How hackers are stealing your stash with no 2FA

"

alpacalypse#1488 wrote:

Guys, I think there is some sense to this. I just tried opening my stand alone client, and pressed login without typing in my password and i managed to login. Is this normal ? There seems to have some session cached somewhere.

"

shootandrise92#3727 wrote:

So moral of the story is don't party up with random people, so the question is how do I trade with someone? If I need to invite them to a party to go to their instance? What's the safest way to play atm?

"

StinbrarKekw#5642 wrote:

Posting this here as it needs to gain more attention.

There is a a possible vulnerability in POE where a hacker can steal your account session token by initiating a trade window with you in game. Numerous reports and evidence of this support this conclusion. If you accept the trade request they can login to your character using an account pivot technique that does not trigger any 2FA and they do NOT need your password. They gain access to your stash, steal your currency/gear and then they're gone.

Typical scenario that many users have reported:

1. You list an expensive item or try to buy an expensive item
2. The hacker pings you to trade
3. The hacker opens a trade window with you
4. The hacker cancels the trade and then logs off
5. They wait for you to log off and then use your hijacked security token to instantly login to your character and rob you
6. This does not trigger any 2FA since they are already "authenticated"

Something that may reset the token if you suspect you are a victim of this:

1. Do not log off
2. Open a second POE client
3. Log in with the second POE client
4. You will be kicked off the other client
5. Close the other client

"

Your session token can only be used to login from your IP, very often even only from the same device (HW-ID). People who got ripped off have been much more likely infested with a keylogger when visiting any RMT websites.

"

iadapt#7831 wrote:

"

Your session token can only be used to login from your IP, very often even only from the same device (HW-ID). People who got ripped off have been much more likely infested with a keylogger when visiting any RMT websites.

This doesnt seem true from my experience. I use both standalone client, and GeForce Now cloud gaming.
Switching between the two is a different IP, and completely different PC. So every switch should trigger the email. But for some reason only about 1/5 actually triggers the email verification.

As a personal experience, its convenient not having to check my email everytime, but it also shoves the lack of security in my face with is concerning.