I didn't get hacked.  I don't even have an account.  But I was in Beta.  And I did get an phishing email today pretending to be Trion.  I have no clue how anyone got that email address.  I only gave it to Trion for beta signup.  Maybe they have been compromised. 

Originally posted by Swanea

Originally posted by EbonHawk

Hey fellow gamers...

Don't know if ya know this or not but in Windows Vista and Windows 7 at least there is a little trick that can pretty much defeat any Keyloggers.

All ya gotta do is go to your "Start" menu and type "osk" (without quotation marks) and bam! there you go an On Screen Keyboard that you use your mouse to type your password. 

Undetectable by the keyloggers...

Hope that helps...

You're lucky you gave some good info there, otherwise I would have the mods ban you for such an avatar.

 

Oh yeah, and just like with WOW, don't be silly about downloading stuff off the web and then wondering why you got keylogged!

What's wrong with his avatar?  I like it!  Go Hawks!

Originally posted by Ad-am
It's not really the players fault. To this day I still can't figure out how my WoW account was hacked by a gold seller. I had 2 antivirus programs on my comp too. Never ever ever bought any gold but did visit a few wow related info sites....thankfully I was able to get it recovered but totally had to change my battle net address, passwords, etc. Now I change passwords every so often. Somewhere somehow I was key logged.

...or you trusted the wrong friend/relative with your account info.

There has been quite a number of Rift oriented trojans popping up on torrent sites lately as well.

Originally posted by RiftFan

[...]

That is one option. Another option is have you download this awesome dps parcer I just came up with and have you do the work for me. I think Riftjunkies has maybe the only trust trust worthy one out there if you insist on using a damage meter.

 [...]

 

So, a parser that has been out for the EQ2 community for 6+ years without any such complains, is not trust worthy?

 

I'm refering to ACT, which is also used as damage parser for Rift.

Originally posted by Renoaku

The most common type of Key logger though is from Add-on interface customizations which is how my WOW account got compromised 3 times in a row before. This was done from an add-on which I downloaded from curse gaming,

 

Sorry for your pain though I do hope you at least appreciate the irony.

Please post updates regarding security in this thread. Discussion is also welcome.

 

Latest updates:

Coin Lock goes into effect 3/17

 

I had my bags hacked two days ago and I still haven't recieved any help from Trion. I've been trying to rebuild my character, but now I'm kinda worried that they ight just try to roll back my toon, which would make me losr several days worth of XP, money and items : (

Well my account just got hacked as well.

The sad thing is that I remember many other alpha testers 

criticizing TRION decision to change from account name to email address.

Now I know why

obvious coin lock updates going through tonight

 

Please note there are some additional changes going out to the EU servers tonight on top of the 1.02 update that went to NA servers this morning. NA servers will receive these updates in a hotfix tomorrow morning:

* Characters cannot be deleted while an account is Coin Locked.
* Cleaned up a case where Satchel of Guardian Spoils or Satchel of Defiant Spoils could turn up empty at certain levels.
* Fixed unlocking of Expert Dungeons that were taking an additional day to unlock after the NA daylight savings time change.

 

http://forums.riftgame.com/showthread.php?128611-**-Incoming-EU-Server-Update-1.02-2-00am-GMT-3-18-11-**&p=1733815&viewfull=1#post1733815

Latest update:

A Message from Trion Customer Support

http://forums.riftgame.com/showthread.php?108133-A-Message-from-Trion-Customer-Support

---

Originally posted by RiftFan

---

Originally posted by Ad-am
It's not really the players fault. To this day I still can't figure out how my WoW account was hacked by a gold seller. I had 2 antivirus programs on my comp too. Never ever ever bought any gold but did visit a few wow related info sites....thankfully I was able to get it recovered but totally had to change my battle net address, passwords, etc. Now I change passwords every so often. Somewhere somehow I was key logged.

---

It really is the players fault. People could not live without dps meter so they downloaded 3rd party programs with bad protection and got owned by key loggers.
Some people not using the official patcher for whatever reason and basically installing key loggers.
I can't blame some people for wanting soul calculators and visiting sites to get it, but those sites were hacked.

---

Here's the thing. I'm not sure how much it applies to Windows 7 or Vista, but for XP it's valid.

For most consumer computers that sit behind a small router, there are two routes of entry onto your system. Your web browser and your email (if you use a separate email program).

If you log into your computer and your account has Administrator privileges (the default), then it doesn't matter what kind of AV software you have. If you run across something new that the AV software doesn't have a definition for, it will get downloaded and executed on your machine with Administrator privileges. That means it can root your system and you're boned. Worse, somebody has to get infected somewhere before the AV software can get updated.

Locking down email is up to the user - do not click on links, do not download attachments. Most AV software should protect you from these types of things, but some things still get through.

Locking down your browser is a little harder, and comes with some inconveniences to make it "safer". I use Mozilla Firefox with the 'No Script' and 'Flash Block' extensions. This allows me to block active scripts and Flash animations on web pages. Active/Javascript and Flash are the two primary methods that can be used to get into your system. Stopping them from executing in the first place will disable the primary method used to get things onto your computer. No Script allows you to selectively enable Active/Javascripting for sites you trust. This is because the scripting on say, CNN.com is probably safe, but the scripting coming from advertising sites or click counting sites may not be safe. You can enable only the stuff you trust. The Flash Blocker requires that you actually click on a Flash animation for it to start working. You Tube takes one extra click to watch a video and isn't a big deal.

