Account pretexters plague Xbox Live

Account thieves numerous and brazen

After initially denying that the service had been hacked, Microsoft said the company is now investigating the issue, but stressed that the problems seem more to do with pretexting than with a security breach of its systems.

"Recently, there have been reports of fraudulent activity and account theft taking place on the Xbox Live network," the software giant said in a statement sent to SecurityFocus. "Security is a top priority for Xbox Live, and we are actively investigating all reports of fraudulent behavior and theft."

Pretexting - another term for social engineering schemes designed to facilitate access to a victim's account - came to national prominence last September when a member of Hewlett-Packard's board revealed that the company had hired private investigators to uncover a leak and that the investigators apparently used pretexting to get access to board members' and journalists' phone records. Patricia Dunn, the former CEO of the company, was recently cleared of charges in the case.

Microsoft and Bungie have not indicated how widespread their own pretexting issues might be, but anecdotal evidence points to endemic account stealing issues.

Groups other than Clan Infamous have also boasted about their account-stealing capabilities, and victims have posted complaints in both Xbox Live forums and in other sites around the internet.

Finisterre may have gotten off lightly. Other victims have more serious stories to tell.

Mr Jokerz, the online handle used by a 19-year-old college student from Michigan, used to run his own clan, T3am Hazard, for playing Halo 2. The teenager, who asked not to be identified by name, found his team at a disadvantage against the cheats commonly used by abusers such as Clan Infamous. Complaints were immediately met with retribution.

Over a matter of months, Mr Jokerz's account was stolen six times and several thousand dollars worth of Microsoft points charged to his credit card, the teenager claimed. The attackers, which Mr Jokerz identified as Clan Infamous, quickly decimated the accounts belonging to the leaders and staff members of T3am Hazard.

"They go after anybody they want to," Mr. Jokerz told SecurityFocus in an online chat. "They just went after me a lot because I was the overlord (leader) of the clan."

The bullying went beyond the game world as well. From his account, the attackers harvested Mr Jokerz's home address and telephone number and called his house more than 100 times, the teenager said. Eventually, the teenager filed a police report. The Halo 2 player also said he identified the names and addresses of the clan members involved and gave them to both the police and Microsoft, but has heard no response back regarding any investigation. Microsoft could not immediately confirm Mr Jokerz's account.

The apparent lack of action has made Clan Infamous quite brazen. In a statement on the clan's site, they dismissed the efforts of Microsoft and Bungie to halt cheaters and account stealing and threw down the gauntlet in front of the company's investigators.

"You guys can't even freeze our accounts," the clan stated on their site. "You are pathetic, a joke...We aren't afraid of you one bit, so we will continue to steal accounts (and) max out credit cards until you find a way to stop us."

This article originally appeared in Security Focus.

Copyright © 2007, SecurityFocus