Account hack "Megathread"

Overlord Pizza·Jan 23, 2019·14 votes·12,421 views

Didn't see any rule against making a megathread about people claiming to have their accounts hacked. I'll provide links to some of the posts i've been able to find (although i didn't dig that far for any of them).if you've got more posts feel free to link them in the comments (i guess). In the hopes to create a conversation about this whole thing and also possibly get a rioter to see this.

Yes one of those posts is mine so i'm biased on this matter.

My opinion on this whole thing. I don't think riots response has been adequate personally. I feel like i've been dismissed by their support staff as "another person asking to get unbanned after doing something bad", Even though id personally never script in any competetive game (and the fact that it wasn't even from my ip). I also feel like alot of the points you ask them just get straight up ignored which just feels frustrating. Also the fact that riot doesn't have any notification system when someone logs in from a new ip is just dumb. Riot should definetely have implemented some two factor authentication system by this point, doesn't even have to be an authenticator app like even email or sms verification increases security by alot. They should also adress the community about this as i'm sure these "my account has been hacked" posts will only be increasing till riot adresses this. I understand it might be hard for riot to distinguish between "people spoofing their ip/buying boosts who use scripts" but just straight up dismissing(which i feel has been done to me personally) the players that get caught up in messes like this seems like bad business practice in my opinion. Also think its unreasonable to believe that people script on accounts that they have poured alot of money/time into and doing stuff like spoofing their ip instead of just buying a level 30 account (which i dont condone personally but if someones gonna cheat id say that's the more likely option) and cheating on that instead.

That's all i had to say thanks for reading and for a continued good discussion [slayer-pantheon-thumbs]

26 Comments

LauchmelderJan 23, 20196 votes

I agree with your opinion about 2FA, it's needed asap.

Having said that it's not as easy as you think it is. Logging in from a different IP could mean that you moved somewhere else for example. Or you're in a system with dynamic IPs that gave you a different one because your usual IP is currently in use.

Accounts also don't really get "hacked" a lot. Most of the times someone else just aquires your login info via phishing or a keylogger.

Overlord PizzaJan 23, 20193 votes

[{quoted}](name=Shuriman God,realm=EUW,application-id=ZGEFLEUQ,discussion-id=djMR501N,comment-id=0001,timestamp=2019-01-23T23:01:47.267+0000)

I agree with your opinion about 2FA, it's needed asap.

Having said that it's not as easy as you think it is. Logging in from a different IP could mean that you moved somewhere else for example. Or you're in a system with dynamic IPs that gave you a different one because your usual IP is currently in use.

Accounts also don't really get "hacked" a lot. Most of the times someone else just aquires your login info via phishing or a keylogger.

I'd say logging in from a different ip should warrant a check if it's actually you though its not like your email/phone suddenly disappear if you move somewhere. also im pretty sure 1 they check more than just ip to confirm its you and 2 can go of off external ip so it wouldn't be that much of an issue (there's alot of similar systems already out there like on ubisofts client that work rather well). lastly i know full on "hacking" doesn't really happen on an individual level im talking more about data breached passwords and such (phishing as well to a certain extent although that's got more to do with the individual not having proper "etiquette" when it comes to scepticism on sites that offer free rp etc, still shouldn't warrant a perm tho).

UnboundHadesJan 23, 20195 votes

most of the people that have their account "hacked" either let someone at their house on their account, gave away their information to a scam site and dont want to admit it, or had their password written down somewhere where someone in their house could get access to it easily.

no one is going to legit hack your specific account

Overlord PizzaJan 23, 20197 votes

{quoted}

most of the people that have their account "hacked" either let someone at their house on their account, gave away their information to a scam site and dont want to admit it, or had their password written down somewhere where someone in their house could get access to it easily.

no one is going to legit hack your specific account

You know that there's tons of data breaches that have happened recently. People have passwords compromised all the time, It's not unreasonable for a player to have their account password compromised. Also i personally never leant my account to anyone, stayed away from scam sites never write down my password (p sure no one in my family knows what league is anyway). Also when people refer to "hacking" as in cases like "my account was hacked" it usually refers to compromised passwords/accounts not actual hacks.

hacking in the literal sense pretty much only happens to large companies (which can lead to data breaches in the long term depending on what was recovered) but thats pretty much never what's being refered to in posts such as the ones i've linked.

Flash Tibbers ezJan 23, 20194 votes

{quoted}

most of the people that have their account "hacked" either let someone at their house on their account, gave away their information to a scam site and dont want to admit it, or had their password written down somewhere where someone in their house could get access to it easily.

no one is going to legit hack your specific account

Fam I literally voice chatted with the hacker of 888leoj's account, I was playing with him thinking it was leoj but after a few games I realized it was the hacker.

Tuition FeeJan 24, 20194 votes

Yes, because a huge wave of people suddenly gave an untrustworthy friend their passwords.

TrulyBlandJan 24, 20191 votes

Scripters get banned in waves. There's no need for something happening suddenly.