Finally, when you log into your computer, use an account that is a limited user. If something does get into your system, this limits the damage it can do. Keylogging becomes very difficult without system level access. You are still at risk, but you've limited the damage. This does come with some inconveniences though, since you have to run things as an Administrator account to install them, and if the installer is an .MSI file, you'll have to log in as an Administrator to run the MSI to install the application. If your game has an updater, you'll have to run the game as an administrator to do updates. Some games refuse to run without Administrator privileges. This is because they run Anti-Hack software that essentially roots your system. I generally don't play those games. It's a trade off I can live with. Others' mileage may vary.

From what I've heard from Windows 7 users, there are additional protections in place and it runs web browsers with limited permissions whether your account is an admin or not. The 'No Script' and 'Flash Block' are still recommended with Windows 7.

2 days old but worth showing

http://forums.riftgame.com/showthread.php?131497-Weekend-Security-Update&p=1761013&viewfull=1#post1761013

03-19-2011 03:03 PM

Hi, everyone -- I wanted to get an update out for the weekend after the last day of excitement around here.


On last night's fix -- I'm very happy to confirm that we did fix a login vulnerability, with significant assistance from an extremely clever user.

The root cause was a very subtle bug in error checking of our login validations deep in the server code. No personal information or any such was leaked out, and no outside attacker penetrated our servers, networks, or databases.

We'd definitely like to thank Mr. ManWitDaPlan for the well-timed assist. Sir, we salute you and offer our most heartfelt thanks.


The rest of what I'd like to add isn't to detract from the above well-deserved compliment, but it's important to include in the comprehensive picture.

The sobering fact is that account security remains a multifaceted issue, as attacks from other sources continue.

It's important to remember is that while a hole was identified and fixed as rapidly as we possibly could, there are still hackers and botnets trying account/password combinations from compromised web sites and past MMOs.

They are doing this right now. Those attacks have been coming constantly since we launched the game. The only thing that changes are how many hundreds of computers are trying to get into your account at any given moment, where they're coming from, and how many are succeeding.

We do block them as they are detected, but the fact that they are using distributed botnets (compromised computers from across the globe) means that this will remain something that we will continue keeping an eye on, forever.

For users getting hacked this way, Coin Lock is currently doing its job protecting people's belongings, provided that your RIFT password and EMail password are both complex and entirely different.


Both the login fix and the Coin Lock addition have been doing their part in signficantly reducing overall incidents over the last 18 hours.

Neither one is a silver bullet, but so far it is looking to be a solid one-two punch for the weekend.


Then, with two-factor authentication coming very soon, we expect security to be improved even further.

All totalled up, under 1% of accounts with characters have had characters impacted. However, 1% of a surprisingly large number is still very noticeable.

Our staff has been, and will continue to be, working around the clock to get those impacted back in shape. We'll continue hiring on even more people to help people with issues of all kinds, as quickly as we can. (Another round of hires begin on Monday, and there will be even more to follow.)

As always, thanks very much for your time, your attention, your assistance, and your patience!


- Scott Hartsman
Exec Producer, RIFT

Trion security is compromised, and i got hacked too just because they have open backdoors, bypasses and overall weak security.

After a week of being hacked trion's cusmoter service has not responded yet,  looks like they dont care at all bout their customers.

And today i dont have control over my account, i cant change my pass and cant change my email address.

Hackers can and they are actually loggin into my account everyday. So Everyday im coinlocked. wft is that crap!!!

Obviously i cancelled my account, im not paying for an account  i do not control.

I deleted all my credit card info, im not stupid to compromise my credit card as well.

If you have a keylogger you have more problems to worry about than your Rift account being taken.

Its already been discussed, but the chances of a keylogger actually infecting your system are very slim to none. However, believe whatever you want.

You should apply this on all online games.... common sense.

The number one key to not getting your system infected is to regard all downloads in this fashion:

• If you did not go to a website or webpage with the intent of downloading something. Do not download it.
• If you must ignore this rule, then google the thing you are downloading. Look for more sources, and information on the source. If the program looks good, use a more reputable site to download it. It's pretty reliable that if something is malware, Google will know.
• If all you can find is one source for a download, try to find an alternative program.
• Be vary careful of all download sites and pages on any software site. Most of them run ads that blend in with the page and say have things like a DOWNLOAD NOW link. Try to make sure what you're clicking is not a banner ad.

getting down with the necro here, but as this is stickied i figured it'd be ok.

i was hacked in Rift as well recently. i got two emails. one was a coin lock notification, and the second was a change of email on my account. i freeked out and called trion support and within a 5 minutes got a rep on the phone. told them i was hacked and she fixed it fast. they asked me security questions and we changed up my account info/email and pswd. said it would be up to 24 hours to rollback my charecters and was done in less then an hour. she gave me a free month of game time and apologized over and over. she stated there may be some issues in some of the third party addons and to run a virus scan. whole time on the phone was about 15 minutes including time waiting for a rep.

i was messin with a few addons the night before and am pretty sure it had something to do with the issues i had. trion gave me a free month game time and the best customer service experience i'd had in a game because i was click happy with addons. i love Trion!