***PSA*** Origin EA Account Hacked

[xBiffx]

FYI to all users of EA Origin for online PC gaming.

Before I begin, please make sure that you go into your Origin account settings and setup Login Verification. This sets up a phone number that you can receive text messages on so that anytime you login or do any changes to your account (password, OriginID, etc.) you are texted another verification code that you must enter to gain access.

Now, to my story to provide background on this issue. I began receiving a random email from what appeared to be EA/Origin about three months ago. The email was very infrequent, maybe 3-4 emails in the last three months. The email was also completely in Russian. I use Gmail so I reported the emails as phishing and thought nothing about it, especially because I couldn't read them.

Well, today I get another email, this time in English from EA/Origin. It tells me that my email address has been changed from my Gmail to cross240@mail.ru. This time, I took a little more notice and what doing a bit of the OMGWTFBBQ dance. Anyways, there was information in the email with a link in case this change wasn't authorized I could revert back to the original email address. The email also said I should change my password once I logged back in. So I went ahead and clicked the link and reverted to my old email. I think logged into my account and changed the password.

This is where is gets scary/interesting. As I was doing this, the hacker was receiving (as was I) emails indicating changes being made to the account. This is the real scary part. As I was making the changes, the person was able to log in just before me and revert or negate those changes. So when I logged out and then went to login and check, I was unable to go into the account. Clicking on the "I forgot my password link" wouldn't do me any good because the email for that was going to the hacker's Russian email account, not mine. I was effectively locked out of my account.

Now, when I did login, I did a little looking around in the account settings and made some changes before I logged out. The hacker had changed my OriginID (which can be used to gain account access with lost password requests), my name, my country, and my language. They also "purchased" a free Need for Speed game. Luckily it was free.

Ok, so moving on. I got in contact with EA support to try and rectify this issue. That process sucks and I won't go too much into it but basically, you can't call them, you have to login and give them your phone number and they call you. Anyways, the guy I got was over in the UK and I told him what was going on. He immediately said, yes, this is a hacker and we've seen this a lot. He began trying to rectify the situation and get everything re-secured. The funny part (at this point I have to laugh to avoid wanting to murder someone) was that as he was changing things on his end, the hacker again was actively in the account changing them back. The tech support guy was like "Wow, this is the worst case we've seen, this guy is actually on right now stopping us from fixing this." So, the tech pulls out his trump card and completely deactivates my account as to allow for only him to make changes and prevent emails being sent to the hacker's account that changes are being made. While doing this, he sets up the additional security with the Login Verification that I mentioned at the beginning. When he gets done, he has some verification emails and texts sent to make sure I can see them and can access the account and can reset things back to normal. All is well again, so we end the call.

All was not really over. Not five minutes later, my phone starts absolutely exploding with text messages containing verification codes. Nearly 100 messages come in (about every 20 seconds) before I decide its time to get in touch with EA again. After EA calls be back I tell the new tech person what's going on and they are like yeah, sounds about right. Its no surprise to them. The only way to fix it is to have them change the email address on the account, which also changes the login. The problem was that the hacker still knew the ID (email) so they could continue asking for a password reset over and over which would spam out text messages with verification codes for the newly activated Login Verification. So, begrudgingly, I give him a new email address which finally ends this ridiculousness. Note: the tech advised me to change my OriginID to something else because that can be used to gain access to a locked account. The tech also, smartly went about changing the email address on the account. He changed it twice, once to a fake donthack@ea.com account and again to my new account. Had he just changed it to the new account, the hacker would have gotten that information. He would have received the same email like the one that started this mess that the email had been changed on the account.

tl;dr: Follow the first paragraph. Also know that EA is aware of huge holes in their security and aren't doing anything proactive about it.

 

[PowerYoga]

something similar happened to me, but i caught the guy in the middle before he could change the e-mail. Funny thing because I only had 1 game installed on it (ME3) and haven't touched the account in 6 months.

Origin has shit security and you need to watch it like a hawk.

 

[Red Hawk]

How could the hacker have changed your email address, in a way that Origin/EA informed you of, without having access to your email account? I'd figure that email confirmation is necessary for such a change.

 

[StinkyPinky]

How could the hacker have changed your email address, in a way that Origin/EA informed you of, without having access to your email account? I'd figure that email confirmation is necessary for such a change.

Brute force attack, get into the account, then change the email?

I would think using a complex password would solve these problems. Also preventing login attempts from different geo locations.

Am curious as to how complex the OP's password was.

 

[xBiffx]

How could the hacker have changed your email address, in a way that Origin/EA informed you of, without having access to your email account? I'd figure that email confirmation is necessary for such a change.

