stop hackers, keyloggers

[Devile]

Like 6 months ago, when I was still a GM, there was this mass hacking were like 40 ppl were hacked in just one day. Password changed, items stolen/deleted, coins stolen. This happened like 3 days in a row. ppl from all servers in a matter of seconds.

Password was the same for all the ppl hacked in the same day. Some were even ingame. When we looked the IP, the same IP showed in all accounts. Same password, and same pattern (no coins, no items not even pots).

411, Forsete, Uarehistory and lots of high level players were hacked and completely striped. Guess was some sort of attack that mass changed passwords for all those chars in matters of seconds and then ppl in a LAN center started to steal their shit cause K2 had to IP ban to make this stop.

Months later, almost all lvl70's char from diez got hacked too. IP matched all characters. Stories like this go on and on. As u can see, this is not someone sharing his account.

These are clear cases of sql injection, db hacking or exploiting security holes in the website. This still happens and the only difference is that hackers noticed there's little benefit on stealing someone's item when u can create a GM account instead and farm legit items. Its quiet and doesnt draw attention to them. Why hack someone else when u can farm and get even better items and nobody will know/complain about it? GM commands are not a secret anymore. Lots of ppl know how to use a GM account, how to move arround, spawn bosses and farm. By the time K2 notices there are more GMs than the ones created by them, its too late and items are spread in hundreds of different accounts, ready to sell on ebay.

[Gollum]

Originally posted by Devile
Right now I'm pretty sure there's a security issue and ppl are able to access any account, need to investigate more. They just need the accountid. What happened to me was exactly the same. First thing the hacker tried was my charid and it matched my accountid like most ppl who played from the start. After that, I never used the same accountid for a char.

The bug used to hack me was related to cookies security. U could change the userid in the cookie and log on the web as anyone. Obviously u needed the userid of your victim, not even the password, and from there change the email and send the password there.

Like this, there have been other security issues.

As i told on the other post, a friend got his hacked account back. All he did was telling a friend the login, and his friend recovered his account. Same with a noob mage that were hacked in december, he is getting the account back for me.
I using dirty ways to get it back becouse k2 dont let me another option to.

[festo]

IM GONNA HACK ZERO MU HA HA HA :P

[Tweety]

I downloaded and installed this program just for try but when i try to uninstall it back it says "deep freeze must be disabled" btw i cant see any icon to disable program,and i cant disable it =s any 1 knows how to uninstall this?

[Road]

This is an interesting discussion. You guys all sound very knowledgeable about what you are talking about. So you're telling me that I can never tell anyone my account IP and I can still get hacked by some lamer exploiting website security defaults? Well, where do these hackers learn the defaults to begin with? I don't know if you guys can answer my question since I don't know how to ask it myself.

[GedKalessin]

Originally posted by Tweety
I downloaded and installed this program just for try but when i try to uninstall it back it says "deep freeze must be disabled" btw i cant see any icon to disable program,and i cant disable it =s any 1 knows how to uninstall this?

ok here how to

once you install deepfreeze, you will have a icon on system tray, you have to held down SHIFT and double click on this icon, and one window appear to insert your password, if you dont have one it will ask you to creat one, make a passwrod and you will see choices

boot frozen
boot thawned next 1,2,3,4 restart etc, and
boot thawned

choose boot thawned, it will reboot you deepfreeze disabled, and now you have to run installation file of deepfreeze again,
and choose uninstall

thats it.

this is why deepfreeze is safe, and no one can disable it remotely, and on your own computer they will need password, there are some ways to uninstall without password but no need to explain here, most public connections protected by deepfreeze.