EVE Search - My account got hijacked - help me find the culprit.

All Channels

EVE General Discussion

My account got hijacked - help me find the culprit.

» Click here to find additional results for this topic using Google

Monitor this thread via RSS [?]

Pages: 1 2 :: [one page]
Author	Thread Statistics \| Show CCP posts - 0 post(s)
Sieessenschwanz	Posted - 2009.01.12 17:59:00 - [1] Edited by: Sieessenschwanz on 12/01/2009 18:14:29 Back around august or so I canceled both EVE accounts and went on with my life. Last week I get an email from a friend from my EVE days saying he'd seen my main online. This came as a shock to me because my account had been inactive for more than 3 months. So I try to log in only to find out upon trying to reset my pass that the account was banned. So I petitioned it and eventually learned that someone else had gained access, and reactivated it (!?) for the purpose of cleaning it out. I reactivated to assess the damage and see what I still had. Turns out very little. I had 5M in cash, no ships of value and my high grade talisman set clone had been carefully podded. I think I know who did it, and how. I'll admit straight off the bat that I could have entirely prevented it myself, but failed to. A few months back, near the time I stopped playing there was this API key based service advertised here on the forums. You had to create an account to use it and I, stupidly, used my main EVE login/pass for it. I think you can figure out what happened after that... The problem is I can't remember the URL, or even any key search words to find it. Why do I think it was them? I don't do RMTs, I'm always exceedingly careful of untrustworthy executables and the like, and my alt account was untouched. Since my alt account that was almost always used at the same time as my main, it probably wasn't a keylogger as they'd have gotten both. The name of the character that all my ISK was given to was Iimztek. Given that my account was banned while it was stolen (I don't know why), this characters' account may be banned as well. What I'm looking for is the help of you guys in finding this site. All I can remember about it was that it would show a lot of information about my characters' assets were & such and that I had to create an account to use it. It was a pay to use site (paid in ISK, not real money). edit: typo in subject
Abrazzar	Posted - 2009.01.12 18:02:00 - [2] Petition it. CCP will investigate the matter and sort things out. May take a month or two, though.
Concorduck Gallente	Posted - 2009.01.12 18:03:00 - [3] Oh cmon, you left once, do you need to come back because the account you left was banned?
Sieessenschwanz	Posted - 2009.01.12 18:04:00 - [4] Originally by: Abrazzar Petition it. CCP will investigate the matter and sort things out. May take a month or two, though. I got the account restored already (I'm posting from it). What I'm looking to do is find the culprit site. I already petitioned to try and get the assets restored (since it's painfully obvious to whom they went), but I don't expect to get anything back as CCP's policy is stated as not restoring assets lost this way.
Sieessenschwanz	Posted - 2009.01.12 18:05:00 - [5] Originally by: Concorduck Oh cmon, you left once, do you need to come back because the account you left was banned? I might come to play some day, and I'd like to have my main around if and when I do. Also, I'm a big fan of justice.
Concorduck Gallente	Posted - 2009.01.12 18:07:00 - [6] Originally by: Sieessenschwanz Originally by: Concorduck Oh cmon, you left once, do you need to come back because the account you left was banned? Also, I'm a big fan of justice. and you play EVE?
Sieessenschwanz	Posted - 2009.01.12 18:08:00 - [7] Originally by: Concorduck Originally by: Sieessenschwanz Originally by: Concorduck Oh cmon, you left once, do you need to come back because the account you left was banned? Also, I'm a big fan of justice. and you play EVE? That includes vigilante justice in some cases.
Spurty Caldari Technologic Dance	Posted - 2009.01.12 18:09:00 - [8] CCP knows all of the IPs that we log in from. There is a way to work out who OWNED an IP at that time. Only really problem is when A) owner is in a different Country, B) owner is a University / Business and NATed. Next time, chose a harder to crack username/password? oh and BACK UP ALL YOUR FILES after you have done a thorough virus scan!