That is the huge hole that I don't have details on and EA isn't going to let people know about. They initiated the Login Verification system as a band-aid because they haven't filled that hole yet.

Also, I think its part of the way you recover a lost password. When they change your email and you forget your password (like me) because you haven't logged in for a while, the reset email goes to hacker's email instead of yours. They click a link that lets them enter new password. But again, how they got in originally is still a question. However, once they are in, its easier for them to stay in.

 

[xBiffx]

Brute force attack, get into the account, then change the email?

I would think using a complex password would solve these problems. Also preventing login attempts from different geo locations.

Am curious as to how complex the OP's password was.

nnnllllLs

n = number
l = lower case letter
L = upper case letter
s = special character

 

[artemicion]

I don't get it. What's the security hole? How'd your account get compromised? Was the e-mail about the e-mail address a fake and your info got stolen when you clicked the link in the e-mail? How do you know this is EA's fault?

 

[xBiffx]

I don't get it. What's the security hole? How'd your account get compromised? Was the e-mail about the e-mail address a fake and your info got stolen when you clicked the link in the e-mail? How do you know this is EA's fault?

Both tech's at EA are more than familiar with the issue. Eerily familiar. Also, the first one indicated that the Login Verification was initiated as a band aid. I don't have to do too much more to connect the dots.

I never clicked on any fake email.

 

[StinkyPinky]

Both tech's at EA are more than familiar with the issue. Eerily familiar. Also, the first one indicated that the Login Verification was initiated as a band aid. I don't have to do too much more to connect the dots.

I never clicked on any fake email.

Well, today I get another email, this time in English from EA/Origin. It tells me that my email address has been changed from my Gmail to cross240@mail.ru. This time, I took a little more notice and what doing a bit of the OMGWTFBBQ dance. Anyways, there was information in the email with a link in case this change wasn't authorized I could revert back to the original email address. The email also said I should change my password once I logged back in. So I went ahead and clicked the link and reverted to my old email. I think logged into my account and changed the password.

Are you sure this email wasn't a phishing scam? Was the email legit? It may be a bogus password change prompt.

 

[artemicion]

Both tech's at EA are more than familiar with the issue. Eerily familiar. Also, the first one indicated that the Login Verification was initiated as a band aid. I don't have to do too much more to connect the dots.

I never clicked on any fake email.

OMG. Tech support was helpful and knowledgeable. How terrible.

Just because they are aware of how to fix hacked accounts doesn't necessarily mean that it's their fault.

Lots of companies use login verification. Microsoft and Blizzard do it. Doesn't mean their login security systems are broken.

 

[xBiffx]

Are you sure this email wasn't a phishing scam? Was the email legit? It may be a bogus password change prompt.

No. But they already had access at that point.

 

[xBiffx]

OMG. Tech support was helpful and knowledgeable. How terrible.

Just because they are aware of how to fix hacked accounts doesn't necessarily mean that it's their fault.

Lots of companies use login verification. Microsoft and Blizzard do it. Doesn't mean their login security systems are broken.

Listen bud. Type in origin account hacked by russian into Google. Enjoy.

 

[StinkyPinky]

No. But they already had access at that point.

That's the point. He may not have had access. Here's how they scam

1 - Send blind phishing emails to a list of harvested email addresses, at this point they don't even know you're an Origin customer.

2 - You see this email, think "holy crap, someone's trying to hack me" and click on the bogus link that takes you to a replica website that looks legit but is actually just a password harvesting front.

3 - You log in with your "new" password details on that site, they get this info. They now have access.

I'm not saying that's exactly how it went down with you, but that's certainly one way they do it and possibly similar to what you experienced.

 

[Subyman]

Listen bud. Type in origin account hacked by russian into Google. Enjoy.

You can do that for any big service and get tons of hits. I'm still not sure how they accessed your email account to verify the change.

 

[xBiffx]

That's the point. He may not have had access. Here's how they scam

Near as I can tell, they had access for a while now. When I looked at the account and saw that they had purchased the free Need for Speed game, that was done back in November. Again, at no time did I click on any email until the one today. The previous emails in Russian were submitted to Google as phishing.

 

[xBiffx]

You can do that for any big service and get tons of hits. I'm still not sure how they accessed your email account to verify the change.

Ah, but you almost never see the exact same thing, to almost every single detail happening in so many cases. That is unless they are exploiting the same issue.

I used Gmail, nothing else is wrong on my email that I can tell. I also change my password for that at least 3-4 times a year and it was never the same as the Origin password.

 

[MrPickins]

That's the point. He may not have had access. Here's how they scam

1 - Send blind phishing emails to a list of harvested email addresses, at this point they don't even know you're an Origin customer.

