RMT putting keyloggers on specific Dynamis websites now?

[aurik]

just get your own domain and put a phpbb board on it

Not as good as getting dedicated hosting, because I bet you don't keep up with security patches.

[#686578]

Something that's kind of been bugging me recently and maybe a pretty stupid question. If you are being keylogged, basically your password is compromised. How do these people know what account number to use to match with the password? Do they brute force the account number?

Something to add to this, don't you guys have your ids and passwords saved? Even with a keylogger there would be no way for RMT to compromise my account.

Because there's no way to have a virus mine data on your computer at a specified location %primary drive%\program files\Play Online\, or even search for a specific file that those IDs and passwords are SAVED to and decrypt said information and send it off to the internet. Nope, impossible.

Meh, looking over this again I'm not sure if you're arguing semantics of virus vs keylogger, a specific type of virus; or if you just generally don't have a clue.

[ronin sparthos]

Something that's kind of been bugging me recently and maybe a pretty stupid question. If you are being keylogged, basically your password is compromised. How do these people know what account number to use to match with the password? Do they brute force the account number?

The keylogger takes screenshots of your PC screen whenever POL.exe launches, allowing them to get the POL ID then combined with the password they get via the keystrokes/mouseclicks they can change your password and compromise you.

[ahnalia]

It doesn't surprise me that they are using ad supported FFXI themed websites as a base of attack now.
I highly recommend anyone who uses a freebie forum for their FFXI related website to use one that isn't ad supported.
I highly recommend http://www.freeforums.org they have 24/7 tech support and the guy who owns the server is always online and will personally answer any questions you have.
Another option is to buy a cheap domain and make your own forum/website there.
Many hosting companies provide free page builders, forums, ect.
http://www.qualityhostonline.com is the host for my linkshell's websites and they will bend over backwards to help you.
I have never had any trouble with this host and have been with them for over 4 years.
If anyone needs help installing their own forum using PHPBB version 2 or 3, I built our forums from scratch, and will be happy to help anyone with theirs.
I'm not the best programmer, but I know some basics and would be happy to help.
My heart goes out to all website/forum owners who have had their sites compromised.

[Plow]

http://i9.tinypic.com/86z9jqu.jpg

LOL kick ass sig dude.

seriously... every time I see that guy post I wanna yell at my wall or something

[Attila]

The best solution is to drop some coin for a domain and run your own ls website. You don't have to deal with advertising, people popping poison iframes, etc.. at most you'll need to restrict any access to posting on a case-by-case basis.

Re: my sig image.. I got lucky finding this thing, some calc professor was using it on a discussion board that I stumbled across a couple months ago.

There's been a few people with that as a sig around here. Never at the same time of course.

[Rydir]

http://i9.tinypic.com/86z9jqu.jpg

LOL kick ass sig dude.

seriously... every time I see that guy post I wanna yell at my wall or something

Good thing i only post about once a month eh? Or else you would be having some very troublesome heart problems i am sure.

[inafume]

http://i9.tinypic.com/86z9jqu.jpg

LOL kick ass sig dude.

seriously... every time I see that guy post I wanna yell at my wall or something

Good thing i only post about once a month eh? Or else you would be having some very troublesome heart problems i am sure.

The postcount sig was also used here by a really annoying douche a couple years ago (Flux), so that could explain why people have antagonistic reactions to it.

[Crisco]

Something that's kind of been bugging me recently and maybe a pretty stupid question. If you are being keylogged, basically your password is compromised. How do these people know what account number to use to match with the password? Do they brute force the account number?

The keylogger takes screenshots of your PC screen whenever POL.exe launches, allowing them to get the POL ID then combined with the password they get via the keystrokes/mouseclicks they can change your password and compromise you.

Last I checked, when you use the saved password function, the password you do use to log in regularly is local and therefor useless to a hacker. They would need to force you to re-input your actual POL password for a keylogger to work.

[Rydir]

Last time I saw or used a key logger was for educational purposes in a class room to show what they did. The only thing a key logger does is input the keys you type into a log or text document. I doubt a key logger would do screen shots, but they could be more advanced now a days and i could be wrong.

[Fadian]

Here is a question. Has anyone ever tried to track down where any keylogger information goes by via, maybe a router log or what not? I mean, why not hack them! but still, good security goes a long way and use common sense. Use trusted sites that people recommend. wiki, and such. or even ask. I'm sure several people would recommend a site to use and it will more then likely be the same.