Sieessenschwanz	Posted - 2009.01.12 18:10:00 - [9] Originally by: Spurty CCP knows all of the IPs that we log in from. There is a way to work out who OWNED an IP at that time. Only really problem is when A) owner is in a different Country, B) owner is a University / Business and NATed. Next time, chose a harder to crack username/password? oh and BACK UP ALL YOUR FILES after you have done a thorough virus scan! I think you missed something in the OP.
Ocih Amarr	Posted - 2009.01.12 18:15:00 - [10] CCP will get your account back. (I know this from experience) They won't tell you who had it though. And you may have inventory issues. You are SOL on that too I believe.
Gunnanmon Gallente UNITED STAR SYNDICATE	Posted - 2009.01.12 18:19:00 - [11] Originally by: Ocih CCP will get your account back. Did you read the thread? The Ghost-training vote thread
Sieessenschwanz	Posted - 2009.01.12 18:19:00 - [12] Originally by: Ocih CCP will get your account back. (I know this from experience) They won't tell you who had it though. And you may have inventory issues. You are SOL on that too I believe. I don't know how I forgot that people don't read past the thread title.
Concorduck Gallente	Posted - 2009.01.12 18:22:00 - [13] Originally by: Sieessenschwanz Originally by: Ocih CCP will get your account back. (I know this from experience) They won't tell you who had it though. And you may have inventory issues. You are SOL on that too I believe. I don't know how I forgot that people don't read past the thread title. i'll try and guess, you were playing vigilante ingame too much, and couldn'pt care less of the forums? ----------------------------------------- Originally by: Crumplecorn Contact the CSM about it, voting themselves into disbandment wouldn't be pushing the boundaries of absurdity for them.
Ocih Amarr	Posted - 2009.01.12 18:26:00 - [14] Originally by: Sieessenschwanz Originally by: Ocih CCP will get your account back. (I know this from experience) They won't tell you who had it though. And you may have inventory issues. You are SOL on that too I believe. I don't know how I forgot that people don't read past the thread title. More of an affinity case in this one. My account got taken over the holidays and I lost it for several weeks. I felt for the guy right off the shot so no, I didn't go through his entire thread. I will repeat: CCP won't tell him who did it. I will add: They can't track it back to his url anyway. I will point out: My thread was still more productive than your snappy comeback shot.
Ki Tarra Caldari Ki Tech Industries	Posted - 2009.01.12 18:27:00 - [15] Originally by: Sieessenschwanz The problem is I can't remember the URL, or even any key search words to find it. Given how reliable your memory is, why should we help you hunt for a website to slander, when we have no idea how many other sites you have forgotten that you registered with using the same username/password. If you want vigilante justice, then go after the people the ISK was sent to if the GM's haven't already banned them.
Concorduck Gallente	Posted - 2009.01.12 18:28:00 - [16] Originally by: Ocih I will point out: My thread was still more productive than your snappy comeback shot. Originally by: Ocih I will point out: My thread was Originally by: Ocih My thread Originally by: Ocih thread Pointing out your post
Ocih Amarr	Posted - 2009.01.12 18:33:00 - [17] Originally by: Concorduck Originally by: Ocih I will point out: My thread was still more productive than your snappy comeback shot. Originally by: Ocih I will point out: My thread was Originally by: Ocih My thread Originally by: Ocih thread Pointing out your post My reply then, Mr. Forum cop. How does CCP **** taste anyway?
Sieessenschwanz	Posted - 2009.01.12 18:39:00 - [18] Originally by: Ocih Originally by: Sieessenschwanz Originally by: Ocih CCP will get your account back. (I know this from experience) They won't tell you who had it though. And you may have inventory issues. You are SOL on that too I believe. I don't know how I forgot that people don't read past the thread title. More of an affinity case in this one. My account got taken over the holidays and I lost it for several weeks. I felt for the guy right off the shot so no, I didn't go through his entire thread. I will repeat: CCP won't tell him who did it. I will add: They can't track it back to his url anyway. I will point out: My thread was still more productive than your snappy comeback shot. I don't know what thread you're talking about. I don't care either.
