Subscribe to Windows IT Pro

 

Get Newsletters

  • Get the Latest News
  • Product Updates
  • Helpful Tricks
  • Productivity Tips

Subscribe Now!

March 26, 2007 12:00 AM

Microsoft Admits to Xbox Support Slipups

Windows IT Pro
InstantDoc ID #95572
Rating: (21)

Last week, Microsoft quickly dismissed rumors of a security problem with its Xbox Live online service, but the company came around to the truth of the matter a bit more slowly: Although the Xbox Live service is technically sound, it appears that some Microsoft Xbox support employees have been giving users' personal information to callers without properly verifying the callers' identities. Consequently, some malicious users have been able to compromise Xbox Live accounts using good, old-fashioned social-engineering schemes.

SecurityFocus, an online security forum, first brought up the possibility that Microsoft support employees were coughing up Xbox Live users' personal information. According to the Web site, malicious Xbox users have been bragging online about their ability to easily steal Xbox Live accounts.

"You call 1-800-4my-xbox, pretend to be that person, make up a story about how your little brother put in the information on the account and it was all fake," one user wrote in an online forum. "You might get one little piece of information per call, but then you keep calling and keep calling, every time getting a little bit more information . . . once you have enough information you can get the password (and) the Windows Live ID reset."

Microsoft said it's now investigating this problem and posted a statement about its efforts on Xbox Live Programming Director Larry Hryb's blog. "We are making some pretty top-to-bottom changes to reduce this type of attack," Hryb wrote. "This shouldn't have happened. Clearly, along the way here, people have not followed the policy and need to be educated with the policy."

Contrary to claims that 10 or more Xbox Live user accounts are being stolen every day, Microsoft said that only a handful of Xbox Live accounts have actually been compromised in the past month or so. Microsoft scheduled an Xbox Live service outage for Tuesday, but said that the outage has nothing to do with the account thefts.

In related news, rumors of a new high-end Xbox 360 console appear to be correct. According to reports, Microsoft will soon unveil a new $479 version of the console that includes a larger hard disk, an HDTV-compatible HDMI connector, and the IP Television (IPTV) capabilities that Microsoft first announced in January. A new version of the console has been expected for some time, and Microsoft's discussions about IPTV in January fueled rumors that a new Xbox 360 version would be released this year.

Related Content:

ARTICLE TOOLS

Comments
  • David
    5 years ago
    Mar 28, 2007

    So wait, the new XBox is going to cost MORE money than the old versions?? This seems like the real story here. I was planning on buying a few for my new house as media center extenders... will have to reconsider now.

    And boomkin seems to have no idea how long it has taken to develop Microsoft's IPTV solution. He thinks it is a reaction to poor PS3 sales and BluRay domination? Wow, that's the wonkiest conspiracy theory I've ever heard... I guess IPTV was whipped up in a couple days by Bill working in his garage.

  • Will
    5 years ago
    Mar 27, 2007

    "Now if Microsoft would 'fess up to the very REAL problems they have with xBox 360 reliability, THAT would be a story."

    What issues? Sony needs to fess up about why my PS3 clicks like a posessed demon if I move it while there is a disc in the tray. And I'm not talking about shaking, more like sliding it to plug in the ethernet to the nic. I had to pull the power, it was going crazy.

    My xbox has been rock solid. Now granted I didn't get one of the first ones, waited a couple months.

    Maybe if you have one of the earliest (and thus oldest) and you are xcorex and leave it on 24/7, it might crap out on you. But I've never seen a broke one yet. Which is better than the clicking demon sitting beside it.

    The press release I'm waiting for is when they release the new X360, effectively shafting everyone who dumped 400 on the 'first gen' one. That's a spot annoying.

  • Joe
    5 years ago
    Mar 27, 2007

    "Normally, I'm against lawsuits, however look at what Microsoft is going to do to correct this otherwise. Most likely, they will simply fire a few phone monkeys to put the fear in the rest to fly straight. This will work for a few months, until the fired phone monkeys are gone."

    nah. lawsuits don't help the consumers any. really, if you've ever worked in the service industry you'd know that all you have to do is give some stuff out for free and then everything's hunky-dorey again.

    Microsoft just needs to give out some free 1-year subscriptions to XBOX Live, and everybody's happy.

    XP

  • Will
    5 years ago
    Mar 27, 2007

    Wait, didn't I call this last week?

    ""It's pretty well known the clan who hijacked his account. They flaunt their abilities."

    Yeah, their abilities to get a moron to tell them the password." -Me

    So I was wrong about 'which' moron. So I apologize for assuming the attackee was the moron. More oft that is the case.

    The initial story ran with there being a breach in the XBL security model. That never was and still isn't the case. The model is fine, the part where humans are in the loop broke down because humans are humans.

    Here's a novel idea, know how all of those phone conversations are recorded? Time to sue.

    Assuming the 'l337 haxxor' was dumb enough to call from a home phone, sue for identity theft. But more importantly, sue Microsoft for misconduct and civil neglegence. With the convos it won't be hard to prove, and it's even worse for Microsoft admitting a breach of protocol.

    Normally, I'm against lawsuits, however look at what Microsoft is going to do to correct this otherwise. Most likely, they will simply fire a few phone monkeys to put the fear in the rest to fly straight. This will work for a few months, until the fired phone monkeys are gone.

    The problem isn't in the phone monkeys, it's in the manager. He should instill this fear 24/7, so he needs to be fired. If you bring a lawsuit into the equation, then the problem gets shifted. A phone monkey isn't going to be defending Microsoft's actions at the support level. No, it's going to be the manager over the whole thing, and once's the dust settles, and the gross misconduct brought to light in the face of this king phone monkey, he'll be gone.

    Not only that, but his replacement will have fear of job security, which should make things work much more smoothly.

    --

    *Phone monkey is not a derogatory term for any race,ethnicity,religious affiliation,nationality,etc. It is a derogatory term for someone who spends their life answering phonecalls from 16yo 'haxxors'.

  • Joe
    5 years ago
    Mar 27, 2007

    ....and people whom have more miles on their donkeys than on their wives should learn a thing or two about a thing or two.

    XP

You must log on before posting a comment.

Are you a new visitor? Register Here

advertisement

advertisement

White Papers

Get your Windows 7 deployment off to the right start by implementing PC lockdown. A locked-down environment is easier and cheaper to support since users are less likely to make unnecessary changes to the core system configuration - read more here!

Essential Guides

Is your iSCSI "lossy"? The reality is that most off-the-shelf Ethernet hardware deployed for iSCSI can lose packets, resulting in slow performance or application downtime. Learn how to assess your current iSCSI infrastructure and engineer an advanced iSCSI SAN infrastructure.

Web Seminars

What's the best way to keep your network safe from malware? In this web seminar, security expert Greg Shields suggests an alternative method to the traditional blacklisting approach that is common with anti-virus and anti-malware solutions.

eLearning Series

We bring the experts direct to you to share their real-world perspective and expertise. During each event, three sessions stream in real time, so you can learn, ask questions, and get solutions.
Upcoming event: Getting the Most with Exchange 2010 with Paul Robichaux

Subscribe to Windows IT Pro!

Windows is a trademark of the Microsoft group of companies. Windows IT Pro is used by Penton Media Inc. under license from owner.