Xbox Live Vulneribility Exposed! Microsoft Ignored The Truth

[jwk94]

From what started as a supposed Fifa 12 hack, turns out to be more then that. Xbox Live has a serious security flaw and Microsoft ignored it for way to long. We have uncovered how easy it is for hackers or anybody with some free time to hack your Xbox Live account.

I spoke with Jason Coutee, a network infrastructure manager who had his Xbox Live account hacked. 8000 Microsoft points were purchased on his account, so he did what anyone of us would do and call Xbox support. A transaction for Xbox Live Family Pack was in the middle of being processed and he was able to cancel it before it went through. Unfortunately Xbox couldn’t refund him for the 8000 Microsoft points but offered to freeze his account for 30 days to investigate. Jason declined to the investigation so that he can do his own investigation. For the next couple of weeks Jason went searching for vulnerabilities that may have caused the hack. He then found Xbox 360′s Achilles heel, Xbox.com

The first step was to gather the Windows Live ID’s of gamertags. So after a round of Halo Reach, he gathered a list of gamertags and enter them individually on Google. Thanks to Facebook, Twitter, or any other links that have their email advertised, hackers now have a potential list of Windows Live ID’s. Now the hackers check to see if the email is a valid Windows Live ID. To do this, hackers headed to Xbox.com Typing in the email and a random password like blah.

If the hacker got the error message “account is invalid†they move on to another email.

When the hacker comes across the error message “password is wrong†then that account is in trouble.

Now with a simple script, hackers can brute force their way into your Xbox Live account. The script would batch run a list of potential password, which anybody can find online with a simple Google search. The script will attempt to enter these potential passwords until it gets in. Xbox allows you to enter your password incorrectly 8 times on the website, then it asks for a CAPTCHA code. When hackers get to that CAPTCHA code, there is a link for “try with another Live IDâ€. Clicking this link resets the CAPTCHA code and hackers can continue to force their way in 8 more times before they need to click the link again. This process can easily be automated by a skilled hacker. Once a hacker is in your account, nothing is safe. Hackers will take your credit card info, Netflix, Hulu Plus, the works.

So what are hackers going to do with your hacked account? Most likely purchase games and Microsoft points, change your gamertag and the email associated with then sell it online. For extra kicks they might also purchase a Xbox Family pack to add 3 more gamertags to their arsenal. Hackers are known to do this several times a day. Making several hundred dollars a day off of Microsoft’s laziness and your money.

Jason Coutee attempted to call Microsoft to report his findings and Microsoft Headquarters gave him the run around. Instructed him to email [email protected] He also tried calling 1-800-4-MY-XBOX where he spoke with a supervisor. The supervisor instructed him to take it to the Xbox.com forums. His latest attempt was with the Piracy and Phishing department at Microsoft who wouldn’t help him with anything Xbox related. Everybody at Microsoft refused to acknowledge the issue and because of that, gamertags are still being hacked. Microsoft can easily fix this issue by sending an email to people when there are more than X amount of failed login attempts and by by storing session id’s.



Thanks to Jason Coutee and Jesszman

Xbox Live Vulneribility Exposed! Microsoft Ignored The Truth - AnalogHype

From what started as a supposed Fifa 12 hack, turns out to be more then that. Xbox Live has a serious security flaw and Microsoft ignored it for way to long. We have uncovered how easy it is for hackers or anybody with some free time to hack your Xbox Live account.

I spoke with Jason Coutee, a network infrastructure manager who had his Xbox Live account hacked. 8000 Microsoft points were purchased on his account, so he did what anyone of us would do and call Xbox support. A transaction for Xbox Live Family Pack was in the middle of being processed and he was able to cancel it before it went through. Unfortunately Xbox couldn’t refund him for the 8000 Microsoft points but offered to freeze his account for 30 days to investigate. Jason declined to the investigation so that he can do his own investigation. For the next couple of weeks Jason went searching for vulnerabilities that may have caused the hack. He then found Xbox 360′s Achilles heel, Xbox.com

The first step was to gather the Windows Live ID’s of gamertags. So after a round of Halo Reach, he gathered a list of gamertags and enter them individually on Google. Thanks to Facebook, Twitter, or any other links that have their email advertised, hackers now have a potential list of Windows Live ID’s. Now the hackers check to see if the email is a valid Windows Live ID. To do this, hackers headed to Xbox.com Typing in the email and a random password like blah.