Sieessenschwanz	Posted - 2009.01.12 18:40:00 - [19] Originally by: Ki Tarra go after the people the ISK was sent to if the GM's haven't already banned them. I'm perusing multiple tactics.
Ocih Amarr	Posted - 2009.01.12 18:45:00 - [20] Originally by: Sieessenschwanz Originally by: Ki Tarra go after the people the ISK was sent to if the GM's haven't already banned them. I'm perusing multiple tactics. I can tell you right now, you aren't getting your stuff back. Any action taken will be action taken by CCP and not you. You don't 'own' anything in EvE. Sorry you got burned. While you are hatefull, I can undertand why. It's futile. Sorry.
Kaar Art of War Exalted.	Posted - 2009.01.12 18:49:00 - [21] API log should have the IP of the site you used, if it was done remotely.
Pen Dulum	Posted - 2009.01.12 18:54:00 - [22] Originally by: Concorduck I reckon you should petition you're name to Concordcck. Every thread i look in on the forums you're in it being a **. Seriously is this ALL you do EVERY day ? sitting in you're arm chair reading thread after thread then posting in it being a complete **.
Jacob Mei	Posted - 2009.01.12 19:07:00 - [23] Bummer to hear OP and I wish you luck in your vendetta however short of getting the URL and shoutting from a mountain that the site is a scam site what do you hope to accomplish?
Shirley Serious Amarr Imperial Academy	Posted - 2009.01.12 19:08:00 - [24] you could try looking on eve-search for your main's posts.
Concorduck Gallente	Posted - 2009.01.12 19:10:00 - [25] Originally by: Pen Dulum Originally by: Concorduck I reckon you should petition you're name to Concordcck. Every thread i look in on the forums you're in it being a **. Seriously is this ALL you do EVERY day ? sitting in you're arm chair reading thread after thread then posting in it being a complete **. i usually play EVE too
Sieessenschwanz	Posted - 2009.01.12 19:15:00 - [26] Originally by: Kaar API log should have the IP of the site you used, if it was done remotely. Unfortunately the log doesn't go that far back. Thanks for the idea though.
Sieessenschwanz	Posted - 2009.01.12 19:17:00 - [27] Originally by: Jacob Mei Bummer to hear OP and I wish you luck in your vendetta however short of getting the URL and shoutting from a mountain that the site is a scam site what do you hope to accomplish? I'm not sure yet. It depends on what information I can get.
Sieessenschwanz	Posted - 2009.01.12 19:19:00 - [28] Originally by: Shirley Serious you could try looking on eve-search for your main's posts. One of the first things I tried, they never used it to post. The cultprit just spent two days selling all my stuff, threw away a dominix, got me podded, and then sent over half a billion of my ISK to another character.
3rr0rc0d3 Amarr	Posted - 2009.01.12 19:32:00 - [29] Originally by: Sieessenschwanz used my main EVE login/pass for it That's where you messed up. Anything else?
Shirley Serious Amarr Imperial Academy	Posted - 2009.01.12 19:35:00 - [30] Originally by: Sieessenschwanz Originally by: Shirley Serious you could try looking on eve-search for your main's posts. One of the first things I tried, they never used it to post. I meant maybe you'd posted about the API service or something.
Sieessenschwanz	Posted - 2009.01.12 19:36:00 - [31] Originally by: 3rr0rc0d3 That's where you messed up. Originally by: Sieessenschwanz I, stupidly, used my main EVE login/pass for it Originally by: 3rr0rc0d3 Anything else? Originally by: Sieessenschwanz help me find the culprit. Quoting phun!
Basil Yer Gallente Dark World Industries	Posted - 2009.01.12 20:31:00 - [32] Good luck with your investigation.
Sieessenschwanz	Posted - 2009.01.13 14:43:00 - [33] Originally by: Basil Yer Good luck with your investigation. Thanks!
