ashtear.net

Hosted => RAWR Guild - Ragnarok Online 2 => Notice Board => Topic started by: Outrack on 05 Mar 2014, 10:43:18

Title: Booted Members - Please Read (Guild leader account compromised)
Post by: Outrack on 05 Mar 2014, 10:43:18
Several guildies were booted from the guild after Zell's account was compromised
IF YOU NEED TO BE RE-ADDED, PLEASE CONTACT US AS EXPLAINED BELOW

Just ahead of today's scheduled maintenance, a few guildies saw ZellKFF come online and kick several members out of the guild before disbanding it entirely (link to screenshot and additional details here (http://forums.warpportal.com/index.php?/topic/146992-guild-disbanding-a-few-mins-before-maintenance/)). We have no idea what was behind this as Zell was at work at the time, and we've now confirmed with WP that the guild is still intact - but we felt that the issue needed to be documented here anyway so that everyone is aware of it in case the guild isn't present when maintenance is over or it happens again later on.

We take pride in our sense of unity and assure everyone that there is absolutely no intention to disband the guild, so if you log on anytime in the near future and suddenly find yourself RAWRless please don't panic and contact one of our GM's immediately to sort it out. As always, you can get in touch with us either in-game, on the forum or our IRC channel (http://ashtear.net/forum/index.php/topic,58.0.html).

Update: Game is back up and it looks like some of our members were removed from the guild after all. If you've been dropped please let us know so we can invite you back in, we're investigating and will post more information shortly.

Update (ZellKFF):
After submitting the ticket, Njoror contacted me and passed the ticket on to the GM team (see below)

[19:22:10] Alexis:sorc was deleted, but nothing was stolen
[19:22:26] Alexis: char was moved, guildies manually kicked one by one until time ran out and MA started
[19:22:38] Alexis: password was not changed
[19:22:42] Alexis: I have no idea how this is possible
[19:24:24] Njoror: The GMs will be able to see the IPs that accessed your account.
[19:24:28] Njoror: They might be able to track back who it was.
[19:24:37] Njoror: I've sent the ticket to them, they've added it to their queue.
[19:24:43] Njoror: They'll start investigating soon.
[19:25:41] Alexis: thanks man
[19:25:51] Alexis: (sooner than the week it took for the VIP tickets I hope xD)
[19:28:18] Njoror: It'll be today, probably morning.
[19:34:59] Alexis: great, thanks again :)
[19:35:11] Njoror: GM Shark is sharking up your ticket.
[19:35:31] Njoror: She's saying another IP accessed your account but that IP isn't associated with another account, and suggests you immediately change your password if you haven't do so already.
[19:35:42] Njoror: She is restoring the character that was deleted, but cannot do anything with the guildies that were kicked.
[19:35:53] Njoror: Which is what I thought. They'll need to be re-accepted. D:
[19:36:13] Njoror: We can see if we can pull the experience logs of RAWR when it started happening and know which levels each player was at
[19:36:18] Njoror: but that's beyond the GM team, would require our sysadmin.

A GM contacted me in game a few minutes later and immediately restored my sorc. They are continuing investigation for the rest of the issues.

Sadly, for now, we will have to manually re-add everyone to guild...exp might be restored during a future maintenance but that is all we can hope for. I still have no idea who did this and how it was done. I hope the investigation will lead to something. I asked the GM to tell me at least the country or the region of the IP that logged into my account, but they said that they need to wait for the invetigation to be completed before discolsing anything. Wait and see for now.
Title: Guild Disbanding Issue - Please Read
Post by: ZellKFF on 05 Mar 2014, 10:46:04
Thanks Nick. I will be on when server reopens and will clarify the situation then. Until then, I can only assume that it was a malicious act. More details will follow. (sent from my phone)
Title: Guild Disbanding Issue/Bug - Please Read
Post by: Outrack on 05 Mar 2014, 10:57:24
All indications pointed to it being intentional right up until the WP staff confirmed that everything's okay... I honestly have no idea whether this was malicious or not now, either the game's database was saved prior to disbanding and the attack failed or this was just a very obscure bug.