If the hacker got the error message “account is invalid†they move on to another email.

When the hacker comes across the error message “password is wrong†then that account is in trouble.

Now with a simple script, hackers can brute force their way into your Xbox Live account. The script would batch run a list of potential password, which anybody can find online with a simple Google search. The script will attempt to enter these potential passwords until it gets in. Xbox allows you to enter your password incorrectly 8 times on the website, then it asks for a CAPTCHA code. When hackers get to that CAPTCHA code, there is a link for “try with another Live IDâ€. Clicking this link resets the CAPTCHA code and hackers can continue to force their way in 8 more times before they need to click the link again. This process can easily be automated by a skilled hacker. Once a hacker is in your account, nothing is safe. Hackers will take your credit card info, Netflix, Hulu Plus, the works.

So what are hackers going to do with your hacked account? Most likely purchase games and Microsoft points, change your gamertag and the email associated with then sell it online. For extra kicks they might also purchase a Xbox Family pack to add 3 more gamertags to their arsenal. Hackers are known to do this several times a day. Making several hundred dollars a day off of Microsoft’s laziness and your money.

Jason Coutee attempted to call Microsoft to report his findings and Microsoft Headquarters gave him the run around. Instructed him to email [email protected] He also tried calling 1-800-4-MY-XBOX where he spoke with a supervisor. The supervisor instructed him to take it to the Xbox.com forums. His latest attempt was with the Piracy and Phishing department at Microsoft who wouldn’t help him with anything Xbox related. Everybody at Microsoft refused to acknowledge the issue and because of that, gamertags are still being hacked. Microsoft can easily fix this issue by sending an email to people when there are more than X amount of failed login attempts and by by storing session id’s.



Thanks to Jason Coutee and Jesszman

Xbox Live Vulneribility Exposed! Microsoft Ignored The Truth - AnalogHype

 

[Tom Constantine]

I wondered how long it'd take for jwk94 to post this thread :169:

This proves that Xbox Live was NOT hacked so supposed the rumour mill filled of scandal lovers have been silenced. There's a reason sites tell you to use a strong password.

 

[The Burning Hunter]

Really this only highlights the fact that Microsoft didn't require a captcha after you failed the first few login attempts and keep the captcha as a requirement until you successfully logged in. Anyone who's done a little studying about passwords will tell you that brute force attacks are slow, and unreliable. Case in point an eight character alphanumeric password would take roughly 7 Million years at one try per second.

Simply put if this guy got "hacked" by a brute force attack then he deserves it for choosing a small password. What's more common is to go the social engineering route and get enough details out of the person to get the password reset through the password reset tool. Sorry if I seem like a bit of an uncaring jerk but really this is why you need a long password of 8-12 characters, even if you don't use symbols or numbers at least it's complex enough to survive a brute force.

 

[Drazic]

I wondered how long it'd take for jwk94 to post this thread :169:

This proves that Xbox Live was NOT hacked so supposed the rumour mill filled of scandal lovers have been silenced. There's a reason sites tell you to use a strong password.

They might not have been hacked but it's definitely a problem on Microsoft's side of things while before this it might've been a 3rd party phishing site.

This is why sites generally only say the combination of username/password is wrong. Not tell you that only the password and/or username is. And you can still brute force strong passwords so the fact that it's possible is still pretty embarrassing.

 

[NateRiver]

I don't even have Xbox Live yet I have an Xbox.

lolz

 

[The Burning Hunter]

This is why sites generally only say the combination of username/password is wrong. Not tell you that only the password and/or username is. And you can still brute force strong passwords so the fact that it's possible is still pretty embarrassing.

