby", where one team is fine but the other is doomed.

Not very nice, but there you go.

3) DDoS Host Booters. These are probably the worst of the three tactics on offer, and involve custom made programs that target specific players, then knock them offline via a dedicated Botnet. This is no different to someone aiming a regular Botnet at your home connection.


host booter, originally uploaded by Paperghost.

As already mentioned, most console games are peer to peer and because you can use Internet Connection Sharing with an XBox console, it's the easiest thing in the world to grab some IP addresses and have some "fun". Because the attacks target the player rather than XBox Live itself (which would likely be a futile effort) it's quite difficult to do anything about it.

Many saw an opening for money making with this technique, because there are no end of technologically clueless (but very angry) gamers out there who want to get even.

Want to DDoS someone, win that online session and move up a rank or three? No problem, pay us and we'll create a custom built DDoS Low Orbital Cannon to clear out the noobs. Some games punish players / teams that leave a session early, removing experience points and / or awarding the win to the other team which makes this technique rather appealing.

Although getting on a bit, the below pricing structure is pretty much what it is now:

ekksbawks1.jpg

$5 for a Bot, with nothing else. This is the option for those who already know what they're doing and have a Booting program ready to roll.

$10 for a Bot AND a Booter, for those who have no idea which Booter to pick. You're not going to kick many people out of Halo 3 with one Bot, however, so from there it's $2 per additional infected computer added to your Botnet of Doom.

$5 extra is needed if you want them to go dabble with your network / Firewall, and it's $20 if you want them to remote into your PC and set EVERYTHING up for you. Also note that they'll put a fake icon onto the infection file they're trying to nail people with on your behalf - I suppose paying up is in your best interest if you want them to infect as many people as possible.

Some charge per game and / or rank in a particular game, rather than per Bot because hey - they're just that nice, and (more importantly) they figure once you've set up your Botnet for someone you probably can't get anymore money out of them. Keep control of the Botnet, however, and you'll have money rolling in for as long as the buyer wants to DDoS gamers.

ekksbawks3.jpg

Dedicated Host Booting sites that contain both Booting programs and tutorials are a relatively new addition to the ranks, but they're definitely growing in number. Here's a membership sample from one of the more recent portals:

host booter community.png

Worryingly, there are rewards for promoting those communities:

ekksbawks4.jpg

Free Bots? Yep. I've seen one or two sites offering up to as many as 30 or 40 free Bots in return for spreading the word. It's interesting how console gaming is becoming a bit of a driving force for individuals racing out to infect computers, and I don't think the situation will improve anytime soon...

Fake Program Is Fake...

| | Comments (0)
Throw another fake program that claims to "hack" XBox Live accounts on the pile:

fakebawkz1.gif

If you ever run anything like the above on your PC, the only thing you'll hack is yourself.

Don't do it, kids!
Not so long ago, I wrote about a site called megasecuredownload.com, which faked a bunch of AV scans so you'd download their file, run it and have yourself a very bad day.

There's another site currently being promoted on video sharing sites such as Youtube, aimed squarely at owners of Playstation 3 consoles.

As ever, it's a case of "something for nothing". They're pimping Playstation network $20 generator programs that look like this:

psnfakezgenz1.jpg
Click to Enlarge

The site this time around is safetransferonline.com, and looks identical to the site covered here (complete with fake "this program is safe" AV results):

Megasecuredownload.com, originally uploaded by Paperghost.

You definitely won't end up with anything as awesome as a free money generating program, so feel free to stick this one on your ever growing blocklist...
mw2dontgetbanned.jpg

All XBox owners have a list of most recently played games set against their profile. As you might have guessed, every game has a unique ID assigned to it so Halo 3 doesn't accidentally show up as The Amazing Adventures of My Little Pony.

Well, like most other things related to the console it can be hexed, modded and generally given a bit of a fiddling. I've seen a few furtive mentions of this in the backroom areas of certain leet forums, so this might not even be doing the rounds yet. But hey, a little advance warning never hurt anyone.

Let's take a look at the scam, it's a pretty clever one.

1) Phisher tampers with their data and makes it look like Modern Warfare 2 - which isn't out until November - shows up in their recent games list. Note the big number "2" in the below image, complete with handy red box just so you know exactly which icon I'm on about.

fakemodernz010.jpg

2) Phisher then trawls around various forums and websites touting access to the "Modern Warfare 2 Beta" - and of COURSE it exists and they have played it, because it wouldn't be in their recent games list if they hadn't. Right?

