Necromancer/White Wolf hacked

[jdrakeh]

but there's no way they actually got into my email account, since the password I use for that is different from any other password I use elsewhere.

Dude... they hacked the White Wolf servers. I think that they can hack a simple POP server. And I think that they have. The email they 'sent' me was, after a quick trace, most certainly sent from my own account (hence my post elsewhere on this forum). More disturbingly, it looks as though my Paypal account has also been compromised. Merry !@#$%!& Christmas, eh?

Instead of watching cartoons tomorrow morning, I guess I get to spend the day down at the local FBI field office (which, BTW, is where all of you will also want to go to report the extortion attempts that the hackers have put to you). Also, if the Secret Service has a branch office in your hometown, you might want to fill out a report there, too. Finally, hit this site:

http://www.ifccfbi.gov/index.asp

 

[Monte At Home]

I've been assured multiple times from people at WW that the hackers didn't get CC info. And actually, these emails they're sending pretty much prove that. If you got CC info, you wouldn't waste your time trying to sell people info for 10 bucks.

 

[Mark CMG]

I've been assured multiple times from people at WW that the hackers didn't get CC info. And actually, these emails they're sending pretty much prove that. If you got CC info, you wouldn't waste your time trying to sell people info for 10 bucks.

Well, that's a relief and it makes sense. They've tipped their hands, in essence.

 

[Thanee]

Dude... they hacked the White Wolf servers. I think that they can hack a simple POP server. And I think that they have. The email they 'sent' me was, after a quick trace, most certainly sent from my own account (hence my post elsewhere on this forum).

I don't think this is really very difficult. Many e-mail servers allow that without any check at all.

You just need to know the SMTP server address and send the mail via that server.
The server address might be simply available from your e-mail provider via some sort of FAQ or helptext.

Not sure how hard it is to fake authentification, if that is used on the e-mail server you use, it is meant to help with this, making it more difficult to 'compromise' your e-mail address by using it as the sender in spam mails, for example. But I suppose the spam mailers have some experience in circumventing these protections.

Bye
Thanee

 

[Nuclear Platypus]

I can't call these so-called hackers the proper name, Eric's grandma would not approve. I think I'll go scrub my brain with a bar of soap (I didn't say it, so I'm not going to bite on a bar of soap).

How about "skidmarks on the Underoos of society"? However like you, I can think of some more creative metaphors (well mostly) too.

 

[Wil]

Dude... they hacked the White Wolf servers. I think that they can hack a simple POP server. And I think that they have. The email they 'sent' me was, after a quick trace, most certainly sent from my own account (hence my post elsewhere on this forum). More disturbingly, it looks as though my Paypal account has also been compromised. Merry !@#$%!& Christmas, eh?

Instead of watching cartoons tomorrow morning, I guess I get to spend the day down at the local FBI field office (which, BTW, is where all of you will also want to go to report the extortion attempts that the hackers have put to you). Also, if the Secret Service has a branch office in your hometown, you might want to fill out a report there, too. Finally, hit this site:

http://www.ifccfbi.gov/index.asp

While this isn't a bad idea, I want to point out the spoofing the sending email address is incredibly easy. As has been pointed out here and elsewhere, email has been received by people who run their own servers or otherwise have email passwords that could not have been in the database information the hackers recovered.

PLUS, there are much more lucrative things to use the information for - get into the email accounts, change the passwords to something else so the owner can't get back in, and then use it for sending spam.

 

[swrushing]

oK so a dumb question...

did they get just the ww board stuff or did they also get into the drivethrurpg database?

the former is just email. the latter is potential financial info.

 

[Wil]

oK so a dumb question...

did they get just the ww board stuff or did they also get into the drivethrurpg database?

the former is just email. the latter is potential financial info.

They've already stated that the drivethrurpg database was not compromised.

 

[jdrakeh]

While this isn't a bad idea, I want to point out the spoofing the sending email address is incredibly easy. As has been pointed out here and elsewhere, email has been received by people who run their own servers or otherwise have email passwords that could not have been in the database information the hackers recovered.

PLUS, there are much more lucrative things to use the information for - get into the email accounts, change the passwords to something else so the owner can't get back in, and then use it for sending spam.

All true, but that doesn't make extortion any more legal (as I said, though, my email adress was, in fact, hacked). Whether somebody is trying to take you for $10 or $10,000, reporting it is always a good idea.

 

[Samnell]

I've been assured multiple times from people at WW that the hackers didn't get CC info. And actually, these emails they're sending pretty much prove that. If you got CC info, you wouldn't waste your time trying to sell people info for 10 bucks.

I wasn't worried until I got the emails, and the thought never crossed my mind that if they're
asking they must not have the goods. Now I'm not worried again. That worked out rather well for me.

Thanks.