recent hackings

[Jas]

I posed the hypothetical question in a support-case today : "What is MAs policy, if any, on returning items etc to an avatar who claims to be hacked, posesses a gold card and who involves their local police force".

It's a question about which I'd certainly like to see a statment from MA & I'm sure Im not the only one....

Will post the response when I get it.

 

[EarlVonKippler]

It'll be interesting to see if MA addresses these recent security issues in public. My guess would be "No."

i doubt it as well. however all this bruhaha has made me buckle down and get a gold card as well. i didn't want to get one because i didnt want to have an extra step, i hate inconvienice. however, losing everythign is pretty fricking inconvienent, so i will avoid that one then i guess

 

[Stagger Organic]

yeah ive just purchased a card and reader myself based almost entirely on this recent spate of hackings... i used the skill and inventory calc thats somewhere on that t'internet thing, and seeing as im not worth that much, it seemed like a large percentage for insurance. but considering how annoyed id be if i did get h@x0r3d, i think its certainly worth the investment.

p.s. MA employee selling passwords?

p.s.s.

p.s.s.s. omg 9/11!

p.s.s.s.s.

p.s.s.s.s.s. japery ftw...

 

[Neo]

Sorry for my sillly question...

Ok... Gold card 200ped...
...do i need a card reader too??
for a additional 100 ped...

 

[Skam]

Sorry for my sillly question...

Ok... Gold card 200ped...
...do i need a card reader too??
for a additional 100 ped...

Nooo, dont think so, unless they changed anything
Since you can order a extra card reader if the one you had is starting to get a bit "rusty" or to have a backup. Which reminds me - I should order one. Mine still says project entropia..

 

[demoniac]

Ok... Gold card 200ped...
...do i need a card reader too??
for a additional 100 ped...

No. The 200 ped Gold Card in the tt includes the reader.

The 100 ped card reader is also listed in the tt separately in case you wish to purchase a spare (for the complete addicts who couldn't stand being offline for a few days should their existing one pack up.)

 

[Hally]

goldcard and what everything else said

 

[Neo]

Ok thanks for the info

 

[Arto]

Some great advice in this thread

Just a little more info in case your curious ...

Why you should NEVER use the same login on a forum as you would for a more critical application like EU or your home / company computer.

The forum sends you an email giving your login and password in clear text. You probably keep the email forever so you don't lose the details.

2 easy 'hacks' are now available
Your email is totally unsecure if you use POP3 mail systems (unencrypted) and people can and do manage to intercept pop3 traffic all the time.

Your younger brother / sister, house cleaner or ex can easily read or forward the mail to a mate and you're done for.

And every half decent virus can also gab these password emails from your PC if it isn't protected and patched up to date.

The moral of this thread is GET A GOLD CARD if you want to be safe, and use a complex password for everything else all the time.

Wishing you all a safe and crime free time on line and irl.

Arto

 

[fnalig]

Pe assistant

One guess i have is theese guys tried 2 download Pe. ass. Mine dissapeared a while agoo. And BOY if i was surprised when my antivirus program went TOTALLLY Bazook when i tried 2 download it. So now i play on MAs terms. NO outide game software 4 me anymore. And as i played Runescape since Beta i KNOW third party software IS and always was the biggest crok when it comes 2 "hacking"

 

[Darker_Star]

Hacked Gold Card?

Does anyone know of a case where an account had a Gold Card and was still hacked. I have the card and have had it since they came out. But, with this case of hacking, I'm just wondering if I have to worry.

I do suggest to MA that if they would just explain what would happen to a hacked Gold Card Account, it might go a long way in reducing the stress of this.

DS

 

[safara]

One guess i have is theese guys tried 2 download Pe. ass. Mine dissapeared a while agoo. And BOY if i was surprised when my antivirus program went TOTALLLY Bazook when i tried 2 download it. So now i play on MAs terms. NO outide game software 4 me anymore. And as i played Runescape since Beta i KNOW third party software IS and always was the biggest crok when it comes 2 "hacking"

Where did you download your copy of PEAss from?

Was it anywhere other than http://pe.jongma.org/download.php ??

 

[Chainfire]

One guess i have is theese guys tried 2 download Pe. ass. Mine dissapeared a while agoo. And BOY if i was surprised when my antivirus program went TOTALLLY Bazook when i tried 2 download it. So now i play on MAs terms. NO outide game software 4 me anymore. And as i played Runescape since Beta i KNOW third party software IS and always was the biggest crok when it comes 2 "hacking"

Maybe it disappeared at around the 8.7 VU? A fix was released days after. Maybe you didn't download from my site? Maybe you are using a crappy virus scanner (UPX packed Delphi exe's do cause false positives on some scanners now and again) ? Maybe you don't know what you're talking about?