Guess we'll find out when the game goes live again, hopefully it's the latter and that's the end of it :sweat2:
Title: Guild Disbanding Issue/Bug - Please Read
Post by: Maxscha on 05 Mar 2014, 11:16:18
   :mischievous:    *fingers crossed*  :love:
Title: Guild Disbanding Issue/Bug - Please Read
Post by: Scribble92 on 05 Mar 2014, 12:47:10
so it appears everyone has been kicked from the guild for some reason. do not fear zellkff is on the case and we'll have it sorted soon hopefully
Title: Guild Disbanding Issue/Bug - Please Read
Post by: Scribble92 on 05 Mar 2014, 12:48:38
pm me for an invite in the meantime
Title: Guild Disbanding Issue/Bug - Please Read
Post by: Outrack on 05 Mar 2014, 12:58:53
Update: Looks like some of our members were removed from the guild after all, if you've been dropped please let us know so we can invite you back in. We're investigating and will post more information shortly.
Title: Guild Disbanding/Booted Members - Please Read
Post by: ZellKFF on 05 Mar 2014, 13:14:12
For your information, this is the ticket I have submitted just now. I hope it gets resolved quickly. Yes, I am pissed off.

Meanwhile, please PM me or scribble92 for a guild invite while this mess gets resolved.

[TOP URGENT] GUILD LEADER OF RAWR - Account hacked, guildmates kicked, character deleted

Hi.
I am the guildmaster of RAWR.

Njoror told me to send you a ticket.

About 30 minutes before planned maintenance, it would seem that someone logged on to my account. I was at work at the time but a guildmate sent me a screenshot:
http://postimg.org/image/5966u1ut5/ (http://postimg.org/image/5966u1ut5/)

That person then proceeded to delete my sorcerer (MrsForge), and then started kicking my guild members, starting from the top of the list. When I logged in after maintenance was over, there were only 20 members left in the guild, the ones who were lowest rank, so I assume that the person ran out of time before maintenance ended.

My main character and guild leader (ZellKFF) was moved, but nothing was stolen or deleted. No items, no zeny.

My passwords were not changed, because I managed to change them myself on the warpportal website (I did so as soon as I found out).

Another strange occurrence is that normally, when you kick a guild member, the guild leader receives the amount of experience that the member had donated. This is not the case - I am still at 18% total guild donation and 48 million exp, with everybody else at 0 (or at the small amount they were at if they were not kicked).

And one final weird thing, when one of my guidmates who were kicked before maintenance logged on just now, they received a message on screen saying "Exodus were kicked from the guild" (this message is normally shown if you get kicked from a guild, but he was never in Exodus. His char name is Hadrubal).

Nothing makes sense.

Could you PLEASE URGENTLY:

- check logs and see what happened
- trace IPs and find out who did this, if anyone
- alternatively, is this just a very strange bug? (seems unlikely)
- restore my sorcerer
- ROLLBACK MY GUILD TO HOW IT WAS A FEW HOURS BEFORE MAINTENANCE so I do not have to add anyone manually again. These people have been here for a long time (some since day 1) and have worked HARD for their experience donation and this is unbearable for most of them.

Sorry for the slightly aggravated tone, I have no clue what is happening.

Please contact me in-game (ZellKFF) or call me on [phone number]

Thanks in advance,

Alexis Borremans
(ZellKFF, guild leader of RAWR)
Title: Booted Members - Please Read (Guild leader account compromised)
Post by: ZellKFF on 05 Mar 2014, 15:52:53
After submitting the ticket, Njoror contacted me and passed the ticket on to the GM team (see below)

[19:22:10] Alexis:sorc was deleted, but nothing was stolen
[19:22:26] Alexis: char was moved, guildies manually kicked one by one until time ran out and MA started
[19:22:38] Alexis: password was not changed
[19:22:42] Alexis: I have no idea how this is possible
[19:24:24] Njoror: The GMs will be able to see the IPs that accessed your account.
[19:24:28] Njoror: They might be able to track back who it was.
[19:24:37] Njoror: I've sent the ticket to them, they've added it to their queue.
[19:24:43] Njoror: They'll start investigating soon.
[19:25:41] Alexis: thanks man
[19:25:51] Alexis: (sooner than the week it took for the VIP tickets I hope xD)
[19:28:18] Njoror: It'll be today, probably morning.
[19:34:59] Alexis: great, thanks again :)
[19:35:11] Njoror: GM Shark is sharking up your ticket.
[19:35:31] Njoror: She's saying another IP accessed your account but that IP isn't associated with another account, and suggests you immediately change your password if you haven't do so already.
[19:35:42] Njoror: She is restoring the character that was deleted, but cannot do anything with the guildies that were kicked.
[19:35:53] Njoror: Which is what I thought. They'll need to be re-accepted. D:
[19:36:13] Njoror: We can see if we can pull the experience logs of RAWR when it started happening and know which levels each player was at
[19:36:18] Njoror: but that's beyond the GM team, would require our sysadmin.

