Discussion Hacked account

[Goldra]

In this morning, in Houndsmoor server (Spain), one player have been hacked. The hacker sells all the event buildings and GB, most of them over level 100, and waste all the fp that the player had. As a leader of a guild, he kicked the stronguest players.
After sending some tickets from diferent players, Inno return some of the event buildings and give blueprints and resources to build again the GB.
We have posted this situation in the spanish forum, and the answer we received is:
- Its a player matter to have a weak password that can be easily hacked or to give to someone the password.
- GB cant be returned to their levels because the information about the investments in every level cant be replaced.
- They know who is the hacker, they have stopped him sometimes, they have legal actuations on the way against him, but they are slow.
- They ask players to have strong passwords.

I can understand the answer, but what i cant understand is, if you know that there are hackers destroying cities, why dont you make a stronger database that allows you to recover a full city, like a security copy of windows.
Have something like these, happened in other servers? Do the security of our cities depend only of how stronger is our password?

 

[Pericles the Lion]

I've not heard of players' accounts being hacked in the US server. However, in this instance, I agree with INNO. I don't think that it is their responsibility to protect players from their own laziness. Creating a strong password is incredibly easy.

 

[-Alin-]

I've not heard of players' accounts being hacked in the US server. However, in this instance, I agree with INNO. I don't think that it is their responsibility to protect players from their own laziness. Creating a strong password is incredibly easy.

Isn't only the password, internet conexion matters also(I mean if he's connecting from different places, internet cafes, work internet, etc), the webpages he acces and gives his data, e-mail and so on ...
But if a hacker targeted You, it will make "everything" to breach Your account, it doesn't matter how strong Your password is, nor If You use a VPN, he will anyway sooner or later "take care" of Your account
I don't trust InnoGames servers nor their security, seems very weak to me, 2fa should be here, phone verification also would be great and the possibility to see whos/which dispositive and when was used to acces the game, but InnoGames is lacking all of these.

InnoGames/Forge of Empires should be able to revert everything to the point when the account has been compromised(when they have the real proof regarding to what happened, not family issues-girlfriend taking care of his buildings because she went mad- but real proof with different ips/mac adresses) not only some blueprints as "mercy" ...
Don't believe them when they are saying they can't, they have every data of each player, levels, even the forge points You donated, all are stored numbers, it's just their bad behaviour in all of these, and I don't care about their German s...t, whatever is called.
When they are giving beta test accounts in new temporsund, they are giving 60-80 level great buildings from scratch, without any donor in them, they could revert this, if They really want, to affected players.

As I mentioned, this game is lacking some important things, some allerts would be great also, "device x accesed Your game at 00:00, it was You?"

 

[CrashBoom]

- GB cant be returned to their levels because the information about the investments in every level cant be replaced.

actually they can return levels

a long time Inno accidentally reset many high level Kraken to level 0

they restored the levels (automatically with a script or so)
and then (for players who have disconnected the Kraken after it happened) they did it manually

(the donations on previous levels were lost and the levels show me having done them all)

 

[Finkadel]

That happened not only with Kraken, but few other GBs as well, they simply delivered missing levels as if I had leveled them with my own FPs. I vaguely remember that happened while chasing after those who abused a bug at power-leveling Oracle of Delphi - they simply cut levels of all GBs levelled at the time, so they had a lot of restoring to make...

And I happen to know for a fact they can recreate whole city if you (not accidentally, of course... ) deleted all you had - they told me that themselves.

So I don't know why wouldn't they restore your friends city - while being aware is it actually doing of hacker, not just a moment of insanity from player, like in my case.

 

[Finkadel]

The only thing they can't restore is a guild itself. So that mustn't you do...

 

[maff]

I think that if your account is hacked, the person responsible is innogameis, let you know if the password is easy or difficult, in banks it has the highest security and they also violate them, and if they take money from you they are responsible, because here they would have to do The same return the account as it was before it was stolen, innogameis knows how the cities of each one are, said by them and that they `put more security to access the accounts to verify that it is you, in the banks if you want to make an operation they ask you for your phone number and they send you a code without that code you can't do any operations and what was said the bank is responsible if they steal your money, here they would have to do the same

 

[vidicecilia]

I was hacked in Spain Server, too.
I was not playing in this server for a long time, but when I went to see my city in Dinegu, I've discovered that my city was destroyed and all my diamonds (3.000) had disappeared.
I begun this city in August 2012 and it was a dear memory for me. Unfortunately, I lost it.
I talk to Support and they tell me that It happened to me because I wasn't playing in this city. I have no doubt that the responsibles of the server are accomplices of the theft of my account.

