What is ICU and why should we as players care about it?
ICU is the Investigations in the Community Unit, a specialist team within the Player Support department. The team are dedicated to the more shady side of RuneScape, dealing specifically with Macroers, Real World Trading, Bug Abuse, Player Safety and Copyright Theft. Traditionally we’ve always been behind the scenes, acting but not speaking!
Our work is extremely diverse, and effects a lot of areas which the RuneScape population probably never know are even a concern. For example, we remove phishing websites by working closely with web hosts, and ensure that any sensitive issues in game are escalated to law enforcement when necessary in order to make sure those individuals are safe.
Care to run us through a typical day at the office? What does the ICU do?
I’d love to describe a typical day in the ICU – when we have one, I’ll let you know!
Our work is so varied no two days are ever the same. One day, we may have to investigate a new bug – how it occurs and what fixes should be put in, who abused it and what gains they made (and decide what action to take!). The following day, we could be looking into an RWT ring who are selling gold to players by taking their passwords, then later stealing the account back to sell on to others.
In a way we’re a little like the team on CSI – our work depends very much on what ‘cases’ cross our desk
Are there any planned future improvements that we can expect to help our security further?
Yes, quite a few! We’ve had a real push this year to do everything we can to help players out. You may have noticed our recent changes to the login applet, the ‘Green Bar’ SSL certification that runs across our login pages, the display names update (which has been a huge success!), CAPTCHA anti-bot input to prevent brute force hacking and so on. There have also been smaller, behind the scenes changes to how we track and ban account hijackers.
In November 2008, as many as 25,000 players were affected by hijacking each month. With a big push this year, the problem is almost 2% of what it was - however, this is just the start. I can’t discuss what we have in the pipeline, but to suffice to say we won’t stop until this problem is gone.
A while back there was an idea proposed to everyone for a security key that would need to be entered, in addition to your password, in order to log in as an optional added security benefit. There was mixed reactions and it sounded like the idea was thrown out completely. Is this idea truly gone or can we expect to eventually see something like this in the future?
The security key, in my opinion, was a really good idea – and I know a lot of people in the community would probably agree. What everyone else seemed to take exception to was how we were planning to implement it. For some reason people seemed to assume that we were bringing it up as a means to make more money – which considering every key sold would be sold at a loss doesn’t really make sense!
The idea is not gone by any means – in fact there are several longer term ideas such as this which are currently being considered. However, it is very much on the back burner for now. We have a lot of details to work out, but we’re serious about account security and exploring as many avenues as needed to make such things work.
Regarding the press release, it was stated that this arrest was the result of a long term investigation. How long does something like this take to reach this stage?
Clearly it depends a lot on how prolific an individual hijacker has been, but the investigation that was publicised was the result of about 3 months work, off and on.
We have to collate all the evidence we can about the hijacker and the effects of them stealing accounts from our own systems. Clearly this means processing a lot of data – snapshots, offence appeals, account appeals, billing changes etc. Everything that can be changed needs to be logged and evidenced. We then start looking at the hijacker themselves, and investigate who they are and whatever relevant information we can find on them.
Once we have everything we can get from our end, we then pass this to the Police (in this case, the PCeU in England, but we do work with the FBI and other local equivalents). They pick up the investigation and will decide how best to approach the case.
There are a number of different laws breached by hijacking. If you are using phishing, this in itself is illegal – both from the copyright theft angle and by the action of knowingly stealing account details. In this particular instance, the individual was arrested on computer misuse act charges. By accessing an account using details you have not been specifically authorised to use, you are in breach of this act.
We are working on some investigations into people who have phished over 1000 accounts – if successful, these could result in reasonable jail sentences or very heavy fines.
What is Jagex doing to help prevent phishing sites from stealing our log in information?
We work closely with a wide range of web hosts all over the world to ensure that sites are removed as soon as they are found. Inside the ICU there are four people whose sole task is identifying and removing phishing websites – and our current average takedown time is just 24 hours.
We’ve got a raft of technical changes in the pipeline to make identifying a phishing website easier for our players, but outside of that the biggest challenge we face is raising awareness of such issues in the community. Letting people know that there are plenty of sites out there which imitate RuneScape.com, or the RuneScape forums, or the login applet is not enough.
We need to ensure that people are taking notice, and that is the biggest problem. It’s not even something we can focus specifically at new players – I’ve seen everyone from a guy with four minutes playtime right up to level 120+’s with billions of GP taken in by phishing scams.
While a big focus is placed on player security with the mini-games, reminders on log-in, etc., there still are players who share account information with friends and family as well as ‘falling’ for the schemes that hackers use to gain control of accounts. Can you explain the current security procedures that are in place to help players to see that they need to take responsibility for their accounts and why it is so important.
You’ll remember a little while ago that we removed the ability to set one of the most commonly used passwords as your RuneScape pass – this went out with much fanfare and really stressed the point that the security of your account really is your responsibility.
Whenever we notice that the security of an account has been compromised, we lock it. This is not like a ban – it stops anyone from logging in and forces any interested parties to submit an account appeal. There’s a 3 day delay on us processing these – that wait allows us to assess all appeals against each other and decide which one is the most valid before granting it. We have other uses for this wait time – see [the question] below
We provide display names, passwords, bank pins and so on as a means to keep player accounts safe. However, these only work if people take advantage of them and in turn keep that information safe. We do as much as we can from this end, but people need to wise up the fact that that ‘epic ban free auto woodcutter’ video on youtube does lead to a keylogger. They need to understand that unless they themselves physically type runescape.com into their browser, the site they are looking at could do anything – even if it looks identical to runescape.com.
One other thing i’d like to stress, and we see it happen more often than you’d believe: if you are hijacked and you do then recover your account – please don’t ever set the password back to the one the hijacker discovered and used to steal it. When you recover with a new pass, and then change that straight back to your old one for convenience, you really are opening yourself up for a protracted battle for control of the account.
What are my chances of getting my account back if it was stolen? How can I prevent it from happening again?
Assuming the account is actually yours, your chances are really good! One of the problems we see a lot with people who are hijacked and then can’t recover their account is that often the person attempting to recover the account is not the original account owner. If the account was previously given to you by someone else, or it was shared for a while and then the original party left the account to you, you will have difficulty recovering it. The only way around this is don’t share accounts, don’t trade accounts and certainly don’t buy them.
That point aside, your best chance is to remember the oldest possible passwords used, good old recoveries, and have an email address set so we can send you a recovery code. That code is an excellent way to help us in the recovery process.
From our point of view, whenever an account is locked for whatever reason, we take the time (during the three day wait) to ‘clean’ the account. What this means is that we remove everything that the hijacker set. His passwords, logins, recovery questions, billing, email address etc all cease to exist for the purposes of recovery. This should mean that they cannot then get your account back once you’ve recovered it!
Of course, this operation is fairly easy when an account has just been hijacked. However, if a ‘clean’ is required on an account that has been shared between two or more parties for an extended period then a clean can often be difficult or impossible – meaning your chances of recovering and keeping the account are minimal. And based on our statistics, 96% of all account shares will go bad at some point. All of this means that sharing of accounts is definitely not recommended!
sry, i failz at typing)