A GM contacted me in game a few minutes later and immediately restored my sorc. They are continuing investigation for the rest of the issues.

Sadly, for now, we will have to manually re-add everyone to guild...exp might be restored during a future maintenance but that is all we can hope for. I still have no idea who did this and how it was done. I hope the investigation will lead to something. I asked the GM to tell me at least the country or the region of the IP that logged into my account, but they said that they need to wait for the invetigation to be completed before discolsing anything. Wait and see for now.
Title: Booted Members - Please Read (Guild leader account compromised)
Post by: Outrack on 05 Mar 2014, 16:04:16
Ugh, so it was definitely malicious :cry:

Is there any chance the GM can pull a list of members so that we can at least contact them manually, if they don't check into the forum or IRC? The location of the user would help a lot, wonder what prompted the attack...

Title: Booted Members - Please Read (Guild leader account compromised)
Post by: Scribble92 on 05 Mar 2014, 16:13:50
oh shit thats not good. but atleast you quickly changed your password etc. just a waiting game i suppose as far as the exp donation is concerned and we'll see what happens
Title: Booted Members - Please Read (Guild leader account compromised)
Post by: Snorkel on 05 Mar 2014, 20:00:39
 :shock:

that sucks!

Zell who's shit list did you get on :<? strange things indeed
Title: Booted Members - Please Read (Guild leader account compromised)
Post by: Lein on 06 Mar 2014, 00:22:15
Guys, please remember to use the User Channels to try to find any online RAWR member if you aren't in guild.

Of course, if you are already in guild, remember to have the user channel at hand

To open the user channel go to your friend list (U) then go to the 3rd tab and add the channel "Rawr"
It is literally «R» uppercase and the rest is «awr» lower case (because Im weird)

This way we can contact each other in game regardless of us being in guild or not.

A side note, User Channels gets deleted per character if your client closed forcefully, so remember to re-enter the channel.
A side note 2, User Channels aren't listened in the chatting Tab in the text box by default, you have to right click on it and check the Usr Ch option.
A side note 3, it is much better if you change the System color to something else because if you have more than 1 User Channel the 2nd chat will be yellow just like the System default. (I recomend white)
Title: Booted Members - Please Read (Guild leader account compromised)
Post by: Murmurlade on 06 Mar 2014, 03:53:05
I got a shock when I pressed 'G' to check who was online and up came the
'You can only use when you're in a guild' message xD
Title: Booted Members - Please Read (Guild leader account compromised)
Post by: ZellKFF on 20 Mar 2014, 14:44:50
FYI, "final" resolution:

Greetings,

 I apologize for the delay in response regarding this matter. At this time we will need a little more clarification regarding the guild experience issue you are experiencing in order to investigate further. With regards to your own guild exp, are you saying that you are unable to donate more than 18% at this time? Or that guild experience for your guild is stuck at 18%? For the kicked members, you would not have received the exp from them while they were kicked, and unfortunately we cannot provide compensation for experience they may have donated during that time. Are your guild members currently unable to donate above a certain percentage in the guild? If so at which percentage are they unable to donate? If possible, please reply back with screenshots of the issue you are experiencing.

Unfortunately we are unable to disclose information about the investigation regarding your account being hacked. There was a discrepancy in your IP address however, during the time that your character was deleted and the guild members kicked from your guild. If you have any further questions or concerns, please let me know. I look forward to hearing back from you soon.

Thank you.

Jennifer
Customer Service Representative
WarpPortal Support Team

I am trying to fix guild exp %, but sadly, it seems that we will never know what really happened, and individual exp won't be restored... :cry:
Title: Booted Members - Please Read (Guild leader account compromised)
Post by: raela on 21 Mar 2014, 07:23:25
For what happened to guild exp..

You yourself have said there is a time right before maintenances where guild exp just won't count/gets rolled back, right? I think it's just some odd server thing.. and so, even though exp was transferred to you from those kicks, the usual exp rollback happened, so that contribution was wiped (but since the exp still belonged to the guild, total exp didn't go anywhere).

And I'm really not surprised they'd refuse to tell you much else about who did it. ;/