Server Database Tables / In Game DevTools

In the last week of March 2009, Ziot crawled in to check out his money-making prospects on Al'Kabor. His first visit to Temerityguild.org was in the third week of March. Then he returned 9 days later to begin hacking into our TPS database. Background: We track our TPS info in a program called EQdkp. Those letters stand for EverQuest Dragon Kill Points. For years now, every new member of Temerity has registered in TPS by entering their character name, email address, and choosing a password. There are non-members in there, too, such as guests, former members, potential apps, etc. We have over 300 people in that database, including many that stopped playing long ago.

Ziot's goal was to use PHP and SQL exploits to extract our character names, email addresses, and encrypted passwords from the EQdkp SQL database. Then he would use cracking programs to un-encrypt the PWs.

He was successful.

There is no doubt about it. We have logs of the exploits happening, in-progress. Within an hour or so on March 30th, Ziot pulled out all the TPS user data and took it back to whatever Summer's Eve box he lives in to de-hash the passwords. One day later, on a March 31st, he made his post on Markee Dragon about accounts for sale on Al'Kabor.

The premise of his hacking method is that people re-use their passwords. Not everyone does, all the time. Some people do use one password everywhere on the web. Most re-use passwords to a lesser extent. Ziot's goal is to get a PW and then check it against any and all logins he can find for that person. We have logs of him googling Temerity member names "+email", We have logs of him viewing profiles of the stolen accounts for email and IM names. When he gets a password from one place, he tries it everywhere else. Including in forums. PM boxes are another source of logins. Having control of an email attached to an EQ account allows him to get EQ station names, change user info, and mine emails for data like CC info, date of birth, and secret question answers.

It spreads like a fungus. He gets in the messages of Person A. In there he finds a login/PW from Person B that was sent when they were worried about missing a flag. Then he tries that PW on the login sources he can find for Person B. And so on.

The first accounts he stole, like Stingy and Perrin, were "one password everywhere" types. Those are easiest to take. As the weeks went on, he was able to reel in more. Like Nilwein, Louieman, Gnatzilla, Derechai, Rumour, Nulien, Nepthys and more. In some cases, he couldn't get control of the email attached to the account, but had just the station login. These hijacks were more likely to be stripped and abandoned, since they aren't as easy to sell. Ziot's earliest sales were the accounts of retired, semi-retired, or leave-of-absence players. They were less likely to immediately notice and call SOE customer service to get the account flipped back. Other accounts, like Gnatzilla, he would strip of items and leave.

The information he's stolen does include some non-Temerity members. People leveling up that guested on raids. People that applied but later returned to their old guild. You folks are at risk.

Now you know how it happened, who did it, and why it was mostly Temerity characters being sold. He was getting it from our EQdkp program.

We've pulled the system offline and won't bring it back up until it's protected. Ziot and his friends (like Tump) won't get any new passwords. We're focused on the pool of thefts already out there and are recovering those accounts. We'll get help from both the original account holders and SOE. We take the thefts very seriously. SOE takes the thefts seriously as well. SOE Legal is involved. SOE Fraud is involved. A genuine legal complaint has been filed. One of the victims may be putting something together to send to the credit card company Buerhaus used on the stolen accounts. Because there are victims both in and out of our guild, we intend to fully identify Brett Buerhaus here on the forums. We'll also post about password security measures at risk Al Kaborians can take to protect themselves.

Part of what made our server special, and an attractive home for many, are the things we didn't have. Like Macroquest exploits or a 'real money' market for characters, items and plat. Account thieves, you are another PC element we never had on Al'Kabor. I think our community is going to show you that you are not welcome here.