Quantcast

What works and what is paused · Email is limited to account activation and password resets.

Jump to content


Neopets Accounts Compromised?


  • Please log in to reply
42 replies to this topic

#1 Guest_Kate_*

Guest_Kate_*

Posted 05 May 2016 - 01:54 PM

Neopets' Facebook Page posted this statement an hour ago:

"In order to be transparent with our players and fans, we want to inform you of recent reports that have come to our attention regarding an alleged data breach to our Neopets’ account database in which a large amount of information from player accounts may have been leaked to third parties. To be clear, this is specific to the Usernames, Passwords, Email Addresses, Birthdates, and Countries tied to player accounts. It does NOT include credit card or payment information.

While we know news like this might be frustrating to our players to learn, we would like to assure all that this breach in security is linked to an incident that occurred in 2012, prior to JumpStart’s acquisition of Neopets. In fact, account security has been elevated since Neopets joined the JumpStart family of games. After further investigation and some quick actions by our team, it is becoming clear that a number of the affected accounts are, in fact, inactive and in some cases have already been completely purged from our system.

Although, the impact of this database hack is limited to this single incident, we want all our players to know the facts surrounding these reports and also hope to encourage active players to take the necessary measures toward keeping their accounts secure. On our end, we plan to implement a password reset for all affected players (more info to come).

We appreciate your understanding and patience at this time and invite you to reach out to us through our normal support channels with any questions or concerns you might have regarding this incident or the security of your account. As a quick reminder to avoid facing any further account access related issues in the future, we recommend that you to never share account information to any parties beside TNT and that you keep your account information up to date, resetting your password regularly. Thank you."



Thoughts?

Advertisement

    #2 NapisaurusRex

    NapisaurusRex
    • 🍴Aioli-American🍴

    • 9425 posts


    Users Awards

    Posted 05 May 2016 - 01:55 PM

    Blame the previous owners, typical.



    #3 Swar

    Swar
    • retired cheater

    • 9280 posts


    Users Awards

    Posted 05 May 2016 - 01:56 PM

    Wow. It's actually nice to see them being transparent about a big issue like that.



    #4 Keil

    Keil
    • Above Average Mediocrity

    • 6593 posts


    Users Awards

    Posted 05 May 2016 - 01:56 PM

    They're not bullshitting us saying that Neopets is unhackable.

     

    That deserve a slow clap.



    #5 Romy

    Romy
    • Neocodex Elite Four Member

    • 4877 posts


    Users Awards

    Posted 05 May 2016 - 01:56 PM

    Change your pws ofc.



    #6 DonValentino

    DonValentino
    • Neocodex Handegg League Champion/Daddy

    • 2482 posts


    Users Awards

    Posted 05 May 2016 - 01:58 PM

    I hope no one steals my pixels

    #7 Katya

    Katya
    • cougar slut

    • 6850 posts


    Users Awards

    Posted 05 May 2016 - 01:59 PM

    Well, at least they admit security issues. That's already something. :/

    Now it's a good time to change our passwords, PIN, and even e-mails for those extra paranoid cautious.

    #8 Waser Lave

    Waser Lave
    • 25516 posts


    Users Awards

    Posted 05 May 2016 - 02:01 PM

    What a shocker.



    #9 Junjie

    Junjie
    • Hi there!

    • 2267 posts


    Users Awards

    Posted 05 May 2016 - 02:05 PM

    Wow. It's actually nice to see them being transparent about a big issue like that.

     

    Thiss. I'm pretty happy regarding this actually. First they talk about security exploits in editorial (and patching them), and now they are actually coming clean on Facebook about hacks.

     

    And yeah they also blamed prev owners but whatever. It seems true that previous owners would never admit to security breaches. Even Adam and Donna tried to cover up major hacks right? :p

     

    Also also, the next important point: So, did the security breach happen in 2012 or something then? Or was it something more recent lols. Cos I actually changed my pass quite recently huh. Don't really wanna change it again.

     

    Fake Edit:

     

    What a shocker.

     

    Hahahah at least they are actually being transparent about it. :p

     

    But yeah. Account lists, birthday "cracks" that obviously rely on such lists that the seller had bought, etc etc have been around for the loongest time on shadier places than this in the cheating scene. I wonder now how many known-to-hackers security flaws and exploits there actually are, and just how long they have been exploited by justt how many people, hahhaha.