That is, to be perfectly honest, also the strongest argument that at least a large majority of the current bans are not the result of a security breach. Most of the incidents that people were banned for must have happened quite a while back. And yet somehow people only started complaining once their accounts were banned and not when they were hacked. I know some people might not have noticed (because the hackers apparently only want to use your account for cheating and don't change the password or anything) but all of them?

Don't get me wrong, two factor authentication absolutely needs to be finally added, if for no other reason than to make these cases less ambiguous to those who cannot verify what actually happened.

Overlord PizzaJan 24, 20193 votes

{quoted}

Scripters get banned in waves. There's no need for something happening suddenly.

from my understanding the "waves" only happen when riot finds a new cheat that's been going around and start banning people over it, not when someone uses an already detected cheat (which I'm guessing is what the hackers are doing). it'd be strange if riot doesn't ban people using cheats they already know of rather quickly.

That is, to be perfectly honest, also the strongest argument that at least a large majority of the current bans are not the result of a security breach. Most of the incidents that people were banned for must have happened quite a while back.

if you check my op.gg every game after that sivir game was played while i was asleep. I've even got chat logs of friends that spoke to the person who breached my account, linked in the first comment on my original post.

And yet somehow people only started complaining once their accounts were banned and not when they were hacked. I know some people might not have noticed (because the hackers apparently only want to use your account for cheating and don't change the password or anything) but all of them?

As wuks (the board developer) posted about earlier you now need access someones email to change their password or email at all so its alot harder to actually hijack someones account instead of just getting them banned by cheating on it. i also didn't have any incriminating information (paypal or credit card stuff) linked to my account so there's really not much other than trying to get it banned a cheater can really do.

Don't get me wrong, two factor authentication absolutely needs to be finally added, if for no other reason than to make these cases less ambiguous to those who cannot verify what actually happened.

yes real two factor authentication needs to be implemented, it'd help prevent pretty much all of this mess.

TrulyBlandJan 24, 20191 votes

{quoted}

from my understanding the "waves" only happen when riot finds a new cheat that's been going around and start banning people over it, not when someone uses an already detected cheat (which I'm guessing is what the hackers are doing). it'd be strange if riot doesn't ban people using cheats they already know of rather quickly.

The point of ban waves is to make "testing" impossible. If Riot banned cheaters the instance they cheat it would be fairly easy to run automated tests with various accounts and determine what exactly Riot is able to detect. At that point it would be much much easier for them to write new scripts that go by undetected (at least for the time being).

if you check my op.gg every game after that sivir game was played while i was already sleeping. I've even got chat logs of friends that spoke to the person who breached my account, linked in the first comment on my original post.

I wasn't commenting on your case specifically. I also don't really have any way to confirm that those were indeed the games you were banned for.

My main point is that every time there is a ban wave, without fail, the number of complaints about allegedly hacked account skyrockets. And I simply choose not to believe that all of those people were blissfully unaware of the fact that somebody else played on their account, which also means the hacker must not have changed the password (or as of late was unable to do so), which in turn requires a pretty weird motive to hack another player.

As wuks (the board developer) posted about earlier you now need access someones email to change their password or email at all so its alot harder to actually hijack someones account instead of just getting them banned by cheating on it. i also didn't have any incriminating information (paypal or credit card stuff) linked to my account so there's really not much other than trying to get it banned a cheater can really do.

Whether there's not much more a cheater can do or not... the question remains why they would do it. Even if it seems equally pointless, the scenario that has happened time and time again (which is that people stupidly decide to try out cheats or pay an untrustworthy booster) seems more plausible to me, I'm sorry.

Tuition FeeJan 24, 20193 votes

Yes, except in many of these cases Riot staff actually agrees that the accounts were compromised, but just won't do anything about it.

Telephone BoothJan 24, 20191 votes

{quoted}

most of the people that have their account "hacked" either let someone at their house on their account, gave away their information to a scam site and dont want to admit it, or had their password written down somewhere where someone in their house could get access to it easily.

no one is going to legit hack your specific account

Lol i agree with the first part... sounds logical and most likely. But "no one is going to legit hack your specific account"? So no one has ever had their account hacked? What?

Overlord PizzaJan 24, 20191 votes

i can't read apparently. disregard this comment as it was a response to something i didnt need to respond to lole.

AquaDestroyer38Jan 23, 20195 votes

Yeah, I never understood why almost every other online service (games included) has 2 factor authentication. Whether that be SMS, E-mail, or separate authenticator app.

Riot really needs to get with the times here, lol

Weiss GuertenaJan 24, 20194 votes

It's honestly baffling how League still lacks even the most basic security features, especially with the "you're responsible for everything happening on your account" stance. You can't outlaw door locks in your country and then say that it's homeowners' fault once they get burgled.

Had my account hacked some time ago and was lucky that the hacker didn't do anything ban-worthy before player support managed to return it for me, but not all people are. Something definitely needs to be done.

