69 replies to this topic

[juju]

I was lurking on the boards. Someone said it was Kaos fault. But someone must have found a new way. I just hope TNT does something. There after premium members thats what I heard.

I lurked also. It was all over the Battledome Boards.

The information I found out was that Infamous made the cookie grabber and Kaos is using it without crediting him.

Not sure if it's true or not, but that's what I've read.

[Sean]

I'm not to deep into the Neopets seen... Who's kaos?

[murderousfiend]

dont think I am accusing eggy, as I am not! from what I have seen and heard, he is a great person and a contributing member of our comunity, and next to 000ghost00, xthcannon and shabba, one of few people I accually admire in cyberspace (I know, its sad).... all I said is that it is believed he is the one who figgured out how to by-pass the neo filters...this is pure genious honestly

as for asking around if anyone noticed some big auctions... noone did, the person who got me towered a shitload of items, and transfered the items

all I can recomend to people, is DO NOT visit any user-edited part of neo for the time being, and if you think you got hit, immediatly delete your cookies, and change your pass

and as for not getting mad about loosing out, because we cheat... that was my main, and a LEGIT account I made everything I had in there from trading, I still have a side that I cheat on, got like 5mil and some change so I can re-build.

Edited by murderousfiend, 28 December 2005 - 01:31 PM.

[shabba]

You lot make me larf. Cookie grabbing isnt a skill atall anyone with basic PHP knowledge could by all means make one within hours. I never really looked into it apart from now and belive me there is enough resources on this site alone to make one. DONT go asking for instructions as no1 will tell you, you dotn need to no.

Kaos/eggy/infamous - minor hackers if you wish to call them that. It was a little script, neopets never thought about anyone doing that. Clever in a way but then again very very stupid. Cookie grabbing is ILLEGAL in USA Canada and the UK. They will prosicute and have a very good chance of winning, if you want to go to young offenders then by all means be my guest, hell ill even tell them myself.

Just remember it may be a kids game, but where do your morals really lie? The ethics behind hacking neopets is kind of pointless to me. Yes I program but there tools, not hacks.

shabba

[magda11us]

Yeah, it's Kaos thats doing this. Like lots of legit players have been cookie grabbed. It's just pretty sad hes doing this kind of things and probably has no life. But I heard he did not make the code someone did.

Some player is saying there going to sue neopets. They got cookie grabbed by Kaos and Kaos posted personal info about him in the boards. Sense TNT have not done anything to protect personal info about other players he says hes going to sue Neopets.

He's hacked into premium people's accounts and charged extra accounts into their credit cards.

[succubus]

Theyre using div coding to make the pop ups with the cookie grabbers well... popup.

Save targed as'ed the link to a userlookup when my popup blocker blocked the cookie grabber popup. XD

[jzbone2]

Haha. keep noobish avatars.

[Kyle]

Damn, exactly what I was going to say. You guy's worship fecking newbs who like to XSS kiddie sites

Respect the people that our hacking into govermental security and making it stronger everyday

*Applause*
I wouldent consider Eggy or Kaos newbs, but there are many more who do the same types of things, that are.

[Ives]

Infamous made it. Kaos spread it.

[Mitch]

Beh this is the most stupid shit I have seen in my life...there cookie grabbing WOW omg you can make a .swf that steals cookies and sends it to a webpage in about 30 mins TOPS. these guys think there really cool doing this but in the realworld it's just stupid there going to get there ass sued and kaos showed me a letter he got from the [email protected] or what ever it was cuase he got it and showed it to me. I hope all the people that did this go to kiddie script hell cuase this is even KS it's BS I mean a 30 min script that basicaly anyone with a half braina nd a little bit of PHP coding can do this.....

[Sean]

Who the heck is Kaos >.<

[Mitch]

Don't worry these huys are giving neo a really hard time. I mean cookie grabbing is REALLY low down and kiddie. -10 respect for those people doing this. Takes no skill WHATSOEVER.

[kartstan]

thanks for the head up ... time top do a cookie cleanings just in case

[sockopen]

You lot make me larf. Cookie grabbing isnt a skill atall anyone with basic PHP knowledge could by all means make one within hours. I never really looked into it apart from now and belive me there is enough resources on this site alone to make one. DONT go asking for instructions as no1 will tell you, you dotn need to no.

The act of 'grabbing cookies' doesn't require skill, it does require newbies though. Finding the actual vulnerability and being able to abuse it does require some skill, a small amount of it, but, some skill (more time than skill). As for the instructions, send me a PM or add me to MSN and I'll give you step-by-step instructions.

Cookie grabbing is ILLEGAL in USA Canada and the UK. They will prosicute and have a very good chance of winning, if you want to go to young offenders then by all means be my guest, hell ill even tell them myself.

I'm not sure if it's illegal in Canada, where would I find more legal documentation? I know there was just some talk in the USA about linking to illegal material, and, it's not even completely illegal. It really hasn't been defined, if you are encouraging people to download and use pirated software, it's usually illegal, but if you just link to it and don't say anything, it's not usually illegal. The laws need to be redeveloped and built upon still; so if you could find me perhaps a section and sub-section in the Criminal Code of Canada, it would be appreciated.

