Windows IT Pro is the leading independent community for IT professionals deploying Microsoft Windows server and client applications and technologies.
  
  
  Advanced Search 


Return to article

Microsoft Admits to Xbox Support Slipups
 

Last week, Microsoft quickly dismissed rumors of a security problem with its Xbox Live online service, but the company came around to the truth of the matter a bit more slowly: Although the Xbox Live service is technically sound, it appears that some Microsoft Xbox support employees have been giving users' personal information to callers without properly verifying the callers' identities. Consequently, some malicious users have been able to compromise Xbox Live accounts using good, old-fashioned social-engineering schemes.

SecurityFocus, an online security forum, first brought up the possibility that Microsoft support employees were coughing up Xbox Live users' personal information. According to the Web site, malicious Xbox users have been bragging online about their ability to easily steal Xbox Live accounts.

"You call 1-800-4my-xbox, pretend to be that person, make up a story about how your little brother put in the information on the account and it was all fake," one user wrote in an online forum. "You might get one little piece of information per call, but then you keep calling and keep calling, every time getting a little bit more information . . . once you have enough information you can get the password (and) the Windows Live ID reset."

Microsoft said it's now investigating this problem and posted a statement about its efforts on Xbox Live Programming Director Larry Hryb's blog. "We are making some pretty top-to-bottom changes to reduce this type of attack," Hryb wrote. "This shouldn't have happened. Clearly, along the way here, people have not followed the policy and need to be educated with the policy."

Contrary to claims that 10 or more Xbox Live user accounts are being stolen every day, Microsoft said that only a handful of Xbox Live accounts have actually been compromised in the past month or so. Microsoft scheduled an Xbox Live service outage for Tuesday, but said that the outage has nothing to do with the account thefts.

In related news, rumors of a new high-end Xbox 360 console appear to be correct. According to reports, Microsoft will soon unveil a new $479 version of the console that includes a larger hard disk, an HDTV-compatible HDMI connector, and the IP Television (IPTV) capabilities that Microsoft first announced in January. A new version of the console has been expected for some time, and Microsoft's discussions about IPTV in January fueled rumors that a new Xbox 360 version would be released this year.







Reader Comments

I guess the question is- Why do the support pesonnel see any personal information for the customer? Call center security 101 - the rep can't give away what they don't have access to.

jersey72 -March 26, 2007

Where are you at will84, shark47, and Waethorn?

Paul's Fact Checker -March 26, 2007

Paul's Fact Checker: where are you at doing justice to your namesake? XP

Waethorn -March 26, 2007

That's your best response, Waethorn? It's just a name. My early posts corrected several factual errors of Paul's. I continue to use that login. I'm not going to create a new login identity for every type of post I make. Get over it. Now, any response to the actual point of this post or should I expect further ad hominem?

Paul's Fact Checker -March 26, 2007

If Microsoft is doing something wrong, I don't think any of us are going to defend it. Microsoft clearly is in the wrong here.

NateB2 -March 26, 2007

"should I expect further ad hominem?" what was that pot and kettle analogy again? XP

Waethorn -March 26, 2007

Again, point out anything disrespectful or ad hominem about any of my posts on this topic. You have not done so yet... at all.

Paul's Fact Checker -March 26, 2007

"Where are you at will84, shark47, and Waethorn?" Well, I was wrong. Microsoft did goof up here.

shark47 -March 26, 2007

It just looks like a DESPERATION move by Microsoft. It’s become apparent in recent months that Sony is going to win the format war in high-def DVD… Blu-Ray will win, and HD-DVD will disappear, likely within a year. So Sony has an advantage in that the PS3 is not only a next-gen console, but gives you access high-def DVD content as well. What does the 360 have in that regard? HD-DVD? HD-DVD is a loser, and will be going away soon. So, when you think about it, Microsoft had to do SOMETHING here. Jumping on the Blu-Ray bandwagon would’ve made them look stupid. So what else is out there? Oh yeah… IPTV and the HD content available there… the 360 could give you access to THAT. Now MS has a selling point to (sort of) match the PS3’s, regarding the console giving you access to HD content. The problem is, IPTV is available only in a very limited number of locations (yet). But availability will improve, and I guess they can keep pointing to their HD-DVD drive add-on for awhile yet, until it becomes obvious even to the suckers that HD-DVD is going bye-bye in the market. This is a decent defensive move on Microsoft’s part, one that they can spin/market as an ‘aggressive/offensive’ play, even though its really just a reaction to the writing on the wall regarding HD-DVD.

boomkin -March 26, 2007

@NateB2 "If Microsoft is doing something wrong, I don't think any of us are going to defend it. Microsoft clearly is in the wrong here." Yeah, but the overriding opinion from all the anti-Microsoft posters here is that all of us that support Microsoft blindly and are willing to defend them in anything they do. Nevermind that pretty much all of us who support Microsoft are also quick to point out when they've made a mistake - such as this one.

jersey72 -March 26, 2007

"point out anything disrespectful or ad hominem about any of my posts on this topic." how about every single post with your name? XP

Waethorn -March 26, 2007

"Again, point out anything disrespectful or ad hominem about any of my posts on this topic. You have not done so yet... at all." I'll bite. "Where are you at will84, shark47, and Waethorn?" What does this have to do with Xbox slip-ups? Nothing. The inferrence is that those people tend to fall on the side of Microsoft in debates. You are inferring that they will try to defend everything MS does, whether right or wrong. That could be construed as "fanboyism" and an affront to their character. Consequently, the above phrase is ad-hominem - it does not address the topic at hand and instead attacks the character of several people.

