$1.2 Million Worth of MS Points Taken After Hackers Figure Out Code Algorithm 203
The Save and Quit blog reports that a group of hackers figured out the algorithm behind a set of promotional codes that were each redeemable for 160 MS points, the currency used on Xbox Live. Quoting:
"A person would just have to sit back and refresh over and over and rack up the 160MSP codes. Not every code would work, but a majority would. The site started to 404 due to the heavy traffic. If you have closer ties to the pirating community, you could find a program to get the codes for you. ... This method took a little more work out of the user, but it was still simple enough for a 12 year old to figure out. ... Microsoft found out about this exploit and put a stop to it immediately, but internet pirates still had enough time to steal $1.2 million worth of Microsoft Points."
$1.2 million worth of Microsoft Points (Score:5, Funny)
Wow, that's almost a full tank of gas.
Re:$1.2 million worth of Microsoft Points (Score:4, Funny)
Re:$1.2 million worth of Microsoft Points (Score:5, Insightful)
Re: (Score:2)
Yes, of course you would. Until you had to fill the huge gaps left in budgets that rely on that extra money you pay for your fuel. It isn't magically more expensive because it's consumed in the United Kingdom, you know.
But, please, continue to complain and make a fool of yourself.
Re: (Score:2)
Why do you keep putting gas in quotes?
Did you really want him to let it loose? I would prefer his gas be restrained, we can only hope double quotes are up to the job...
Re: (Score:2)
Ughhhh, I can just imagine your high pitched snotty voice as if you were actually saying that. I hope you get "shagged" by a "lorry" while chasing a "football", and thus your "jeans" don't "continue".
Re: (Score:2)
Because I'm British and think it's a stupid name.
I agree, "gas" is a specific word for a state of matte, "gasoline" is liquid, it is a silly abbreviation.
But then again I'm British too
Re: (Score:2)
Ask for a gas can in the UK and you'll most likely get a propane gas bottle.
Which is a gas.
Re: (Score:2)
Ask for a gas can in the UK and you'll most likely get a propane gas bottle.
Which is a gas.
They make the bottles out of gas now? And here I am using the old-fashioned metal ones like a sucker.
Don't be a wanker, the phrase "a propane gas bottle" will normally be undertood to mean "a bottle full of propane gas" unless you specifically say "an empty bottle for putting propane gas in."
Re: (Score:2)
s'ok, I don't smoke.
Re: (Score:2)
Well, you could always go to a real restaurant instead of a Starbucks and get coffee at a reasonable price.
Ok, might be different for you, I don't know how far along they came already in your area.
only 160 points worth of microsoft funny money? (Score:2)
I wonder if they're just going to ban everyone who redeemed a code worth such a small amount. Why the hell do amounts that small exist? must be for fast food promos or something.
Re: (Score:2)
It pretty much is. They never sold anything outright less than 500 points.
Re: (Score:2)
No, but if you redeemed 50,000 of them might be an issue..
Exchange rate (Score:3)
What's the exchange rate from MS points to Schrute Bucks?
Re: (Score:3)
Same as the ratio of unicorns to leprechauns
Re: (Score:3)
Same as Unicorns to Leprechauns.
Not hard to track down (Score:2)
Re: (Score:2)
Just look who made more than one purchase of MS points to their account in the last week or two, that will cut down the list of possible suspects significantly. Cross-reference the transactions for which there was payment. You'll find that you have a handy list of those people who will soon find a huge "CHEATER" banner on their Xbox account.
I purchase MS points a few times a week, and I have a feeling I'm not alone. I don't see how that would help narrow down the evil doers.
Re: (Score:2)
I purchase MS points a few times a week, and I have a feeling I'm not alone. I don't see how that would help narrow down the evil doers.
Read my whole post. Once you've narrowed down people who made multiple purchases in a row (a hacker who finds this trick working repeatedly is likely to do it as long as it will work) all they need to do is make sure every one of those names has PAID for his purchases. The idea here was merely to narrow it down to make the payment double-checking part go faster.
Re: (Score:2)
I purchase MS points a few times a week, and I have a feeling I'm not alone. I don't see how that would help narrow down the evil doers.
Read my whole post. Once you've narrowed down people who made multiple purchases in a row (a hacker who finds this trick working repeatedly is likely to do it as long as it will work) all they need to do is make sure every one of those names has PAID for his purchases. The idea here was merely to narrow it down to make the payment double-checking part go faster.
I read your post in its entirety but it is still in the end a mostly education guess. I just don't see how Microsoft could punish based off a good guess. I realize they can ban whomever they want for what ever reason but it would just end up causing more headaches and added cost. I don't see the real payoff.