 

[Tanmay11]

GB cant be returned to their levels because the information about the investments in every level cant be replaced.

This is BS reason, I know a player on beta(senol64). who had his GBs deleted for whatever reason, a few weeks later inno restored all their gbs to lvl 10 and some 30ish levels on traz.

not to mention, for testing SAAB they created hundreds of accounts here with high lvl gbs

 

[beelzebob666]

Without having all the information I would says they found a compromise here - assuming there is no indisputable proof a hack has happened, inno actually was generous in returning some of the stuff.

The only indisputable proof would be, if multiple accounts were razed from a single IP - and which hacker nowadays does not use vpn - and if the ip leads to a vpn provider, who says that the actual user did not use a vpn... to many points of doubt.

On the argument of a weak password I am with ninja... if someone wants to damage someone specific, there are too many ways... sure, a "secure" password may delay it, but I doubt there is a truly secure way.

 

[Finkadel]

Without having all the information I would says they found a compromise here - assuming there is no indisputable proof a hack has happened, inno actually was generous in returning some of the stuff.

The only indisputable proof would be, if multiple accounts were razed from a single IP - and which hacker nowadays does not use vpn - and if the ip leads to a vpn provider, who says that the actual user did not use a vpn... to many points of doubt.

On the argument of a weak password I am with ninja... if someone wants to damage someone specific, there are too many ways... sure, a "secure" password may delay it, but I doubt there is a truly secure way.

If INNO admited they know it was hacker - what is there to dispute about...? If they admited that, they should restore the city to the state before hacker attack, case closed. No generosity needed, no hard feelings, restore and that is that. They CAN do that - why won't they, I still wonder...

 

[Yekk]

I've not heard of players' accounts being hacked in the US server. However, in this instance, I agree with INNO. I don't think that it is their responsibility to protect players from their own laziness. Creating a strong password is incredibly easy.

The best password is useless if your connection is hacked... A problem even the biggest multi national corps have...The culprit can see the password. Inno is way behind the eight ball in how they handle this sort of problem. Restoring the city would be child's play if they used the tools they already have. I do know of players in the US who have been hacked. Weeks later they get their cities back even though they showed Inno they were the original owners.

 

[maff]

What innogameis has to do is return the stolen cities as they were, once it has been verified that it is the account of the person who has stolen it, it is what they do on several servers and the same thing that banks do if they steal your account on bank reimburses you the stolen money, there is no secure password in the world but more means to make it more difficult for pirates to steal things

 

[Thunderdome]

One has to be wary of what they download off the internet. Viruses, malware, and other programs that sniff your connection will get on your computer. Sometimes we have to make that judgment call when installing something especially if the program itself (on a website) says to disable your scanning program (anti-virus, anti-spyware, etc.) prior to installation. I doesn't matter if you have a password that is like "Ft. Knox" when you download and install stuff that has these items within.

I have my own specific list of programs I download for each computer I own and never download anything else. I also have my password secured and never tell anyone of it, including my other half. But, that's just me.

As to Inno, they should have safeguards in place just in case things like this happen, so they can roll back the account to what it was before the attack happened. At the same token, they should have this in place for when catastrophic things happen like a server gone bad. They should have a backup database at all times at certain intervals so they can act when needed.

 

[Goldra]

Thanks for all your answers!
The spanish forum has removed the trheat 2 days after we created it. They say it cant be done. No, no, no, no... But here, some people talk about situations in the past, where the levels of GB were restored. And the forum moderators here, dont say anything. If it was wrong, or a lie, they should say it. In addition, Spanish Inno Team has some critics about allowing cheaters. There are an audio of a discord call where it shows a group of people, how they use multiple accounts and cheats in GVG.
We are helping the player to grow up again all the GB.

 

[Fire Witch]

How would the Beta team know about the situation on the Spanish servers? Or any other server? Each language version has their own Community Managers and FoE Team. The CMs have the last say, clearly stated in the game rules.
Also, each situation is different and only the player and the respective support staff may know what happened and how to move forward.

I'll close this thread now.