Xbox Live Hacked M$ points and information stole
Xbox.com security flaw behind Live account hacks
Hacking victim declines Microsoft's offer to investigate and works it out by himself.
A network infrastructure manager claims that lax security on the official Xbox website is behind the recent spate of Xbox Live account thefts.
Analog Hype reports that the security flaw was found by Jason Coutee, who had his own account stolen and 8,000 Microsoft Points purchased using his stored credit card details.
When he contacted Microsoft support to notify them he was told that the company would not be able to refund him for the 8000 MSP, but offered to lock his account down and investigate, which could take up to 30 days. He declined, opting to use his professional experience and investigate by himself. A couple of weeks later, he found a hole in Xbox.com security.
It appears that Xbox.com allows an indefinite number of password attempts, requiring only that a Captcha code be input after eight failed attempts. Input the correct Captcha and you get another eight attempts, meaning that by using a password-generating script a hacker can brute-force control of Xbox Live accounts without fear of the account being locked down as a precaution after too many failed attempts.
So, Coutee played a few rounds of Halo: Reach, noted down the Xbox Live gamertags of his opponents, and Googled them in the hope of finding related email addresses. Xbox.com was a help here, as it makes clear whether an email address has an associated Windows Live ID or not after a login attempt.
Coutee attempted to report his findings to Microsoft but claims he was given the runaround, with HQ giving him a support email address, a helpline pointing him to the Xbox.com forums, while Microsoft's piracy and phishing department simply declined to help at all.
We've verified that Coutee's claim about the eight-attempt system is correct, and have sought comment from Microsoft. Whether this is to blame for the recent spate of accounts thefts or not, it's troubling that so large a company, with so much experience in network solutions, is apparently content leaving its back gate on the latch like this.
Xbox Live Hacked M$ points and information stole
Have a read and let us know what you think.
Jump to
- News of Today
- ↳ Front Page News
- Welcome to Robinhoods Playground
- ↳ Rules
- ↳ Welcome
- ↳ Whats needed
- ↳ Say Hello
- Destiny
- ↳ RHPG in Destiny
- ↳ Tips and Tricks
- ↳ All Good Things
- ↳ Clan member needed
- The Camp site. Our home in the Woods
- ↳ The Forest
- ↳ Rants & Raves
- ↳ Car,Bike or boat
- ↳ MMA Mixed Martial Arts
- ↳ Water Sports
- ↳ Music , If you dig the sound waves this is the Thread for you.
- ↳ The Outhouse
- ↳ The Movie House & TV Room
- Game Reviews and Game News
- ↳ Gaming News
- ↳ Video Game Reviews from Revision3
- ↳ 360 Video game review
- ↳ Wii Video game review
- ↳ PS3 Video game review
- ↳ PSP Game Review
- ↳ DS game reviews
- ↳ 360 Game Reviews
- ↳ Xbox One Game Reviews
- Online Retailers & Product Review
- ↳ 360 Product Review
- ↳ Members Reviews
- ↳ Wii Products Reviews
- ↳ DS and DSi Products Reviews
- ↳ On-line retailer Review
- ↳ Members Product Review & Retail Site Review
- Tutorials and Downloads
- ↳ Tutorials
- ↳ 360 Tutorials
- ↳ Video Tutorials
- ↳ Drive Flashing Tutorials
- ↳ Other Tutorials
- ↳ Traditional Text/pic Style
- ↳ Drive Flashing Tutorials
- ↳ Other Tutorials
- ↳ PS3 Tutorials
- ↳ WII Tutorials
- ↳ Nintendo DS
- ↳ PSP Tutorials
- ↳ Ipod Iphone & Itouch
- ↳ Programs and Downloads
- ↳ 360 programs
- ↳ PS3 programs
- ↳ PSP custom Firmware & Programs
- ↳ WII Programs
- ↳ Programs you will need for most modding
- ↳ Ipod Touch Programs
- ↳ DS programs
- ↳ Tutorials submitted by members
- ↳ Xbox360 guides go here
- ↳ PS3 guides go here
- ↳ Wii guides go here
- ↳ PSP guides go here
- Consoles
- ↳ Xbox 360
- ↳ Beginners
- ↳ General information
- ↳ 360 DVD Drive Flashing
- ↳ IPreP
- ↳ Game Backups
- ↳ Cosmetic Case Mods
- ↳ What you're playing
- ↳ Junk
- ↳ J-Tag
- ↳ Wii
- ↳ Beginners
- ↳ General information
- ↳ Soft Mod Questions
- ↳ Homebrew Apps
- ↳ Hard mod or chip Questions
- ↳ Game Backups
- ↳ What you're playing.
- ↳ Junk
- ↳ Homebrew Apps
- ↳ Playstation 3
- ↳ General information
- ↳ What you're playing
- ↳ Junk
- ↳ Blackcat usb PSGroove
- ↳ PSP
- ↳ Beginners
- ↳ General information
- ↳ Hardware add-ons or changes
- ↳ What you're playing
- ↳ Junk
- ↳ HomeBrew APP for PSP
- ↳ Nintendo DS & DSi
- ↳ General information
- ↳ What you're playing
- ↳ junk
- Phone modding
- ↳ Cell phone News
- ↳ "AnDroid os" phones
- ↳ General Information & Questions
- ↳ Guides and Tutorials
- ↳ Other Cell phones
- ↳ iphone/ipod touch
- ↳ General Discussion
- ↳ iphone specific
- ↳ ipod touch specific
- ↳ Guides/Tutorials
- Computer Gaming & Hardware
- ↳ Computers
- ↳ General information
- ↳ Hardware
- ↳ Software
- ↳ Games
- Trusted Members