60 replies to this topic

[openu2]

Recently I have heard many accounts get stolen,
Does anyone know why? lot of active accounts

how can I protect my accounts?

[Boggart]

PIN everything. I mean EVERYTHING to be super safe
Change your password whenever you can, try to make it as complex as possible
Secure your e-mail; change the password to your e-mail to be super safe
Don't click on any links that you're not sure is safe. If you accidently do, change your password
Keep all valuables in your safety deposit box that is pinned
Don't keep too much NP on hand.

I think that's about all you can do.

Oh and record all the information about your account; birthday, e-mail, pets, what's in your SDB/Closet etc. so if something does happen, you can prove its yours

I'm in a helpful mood today

[openu2]

Thanks for answering

HB forum, there are tons of active accounts being sold,
They can crack pin like nothing, do you know how they get the passwords tho?

if they can, no matter how hard you try, they still hack it, (THIS IS A Big THREAT)

Edited by johnnxiv, 20 September 2011 - 08:38 AM.

[Honey]

It was a long time ago that I was at in HB forums.
I think there was a programm for checking mail accounts and passwords.

You make a list like [email protected] and passwords like neopets111, neopets222, neopets333 etc...
Then you let the programm work and see if you can log in with these data.


(Its not a fact, I'm just guessing)

[openu2]

It was a long time ago that I was at in HB forums.
I think there was a programm for checking mail accounts and passwords.

You make a list like [email protected] and passwords like neopets111, neopets222, neopets333 etc...
Then you let the programm work and see if you can log in with these data.


(Its not a fact, I'm just guessing)

I believe so, they can crack pin too,

even you can get back your accounts, but your stuffs will be gone

[Georgina]

Stupid people will never be able to avoid being hacked.

Basicaly you need to keep everything seperate wherever you go neo wise.



Your right, they can get your pin with your email adress, of if you dont pin your email, they will just change your email and then request pin from your neoaccount.

The most common way of hacking is either brute force, as was allready mentioned, using a list of common passwords like password123 and qwerty1 etc etc to trawl through a list of active neo account usernames OR the other way is through other websites, ones you have to sign up to and give information like your neopets username, and email adress, so many people use a single or very few passwords over all thier internet activity, so if you use the same pass on your neo account as your email, or your signup account on these websites as your email or neo account password, then theres a high chance they can get enough info to hack you.

Have a different password for everything you do, especialy your email accounts.

There are other methods of hacking, ie FLP's (fake log in pages) and cookie grabbers, but you have to be pretty unlucky/stupid to get done by one of those.


Good luck anyway, im sure you will be fine

[Waser Lave]

I believe so, they can crack pin too,

even you can get back your accounts, but your stuffs will be gone

Anybody can crack pins given enough time, you give them too much credit.

[Honey]

There are other methods of hacking, ie FLP's (fake log in pages) and cookie grabbers, but you have to be pretty unlucky/stupid to get done by one of those.

Yeah, I'm one of these stupid kids. I though I could snipe a very cheap item in a usershop....

[openu2]

well, we all make mistake,

we all know if you dont pin your email, they can change the email and then change request the pin

but i believe they can crack the pin without the email

[Georgina]

Yeah, I'm one of these stupid kids. I though I could snipe a very cheap item in a usershop....

As i said, it can just be bad luck too

well, we all make mistake,

we all know if you dont pin your email, they can change the email and then change request the pin

but i believe they can crack the pin without the email

And yes, they can, as people have allready answered ;D all it takes is time.

[Boggart]

They can only crack a pin with bruteforce (assuming you didn't stupidly download a keylogger which tracks which keys you press). They can only do it 5 times an hour, which if you use a program amounts to 120 guesses a day. In a span of week, if your PIN is easy like 1111, 1234, 2222 etc. it'll probably get cracked. So make your pin complex such as 6392 or w/e.

I've gotten a few shells cookie grabbed, but they never got away with more than a few hundred thousand NP because I kept everything else pinned.

[iargue]

This thread just makes me facepalm.

Bruteforcing passwords on neopets is a lost cause unless you use a rediculous easy password.

120% of the time, crackers will only try the easy ones (password, 12345, password123 etc) and then move on to the next account.

