LoL account hijacked. Possible flaw in security? Help please!

Comment below rating threshold, click here to show it.

Super Yuri Time

Junior Member

08-07-2012

~15 hours ago
2012.08.06 2400 PST Luvsiq was able to login to his own account and played a game.
2012.08.07 1200 PST Luvsiq was unable to login to LoL account and prompted the message "Incorrect login info."
2012.08.07 1347 PST Unauthorized user is currently on Luvsiq's account and played a Normal 5v5. (confirmed on lolking)
2012.08.07 1438 PST We notice the unauthorized user is playing with two users in multiple games, confirmed via lolking. Junglord and aBlueCrayon.

Unauthorized user gains access to account by unknown means with username and password.
Unauthorized user changed the password and e-mail associated with the username.

Luvsiq's friend's (makaio and ShadFACE) see username Luvsiq logged into LoL NA.
We attempt to communicate with user not knowing that his account was compromised at the time.
Unauthorized user continued to sever ties with everyone else and blocked everyone on Luvsiq's friend list and left Ranked Teams. (attached is a picture of this for confirmation)

Luvsiq is able to post on the forums because he has not logged out and has his information saved to keep him logged into the LoL forums.

A problem I have come to see through these events is that an unauthorized user can gain access to a LoL and hijack an account simply having the password. Once an unauthorized user has the password they can change the password and e-mail associated with the LoL account.

To change the e-mail address associated with the account you simply need a new e-mail address and the current password. The old e-mail associated with the account does not receive a notification of any type saying that there has been a change in the e-mails associated with a LoL account. There’s not even a security question system in place to help with retrieving passwords/e-mails.

After seeing these flaws in the system, I am deeply concerned about the security on LoL for myself and others. I know that myself and others have invested lots of time, and sometimes money into this game.

Granted, you can take precautions to keep this type of thing from happening, but that does not hide the fact that LoL accounts are easy to hijack by simply having the username and password.

There should be an e-mail confirmation system in place where if a user wants to change the e-mail associated with a LoL account, the user should receive an e-mail on the old e-mail account to confirm this action; not flat out change the e-mail under the LoL Account Management page.

I hope that these issues can be addressed and resolved to solve our problems and prevent further incidents like this to happen to anyone else.

Thank you.


Comment below rating threshold, click here to show it.

Admiral Fakku

This user has referred a friend to League of Legends, click for more information

Member

08-07-2012

Bump!


Comment below rating threshold, click here to show it.

LuvSic

This user has referred a friend to League of Legends, click for more information

Junior Member

08-07-2012

I never signed out from the website so I'm currently still logged in here but as you can tell, I can't access my account through the client.


Comment below rating threshold, click here to show it.

LuvSic

This user has referred a friend to League of Legends, click for more information

Junior Member

08-07-2012

The hacker is currently playing with two other players named Junglord and aBlueCrayon at 14:38PST.


Comment below rating threshold, click here to show it.

HuntsAlone

This user has referred a friend to League of Legends, click for more information

Wrenchman

08-07-2012

I am going to assume they changed the email and you already tried to gain it back. If not please follow this link to password recovery.
https://na.leagueoflegends.com/accou...overy/password

If it has been changed please submit a support ticket.
https://support.leagueoflegends.com/...s_requests/new

Good luck.


Comment below rating threshold, click here to show it.

LuvSic

This user has referred a friend to League of Legends, click for more information

Junior Member

08-07-2012

I have done what you recommended already and am just waiting on a response. Thanks for at least checking the thread out.


Comment below rating threshold, click here to show it.

HuntsAlone

This user has referred a friend to League of Legends, click for more information

Wrenchman

08-07-2012

Yeah no problem.
Just remember that you can't get any direct help from the forums and that all account related issues must be sent through the support system.

Cheers.


Comment below rating threshold, click here to show it.

LuvSic

This user has referred a friend to League of Legends, click for more information

Junior Member

08-07-2012

Thanks again.