    #10 GetJinxed

    GetJinxed
    • Reckless Cheater

    • 1423 posts


    Users Awards

    Posted 05 May 2016 - 02:39 PM

    Eh.. props to them for bringing it up. I've seen some guy on a shady forum trying to sell that database. No idea if it was actually real or not but whatever. Just make a fucking Two-factor authentication. There, most of the hacking attempts will fail



    #11 HiMyNameIsNick

    HiMyNameIsNick
    • Shitlord

    • 1730 posts


    Users Awards

    Posted 05 May 2016 - 02:49 PM

    While we know news like this might be frustrating to our players to learn, we would like to assure all that this breach in security is linked to an incident that occurred in 2012, prior to JumpStart’s acquisition of Neopets.

     

    Hand washing



    #12 Rogue

    Rogue
    • 674 posts


    Users Awards

    Posted 05 May 2016 - 03:18 PM

    OMG! Does it have anything to do with the NC Mall glitch? I mean, they said it was cause by a breach from 2012 but it looks like the breach was exploited just NOW.



    #13 Guest_iCarly_*

    Guest_iCarly_*

    Posted 05 May 2016 - 03:18 PM

    The security breech is from Gmail, Yahoo, and Hotmail being hacked, and the information from accounts being stolen.


    This isn't related to neopets.

     

    Unless it really is from 2012. I dunno if they're lying


    Edited by Aria, 05 May 2016 - 03:19 PM.


    #14 WarezHaxor

    WarezHaxor
    • 668 posts


    Users Awards

    Posted 05 May 2016 - 03:20 PM

    There are quite a few exploits in neo not known to them or the public. A smart person could bring CGers back with little effort, and SQL injection and other various forms of RCE exploits are abound...just a matter of the individuals who know them to make use of them or expose them. And that doesn't even touch on MiTB attacks that they couldn't stop even if they wanted to. I used to laugh when they'd say they were unhackable as I found more and more vulnerabilities and attack vectors. Anyone who knows IT security will say the same thing...never utter the word unhackable or uncrackable because there's always a way. ALWAYS. I'm glad to see them being mildly transparent but 2fa and mandatory password resets aren't going to stop a database hack or a MiTB attack. This hasn't worked for banks and card processors and it won't work for neo either.

    #15 KaibaSama

    KaibaSama
    • Weeaboo

    • 5640 posts


    Users Awards

    Posted 05 May 2016 - 03:25 PM

    The security breech is from Gmail, Yahoo, and Hotmail being hacked, and the information from accounts being stolen.
    This isn't related to neopets.
     
    Unless it really is from 2012. I dunno if they're lying

    Gmail got hacked? Crap, my email is a gmail account. I'm debating going to change all my passwords and such.

    #16 Fikri

    Fikri
    • submissive

    • 4433 posts


    Users Awards

    Posted 05 May 2016 - 03:26 PM

    my main was made after 2012 so i guess i'm good? i hope everyone's safe!

     

    kinda refreshing to see jumpstart being so open and transparent. that's great. :)



    #17 Guest_iCarly_*

    Guest_iCarly_*

    Posted 05 May 2016 - 03:26 PM

    Gmail got hacked? Crap, my email is a gmail account. I'm debating going to change all my passwords and such.

     

    Don't debate it, seriously. Do it, HUNDREDS OF MILLIONS of users are compromised.



    #18 WarezHaxor

    WarezHaxor
    • 668 posts


    Users Awards

    Posted 05 May 2016 - 03:28 PM

    Doubtful that you'll need to change your password for Google honestly. They're pretty quick on catching logins from areas that aren't geographically known to have been used in the past. And without a log of your ip and a way to make it a socks proxy you'll have trouble getting into those accounts anyway. Plus Google is very transparent about something like that happening and would have taken measure to publicize and rectify the situation.


    Edit: After seeing the news articles...I highly doubt it was a hack on google/yahoo/bing...looks more like someone who had a botnet harvesting email accounts for a while selling them. 272 million accounts...but how many duplicate entries? And how many are from old publicized breaches? These are the things you need to ask about such large breaches. Media sensationalizes everything.

    Edited by WarezHaxor, 05 May 2016 - 03:32 PM.