Maybe you should call the police? Maybe you should have them invistigate me. Maybe I'll cooperate. Maybe that would be a good thing. Maybe it would stop feckin' noobs from badmouthing me and my app, once and for all. Maybe I heard what you said a hundred times before. Maybe every single person who has said PEAss/Chainfire is the culprit was full of shit. Probably.

Maybe you should have something real to back you up if you say stuff like this. Maybe you should just stick to saying "3rd party apps can be a source of h4xx0rs", and not imply other things.

But then again, maybe I am such an evil person. Maybe that's why so many people use PEAss without complaint. Maybe I'm just waiting for Knuckles to install it to push the big red stuff-it-to-MA button. Yes, that must be it.

 

[711]

The advice to use a different password for your EU account than you use for other sites, such as this forum, is very good advice.

In any case, I can assure you that the EF database has not been compromised. Even if it had been somehow accessed by an unauthorized user, the passwords are encrypted in the database. This is standard for all MySQL password database fields, and I am not aware of any instance where a hacker or intruder was able to extract passwords from an encrypted field in a MySQL database. In fact, forum admins have no way of retrieving a user's password, they can only send the user a link to change it themself.

Despite this protection, it is still very good practice to use different passwords for different accounts on various websites.

Also, as many have suggested here and in other threads, if your avatar is at all valuable to you (i.e. worth more than 500 PEDs), you are simply being irresponsible by not ordering a Gold Card.

Mindark provides us a very inexpensive and effective tool to safeguard our accounts, and to the best of my knowledge, noone with a Gold Card has ever had their account stolen, hacked or otherwise compromised.

Best of luck to anyone unfortunate enough to have had their account hacked.

 

[Xandra]

Hi,

doin' a copy and paste here, my usual advice for computer users. I'm in the IT business, and I often have compromised machines here to "heal" - there are some basic rules to get rid of most part of the danger getting "hacked". Which most of the time has really nothing to do with "hacking", but that's another thing.

-----------------------------------------------------------------------
Rules to reach a decent level of security

1. Don't ever use Internet Explorer nor Outlook Express! Well, you'll need IE for Windows Update, but don't do anything else with them! Both have the possibility to very fast shoot your leg - both can be hardened, for sure, but that will make them rather useless ... Most key loggers/ viruses are caught using these 2.
2. Don't ever connect your computer directly to the internet! Always use a router and "network address translation" (NAT), and the hardware firewall the router provides. Let the hardware firewall block anything from outside. This makes your computer invisible to the IN and Mr. evil haXXor will not find it ... An out-of-the-box windows machine takes just minutes to be compromised, connected directly!
3. Always use "safe passwords", and never reuse them! A safe password is at least 8 chars long and contains at least 1 of
   • lower case char
   • upper case char
   • number
   • punctuation mark
   And don't have these passwords saved in your browser - at least not these protecting something of worth ...
4. Don't relay on a Personal firewall! You can use them for controlling outgoing traffic, but they are not of much use to protect you from attacks from the outside - they're on your machine, and if someone has reached it, it wouldn't be this hard to disable or circumvent the personal firewall!
5. Have a good antivirus-tool, and update it daily! The first thing that happens after booting your PC should be the update of your AV tool! Don't panic if you get an alarm - an AV tool worth it's money will do whatever is necessary to protect you: Check what it is saying, maybe write down. You may want to do a double check with another tool - there are some softwares that look like a virus but aren't.
6. If you're using a WLAN, make it safe! Check for firmware updates etc. If you don't really need to use one, don't use it - breaking into a WLAN is ways more easy then breaking into a cable LAN! Using a WLAN and reaching a decent level of security is ways more difficult, you might think of getting professional help!

-----------------------------------------------------------------------

For gamers I might add:

• There are free email providers - use them! Make a solitary email adress for any game you play, where you need an email to participate - and don't use these for anything else! This adds a layer of security - someone stealing your account first needs to get the email adress, then the password - double effort! Don't forget to delete any activation/ password mail on server - save them locally, best just printout and hide in your safe ;-)
• Never ever give your account data to anybody! No, even your mom, wife, hubbie, cat, dog or bird doesn't need it! Both user name and password are yours only, and even game support might perhaps ask for user name, but never for password! And never use a char name as user name - a good user name looks like a password!

