17 replies to this topic

[aneoguy]

yea so i been playing back on neo for about 3months now.. and about 2 times a week i will see on either AC, BD, or TC accounts getting hacked losing absolutly millions into the hundreds of millions some times,

Should TNT not to be able to stop this from being caught around,

Yeayea there are noobs that hand out their magic word to people who promise them stuff but with these accounts they are smart and change password often etcetc

Makes you kinda feel that your not safe?

Dont you think!

[Romy]

yea so i been playing back on neo for about 3months now.. and about 2 times a week i will see on either AC, BD, or TC accounts getting hacked losing absolutly millions into the hundreds of millions some times,

Should TNT not to be able to stop this from being caught around,

Yeayea there are noobs that hand out their magic word to people who promise them stuff but with these accounts they are smart and change password often etcetc

Makes you kinda feel that your not safe?

Dont you think!

Actually, as long as you don't click on random link or pictures on NP, you're fine. Most people get CG'd for doing stupid things like clicking on random links. Just wise up. More importantly, log-out when you walk away from your comp. Not too hard.

[aneoguy]

Actually, as long as you don't click on random link or pictures on NP, you're fine. Most people get CG'd for doing stupid things like clicking on random links. Just wise up. More importantly, log-out when you walk away from your comp. Not too hard.

One of my friends was one of the people within the last few months that got hacked! it was not a CG

I know the effects of being CG'd

It was actually another player in their account.

[iargue]

It was actually another player in their account.

Thats what cging is....

[Nubge]

Thats what cging is....

+rep that LOL

[Romy]

One of my friends was one of the people within the last few months that got hacked! it was not a CG

I know the effects of being CG'd

It was actually another player in their account.

Yeah. Your friend prob clicked on something he shouldn't have (maybe a baby paint brush in a random person shop selling for 80k or something) and got his "logged in" marker swiped off his computer. It's really that easy. Just don't be dumb.

And if you do think u've been CG'd; log out right away, log back in and change ur pw.

[Rainie]

And if you do think u've been CG'd; log out right away, log back in and change ur pw.

I'd recommend changing your password first actually.
Logging out of your account will log anybody else on the account off as well, but they could log back in before you (&before you change your password) in that situation o:

[Romy]

I'd recommend changing your password first actually.
Logging out of your account will log anybody else on the account off as well, but they could log back in before you (&before you change your password) in that situation o:

She's right. Good tip Rainie. I'll take that into mind from now on.

[lluvia]

OMG I HATE THIS.

I just typed up like an essay about how to prevent being hacked and it deleted it ALL. D:<

GAHHHH. waejrij;awer wer;iwrio

But basically.

People generally agree that you should log out before changing your password because the CGer can probably see you change your word. When you log out, you log them out as well.

Most people aren't CGed.
This page has the 3 main ways people are hacked:
http://www.neopets.com/~3tz

To prevent from being CGed, use NoScripts/NotScripts (depending on your browser).
This page has lots of info about how to prevent from being CGed and has links to pages with even more info - http://www.neopets.com/~ripht

Also we Codexers have a problem. Usually a warning sign for when you've been CGed/hacked is when you're logged out randomly. However if we use the program manager, even if it's just like for Punchbag Sid and like the Autotrainer, we still randomly get logged out. So we can't know/check unless we completely shut down the Program Manager.

The main problem these days is that people are being hacked with unregistered emails.
MAKE SURE you periodically log into the email you use for Neo. When you don't and your email is purged they can recreate it and access your account (not always, though. I recreated an email that was purged that was linked to an old account I lost and the info wouldn't send so I had to send in a ticket. TNT said my email was apparently blocked from receiving email from Neo and they unblocked it. doesn't make sense as I never used the email before except to create the account and then it was just newly recreated after.)
There's a way to see if you've been hacked email-wise too. On yahoo at least you can see which IPs have visited your email. Don't remember how to do it, though.

Stay safe.
I see a new batch of stolen pets/hacked accounts about twice a week on the PC.

Edited by lluvia, 30 November 2011 - 05:19 PM.

[Neoquest]

She's right. Good tip Rainie. I'll take that into mind from now on.

Apparently logging out is supposed to "invalidate the cookie" so you'd want to do that first, but honestly I'm not sure about any of this stuff.