    #19 Guest_iCarly_*

    Guest_iCarly_*

    Posted 05 May 2016 - 03:35 PM

    Doubtful that you'll need to change your password for Google honestly. They're pretty quick on catching logins from areas that aren't geographically known to have been used in the past. And without a log of your ip and a way to make it a socks proxy you'll have trouble getting into those accounts anyway. Plus Google is very transparent about something like that happening and would have taken measure to publicize and rectify the situation.


    Edit: After seeing the news articles...I highly doubt it was a hack on google/yahoo/bing...looks more like someone who had a botnet harvesting email accounts for a while selling them. 272 million accounts...but how many duplicate entries? And how many are from old publicized breaches? These are the things you need to ask about such large breaches. Media sensationalizes everything.

     

    I'm not really smart about all this.

    Does this mean my emails are all safe? What about my hotmail ones?



    #20 talbs

    talbs
    • 4084 posts


    Users Awards

    Posted 05 May 2016 - 03:43 PM

    Hell, I can't even get into my own shells that I know the passwords and birthdays to, so good luck hackers.



    #21 WarezHaxor

    WarezHaxor
    • 668 posts


    Users Awards

    Posted 05 May 2016 - 03:44 PM

    I'm not saying they're not safe...but the saying goes "better to be safe than sorry," history with data breaches has shown maybe 1 out of 100 is legit and unique, usually it's compilations of old breaches or duplicate entries and the sellers are talking a load of crap. Odds are if it is legitimate, that it wasn't Google or yahoo or bing or Hotmail who was breached, it was you becoming victim of a botnet. But I know Russian hackers and frequent their underground boards from time to time, and there is one major prevalent thing...they hate americans/Europeans, and they are known to stretch the truth as far as leaks like these go. Until they actually present a section of the database that's probably unique and of at least 1% of the total database, I wouldn't put too much weight into it. Do take the precautions of changing your info, especially if previously having been victimized by a RAT or keylogger, but my bet is that it's a load of crap and just a rehashing of old info if it's exists at all.

    #22 Junjie

    Junjie
    • Hi there!

    • 2267 posts


    Users Awards

    Posted 05 May 2016 - 05:07 PM

    Thankss for coming in to clarify things @WarezHaxor !

    Always useful for someone who knows this stuff and the scene to come along and explain things. :) :p

    #23 Mishelle

    Mishelle
    • Bitch Of The Boards

    • 2245 posts


    Users Awards

    Posted 05 May 2016 - 06:12 PM

    I'm wondering if this has anything to do with why I couldn't log into one of my sides today. I think one of my passwords were changed. That's the only thing that makes sense because I've had the same password since I created the account.



    #24 WarezHaxor

    WarezHaxor
    • 668 posts


    Users Awards

    Posted 06 May 2016 - 04:26 AM

    Thankss for coming in to clarify things @WarezHaxor !
    Always useful for someone who knows this stuff and the scene to come along and explain things. :) :p

    Anytime! These kinds of things are where my expertise lies, coding and vulnerability discovery. I hate to see the media sensationalism about things like this. Fact is, if it's even remotely legit, they don't want your neopets account. They will get whatever bank info, subscription services like Netflix, loan info, tax info, and use that for a good return on their works...neo does not fall into the "Big money fast" category these guys are into...they're committing felonies, they want to get paid quick and well. If they can't get any information that is useful for a big payday, they will gather information to use in a spearphishing attack to get you to divulge that information or just use your email for spam purposed. Like I said, neo has got a few vulnerabilities I personally know about, but I'm not gonna get a bug bounty for reporting it to them nor would it repay the time I put into finding them to exploit them, so I just have them for nostalgia purposes. Computer security is a hobby and passion for me, I'm just lucky enough that it adds a little bit of extra pay to do things for my kids by reporting the bugs to the right companies. FB and Google for instance will pay upwards of $10k USD for a persistent bug that allows account traversal, yeah it may take a couple months to find one that works, but on top of a 60 hour work week, that's anywhere from 1/4 to 1/2 the average Americans yearly salary. I definitely would not get that from JS. Just know that any site claiming it can't be hacked just hasn't had it exposed yet. What ad0 did years ago to neo was nothing compared to what could happen to neo.

    Edited by WarezHaxor, 06 May 2016 - 04:28 AM.


    #25 jinq

    jinq
    • 1554 posts


    Users Awards

    Posted 06 May 2016 - 03:49 PM

    let me guess, they stored the pw as plain texts?




    1 user(s) are reading this topic

    0 members, 1 guests, 0 anonymous users