You get five shots at guessing a password every hour, so 120 guesses a day, which means that a password which contains a random world, number and special character, would take over a year to crack. That is simply not feasible to do, and thus they target the weak passwords. They do what is known as a dictionary attack. It takes the most popular words from the dictionary and tries to guess them. If they cannot guess it, it moves on to the next account.

As for guessing a pin, it is fairly hard but given that they have your password and can change email without confirmation, they can spend a long time doing that. At 10,000 possible combinations, and 120 guesses a day, they can crack it at maximum 83 and a half days. So just under 3 months of stealing your account.

Given that you are not an idiot, hopefully you can recover your account before then.


(Neopets security sucks badly, but can be countered by not being stupid)

[Ladida]

One of the first ways you can prevent your account from being frozen (unrelated) is not to use the same username across forums, especially when on one forum, your signature there has a link directly to your shop

[openu2]

The thing is, the hackers, why dont they hack inactive accounts?

inactive is much safer, right?

iargue, I dont know how, but they crack pin very fast,

[Ladida]

And on that said forum, you're freaking out about keeping accounts safe, so it's extremely easy to associate the two.

[Sammiantha]

The thing is, the hackers, why dont they hack inactive accounts?

inactive is much safer, right?

iargue, I dont know how, but they crack pin very fast,

Sure it's safer, but there's profit to be made (I guess) in active and inactive accounts. I'm just glad selling accounts obtained like this isn't allowed on these forums.

There has also been a rise in inactive accounts for sale obtained through the unregistered emails method.

[Epidote]

Seeing these kind of threads makes me want to go through and change all my passwords, everywhere. will make a busy night.

[Ziz]

Basically if you do this, you can rest without wrries of getting hacked:

PIN everything. I mean EVERYTHING to be super safe
Change your password whenever you can, try to make it as complex as possible
Secure your e-mail; change the password to your e-mail to be super safe
Don't click on any links that you're not sure is safe. If you accidently do, change your password
Keep all valuables in your safety deposit box that is pinned
Don't keep too much NP on hand.

keep everything seperate wherever you go neo wise.
Have a different password for everything you do, especialy your email accounts.

Also, don't forget having a good antivirus, because things like keyloggers and spyware can get you even if you have the craziest ever-made passwords.



And if you ever find something fishy like objects or np moved to/from your account; or they have tried to guess your pin too many times (after 5 tries, TNT doesn't let that account try again),
just log out and log in again, change password, and do a virus scan.

.

The thing is, the hackers, why dont they hack inactive accounts?

inactive is much safer, right?

iargue, I dont know how, but they crack pin very fast,

They lock the pin after 5 failed tries, and you'd have to wait about an hour after that to try again.
Considering that a day has 24 hours, you can try 120 pins a day (considering a program doing it without stopping).
Now, with 4 digits, there are 10,000 posibilities...

Sure, so fast.

[Darkthrone]

If somebody really wants your account they will get it. The way people are PIN cracking bypasses the 5 tries and hour limit so they just brute force it until it cracks, same as with birthdays. Regularly change your password/PIN and make sure all your PW's are different. If you use only 1 password they will be able to get any linked accounts, your email, facebook, bank blah blah. Obviously don't visit sketchy sites or use programs from untrusted sites.

[Ziz]

If someone doesn't want their account stolen, nobody will take it.
But that involves doing research and taking the adequate actions.

Obviously a player who has achieved enough as to be the target of account hacks would do it.
And if he/she doesn't then he/she hasn't learned enough about the game yet.

How can anyone get into your account if you do it right?
(always browse with script protection, a good antivirus, strong passwords/pin security both on neopets and on e-mail and never give out passwords)

Even if you commit a mistake on your security, you should be able to recognize it and act swiftly to correct it.

[openu2]

This thread just makes me facepalm.

Bruteforcing passwords on neopets is a lost cause unless you use a rediculous easy password.

120% of the time, crackers will only try the easy ones (password, 12345, password123 etc) and then move on to the next account.

so HB is the creator of bluteforce?, is it safe to surf their forum?

[Scot]

so HB is the creator of bluteforce?, is it safe to surf their forum?

What is your age, race and native language? Please humor me.

[Maloo]

so HB is the creator of bluteforce?, is it safe to surf their forum?

Do you mean fluteforce?

[Therion]

Do you mean fluteforce?

Clearly he meant Lute force.

I was unable to find a witty image of a lute.

[openu2]

I mean Bruteforcing passwords, LOl