NateB2 -March 26, 2007

Stop fighting, girls. You're all pretty. "it appears that staffers at Xbox support have been giving up users' personal information to callers without properly verifying their identities. " This is almost a non-story, considering how few people it really affects. Now if Microsoft would 'fess up to the very REAL problems they have with xBox 360 reliability, THAT would be a story. As is: *yawn*.

lotsamystuff -March 26, 2007

@Paul's Fact Checker- "Where are you at will84, shark47, and Waethorn?" Why would you even post something like this unless you were attmepting to start a flame war? Go lurk elsewhere... --tayme

tayme -March 26, 2007

"This is almost a non-story, considering how few people it really affects." for once, i'll agree with losta on this one. (don't laugh - it won't happen too often) 12 out of 20 million isn't very much at all! i'm sure losta knows this all too well. ;) sorry, that was just too easy. XP

Waethorn -March 26, 2007

For once, i'll agree with losta on this one. (don't laugh - it won't happen too often) 12 out of 20 million isn't very much at all! i'm sure losta knows this all too well. ;) People whom have more miles on their snowblowers then on their automobiles should not throw hockey pucks in their glass houses. Your right though it is a non-story. Vista (SP1)

Yawn! -March 26, 2007

....and people whom have more miles on their donkeys than on their wives should learn a thing or two about a thing or two. XP

Waethorn -March 27, 2007

Wait, didn't I call this last week? ""It's pretty well known the clan who hijacked his account. They flaunt their abilities." Yeah, their abilities to get a moron to tell them the password." -Me So I was wrong about 'which' moron. So I apologize for assuming the attackee was the moron. More oft that is the case. The initial story ran with there being a breach in the XBL security model. That never was and still isn't the case. The model is fine, the part where humans are in the loop broke down because humans are humans. Here's a novel idea, know how all of those phone conversations are recorded? Time to sue. Assuming the 'l337 haxxor' was dumb enough to call from a home phone, sue for identity theft. But more importantly, sue Microsoft for misconduct and civil neglegence. With the convos it won't be hard to prove, and it's even worse for Microsoft admitting a breach of protocol. Normally, I'm against lawsuits, however look at what Microsoft is going to do to correct this otherwise. Most likely, they will simply fire a few phone monkeys to put the fear in the rest to fly straight. This will work for a few months, until the fired phone monkeys are gone. The problem isn't in the phone monkeys, it's in the manager. He should instill this fear 24/7, so he needs to be fired. If you bring a lawsuit into the equation, then the problem gets shifted. A phone monkey isn't going to be defending Microsoft's actions at the support level. No, it's going to be the manager over the whole thing, and once's the dust settles, and the gross misconduct brought to light in the face of this king phone monkey, he'll be gone. Not only that, but his replacement will have fear of job security, which should make things work much more smoothly. -- *Phone monkey is not a derogatory term for any race,ethnicity,religious affiliation,nationality,etc. It is a derogatory term for someone who spends their life answering phonecalls from 16yo 'haxxors'.

will84 -March 27, 2007

"Normally, I'm against lawsuits, however look at what Microsoft is going to do to correct this otherwise. Most likely, they will simply fire a few phone monkeys to put the fear in the rest to fly straight. This will work for a few months, until the fired phone monkeys are gone." nah. lawsuits don't help the consumers any. really, if you've ever worked in the service industry you'd know that all you have to do is give some stuff out for free and then everything's hunky-dorey again. Microsoft just needs to give out some free 1-year subscriptions to XBOX Live, and everybody's happy. XP

Waethorn -March 27, 2007

"Now if Microsoft would 'fess up to the very REAL problems they have with xBox 360 reliability, THAT would be a story." What issues? Sony needs to fess up about why my PS3 clicks like a posessed demon if I move it while there is a disc in the tray. And I'm not talking about shaking, more like sliding it to plug in the ethernet to the nic. I had to pull the power, it was going crazy. My xbox has been rock solid. Now granted I didn't get one of the first ones, waited a couple months. Maybe if you have one of the earliest (and thus oldest) and you are xcorex and leave it on 24/7, it might crap out on you. But I've never seen a broke one yet. Which is better than the clicking demon sitting beside it. The press release I'm waiting for is when they release the new X360, effectively shafting everyone who dumped 400 on the 'first gen' one. That's a spot annoying.

will84 -March 27, 2007

So wait, the new XBox is going to cost MORE money than the old versions?? This seems like the real story here. I was planning on buying a few for my new house as media center extenders... will have to reconsider now. And boomkin seems to have no idea how long it has taken to develop Microsoft's IPTV solution. He thinks it is a reaction to poor PS3 sales and BluRay domination? Wow, that's the wonkiest conspiracy theory I've ever heard... I guess IPTV was whipped up in a couple days by Bill working in his garage.

poddie -March 28, 2007
Windows IT Pro Home Register FAQ for Windows WinInfo News
Europe Edition About Us Contact Us/Customer Service Media Kit Affiliates / Licensing  
SQL Server Magazine Office & SharePoint Pro DevProConnections IT Job Hound
Left-Brain.com Technology Resource Directory asp.netPRO ITTV Windows SuperSite 
 
 Windows IT Pro is a Division of Penton Media Inc.
 © 2009 Penton Media, Inc. Terms of Use | Privacy Statement