For sure, this will not give 100% security. But it gives enough security that the one in front of screen just has to look for obvious threats, and has a good chance to stay safe. It's not complete, it was meant as a fast, easy to understand information for my customers covering the most done mistakes.

And it may be badly translated, it wasn't originally done in english ;-))

But if it would protect one of you out there, my work had payed off.

Have fun!

 

[MrSmith]

Come on everyone, stop blaming 3 party EU software without proof.

Don't be so friggin paranoid, some of us are actually trying to help out to make the EU experience even better.

If you don't wanna download a 3 party software, then don't, but don't come blaming every programmer and 3 party EU programs.

If you don't have any proof of a 3 party software being a Trojan, the stfu.

Some of use spend hours to help out with the EU experience, so the last we need is BS from some paranoid user.

Download the software from the original websites and not from somewhere else.

I have also added the MD5 checksum for the zip file for Autoscreen, on the Autoscreen website. With this you can see if the zip file is original.

 

[dolera]

Come on everyone, stop blaming 3 party EU software without proof.

Don't be so friggin paranoid, some of us are actually trying to help out to make the EU experience even better.

Paranoia isn't bad when it's about security! It is the main reason i would never use [edit: third party] software that is closed source, especially not when it is targetted to a specific audience.
And that's not because i mistrust the software or the author, but because i dont know i can trust it.

If you don't wanna download a 3 party software, then don't, but don't come blaming every programmer and 3 party EU programs.

Agreed, dont blame without proof.
But there is a difference between saying "Don't use third party software if you cant be sure it does not contain anything malicious" (and imo you can only know it if you have access to the source AND understand the source) and "Dont use software xyz because it is suspicious"

If you don't have any proof of a 3 party software being a Trojan, the stfu.

That's IMO BS. It's the other way around. "use unless proven guilty" is plain and simply FALSE when talking about serious security. The only credo here is 'dont use unless proven innocent'.
Now it's all a matter of what standards you use for a proof. For me, that's more than 'no reported keyloggers/exploits/hacks/whatever inside'
This though, as i said above, doesnt justify accusing software just because you have no proof it's innocent.

Some of use spend hours to help out with the EU experience, so the last we need is BS from some paranoid user.

Download the software from the original websites and not from somewhere else.

I have also added the MD5 checksum for the zip file for Autoscreen, on the Autoscreen website. With this you can see if the zip file is original.

As long as software is closed source (and it's the right of the author to keep it close, unless he used GPL-code in it), it's a matter of trust. I for one dont trust someone i dont know.
I understand it doesnt feel right when someone says that your software possibly contains exploits, but as long as we can't verify it does not, live with it.

 

[MrSmith]

It's easy, if you don't wanna use 3 party software, then don't.
But don't come blame any of us trying to help out saying we are all "hackers" and all software are "Trojans".

One of the reasons for not releasing the source codes are misuse of it.

 

[Xandra]

Hi,

Paranoia isn't bad when it's about security! It is the main reason i would never use software that is closed source, especially not when it is targetted to a specific audience.

This is a valid point, but (*1):

One of the reasons for not releasing the source codes are misuse of it.

And this one seems much more valid to me! I don't use Mr. Smith's software so I'll use PEAssistant as an example:

I trust chainfire. I have his homepage bookmarked, and whenever I read about an update, I don't use any link provided in the message, I use my trusted bookmark. And whenever I download something, my trusted av tool checks for possible contamination. Given that my trust isn't something easy to earn this gives me some kind of security.

Would add an open source PEAssistant more security? Not really, I think. I'm not the one able to read the code and check for possible vulnerabilities, and, other than for instance Mozilla, the amount of people willing and able to evaluate the code would be very small to zero, right?

So it would provide no greater means of security. But it would add another vector of attack, using the open source code there could be written hooks exploiting even an unaltered PEAssistant installations to harm the user.

I'm a fan of open source software, and I use it whenever possible. But open source isn't the cure to all diseases of this world, and sometimes it even opens new doors to the evil beings out there. Let's check, think, think again, then decide.

And I'd be very careful about accusing one of our known voluntary 3rd party programmers of being possibly malevolent - these individuals are doing a great work for all of us! If ever something "fishy" would come to knowledge, I'd always first contact the author, giving opportunity to prove false. Imposing false accusations would only hurt myself ...

Have fun!

(*1) So I can speculate you're not playing EU at all?