Yes and no, you'll never see a strong password brute forced as it's just statistically ridiculous. However what you will see is a dictionary attack which is just as it sounds. A lot of people just use words as their password which makes them very weak to a dictionary attack. Honestly if you want a good strong password do the following:

1. Take a phrase or word you can remember like "Kamen Rider"

2. Change any letters you feel comfortable with with symbols or numbers such as replacing the a as 4 or @ for example "K4m3n R1d3r"

3. If you feel comfortable with remembering case then play with the case of the letters "K4M3N r1d3r" in this case I alternate every other space between lowercase and capital even if there's no letter there. You can always use symbols instead of numbers if the space is supposed to be capitalized such as "K4M3N r!d#r"

4. Finally get rid of any spaces by adding underscores "K4M3N_r!d#r"

While that looks like just a random assortment of characters it'll make sense to you and the more you practice it the easier it'll be for you to input it. While this is a bit extreme it's not venerable to a dictionary attack. However you can also just practice adding numbers or symbols to the end of a phrase for a simpler phrase such as "Kamen_Rider4ze"

 

[Drazic]

Yes and no, you'll never see a strong password brute forced as it's just statistically ridiculous. However what you will see is a dictionary attack which is just as it sounds. A lot of people just use words as their password which makes them very weak to a dictionary attack. Honestly if you want a good strong password do the following:

1. Take a phrase or word you can remember like "Kamen Rider"

2. Change any letters you feel comfortable with with symbols or numbers such as replacing the a as 4 or @ for example "K4m3n R1d3r"

3. If you feel comfortable with remembering case then play with the case of the letters "K4M3N r1d3r" in this case I alternate every other space between lowercase and capital even if there's no letter there. You can always use symbols instead of numbers if the space is supposed to be capitalized such as "K4M3N r!d#r"

4. Finally get rid of any spaces by adding underscores "K4M3N_r!d#r"

While that looks like just a random assortment of characters it'll make sense to you and the more you practice it the easier it'll be for you to input it. While this is a bit extreme it's not venerable to a dictionary attack. However you can also just practice adding numbers or symbols to the end of a phrase for a simpler phrase such as "Kamen_Rider4ze"

Brute forcing will always be possible. What you're referring to as impossible is taking years. While it's true that taking years or maybe even more to brute force one password probably isn't worth it we're already seeing improvements on CPU speed and better dictionaries cutting back on that time by a lot. While it might not be possible in this case (since the xbox.com website probably would simply be DDOSed if you tried) this article mentions a program being able to try 400k passwords per second: http://www.infosecisland.com/blogview/11018-Cracking-WPA-Protected-WiFi-in-Six-Minutes.html

It used to be that brute forcing WPA would take ages as well. But now you can use Amazon cloud servers to crack that in just minutes (or your own PC but I guess that would be slower and/or really expensive if you have to buy the hardware yourself but in time consume hardware will get to that level). Though the way that works is that they take a encrypted hash of the password and brute force it somewhere else. If this article is right then they're not even doing that and just brute forcing it on the xbox.com website itself. No matter how weak your password is that should not be possible. Even a 3 letter password would need more guesses than any sane human ever would try so it should be obvious that it's a bot.

Also:

 

[NateRiver]

What if you have a password like:

82y3rh8fyh894fr80f3h83e223r8hnr23%%#!#@@#$2734h4ewfcgybdn2389ej2enfcd7d32e,sxu3ek3e4++&^$#!2?ewfhuwe7%%%348ejdsdi[sdsdada+-?213sdasfsaf4rffw32

Sure, it'll take a while to write it down, but will it be secure?

 

[The Burning Hunter]

@Drazic: I'm no security expert, just a guy who loves studying tech, so I'll concede the point to you. Tech is always evolving and it doesn't surprised me that newer and better programs and being developed by hackers to break passwords.

However I've always thought of a password as merely a way to deter someone. If someone wants to break into my account they will and there's not much I can do about it but keep an eye on it for any suspicious activity. Still stronger passwords do help. Also yeah a phrase certainly is better and easier to remember than a complex mess of numbers and symbols, though I tend to have to use the alpha numeric route sometimes as a lot of sites I go to only allow 16 character passwords at maximum and I always throw in at least one number due to it being a requirement for work.