PSA: Microsoft/Xbox Users

Sidewinderpb · 12-18-2015, 11:29 AM

Guys, do yourselves a favor and setup the 2-step verification feature on your Microsoft accounts, if you haven't already.

My account (and PayPal account) was compromised on Tuesday night, nothing came of it. I changed all of my passwords and moved on.
Thursday night it was breached again. This time, the guy purchased $800 worth of in-game currency - charged to my PayPal account. Had I setup the 2-step feature, this likely wouldn't have happened.

TL;DR: There are plenty of scammers and fat kids out there. None of us are safe. Set up risk mitigation measures!

P.S. The asshole left everything he purchased on my account...

gtron · 12-18-2015, 03:37 PM

was it through clicking links and/or password guessing?

Sidewinderpb · 12-18-2015, 03:56 PM

Are you asking how they got the credentials? I can't say for sure. Perhaps a brute force cracker?

gtron · 12-18-2015, 10:47 PM

yea, to be more specific i was wondering if it was from cross site request forgery, click jacking, cross site scripting, session hijacking, or password brute forcing. but if you didn't perform any noticeable actions i would guess password brute forcing. no worries. glad you got it sorted.

12-18-2015, 11:29 AM	#1
Sidewinderpb Banned 329 Rep 1,739 Posts Drives: 2017 340i xDrive 6mt Join Date: Nov 2013 Location: CT iTrader: (7)	PSA: Microsoft/Xbox Users Guys, do yourselves a favor and setup the 2-step verification feature on your Microsoft accounts, if you haven't already. My account (and PayPal account) was compromised on Tuesday night, nothing came of it. I changed all of my passwords and moved on. Thursday night it was breached again. This time, the guy purchased $800 worth of in-game currency - charged to my PayPal account. Had I setup the 2-step feature, this likely wouldn't have happened. TL;DR: There are plenty of scammers and fat kids out there. None of us are safe. Set up risk mitigation measures! P.S. The asshole left everything he purchased on my account...
	Appreciate 0 Tweet Quote

12-18-2015, 03:37 PM	#2
gtron powerhouse 708 Rep 1,628 Posts Drives: 2014 Porsche 981 CS Join Date: Feb 2011 Location: Orange County, CA iTrader: (1) Garage List 2016 Mercedes C450 AMG [10.00] 2016 Lexus RC 200t [0.00] 2014 Porsche [9.50] 2012 550i M-Sport [7.86]	was it through clicking links and/or password guessing? __________________ no signature. except for this one.
	Appreciate 0 Quote

12-18-2015, 03:56 PM	#3
Sidewinderpb Banned 329 Rep 1,739 Posts Drives: 2017 340i xDrive 6mt Join Date: Nov 2013 Location: CT iTrader: (7)	Are you asking how they got the credentials? I can't say for sure. Perhaps a brute force cracker?
	Appreciate 0 Quote

12-18-2015, 10:47 PM	#4
gtron powerhouse 708 Rep 1,628 Posts Drives: 2014 Porsche 981 CS Join Date: Feb 2011 Location: Orange County, CA iTrader: (1) Garage List 2016 Mercedes C450 AMG [10.00] 2016 Lexus RC 200t [0.00] 2014 Porsche [9.50] 2012 550i M-Sport [7.86]	yea, to be more specific i was wondering if it was from cross site request forgery, click jacking, cross site scripting, session hijacking, or password brute forcing. but if you didn't perform any noticeable actions i would guess password brute forcing. no worries. glad you got it sorted. __________________ no signature. except for this one.
	Appreciate 0 Quote