Myrhial Arkenath Ghost Festival	Posted - 2009.01.13 14:55:00 - [34] http://www.eve-commander.com/? Apologies in advance to the owner of said website if this is not the one.
Sieessenschwanz	Posted - 2009.01.13 15:26:00 - [35] Originally by: Myrhial Arkenath http://www.eve-commander.com/? Apologies in advance to the owner of said website if this is not the one. I think that was it actually. Only non-official eve related site I signed up for that I wasn't the admin of.
Digital Solaris	Posted - 2009.01.13 15:51:00 - [36] Originally by: Sieessenschwanz Originally by: Myrhial Arkenath http://www.eve-commander.com/? Apologies in advance to the owner of said website if this is not the one. I think that was it actually. Only non-official eve related site I signed up for that I wasn't the admin of. But, if you signed up on eve-commnader.com or somewhere else, how did he, she or they get the details for your account when this site (and surely others) only needs your limited API-key unless you signed up on "random_site".com with the same name and password as you use for your EVE account. That is the only way I can see how this has happened. -god made me a cannibal to end problems like you-
Myrhial Arkenath Ghost Festival	Posted - 2009.01.13 16:00:00 - [37] Originally by: Digital Solaris Originally by: Sieessenschwanz Originally by: Myrhial Arkenath http://www.eve-commander.com/? Apologies in advance to the owner of said website if this is not the one. I think that was it actually. Only non-official eve related site I signed up for that I wasn't the admin of. But, if you signed up on eve-commnader.com or somewhere else, how did he, she or they get the details for your account when this site (and surely others) only needs your limited API-key unless you signed up on "random_site".com with the same name and password as you use for your EVE account. That is the only way I can see how this has happened. OP says that he signed up here, and used his EVE login / password for the account, together with his API key. Possibilities are that either someone behind the eve-commander website tried all login / password combo's to see if they would give access to game accounts. This is a bold accusation however. The other posibility is that a keylogger or packet sniffer got hold of the login procedure at said website and intercepted his account details like that. I am not sure what actions should be taken when an eve service website is suspected from stealing accounts. I would suggest that the OP puts this website in his petition so that the GM team can look into this. It always seemed like a very decent service to me. Diary of a pod pilot
Sieessenschwanz	Posted - 2009.01.13 16:01:00 - [38] Originally by: Digital Solaris Originally by: Sieessenschwanz Originally by: Myrhial Arkenath http://www.eve-commander.com/? Apologies in advance to the owner of said website if this is not the one. I think that was it actually. Only non-official eve related site I signed up for that I wasn't the admin of. But, if you signed up on eve-commnader.com or somewhere else, how did he, she or they get the details for your account when this site (and surely others) only needs your limited API-key unless you signed up on "random_site".com with the same name and password as you use for your EVE account. That is the only way I can see how this has happened. The site requires you create an account. Your API key is an attribute of that account. Also: Originally by: Sieessenschwanz I, stupidly, used my main EVE login/pass for it
Faife Federation of Freedom Fighters	Posted - 2009.01.13 16:42:00 - [39] hm. i had an account there, but with throwaway username/pass. i wonder if it's the owner or if the site had a vulnerability.
Digital Solaris	Posted - 2009.01.13 18:16:00 - [40] Edited by: Digital Solaris on 13/01/2009 18:22:33 Originally by: Sieessenschwanz I, stupidly, used my main EVE login/pass for it Yeah... I did pretty much skim through your post. Sorry 'bout that, but how does this turn into account theft when you practically gave the account away you silly muppet? edit: brutal statement
Sieessenschwanz	Posted - 2009.01.13 18:37:00 - [41] Originally by: Digital Solaris Edited by: Digital Solaris on 13/01/2009 18:22:33 Originally by: Sieessenschwanz I, stupidly, used my main EVE login/pass for it Yeah... I did pretty much skim through your post. Sorry 'bout that, but how does this turn into account theft when you practically gave the account away you silly muppet? edit: brutal statement I knew when I signed up that was a pretty bad idea, but due to modern libraries it's often as easy to perform user authentication (without actually storing the password) as it is to store plain text. And more secure. I just figured that's what was being done. It seems that was not the case.
