Don't have an account? Click here to Register! Forgot password?

Booted Members - Please Read (Guild leader account compromised)  (Read 1168 times)

Posted on 05 Mar 2014, 10:43:18
Outrack
Several guildies were booted from the guild after Zell's account was compromised
IF YOU NEED TO BE RE-ADDED, PLEASE CONTACT US AS EXPLAINED BELOW

Just ahead of today's scheduled maintenance, a few guildies saw ZellKFF come online and kick several members out of the guild before disbanding it entirely (link to screenshot and additional details here). We have no idea what was behind this as Zell was at work at the time, and we've now confirmed with WP that the guild is still intact - but we felt that the issue needed to be documented here anyway so that everyone is aware of it in case the guild isn't present when maintenance is over or it happens again later on.

We take pride in our sense of unity and assure everyone that there is absolutely no intention to disband the guild, so if you log on anytime in the near future and suddenly find yourself RAWRless please don't panic and contact one of our GM's immediately to sort it out. As always, you can get in touch with us either in-game, on the forum or our IRC channel.

Update: Game is back up and it looks like some of our members were removed from the guild after all. If you've been dropped please let us know so we can invite you back in, we're investigating and will post more information shortly.

Update (ZellKFF):
After submitting the ticket, Njoror contacted me and passed the ticket on to the GM team (see below)

[19:22:10] Alexis:sorc was deleted, but nothing was stolen
[19:22:26] Alexis: char was moved, guildies manually kicked one by one until time ran out and MA started
[19:22:38] Alexis: password was not changed
[19:22:42] Alexis: I have no idea how this is possible
[19:24:24] Njoror: The GMs will be able to see the IPs that accessed your account.
[19:24:28] Njoror: They might be able to track back who it was.
[19:24:37] Njoror: I've sent the ticket to them, they've added it to their queue.
[19:24:43] Njoror: They'll start investigating soon.
[19:25:41] Alexis: thanks man
[19:25:51] Alexis: (sooner than the week it took for the VIP tickets I hope xD)
[19:28:18] Njoror: It'll be today, probably morning.
[19:34:59] Alexis: great, thanks again :)
[19:35:11] Njoror: GM Shark is sharking up your ticket.
[19:35:31] Njoror: She's saying another IP accessed your account but that IP isn't associated with another account, and suggests you immediately change your password if you haven't do so already.
[19:35:42] Njoror: She is restoring the character that was deleted, but cannot do anything with the guildies that were kicked.
[19:35:53] Njoror: Which is what I thought. They'll need to be re-accepted. D:
[19:36:13] Njoror: We can see if we can pull the experience logs of RAWR when it started happening and know which levels each player was at
[19:36:18] Njoror: but that's beyond the GM team, would require our sysadmin.

A GM contacted me in game a few minutes later and immediately restored my sorc. They are continuing investigation for the rest of the issues.

Sadly, for now, we will have to manually re-add everyone to guild...exp might be restored during a future maintenance but that is all we can hope for. I still have no idea who did this and how it was done. I hope the investigation will lead to something. I asked the GM to tell me at least the country or the region of the IP that logged into my account, but they said that they need to wait for the invetigation to be completed before discolsing anything. Wait and see for now.
Last Edit: 05 Mar 2014, 15:59:19 by Outrack

Posted on 05 Mar 2014, 10:46:04
ZellKFF
Thanks Nick. I will be on when server reopens and will clarify the situation then. Until then, I can only assume that it was a malicious act. More details will follow. (sent from my phone)

RAWR guildmaster since 2004
Currently playing: RO2 - channel 5

Posted on 05 Mar 2014, 10:57:24
Outrack
All indications pointed to it being intentional right up until the WP staff confirmed that everything's okay... I honestly have no idea whether this was malicious or not now, either the game's database was saved prior to disbanding and the attack failed or this was just a very obscure bug.