Re: (Score:2)
Re: (Score:2)
Re: (Score:3)
It's quite possible that the set of generated codes on the website overlap with the set of codes on printed tickets, in which case I happily concede the argument to your favour, but my understanding is that the codes are different (
Re: (Score:2)
I purchase MS points a few times a week, and I have a feeling I'm not alone. I don't see how that would help narrow down the evil doers.
In 160MSP increments?
Re: (Score:2, Insightful)
Re: (Score:3)
Don't hate the farmers, hate the MMO. It's their fault.
They didn't steal anything. (Score:3)
Re: (Score:3, Insightful)
It's not like MS ran out of codes.
Tell that to someone who legitimately had one of these codes that couldn't redeem it because someone else used it.
Re: (Score:3)
Didn't hack the algorithm (Score:4, Informative)
Re: (Score:3)
$1.2 Million is pretty cheap to learn that lesson, all considered.
And I'll be very surprised if they take any action against the lucky winners - the bad publicity (and risk of accidentally tagging someone who just happened to redeem their three codes at the wrong time) won't be worth the hassle.
Re: (Score:3, Informative)
http://kotaku.com/#!5780686 [kotaku.com]
This is why you have corporate america (Score:2)
They have to set a president
You're against campaign finance reform, I take it? ;-)
Read that wrong the first time. (Score:2)
Re: (Score:2)
Just like Pepsi iTunes codes. All you hadda do.. (Score:2)
.
Re: (Score:3)
...to find the caps with the codes was to tilt the bottle. .
Totally, completely, 100% off topic, but... this reminded me that when I looked at a map of Tripoli the other day I noticed this:
Pepsi-Cola Road [google.com].
I've been hoping to hear something about anti-government protesters on Pepsi-Cola Road ever since.
Just like, you know... stolen Microsoft Points. Or something.
Curisous and Furious (Score:2)
Boggles the mind (Score:5, Insightful)
Why weren't these codes completely random? Why don't they have a database of valid and used codes, where codes only get inserted when they're printed on cards that are then shipped to stores? Perhaps most importantly, why would you EVER have a public web-accessible interface to generate codes on the fly?
Re: (Score:2)
Re: (Score:2)
Cost and reuse.
Re: (Score:2)
You're confusing this article and the prepaid points cards. First, they were 160 points at a time. No prepaid card comes with such little points - I think the smallest I've every seen was 400 as part of some
Re: (Score:2)
What happened then was people figured out how to get 160 points without doing X, and with enough hackery, figure out the algorithm behind it.
According to TFA it doesn't appear that they ever figured out the algorithm. They just figured out how to get 160 points by refreshing web page X, and then repeated until they had a lot of points.
As usual the /. headline is sufficiently lacking in factual basis. The "hackers" figured out a URL, not an algorithm.
Re: (Score:2)
Perhaps most importantly, why would you EVER have a public web-accessible interface to generate codes on the fly?
Because they sent emails with a link to it passing an ID. The problem is that the ID is easily guessable.
Re: (Score:3)
Only if you believe in a deterministic universe. Otherwise you get pretty good results with TRNG's and quantum mechanics.
http://www.random.org/randomness/ [random.org]
http://en.wikipedia.org/wiki/Quantum_cryptography [wikipedia.org]
Re: (Score:2)
That really doesn't change his point, though.
The API still should have been secured with some sort of credentials. They don't have to be rocket science and they don't have to be so complex they get in the way of the third parties, but I don't think a username/password passed with HTTP Auth or something would be overly burdensome if you're already asking partners to connect with an API. And a couple of Microsoft developers could probably pump out libraries for most major languages to do that in only a fe
Re: (Score:2)
Enjoy your fake money! (Score:2)
Wait! We were talking about the US Dollar right?
Re: (Score:2)
Hey, the U.S. Dollar isn't fake as long as we all agree it isn't fake. Even if it is.
Re: (Score:2)
404? really? (Score:2)
Re: (Score:3)
I doubt it'll be hard for Microsoft to figure out who redeemed an excessively large number of these codes.
If they are valid codes I don't see how Microsoft could tell the difference.
Re: (Score:2)
Re: (Score:2)
The difference between redeeming 1 valid code and redeeming 10? Thats pretty easy. Most people learn how to count pretty early on. Or looking at how fast they redeemed them. "Oh, it only took them 1.28 seconds to type in this 25 character string of not-so-random numbers.... how odd!"
FTFY
Re: (Score:2)
Don't the codes get associated with some sort of account somewhere? Could Microsoft not simply look for accounts with some arbitrarily reasonable amount of points on them, then query the purchasing/issuing database to see which of those accounts got most of their credit in short order in 160-point increments then drain those accounts?
Or just simply look for any issuance of points using these promo codes to any accounts, and make sure that credit is only given for ONE promo code per account, and remove all
Re: (Score:3)
After all, Microsoft really hasn't "lost" $1.2 million in cash
Careful now. Microsoft points can be used to purchase things from the MS store. Not all of which are owned by MS. If I developed and XBLA game, or DLC for something I expect my 70% (I think it's 70%, steam is 70%, I haven't worked with anyone using MS points in a while), whether the points where legitimate or not is MS's problem. The deal I have is to be compensated, in cash, for downloads of my product through their store.