Myrhial Arkenath Ghost Festival	Posted - 2009.01.13 22:18:00 - [42] I really suggest you petition the website, if only to find out if said website is to be trusted or not. I know I'm finding it rather doubtful now, but it is listed on a sticky post. It can't be that CCP will not do anything about it if they are stealing account info through a service. Diary of a pod pilot
C601	Posted - 2009.01.13 22:41:00 - [43] From that website above or enter the Full Access API Key for complete access to your character data including skills, transactions, assets and market orders. If flashing red lights don't go off..... ╦ ╦╔╗ ╔╗ ╦╔╗╔╗╔╗ ║ ║╚╗ ╠╣ ║╠╣╠╣╠╝ ╩ ║╚╝ ║║ ║║╚║║║
Lar'san	Posted - 2009.01.14 04:12:00 - [44] Edited by: Lar''san on 14/01/2009 04:14:02 Originally by: 3rr0rc0d3 Originally by: Sieessenschwanz w o r d s That's where you messed up. Anything else? Reading this thread would have been a total waste of time if it weren't for your wealth of knowledge. I'm so relieved that I took the time to find this little gem you have chosen to share. OP , good luck but your labor will likely bare little fruit. You gotta give it a shot though. EDIT : Spelling, ugh
AkRoYeR Amarr	Posted - 2009.01.14 04:21:00 - [45] Sounds like a clear case of "I sold my account and now I want it back" to me. Don't sell your accounts, keep them because eventually you will come back. kthx.
Jaina Proudmoar Caldari School of Applied Knowledge	Posted - 2009.01.14 04:45:00 - [46] You haven't lost SP. You have lost ~half a billion in assets. Buy a 60 day GTC, sell for ~660 million. Damage undone. Yes, it sucks you lost your stuff, but tbh, it's small change.
Destoya	Posted - 2009.01.14 05:33:00 - [47] Originally by: Jaina Proudmoar You haven't lost SP. You have lost ~half a billion in assets. Buy a 60 day GTC, sell for ~660 million. Damage undone. Yes, it sucks you lost your stuff, but tbh, it's small change. This. Just put in an hour or two of overtime in RL, and you will have all your stuff back
Xiao Endo Caldari Strix Armaments and Defence	Posted - 2009.01.14 05:56:00 - [48] Quote: Also, I'm a big fan of justice. This is why I'm not helping you. Even if I knew who did it (and I don't), I would not help you. Being stolen from like this is a valuable lesson for you. I suggest that you learn it. Finding the culprit and getting compensated/revenge teaches you a bad thing: it teaches you that there is a way to even the scales in a situation such as this. There is not, so forget about it. Do not focus on revenge or compensation. Instead, learn the initial lesson you were taught by the theft - account security, don't double up your passwords, common sense. Now you won't make this mistake in a place where it actually MATTERS and can HURT you - for instance, internet banking, or your credit card. You should be grateful and thankful, and happy that this theft happened in a virtual world (that you weren't even actively participating in!) instead of the real world. Other fools are not so lucky as you.

Pages: 1 2 :: [one page]

COPYRIGHT NOTICE
EVE Online, the EVE logo, EVE and all associated logos and designs are the intellectual property of CCP hf. All artwork, screenshots, characters, vehicles, storylines, world facts or other recognizable features of the intellectual property relating to these trademarks are likewise the intellectual property of CCP hf. EVE Online and the EVE logo are the registered trademarks of CCP hf. All rights are reserved worldwide. All other trademarks are the property of their respective owners. CCP hf. has granted permission to EVE-Search.com to use EVE Online and all associated logos and designs for promotional and information purposes on its website but does not endorse, and is not in any way affiliated with, EVE-Search.com. CCP is in no way responsible for the content on or functioning of this website, nor can it be liable for any damage arising from the use of this website.