ModmichaelchanJan 23, 20193 votes

####~~Q: Hello riot, I was wondering if you have any updates for two-step verification?~~

######~~A: We actually do!~~ We know this is something players have been asking about for a while, and we’re happy to announce that the ~~wait is almost over~~. Starting this year, you’re going to be getting verification requests when you try to log in to your League of Legends account on the website to make changes to your account, or when you perform other tasks that may require a higher level of security. We’ve already been requiring two step verification for the past few months to log into the account management portal. For those who haven’t experienced it yet, it’ll be pretty simple in practice:

When you try to log in on a new device for the first time, a code will automatically be sent to the email address linked with your League of Legends account.

That code will get you logged in, that device will be added to a list of “trusted devices.” AKA, you won’t need to do it again next time.
That’s it. Those are the two steps. We just put a third bullet here because those two looked lonely all by themselves.

Verification codes will be sent straight to your email address, and next year we’re going to be looking into whether or not it makes sense to develop a mobile app-based solution for two-factor authentication.

https://nexus.leagueoflegends.com/en-us/2018/11/ask-riot-k-da-evelynn-and-poros/

Overlord PizzaJan 24, 20195 votes

{quoted}

We know this is something players have been asking about for a while, and we’re happy to announce that the ~~wait is almost over~~. Starting this year, you’re going to be getting verification requests when you try to log in to your League of Legends account on the website to make changes to your account, or when you perform other tasks that may require a higher level of security. We’ve already been requiring two step verification for the past few months to log into the account management portal. For those who haven’t experienced it yet, it’ll be pretty simple in practice: 2. That code will get you logged in, that device will be added to a list of “trusted devices.” AKA, you won’t need to do it again next time. 3. That’s it. Those are the two steps. We just put a third bullet here because those two looked lonely all by themselves.

https://nexus.leagueoflegends.com/en-us/2018/11/ask-riot-k-da-evelynn-and-poros/

"higher level of security" meaning stuff like changing password and emails yes? you don't need to do either to get someones account banned (for example) which was part of my point of bringing up 2fa in my original post. I meant that it should be implemented in a more general sense (like steam or battle.net's authenticator for example) where you'd need to use some sort of authorization method when logging into your account on a new device for any reason not just for account management. that's also in my experience what people mean when they say "league requires 2fa" or "where's our two factor authentication riot".

GatekeeperTDSJan 24, 20192 votes

You don't need to know someone's password to get their account banned?

Please explain.

Overlord PizzaJan 24, 20191 votes

{quoted}

You don't need to know someone's password to get their account banned?

Please explain.

when did i say that? yes you need someones password to breach an account. you don't need their permission to do anything but change password though (it's the only place where riot will send an email to you if someone tries to access the page where you can).

SaezioJan 24, 20192 votes

{quoted}

"higher level of security" meaning stuff like changing password and emails yes? you don't need to do either to get someones account banned (for example) which was part of my point of bringing up 2fa in my original post. I meant that it should be implemented in a more general sense (like steam or battle.net's authenticator for example) where you'd need to use some sort of authorization method when logging into your account on a new device for any reason not just for account management. that's also in my experience what people mean when they say "league requires 2fa" or "where's our two factor authentication riot".

My perception was that 2fa will ALWAYS be used to login from new device but additionally will be used for ANY device when changing passwords etc. English is not my main though

Overlord PizzaJan 24, 20191 votes

{quoted}

My perception was that 2fa will ALWAYS be used to login from new device but additionally will be used for ANY device when changing passwords etc. English is not my main though

that's not how the current system works though. right now the only thing that even gets you notified of a breach is when they try to change the password/email of an account and nothing else. otherwise my and others accounts wouldn't have been breached in the first place (unless your email is compromised as well i guess). can understand the confusion though, that post is pretty ambiguous on that fact lol.

TrockaFlockaJan 25, 20193 votes

I was hacked today! Dude only got 2 games in before I changed my info but I added people from the recently played games since his scores were pretty damn high and sure enough he was scripting. Hope I don't get banned for this or I'm gonna be fucking fuming.

Overlord PizzaJan 25, 20191 votes

{quoted}

I was hacked today! Dude only got 2 games in before I changed my info but I added people from the recently played games since his scores were pretty damn high and sure enough he was scripting. Hope I don't get banned for this or I'm gonna be fucking fuming.

heres to hoping it doesnt get banned. could make a support ticket about it or something but idk how helpful they'll be in ensuring that it doesn't, might help you avoid the wave though.

RockkedJan 24, 20192 votes

2FA is a must need for people who actually spend time and money on the game. Getting an account that you have spent countless amounts of money and time into just so it can get compromised and banned would make most people quit the game honestly.

Email Support 47Jan 24, 20192 votes

I feel sorry for anyone that has had their accounts permanently banned and disputed it with evidence to back up not being at fault/responsible. Riot support staff just don't care and you're only a number in their ticket queue. Next in line please...denied...NEXT!

SaevumJan 24, 20192 votes

There are plenty of threads regarding security lacks in the support section. Let's better make more skins.