If they give away 10 million MS points for the hell of it, I still expect to be p
Re: (Score:3)
Have the hackers arrested and thrown in prison for fraud.
Re: (Score:2)
They aren't "valid" in the sense that although they meet the algorithm for validation they were not created by MS, who can in fact tie those codes back to SKUs and track the purchase. I know that's how I do it. But I also validate against that list on the fly because I'm not fucking retarded :P
Seriously this is like checking a credit card using Luhn but never actually validating it by doing a capture via a payment gateway. It's laughable and I bet someone got fired for it.
Re: (Score:2)
The codes were generated I believe on a MS service that was tricked into generating codes based on existing codes.
From Kotaku:
With Microsoft able to track the generated codes, that means they can also track accounts that cashed in the generated codes for points.
And since they can track the damage, they are qualified to tell us that the $1.2 million figure being thrown about is far from the actual number. "We can't share specific numbers, but the figure is nowhere near the amount that has been reported."
[...]
"We take safety and security very seriously and require that Xbox LIVE members use the service in compliance with applicable laws and specifically prohibit people from engaging in illegal activity as a part of our Terms of Use and Code of Conduct," the statement continued. Our Policy and Enforcement team is evaluating whether or not certain individuals have violated the Terms of Use for Xbox LIVE and will take the appropriate enforcement on an individual basis."
http://kotaku.com/#!5780686 [kotaku.com]
Re:Dumb kids (Score:4, Funny)
why do you cower behind a chosen underwear based pseudonym? what are you afraid of?
Perhaps he meant a striped, horse-like animal, and he has a lisp, you insensitive clod.
Re: (Score:2)
English is a cruel language:
Perhapth he meant a thtriped, horthe-like animal, and he hath a lithp, you inthenthitive clod.
Fixed that for you
Re: (Score:2)
I don't have a lithp! My keyboard doeth, you inthenthitive clod!
-
Re:Dumb kids (Score:4, Funny)
you're an idiot.
And you have the social graces and sense of humor of a striped, horse like animal with a lisp.
Re: (Score:2)
Re: (Score:3)
Re: (Score:2)
Re: (Score:2)
Re: (Score:3)
And how many kids will come crying after they got nothing but MS-Points for their birthday (because they wanted them, remember, kids aren't really the most reasonable people on the planet) and now are accused of cheating?
Could you see how this could maybe ruin a few kids' birthdays?
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Do you arrest the CEO of Smith&Wesson for a bank robbery?
Outlawing a tool and incriminating its maker for its abuse is a dangerous slippery slope.
Re: (Score:2)
What is the arrestable offense here? They put some numbers in a website text box, and it gave them "Microsoft Points" which have only the 'value' that Microsoft ascribes to them -- they aren't even redeemable for cash. If, instead, they had used a code to generate 1.2 million gold pieces in WoW, would that be worthy of arrest? If it were 1.2 million in gold in a single-player-only game, would that warrant arrest?
My point is that nothing was "stolen" -- there wasn't even any arguable "unauthorized compute
Re: (Score:2)
I don't know the law, but I think there may be something in this that would put you afoul of the law. There is probably a limit to the number of codes you can redeem within the context of the giveaway or whatever. Some forum posts claim as high as several thousand points redeemed.
And MS is losing money if someone uses an improper means to get the codes and then spends the points on games. Tho
Re: (Score:2)
Small point perhaps, but: maybe. This argument is used a lot when calculating the harm of music/film/video game piracy but it doesn't hold much water. If Pw|\|3rB01_13 is some 14 year old peon who gets $10 a month pocket money and $100 at Christmas, Microsoft might sell him one or two games a year. Or $100 worth of MS points, whatever. If he gets his hands on $1600 worth of free MS points and goes on a
Re: (Score:2)
Except that some of the things he buys may not be MS products, meaning MS would have to pay for the goods he purchased.
Re:Dumb kids (Score:4, Insightful)
Re: (Score:2)
In this case, stolen bits doesn't == lost sale. In this case, stolen bits == sale for the publisher. Microsoft has to pay the publisher of the game with real money that was bought with stolen bits. Also, congratulations on your ethics, that allows you to rationalize your behavior to this degree.
I don't get the "stolen bits" argument at all, but an even better comparison is generating gift card activation codes. Plain and simple fraud, bit or no bits.
Re: (Score:2)
Surely all these people who 'stole' several thousand dollars worth of MS Points would have purchased them, had they not been able to obtain them by generating codes, therefore Microsoft suffered financial damages.
Re: (Score:3)
What is the arrestable offense here?
