After some careful sleuthing, Bill Steinberg of Zeboyd Games revealed on his Twitter account Monday some information which raised his brow: a posting on ScriptLance.com, a site for connecting businesses with programmers, entitled “Need 5000 Live Accounds Created” [sic] and states the following:
We need a talented quick team to create 5,000 valid xbox live accounts. They do not need to be made from valid email addresses, but the accounts must be saved and valid.
Must provide CSV with email/usernames and passwords for all accounts.
Note: We have a script that will validate all accounts provided before final payment is released.”
NOTE: We need FREE Xbox accounts set up, not the paid accounts. This is the URL that will be used: https://live.xbox.com/en-US/Signin/Signup?cbcxt=0-aHR0cDovL2xpdmUueGJveC5jb20vZW4tVVMvTXlYYm940
It makes one wonder why any company would need the ability to quickly acquire a script to create 5,000 Xbox Live Silver accounts. There is potential for something nefarious to occur on the service with this number of accounts in the hands of one company in such a short period of time. The programming company ftsfreelane, who was awarded the contract has their CV available as well, and states the following:
C# Web 2.0 Automation
The main objective of the project is to create automated accounts for web 2.0 sites. The project has two parts:
Part 1 Have the following facilities
1. Solve Caphas
2. Dynamic username, password, email and user details.
3. Auto email verification
Part 2 have the following facilities
1. Auto login to the created accounts
2. Post dynamic content for an each account
The job posting was created on March 11, and the contract was awarded on March 18. The site profile for ftsfreelane reveals that it is actually Flourish Technology Solution, located in Channai, TN, India, and consists of 20 programmers. We were curious as to why anyone would want this, so Monday morning we contacted the job contractor, graphic design firm Limitless Exposure, but have not heard back. We’ve also contacted a Microsoft PR representative to ask if this is against their terms of service and whether or not they have anything in place to defend against this, but have not heard back from them as well.
A quick scan of the Xbox Live Terms of Service reveals that “The Service is offered to you conditioned on your acceptance of all terms in this contract. By selecting “ACCEPT” below, you are representing that you are 18 years old (and have reached the “age of majority” if that is not 18 years of age where you live), the information you provided to Microsoft during Service signup is truthful and accurate, and you are attaching your electronic signature to and agreeing to all terms in this contract.” Clearly not all of the information being generated by the requested script, including potentially invalid email addresses, is truthful and accurate.
All of this leaves us with more questions than answers at this point. Are these accounts being used for nefarious purposes, and if so, by whom? Be sure to leave your thoughts below and check back in as we update you on the story.
Source: Bill Steinberg