[IMPORTANT] Hackers, Security Flaw, Censorship!!

• Chrisible wrote on 2015-10-02 08:34
  We're bringing this discussion here because Nexon is going to keep censoring the official forums to attempt to damage control.
  
  Basically, shops that have ********** as the name sell the hacked victim's items.
  
  
  Through our research we've discovered something interesting about Nexon's email system. If you want to change your email, all you need is the original email and password. Once you do this, the NEW email will get a confirmation message rather than the old email. The old email is rather just informed that the change is happening, which is a huge security flaw.
  
  Nexon has been blaming mods on all of this, but I'm not too sure that is the case. Feel free to add if you have any more information about all this. I've heard of some other people having been hacked and I'd like to hear more details so we can maybe figure out what's going on.
  
  All links here because apparently there's a limit to how many URLs I can post.
  pastebin(DOT)com/DCfCcKZA
• Lolifister wrote on 2015-10-02 09:46
  https://a.pomf.cat/pcugui.webm
• Rixx wrote on 2015-10-02 13:11
  And don't use same passwords for email account and Nexon account.
  Using same password for anything is... Highly insecure.
• TheDarkPaladin wrote on 2015-10-02 13:15

  Quote from Rixx;1287857:

  And don't use same passwords for email account and Nexon account.
  Using same password for anything is... Highly insecure.

  
  so true, i try to use different ones for as many things as i can....unfortunately, after awhile you either need to start reusing them or keep some kind of note for them, since after so many different ones, you tend to lose track of them
• Deletion wrote on 2015-10-02 14:06
  What I do get prompted when I try to change it is this:
  

  [Image: http://puu.sh/kvRbK/fb2f0611c9.png]

  
  
  But in another account, it is changeable without such a prompt.
• Kingofrunes wrote on 2015-10-02 14:30
  so the question here is it more safe to add the facebook link or safer to not do that. I've heard mixed things on the subject.
  
  I've already suggested Nexon implement two factor authentication. However like 99% of all suggestions, it will be ignored and Nexon will remain behind the times.
• Code2008 wrote on 2015-10-02 18:21
  I opened one of those shops.
  
  
  My character is still doing fine.
• Rydian wrote on 2015-10-02 19:59
  Opening the shop doesn't magically hack your account, don't spread crap.
• Jake wrote on 2015-10-02 22:15
  The censorship is probably just to avoid fear mongering.
  
  Honestly even if there was a security flaw (and just accessing the victims shop isn't going to get you hacked) the best possible advice to be given when situations like these arise really is just to scan your computer and change your information.
  
  Database leak? Info change the best solution
  Virus? Scan computer and change info the best solution (or reformat and dban if you are paranoid like me)
  
  Also, from my experience don't you get a link to reverse the e-mail change in your old e-mail along with the alert message? I've sold plenty of maplestory accounts (most recent a month ago) and for all of my buyers I show proof of deleting the reversal request from the "old" e-mail.
  
  Last time I saw something like this happening on maplestory everyone pointed to database leaks and a bunch of other stuff, which of course is possible, but there was a more likely suspect after everything was under control:
  
  MapleStory used to use some service that was packaged with their game (I don't remember if this was Akamai or not) but as it turned out that service got hijacked after the company dissolved or something. Unfortunately, up until this happened Nexon didn't even inform the playerbase about severing their ties with this service
  
  edit: It was pando media booster
• Bunny wrote on 2015-10-02 22:18
  I opened some hacked shops with ******* as the title and I'm fine..
  
  Please change that part of your post unless you have 100% proof, or I'll have to edit it out later myself.
  What IS true so far is that those shops have the victim's items for sale.
  
  No fear mongering here please. Not saying you're completely wrong, but I need some proof with that pudding.
  
  EDIT: I changed up your post for that part. You can edit what I put yourself, but keep in mind we still need proof of what you wrote initially if you wish to present that information.
• Chihaya wrote on 2015-10-03 05:17
  What I'm curious about is why is it that said "hackers" need a victim to open up a shop SPECIFICALLY with the title "**********" in order to obtain information about the victim's account. Hell, it's probably just for attention instead of actually having any meaning.
  
  In addition, it's completely possible that the "********" shop is selling the victim's items obtained from a different "hack" or exploit and not necessarily due to clicking on the shop title. If that happens to be the case and someone did lose their items, it is likely coincidence and the victim's fault of not having a good enough password
• Rixx wrote on 2015-10-03 05:41
  Whether ******* titled shops get your account hijacked or not,
  one thing we know is that they sell stolen items.
  
  It's probably a good idea to stay away from it anyway.
• Bunny wrote on 2015-10-03 05:49

  Quote from Chihaya;1287902:

  What I'm curious about is why is it that said "hackers" need a victim to open up a shop SPECIFICALLY with the title "**********" in order to obtain information about the victim's account. Hell, it's probably just for attention instead of actually having any meaning.
  

  
  
  This has yet to be proven, and I doubt that's the case. However, that email thing is real.
• Rydian wrote on 2015-10-03 19:14
  So here's a packet log of what information you get when somebody else opens up your personal shop.
  
  

  [Image: http://i.imgur.com/ZTAHSq7.png]

  
  
  As you can see from the first packet of AbsolutelyNothing, we get jack for info.
  The second packet, DoesNotExist, contains some interesting empty space.
  The third packet, NullingtonTheThird, has some very specifics nothings in it.
  
  Now actually buying from the store on the other hand does get the server to send you some info.
  None of which can be used to hack accounts. Doesn't even have their character ID in it.
  [spoiler="Purchase"]

  [Image: http://i.imgur.com/FB2YZlo.png]

  
  
  1 - The item is removed from your inventory.
  2 - The on-screen notice that the player bought it pops up.
  3 - The in-chat notice that the player bought it pops up.
  4 - The item update to the shop license happens.
  5 - The remaining data for that sold item is removed.[/spoiler]
• Osayidan wrote on 2015-10-03 19:51

  Quote from Rydian;1287935:

  As you can see from the first packet of AbsolutelyNothing, we get jack for info.
  The second packet, DoesNotExist, contains some interesting empty space.
  The third packet, NullingtonTheThird, has some very specifics nothings in it.
  

  
  
  Ohshit, sound the alarms.