Making fools of a company rich and powerful enough to buy your arrest and punishment.
Re: (Score:2)
This is, sadly, not illegal.
Re: (Score:2)
Cheaters never win
Obviously, you don't play on XBox Live.
Re: (Score:2)
Yeah, really, when I was 11, the most likely place to go for computer help was from us 11 year old kids, as it seemed that a huge portion of the computer literate population was that age at that time. I'm not sure why today's kids would be so feeble intellectually as to make that true.
Re: (Score:2, Insightful)
Go spend some time with a group of "today's kids." Then watch Idiocracy. Then weep as the truth becomes clear to you.
Re: (Score:2)
Well, to be fair, I don't think it's an intellect issue. I'd say most kids have an intellect that's just fine.
They just don't use it.
If anything, it's laziness (partially due to lack of necessity), lack of ... ambition, one might say... lack of interests in anything but [insert wastes of time here], etc.
In short, it's kind of a parenting issue, I suppose.
Re: (Score:2)
i point it at society's need for instant gratification.. most kids and people now days don't want to do something that might not work or takes time/energy/brains/effort to complete, when there is something easier to do.
It's not so much being lazy because they are doing something most of the time.. even if it is just playing a game/watching tv/talking/texting/surfing the net.
it's kinda sad really
Re: (Score:2)
Not my kids. They're plenty smart and technically literate (mostly self-taught too).
But we are not a typical family... in good ways and bad,
Rick
Re: (Score:2)
the ratio of kids that can do such things is probably the same, it's just that computers are everywhere now.
So i submit that you are wrong. and so is idiocracy... atleast in the regard that we're getting dumber.
Personally I would suspect that as far as strictly intelligence is concerned, we're the exact same as we were whether you compare to gen y/x/baby boomers/ 500 years ago. Just that knowledge and how quickly knowledge is available upon demand, has changed.
Re: (Score:2)
"This method took a little more work out of the user, but it was still simple enough for a 12 year old to figure out."
Huh? When I was 12, I was programming in assembler.
So... this would have been simple enough for you to figure out when you were 12. Right?
Re: (Score:2)
Re: (Score:2)
I met my elementry school bully as an adult once; the last thing I said to him was "No", when he asked if I wanted fries with that. (true story)
Re: (Score:2)
Re: (Score:2)
Huh? When I was 12, I was programming in assembler.
Huh? When I was 11 I was bitbanging RS-232 at 300bps using a telegraph straight key. Got to the point where I could emulate a TTY well enough that I could launch vi and edit a file. We won't go into my privilege escalation exploits... ah, misspent youth.
Luxury. When I was 11 we used to dream of 300bps. We had to whistle FSK sounds directly into the 110bps modem, and if we failed two sign-ons in a row our teachers would thrash us with their belts.
Re: (Score:2)
Huh? When I was 12, I was programming in assembler.
Huh? When I was 11 I was bitbanging RS-232 at 300bps using a telegraph straight key. Got to the point where I could emulate a TTY well enough that I could launch vi and edit a file. We won't go into my privilege escalation exploits... ah, misspent youth.
Luxury. When I was 11 we used to dream of 300bps. We had to whistle FSK sounds directly into the 110bps modem, and if we failed two sign-ons in a row our teachers would thrash us with their belts.
Well, when I was 11 we had to mind link with our living quarters nano-bot hivemind just to get the wall display to turn on the ultra-porn and we only did that for the ironic nostalgia of it when we're bored of watching the 3D vids on our retinal implants. Pardon me, while I matter make up some popcorn and consider uploading myself to the compumatter dyson sphere or just getting that extra thumb on each hand upgrade, I hear it only takes a minute. TTFN, apeman.
Re: (Score:2)
In fairness to Gates, he's willingly given away something like $39 /billion/ dollars of his own money through philanthropic and charity efforts [businessinsider.com]. Even as a stockholder in MS, I doubt he cares much about $1.2 million. But there were probably some chairs thrown in Ballmer's office...
Re: (Score:2)
Actually, for that format, you could use all of any repeating number. For the more "advanced" CD Key which had 4 digits in the first group, you just had to change the 4th digit until it worked (i.e. 9990-999999999, 9991-999999999, etc.)
Re: (Score:2)
I imagine seeing a ship off in the distance with a Microsoft Windows logo flag flapping in the wind. A cool breeze from the East and the sails go up. The pirates raise their colors and proceed to bombard the ship with cannon balls. They pull aside the ailing ship to seize their booty while off in the distance they see an armada of Microsoft ships coming their way. They act quickly, taking everything they can manage before re-boarding their ship and setting sail.
Re: (Score:2)
Re: (Score:2)
You're implying MS has management skills?
I think reality is the opposite: MS has plenty of technical skills but management is so utterly incompetent the company is unable to put most of the technical skill to good use.