Guess we'll find out when the game goes live again, hopefully it's the latter and that's the end of it :sweat2:

Posted on 05 Mar 2014, 11:16:18
Maxscha
   :mischievous:    *fingers crossed*  :love:

Posted on 05 Mar 2014, 12:47:10
Scribble92
so it appears everyone has been kicked from the guild for some reason. do not fear zellkff is on the case and we'll have it sorted soon hopefully
Scribble92- beastmaster extraordinaire

Posted on 05 Mar 2014, 12:48:38
Scribble92
pm me for an invite in the meantime
Scribble92- beastmaster extraordinaire

Posted on 05 Mar 2014, 12:58:53
Outrack
Update: Looks like some of our members were removed from the guild after all, if you've been dropped please let us know so we can invite you back in. We're investigating and will post more information shortly.

Posted on 05 Mar 2014, 13:14:12
ZellKFF
For your information, this is the ticket I have submitted just now. I hope it gets resolved quickly. Yes, I am pissed off.

Meanwhile, please PM me or scribble92 for a guild invite while this mess gets resolved.

[TOP URGENT] GUILD LEADER OF RAWR - Account hacked, guildmates kicked, character deleted

Hi.
I am the guildmaster of RAWR.

Njoror told me to send you a ticket.

About 30 minutes before planned maintenance, it would seem that someone logged on to my account. I was at work at the time but a guildmate sent me a screenshot:
http://postimg.org/image/5966u1ut5/

That person then proceeded to delete my sorcerer (MrsForge), and then started kicking my guild members, starting from the top of the list. When I logged in after maintenance was over, there were only 20 members left in the guild, the ones who were lowest rank, so I assume that the person ran out of time before maintenance ended.

My main character and guild leader (ZellKFF) was moved, but nothing was stolen or deleted. No items, no zeny.

My passwords were not changed, because I managed to change them myself on the warpportal website (I did so as soon as I found out).

Another strange occurrence is that normally, when you kick a guild member, the guild leader receives the amount of experience that the member had donated. This is not the case - I am still at 18% total guild donation and 48 million exp, with everybody else at 0 (or at the small amount they were at if they were not kicked).

And one final weird thing, when one of my guidmates who were kicked before maintenance logged on just now, they received a message on screen saying "Exodus were kicked from the guild" (this message is normally shown if you get kicked from a guild, but he was never in Exodus. His char name is Hadrubal).

Nothing makes sense.

Could you PLEASE URGENTLY:

- check logs and see what happened
- trace IPs and find out who did this, if anyone
- alternatively, is this just a very strange bug? (seems unlikely)
- restore my sorcerer
- ROLLBACK MY GUILD TO HOW IT WAS A FEW HOURS BEFORE MAINTENANCE so I do not have to add anyone manually again. These people have been here for a long time (some since day 1) and have worked HARD for their experience donation and this is unbearable for most of them.

Sorry for the slightly aggravated tone, I have no clue what is happening.

Please contact me in-game (ZellKFF) or call me on [phone number]

Thanks in advance,

Alexis Borremans
(ZellKFF, guild leader of RAWR)

RAWR guildmaster since 2004
Currently playing: RO2 - channel 5

Posted on 05 Mar 2014, 15:52:53
ZellKFF
After submitting the ticket, Njoror contacted me and passed the ticket on to the GM team (see below)

[19:22:10] Alexis:sorc was deleted, but nothing was stolen
[19:22:26] Alexis: char was moved, guildies manually kicked one by one until time ran out and MA started
[19:22:38] Alexis: password was not changed
[19:22:42] Alexis: I have no idea how this is possible
[19:24:24] Njoror: The GMs will be able to see the IPs that accessed your account.
[19:24:28] Njoror: They might be able to track back who it was.
[19:24:37] Njoror: I've sent the ticket to them, they've added it to their queue.
[19:24:43] Njoror: They'll start investigating soon.
[19:25:41] Alexis: thanks man
[19:25:51] Alexis: (sooner than the week it took for the VIP tickets I hope xD)
[19:28:18] Njoror: It'll be today, probably morning.
[19:34:59] Alexis: great, thanks again :)
[19:35:11] Njoror: GM Shark is sharking up your ticket.
[19:35:31] Njoror: She's saying another IP accessed your account but that IP isn't associated with another account, and suggests you immediately change your password if you haven't do so already.
[19:35:42] Njoror: She is restoring the character that was deleted, but cannot do anything with the guildies that were kicked.
[19:35:53] Njoror: Which is what I thought. They'll need to be re-accepted. D:
[19:36:13] Njoror: We can see if we can pull the experience logs of RAWR when it started happening and know which levels each player was at
[19:36:18] Njoror: but that's beyond the GM team, would require our sysadmin.

