Anyone noticing the hacked shops

This is an archive of the mabination.com forums which were active from 2010 to 2018. You can not register, post or otherwise interact with the site other than browsing the content for historical purposes. The content is provided as-is, from the moment of the last backup taken of the database in 2019. Image and video embeds are disabled on purpose and represented textually since most of those links are dead.

To view other archive projects go to https://archives.mabination.com

NecroBomb wrote on 2015-09-30 22:24

There are shops in Belvast that are named "*********" with the owner next to it completely naked. my best bet with this is someone haceked the abyss password logs and started pulling peoples passwords from the strings

";Enter your user name or email used to sign into your account along with your secondary password.
; Patch by Plonecakes.
; Example: If you log in with the credentials:
; Username: Blade
; Password: 3575
; Secondary Password: 0000
; You would type YourUsername=YourSecondaryPass (e.g. Blade=0000) like below.
SecondaryPass=1
Blade=0000
"

if anyone else can find more info about the hackings it would be lovely. I haven't seen any on mari but I did see a few on alexina.

~Necro
Rydian wrote on 2015-09-30 23:06

This isn't the official Nexon forums, this isn't the place to post rampant paranoia.
Most of this crap is from people on the official forums that wouldn't know /dev/null from a hole in the ground.

Those aren't logs, users can optionally set them up manually to input their secondary (not primary) password into the game for them, it's not transferred anywhere, and "hacking" it would require their computer itself being hacked (to browse the file manually or read the RAM data), which is a federal offense, and would allow the hacker to get at their pass info regardless of if that mod was used or not, etc.

Like there's so much wrong with that assumption that it'd take paragraphs to cover it.

EDIT: Not that I'm saying the shops aren't on stolen accounts, they could very well be, but anything beyond "there's a hacked account selling off goods with a specific shop title" is wild mass guessing and I've seen enough BS rumors about this (with little to no backing) today already.

EDIT2: Here's how a report on something like this should actually be done.
http://forum2.nexon.net/showthread.php?1483276-Hacker-Warrning&p=12161773&viewfull=1#post12161773&nxid=10
http://forum2.nexon.net/showthread.php?1483276-Hacker-Warrning&p=12161896&viewfull=1#post12161896&nxid=10
Statments from Sabina, confirming the issue exists but not extrapolating on details that aren't actually known. A confirmation of what is known and a proper warning and no more.
Rynn wrote on 2015-09-30 23:15

I'll reserve my thoughts on the matter, but for the sake of argument here's the thread in question currently generating mod paranoia due to the posts of Sabina:

http://mabinogi.nexon.net/Community/forums#%2Fshowthread.php%3F1483276-Hacker-Warrning%26nxid%3D10
NecroBomb wrote on 2015-09-30 23:32

Quote from Rydian;1287738:
This isn't the official Nexon forums, this isn't the place to post rampant paranoia.
Most of this crap is from people on the official forums that wouldn't know /dev/null from a hole in the ground.

I would of never guessed.

Quote from Rydian;1287738:
Those aren't logs, users can optionally set them up manually to input their secondary (not primary) password into the game for them, it's not transferred anywhere, and "hacking" it would require their computer itself being hacked (to browse the file manually or read the RAM data), which is a federal offense, and would allow the hacker to get at their pass info regardless of if that mod was used or not, etc.

You mean key logger

Quote from Rydian;1287738:
[SIZE="1"]
EDIT: Not that I'm saying the shops aren't on stolen accounts, they could very well be, but anything beyond "there's a hacked account selling off goods with a specific shop title" is wild mass guessing and I've seen enough BS rumors about this (with little to no backing) today already.

EDIT2: Here's how a report on something like this should actually be done.
http://forum2.nexon.net/showthread.php?1483276-Hacker-Warrning&p=12161773&viewfull=1#post12161773&nxid=10
http://forum2.nexon.net/showthread.php?1483276-Hacker-Warrning&p=12161896&viewfull=1#post12161896&nxid=10
Statments from Sabina, confirming the issue exists but not extrapolating on details that aren't actually known. A confirmation of what is known and a proper warning and no more
[/SIZE]

Not helpful at all buddy since I already read it, that's why I asked if anyone knew any more information on it.

Any who thanks for information I already knew.
Rydian wrote on 2015-09-30 23:40

Quote from NecroBomb;1287743:
You mean key logger
No, considering that info is set up once and the way it's repeated into the client does not involve a specific sequence of keypresses or mouse movements from that point forward. Getting the data out of the file (which is what you said was a possible method in use) would require a trojan on the machine capable of actively browsing the local filesystem.

[SIZE="1"](And a trojan capable of doing that is capable of far worse anyways.)[/SIZE]

Remove that text and statement.
NecroBomb wrote on 2015-09-30 23:50

Quote from Rydian;1287744:
No, considering that info is set up once and the way it's repeated into the client does not involve a specific sequence of keypresses or mouse movements from that point forward. Getting the data out of the file (which is what you said was a possible method in use) would require a trojan on the machine capable of actively browsing the local filesystem.

[SIZE="1"](And a trojan capable of doing that is capable of far worse anyways.)[/SIZE]

Remove that text and statement.

You do know that if they do not set it up in abyss with the auto login you can still track the login information. For instance a keylogger would be able to pull information by the keystrokes and the mouse position (x,y coordinates) on the screen with where the user clicks for the secondary password.
Rydian wrote on 2015-10-01 00:32

Quote from NecroBomb;1287745:
You do know that if they do not set it up in abyss with the auto login you can still track the login information. For instance a keylogger would be able to pull information by the keystrokes and the mouse position (x,y coordinates) on the screen with where the user clicks for the secondary password.
Correct, if somebody had a trojan installed it could gather all sorts of information about them regardless.

Which has nothing to do with that copy-paste and accusation you made in the first post. Which is why I'm telling you to remove that part.
Esileruf wrote on 2015-10-01 04:17

Since 4:13PM EST to Midnight there has not been a single shop similar to that one you have in the OP in mari at all.

Posting unnecessary fearmongering over things that have existed for months without issue, not to mention things that many people have used, all not hacked for some spooky reason, does nothing good. Also, that's the secondary. Not only would it be worthless to anybody, if they had THAT info it'd mean that a keylogger would have had to been on the computer for a VERY long while, or a Trojan would be used, which would still mean worthlessness without a password. And anybody whose 2ndary is the same as their real password deserves a BIGGEST PLEB award.

There's a good chance that people were using private packs and getting nailed rather than public packs. And considering I was never privy, nor cared enough, and the one man I know who'd give me info on it mysteriously poofed yet again about 2~4 weeks back, chances are this'll end up an isolated incident.