 

[madman]

Its like that GOOD old christmas saying but for EU ,

A GOLD CARD IS FOR 20$ A HACKING IS FOR LIFE

 

[dolera]

Hi,

This is a valid point, but (*1):
(*1) So I can speculate you're not playing EU at all?

You can speculate... sure, but you're wrong in this case. I was talking about third party software
I'll add that... now, thanks.

I trust chainfire. I have his homepage bookmarked, and whenever I read about an update, I don't use any link provided in the message, I use my trusted bookmark. And whenever I download something, my trusted av tool checks for possible contamination. Given that my trust isn't something easy to earn this gives me some kind of security.

Would add an open source PEAssistant more security? Not really, I think. I'm not the one able to read the code and check for possible vulnerabilities, and, other than for instance Mozilla, the amount of people willing and able to evaluate the code would be very small to zero, right?

So it would provide no greater means of security. But it would add another vector of attack, using the open source code there could be written hooks exploiting even an unaltered PEAssistant installations to harm the user.

I'm a fan of open source software, and I use it whenever possible. But open source isn't the cure to all diseases of this world, and sometimes it even opens new doors to the evil beings out there. Let's check, think, think again, then decide.

very valid points, and i surely see the problems that arise with open sourced pe-ass/other programs.

I think e.g. you are right that not many would volunteer proof-reading the source, but that's not really the issue IMO. - and what follows now is a general statement, not specifically about eu-related software - one of the main benefits of open source software is simply that the author states that he has nothing to hide, so especially no fishy stuff.
There are many other valid things you want to hide, so i'm by no means implying that if you hide your source, you hide fishy stuff!

What i however fail to see is how someone would be willing to install a modified version that is not provided by the initial author (unless they have the same level of thrust in the new author)

Therefore I doubt that open sourcing e.g. pe-ass would result in any modified, maleficious version. Why? Because ppl lack trust in the 'mod peass'.
for example suppose that chainfire releases pe-ass, and i modify it (with or without malicious functions). Would you ever test it? No, because you dont have sufficient trust in me.
The odds of someone succesfully expoiting a currently existing, trusted versions of pe-ass are almost nihil. Why? because of the same trust that is needed.

Anyway, that 'i wont use it if it's closed source' was more directed to third party software that is not targetted to a specific audience (such as fraps). Software such as pe-ass, that has a specific audience (EU-payers) i wont use due to my paranoid skills

 

[Samantha Carter]

Like Chainfire and Mr.Smith said, If you don't want to use 3rd party software then don't. I personally have used PE-Ass and wouldn't play without it any time i played. Its tools are valuable to me and I trust Chainfire's code. However some people may not Know that Chainfire is a respected member of the community, and if i didn't know to trust them then i wouldn't download it either.

Fact of the matter is, if you are a paranoid type, Don't Use it. But not every coder is out to get you, Hell for that matter, Every hacker is not malicious. You can't blame 3rd party programs right off the bat without proof. Calling a paticular program out in blame is shortsighted and down right rude at the very least.

The problem with third party software, ISN'T that it was written maliciously. Its that once people begin to rely on the software and an update comes and they go to the wrong site to download it (Other than the original coders site), Now is where your running into problems. This cannot be placed on the shoulders of the coder. It was not their intent for you to be mislead to another site to DL it. Now im not in anyway saying this is the case with these hackings either. Simple fact is we do not know enough about any of these cases to assume anything. Until Loki or one of the others comes out with more details then we will not know for sure. Im hoping that if one of these guys knows what they did wrong and has the guts to come forward and admit that they may have visited a wrong site to dl software, or opened a strange email with an attachment then we will just have to speculate and protect ourselfs from all possibilities. Which may not be the case either. It may have been done by no wrong doing of the user him/herself.

Seriously though, If your going to blame 3rd party software then do the research. Get your virus protection's out and updated, Turn on your port scanner, Break out your packet sniffer, if you see something out of the ordinary then question it and find out whats going on. If you have no idea how to do this stuff, THEN YOUR NOT QUALIFIED TO PLACE BLAME ANYWHERE. Plain and simple. Ask for someones assistance. Im sure you'll find many people here are willing to show you how to use these tools (assuming you have at least a moderate knowledge of a PC)

But to be quite honest, Im sick of reading threads about Chainfire defending himself to people who have absolutely no idea wtf they are talking about. Learn to test it yourself or Don't use it, those are your options, but FFS stop throwing people under the bus when you have no facts.