[Izzy]

Here is a question. Has anyone ever tried to track down where any keylogger information goes by via, maybe a router log or what not? I mean, why not hack them! but still, good security goes a long way and use common sense. Use trusted sites that people recommend. wiki, and such. or even ask. I'm sure several people would recommend a site to use and it will more then likely be the same.

Cant use those sites for things like dynamis calenders...which is what this thread is about

[Spekkio]

Last time I saw or used a key logger was for educational purposes in a class room to show what they did. The only thing a key logger does is input the keys you type into a log or text document. I doubt a key logger would do screen shots, but they could be more advanced now a days and i could be wrong.

a key logger in the purest sense is just what the name implies. it logs keys and nothing more. the thing is, these pure keyloggers are terribly limited in that they can be defeated by cut and paste, onscreen keyboards, and other tools. thieves aren't just going to throw up their hands and say "oh well! guess you guys rock and beat us!" they'll try new methods. as such these keyloggers have been enhanced with more logging tools, with the end result being a cocktail of screenshots, key logging, mouse click position logging, clipboard logging, and hell, even keeping a record of the audio from a mic attached to the PC or webcam footage wouldn't be surprising to see in these. still, since the primary means of capturing information is from the keyboard, the most common name for these amalgamations of threats are "keyloggers."

also, as for tracking down where they went to, i don't need to check logs to tell you that. they went to china. and china doesn't give a damn about helping to track down digital thieves in their country. and before you ask the obvious question of "why don't we just block china from our computers?" the answer is b/c even if you did, they'd route it through a proxy of one sort or another so that you would likely not only be connecting within the country but very plausibly even within your own state.

[#686578]

Here is a question. Has anyone ever tried to track down where any keylogger information goes by via, maybe a router log or what not? I mean, why not hack them! but still, good security goes a long way and use common sense. Use trusted sites that people recommend. wiki, and such. or even ask. I'm sure several people would recommend a site to use and it will more then likely be the same.

Yes. China.

[hotpiercedguy]

I know this is going to sound fucked up...

But I can't help but feel a little flattered that they hacked us. From what I can tell, only the more "big deal" ls's have gotten attacked><

[#686578]

I know this is going to sound fucked up...

But I can't help but feel a little flattered that they hacked us. From what I can tell, only the more "big deal" ls's have gotten attacked><

Yes, because they certainly couldn't have gone up to the advertising company and say "Hey, we only want you to sell our ads to websites that match these interests: FFXI, GIL, LINKSHELL, RIDILL, etc". Your linkshell wouldnt match any of those things would they?

[hotpiercedguy]

I know this is going to sound fucked up...

But I can't help but feel a little flattered that they hacked us. From what I can tell, only the more "big deal" ls's have gotten attacked><

Yes, because they certainly couldn't have gone up to the advertising company and say "Hey, we only want you to sell our ads to websites that match these interests: FFXI, GIL, LINKSHELL, RIDILL, etc". Your linkshell wouldnt match any of those things would they?

Let me dream....

[terranova]

Clearly SE has them by the nuts and now they seek stealing accounts in Dynamis shells as a "last resort to restoring lost glory".

[Brill Weave]

Last time I saw or used a key logger was for educational purposes in a class room to show what they did. The only thing a key logger does is input the keys you type into a log or text document. I doubt a key logger would do screen shots, but they could be more advanced now a days and i could be wrong.

Ronin Sparthos is speaking from experience though. His account was taken in this manner.

[ronin sparthos]

Last time I saw or used a key logger was for educational purposes in a class room to show what they did. The only thing a key logger does is input the keys you type into a log or text document. I doubt a key logger would do screen shots, but they could be more advanced now a days and i could be wrong.

From what i read about the keyloggers the RMT used in the early hackings, they do indeed take frequent screenshots when POL.exe is opened on the infected PC. It was merely a keylogger that also happens to take screenshots when certain conditions were met and was basically just a modified version of the WoW/LII keylogger used to fish accounts from those games as well.

Judging by the amount of people hit even without actually keying in their passwords, one theory was that they found a way to decrypt the POL 'save password' function but im no computer wiz and couldnt actually confirm that myself.