A GM contacted me in game a few minutes later and immediately restored my sorc. They are continuing investigation for the rest of the issues.

Sadly, for now, we will have to manually re-add everyone to guild...exp might be restored during a future maintenance but that is all we can hope for. I still have no idea who did this and how it was done. I hope the investigation will lead to something. I asked the GM to tell me at least the country or the region of the IP that logged into my account, but they said that they need to wait for the invetigation to be completed before discolsing anything. Wait and see for now.

RAWR guildmaster since 2004
Currently playing: RO2 - channel 5

Posted on 05 Mar 2014, 16:04:16
Outrack
Ugh, so it was definitely malicious :cry:

Is there any chance the GM can pull a list of members so that we can at least contact them manually, if they don't check into the forum or IRC? The location of the user would help a lot, wonder what prompted the attack...


Posted on 05 Mar 2014, 16:13:50
Scribble92
oh shit thats not good. but atleast you quickly changed your password etc. just a waiting game i suppose as far as the exp donation is concerned and we'll see what happens
Scribble92- beastmaster extraordinaire

Posted on 05 Mar 2014, 20:00:39
Snorkel
 :shock:

that sucks!

Zell who's shit list did you get on :<? strange things indeed

Posted on 06 Mar 2014, 00:22:15
Lein
Lein was awarded 1 point/s for this post
Guys, please remember to use the User Channels to try to find any online RAWR member if you aren't in guild.

Of course, if you are already in guild, remember to have the user channel at hand

To open the user channel go to your friend list (U) then go to the 3rd tab and add the channel "Rawr"
It is literally «R» uppercase and the rest is «awr» lower case (because Im weird)

This way we can contact each other in game regardless of us being in guild or not.

A side note, User Channels gets deleted per character if your client closed forcefully, so remember to re-enter the channel.
A side note 2, User Channels aren't listened in the chatting Tab in the text box by default, you have to right click on it and check the Usr Ch option.
A side note 3, it is much better if you change the System color to something else because if you have more than 1 User Channel the 2nd chat will be yellow just like the System default. (I recomend white)
Nick -> Lein
Leinzan -> Average Rogue!
Aiot -> Monkey Assassin!
Citlalicue -> Cursing Crescentia of the Vengenful Stigma!
Arkenne -> Squishy Tanky Monk

Posted on 06 Mar 2014, 03:53:05
Murmurlade
I got a shock when I pressed 'G' to check who was online and up came the
'You can only use when you're in a guild' message xD

Posted on 20 Mar 2014, 14:44:50
ZellKFF
FYI, "final" resolution:

Greetings,

 I apologize for the delay in response regarding this matter. At this time we will need a little more clarification regarding the guild experience issue you are experiencing in order to investigate further. With regards to your own guild exp, are you saying that you are unable to donate more than 18% at this time? Or that guild experience for your guild is stuck at 18%? For the kicked members, you would not have received the exp from them while they were kicked, and unfortunately we cannot provide compensation for experience they may have donated during that time. Are your guild members currently unable to donate above a certain percentage in the guild? If so at which percentage are they unable to donate? If possible, please reply back with screenshots of the issue you are experiencing.

Unfortunately we are unable to disclose information about the investigation regarding your account being hacked. There was a discrepancy in your IP address however, during the time that your character was deleted and the guild members kicked from your guild. If you have any further questions or concerns, please let me know. I look forward to hearing back from you soon.

Thank you.

Jennifer
Customer Service Representative
WarpPortal Support Team

I am trying to fix guild exp %, but sadly, it seems that we will never know what really happened, and individual exp won't be restored... :cry:

RAWR guildmaster since 2004
Currently playing: RO2 - channel 5

 

SMF 2.0.4 | SMF © 2013, Simple Machines
SimplePortal 2.3.5 © 2013