[Rainie]

People generally agree that you should log out before changing your password because the CGer can probably see you change your word. When you log out, you log them out as well.

Apparently logging out is supposed to "invalidate the cookie" so you'd want to do that first, but honestly I'm not sure about any of this stuff.

Ah, I didn't realize that o: Sorry, my bad >n< ~~
/Usually why I put disclaimers that I could be wrong at the end of my posts cX/

I see a new batch of stolen pets/hacked accounts about twice a week on the PC.

I see a bunch as well, although TNT's been deleting stolen pet board alerts lately o:

[Romy]

Apparently logging out is supposed to "invalidate the cookie" so you'd want to do that first, but honestly I'm not sure about any of this stuff.

That is what I thought *shrugs*

Ah, I didn't realize that o: Sorry, my bad >n< ~~
/Usually why I put disclaimers that I could be wrong at the end of my posts cX/



I see a bunch as well, although TNT's been deleting stolen pet board alerts lately o:

Weird. Why would they delete them??

[Rainie]

Weird. Why would they delete them??

I have no clue, maybe cause they're buttheads xP

A few weeks back there'd be a bunch of stolen pet alert boards on the PC everyday, but TNT always deletes them at around the 2nd-3rd page o:
/Probably why people don't even bother to make the boards anymore/

[Romy]

I have no clue, maybe cause they're buttheads xP

A few weeks back there'd be a bunch of stolen pet alert boards on the PC everyday, but TNT always deletes them at around the 2nd-3rd page o:
/Probably why people don't even bother to make the boards anymore/

Pfft. I'd spam those boards. Perhaps TNT doesn't want to advertise the fast that they can't stop the CGing?

[iargue]

I'd recommend changing your password first actually.
Logging out of your account will log anybody else on the account off as well, but they could log back in before you (&before you change your password) in that situation o:

Cging doesn't take your password.

When you log into neopets in your browser, it creates a cookie object. This object simply has your username, a hash of your password (Usually impossible to crack) and a validity period. When you log in from somewhere else, or from our programs. a brand new cookie is issued. Now, both cookies are valid, but one will eventually be logged out if the other is used. Cookie grabbing works differently then this. Instead of them taking it, and logging in and getting their own cookie, they simply take yours.

What this does, is it makes neopets believe that they are you, at your computer, doing everything. They don't need a password to sign in, and they wont get kicked off if you are using the account. BUT, when you press the log out button, that cookie is no longer valid. This causes both your session, and the one that they stole the cookie, to be invalidated, and Neopets will ask them to log in.

Thus, changing your password does nothing to counter cookie grabbing. Logging out does everything to counter it.

[Therion]

That is what I thought *shrugs*



Weird. Why would they delete them??

I don't think you realise how little they care about individual people. If EVERYBODY paid, they might. But only a select few users that spend a lot of money tend to get decent service and reliable game masters when microtransactions are involved.

[repap]

Cging doesn't take your password.

When you log into neopets in your browser, it creates a cookie object. This object simply has your username, a hash of your password (Usually impossible to crack) and a validity period. When you log in from somewhere else, or from our programs. a brand new cookie is issued. Now, both cookies are valid, but one will eventually be logged out if the other is used. Cookie grabbing works differently then this. Instead of them taking it, and logging in and getting their own cookie, they simply take yours.

What this does, is it makes neopets believe that they are you, at your computer, doing everything. They don't need a password to sign in, and they wont get kicked off if you are using the account. BUT, when you press the log out button, that cookie is no longer valid. This causes both your session, and the one that they stole the cookie, to be invalidated, and Neopets will ask them to log in.

Thus, changing your password does nothing to counter cookie grabbing. Logging out does everything to counter it.

Can you explain why I only ever hear about cookie grabbing with respect to neopets and never on a more important website, like an email account?

[Turnip]

Weird. Why would they delete them??

It's TNT, what are you expecting? Thoroughly thought out, reasonable actions?


But yeah honestly, it would make more sense just to send the stolen pet back to it's original account (and I don't know, change the email/word to something else temporarily). Same with bought nps/items etc. Rather than freezing everyone who had that item ever, it'd be easiest just to send the item/nps to the original account or delete them from the account altogether. I could see sellers abusing that though to be honest.... :V welp