3) Phisher then asks you for your login details in order to "gain access". All that's actually going to happen is you lose your account to a scumbag.

I've already seen quite a few accounts (including the one above) hit with various degrees of banhammer for altering their recent games list, so hopefully that'll kill a few phishes off before they're even launched. In the meantime, know this: there is currently NO beta planned for this game, and in all probability there won't be one.

Don't be suckered in!



This is a step above the usual phish attempt we see here, with a number of bits and pieces that build up a pretty convincing fake website. As you probably guessed from the title, the phish involves the upcoming juggernaut that is Call of Duty: Modern Warfare 2, and the endless desire some people have to take part in a beta.

The URL to avoid is

freemw2beta36.tk

and the page itself is hosted at

freemwbeta36.t35.com

Want to take a look? Sure you do.


Modern Warfare 2 Beta Phish, originally uploaded by Paperghost.

What does this phish do that sets it a way above other phish attempts? Well, for starters it looks quite professional. Top left, they use the kind of info splash you normally see on an official XBox page. On the right, there's a media section with screenshots you can actually click into. Might not sound like much, but most phishes like this one don't have anything clickable in that whatsoever. Bottom left, they've embedded a real Youtube video that you can watch to your hearts content. Right at the bottom of the page, they've included a copyright notice - something else phishers tend to lose in translation.

All in all, pretty convincing.

The only real flaw with this phish is that there is currently NO public beta planned, and it's highly unlikely there will ever be one. Don't get suckered into handing over your Windows Live ID, as no good will come of it.
A while ago we wrote about multiple friend requests made on the XBox Live network with the aid of PC based spamming tools. Well, if you try any of those shenanigans now you'll see this:

blockstopped1.jpg
Click to Enlarge

I'd call that a result!

Gamertag Exploit Rumbles On

| | Comments (0)
Back in August we reported that individuals were changing their usernames in gaming sessions to impersonate Microsoft staff and game developers, grabbing login details from unsuspecting victims. It seems the problem is not only taking place, but now comes with an interesting addition - the hackers have now found a way to play on the XBox Live network for free while using the above exploit.

Whoops.

The "playing for free" thing is a new one on me, but I'm a little surprised Microsoft haven't fixed the ingame namechanging yet - this has left users open to social engineering for a number of weeks now. Fingers crossed they put this one to bed for good...

Guns, lots of guns. Well, two., originally uploaded by Paperghost.

Next month - October 6th & 7th - I'll be at the Sector.ca Conference, talking about a subject close to my heart: how lots of rather naughty people are using consoles to both cheat the system and attack other users, via spam, DDoS and account theft. Is it abstract extract time?

I think it is.

Game Over, Man: Gamers Under Fire - Chris Boyd

An exploration of security issues relating to consoles and their risks to both home users and the business environment. This will include issues such as custom built DDoS tools, social engineering of Microsoft support staff, account theft, the risk to businesses and personal tips to keep your own details secure. I'll also examine the trade of stolen Xbox accounts in return for credit cards, how the rewards that companies give gamers make them targets because of inadequate privacy features and how free programs allow hackers to exploit profanity filters, paid content and even the profiles themselves.



As you may know, I've spent a lot of time digging around script kiddy forums. By and large, most of what I see isn't very impressive. However, for a while now there's been an interesting offshoot of hacking forums, with entire sections devoted to console hacks and attacks. There's an impressive amount of technical knowledge and skill going into the creation of hacking tools for consoles, hacking the console itself and doing all sorts of horrible things to the people that use them.

Some of the techniques used to turn an otherwise harmless lump of content restricted plastic - whose very soul is supposedly on the leash of the company who made it - into something you can spend all day annoying somebody with never fails to amaze me.

How many companies now have gaming / recreation rooms with a console just plugged in and left to its own devices? How many parents mistakenly think the worst thing that'll befall their kid is seeing someone get their head blown off on GTA4?

They're all accidents waiting to happen, and the general promotion of consoles as these "unhackable, unsinkable" battleships of gaming is something that needs to be examined in greater detail.

It's not just PCs under fire anymore...
Remember this spamming program? It seems someone decided they really needed MORE SPAM EVERYWHERE. With that in mind, a modified version of that application now lets you send infinite spam messages to up to four people at once.

spmz10101.jpg
Click to Enlarge

I've heard somebody devided to go one better, and there's now a tool that spams five lucky individuals. Wonder when we'll hit double figures...

Pages

About this Archive

This page is a archive of recent entries in the Videogames category.

Twitter is the previous category.

Worms is the next category.

Find recent content on the main index or look in the archives to find all content.