2 - You see this email, think "holy crap, someone's trying to hack me" and click on the bogus link that takes you to a replica website that looks legit but is actually just a password harvesting front.

3 - You log in with your "new" password details on that site, they get this info. They now have access.

I'm not saying that's exactly how it went down with you, but that's certainly one way they do it and possibly similar to what you experienced.

This is almost certainly what happened.


OP: Never click a link in an email and then enter your password. Navigate to the site on your own if you need to provide login credentials.

 

[quest4glory]

Something like this happened to me. Not exactly the same thing, but one lazy Saturday morning I saw an email (by chance) that the password to my Origin account was changed. I hadn't logged into the Origin app in almost 9 months.

I changed my password via the reset link on the website. Then I changed my username and email address. Finally, I enacted two step verification.

End result is I have control over the account and there's a Russian version of Battlefield 3 in my Origin Library. Funny thing is I didn't pay for it because the account associated has an expired card.

I would guess EA was hacked and they haven't fessed up, they were or are subject to some sort of exploit, OR recent well known hacks of other companies by Russian nationals produced matching email addresses and passwords. Moral of that possible explanation is stop using the same password on multiple sites. It's a sure fire way to get screwed over sometime soon.

 

[Elixer]

Well, today I get another email, this time in English from EA/Origin. It tells me that my email address has been changed from my Gmail to cross240@mail.ru. This time, I took a little more notice and what doing a bit of the OMGWTFBBQ dance. Anyways, there was information in the email with a link in case this change wasn't authorized I could revert back to the original email address.
...
tl;dr: Follow the first paragraph. Also know that EA is aware of huge holes in their security and aren't doing anything proactive about it.

Origin has 2 step verification, as does Steam, and pretty much everyone else.
Now, if that wasn't enabled on Origin, they still need your Origin password, or, access to your e-mail account.
They have brute force and IP limit on passwords at Origin, so, not sure I follow how there is a security hole here...
If they guessed your password, then they got really, really lucky, or you use the same password on multiple sites, or it was a simple password, or you clicked on a phishing link as was mentioned.

Login Verification is enabled by default these days.

 

[xBiffx]

OP: Never click a link in an email and then enter your password. Navigate to the site on your own if you need to provide login credentials.

The only email I clicked on was yesterday, for the last time! They had access for over a month by that time. They had purchased a game, changed my OriginID, the language (obviously), and the country.

The email I clicked on was legitimate. It went to an Origin password change request. The exact same request that I got when the tech sent me an email while he was on the phone helping me sort it out.

 

[xBiffx]

Origin has 2 step verification, as does Steam, and pretty much everyone else.
Now, if that wasn't enabled on Origin, they still need your Origin password, or, access to your e-mail account.
They have brute force and IP limit on passwords at Origin, so, not sure I follow how there is a security hole here...
If they guessed your password, then they got really, really lucky, or you use the same password on multiple sites, or it was a simple password, or you clicked on a phishing link as was mentioned.

Login Verification is enabled by default these days.

Origin hasn't had two step verification, that is new. IT IS NOT ENABLED BY DEFAULT. That is completely false information. The tech had to set that up for me.

I already posted my password complexity and it was not the same as my email. Does anyone read anymore?

 

[darkewaffle]

It sounds more to me like they had access to your email account. Which was probably due to password recycling and some secondary site being compromised or possibly getting phished.

Either way I'm not seeing the problem with how EA handled it at any rate.

 

[xBiffx]

It sounds more to me like they had access to your email account. Which was probably due to password recycling and some secondary site being compromised or possibly getting phished.

Either way I'm not seeing the problem with how EA handled it at any rate.

I can't see how. Password was changed regularly and was never the same as the Origin password. Also, I have the text verification for my email for unrecognized devices. Gmail also has a built in feature for devices that it doesn't recognize and aren't in your region, such as someone that my have gotten the password, say like Russia. I even went backed and check my Gmail logins and everything is me.

No problem with EA handling it. But without a better explanation, they appear to be the cause of it. I did absolutely nothing on my end to cause this. That leaves Origin as they are the only other source of a security breech.

 

[PowerYoga]

I would guess EA was hacked and they haven't fessed up, they were or are subject to some sort of exploit, OR recent well known hacks of other companies by Russian nationals produced matching email addresses and passwords.

Only reasonable explanation here. It's so easy to dismiss leaks and exploits as user error that people forget security breeches happen and are fairly common. We seem to get at least 1 or 2 major ones each year and numerous unpublished ones.

 

[Elixer]

Origin hasn't had two step verification, that is new. IT IS NOT ENABLED BY DEFAULT. That is completely false information. The tech had to set that up for me.

Not false, just a bit early. It will have it on by default starting today.

IIRC, Origin was asking to turn it on all the way back in April...