Just remember it may be a kids game, but where do your morals really lie? The ethics behind hacking neopets is kind of pointless to me. Yes I program but there tools, not hacks.

You're basically contradicting yourself, you act as if it's such a morally offensive thing to disturb the community of a 'kids game', yet you do exactly that; making programs to execute things faster and more often than a human (a 'kid' according to your previous statement) can do.

Edited by sockopen, 28 December 2005 - 09:50 PM.

[RiceCooker]

wait does this only grab my neopets account cookie only and not my other ones, like when I log into my email account or log onto here

[Icey Defeat]

Ok basically, whoever is doing will probably get the max penalty in neopets ToS, which is like 50 grand. However alot, its not underestimated here. They people doing this probably caused millions in damage to just peoples lives, they caused ALOT of damage.

I don't personal play neopets, but whoever did this is no friend to me.

wait does this only grab my neopets account cookie only and not my other ones, like when I log into my email account or log onto here

They would have your e-mails, paypal... everything.

[sockopen]

They would have your e-mails, paypal... everything.

It only grabs parts of the Neopets cookie.

[WarezHaxor]

Icey, you are wrong, this exploit doesnt grab all cookies, it only grabs the neopets cookie, as it uses Document.Cookie when it grabs them, I know exactly how the exploit worked, down to the very coding of it. This exploit wouldnt be found on sites, as its not truly an exploit, its just some CSS coding.

Much, you act like only a noob could figure this out, well tell me this, why hasnt this run rampant on neopets before? Sure, the code to save the cookies and post the cookies is simple to make, but as sock said before, discovering the 'exploit' is harder, and not any noob could figure this out.

Dont underestimate the powers that this can come to, It can be used very maliciously, you should be glad that #1, infamous wasnt smart enough to make it steal all your cookies, and #2, that it was done merely to cause havok on neopets. I dont condone this type of action, but I must say that you guys are getting angry over 2 people that actually did neopets a favor. Lemme ask you this, Would you rather every person in neopets was able to do this and it just ran wild, or would you rather 2 people have done it, and now neopets has blocked it and it wont happen to this extent again.

[SpikeOut]

It's funny how you guys go gaga about it. Cookie grabbing isn't new in Neopets at all. Idiotproof and company first made the cookie grabber famous in Neopets 3 years back. Much more was hacked as many still used the IE 5.x and older versions which are vulnerable. IE 6 and Firefox are protected against XSS (document.cookie) as far as I know.

Anyways, kudos to whoever who found a new way to inject the exploit into userlookup.

[sockopen]

It's funny how you guys go gaga about it. Cookie grabbing isn't new in Neopets at all. Idiotproof and company first made the cookie grabber famous in Neopets 3 years back. Much more was hacked as many still used the IE 5.x and older versions which are vulnerable. IE 6 and Firefox are protected against XSS (document.cookie) as far as I know.

Anyways, kudos to whoever who found a new way to inject the exploit into userlookup.

Wow, I would have thought this to be abused much longer ago than 3 years ago. Kind of sad really, XSS w/ Javascript was just starting to get known what was it, 9 or so years ago, and it took someone 3 years (Neopets was created in '99 I think) to exploit a very vulnerable site? Sad. Anyways, Internet Explorer and FireFox do not have selective Javascript choosing enabled, of course Document.Cookie works.

Edited by sockopen, 29 December 2005 - 04:16 AM.

[Dazz]

My account is safe as sound since I havn't been on it ages. AND my account is 100% legit

So if I havn't been on it in ages then I couldn't of gone on user lookups

[Carbon]

Its hard to avoid this hack, im always going to userlook up

[Mitch]

Much, you act like only a noob could figure this out, well tell me this, why hasnt this run rampant on neopets before? Sure, the code to save the cookies and post the cookies is simple to make, but as sock said before, discovering the 'exploit' is harder, and not any noob could figure this out.

it happened about 1 1/1 years ago. people but cookie grabbers in there shop or they put a link there that automaticaly poped up and it stole your cookies. neopets stopped those popups and they switched to a different type of way to use their cookies. Their doing the same here. so let me give you a little ipod part of me.

iDon't Give a CENSORED

there going to get sued if they live here in the US.

I'm not going into detail on what they are doing to do this cuase other people will catch on.

[Radiuju]

Ok, so what is one username with this cookie grabber on their lookup/shop? I have so high protection on this computer a cookie grabber is a laugh. I want to look into who is doing this, maybe trace their ip. Send it to neo...Etc. Pm me if you wish to tell me in private.

[sockopen]

Ok, so what is one username with this cookie grabber on their lookup/shop? I have so high protection on this computer a cookie grabber is a laugh. I want to look into who is doing this, maybe trace their ip. Send it to neo...Etc. Pm me if you wish to tell me in private.

I do not mean to sound offensive, but regardless if you're personal computer is 'protected' or not; more than likely your cookie will be sent, unhashed, and, your account will be taken from you. You will not be able to trace anyone's IP through the Neopets servers, and, what would you be sending to Neopets? These cookie grabbers already are on Neopets, and, more than likely are being taken care of.

If however, you choose to ignore this advice, and reality, I will send you to the location of one if you intend on using a good account, I don't want to waste my time, and my friends' time on a worthless account.