The sky is falling: player with token hacked? (lolIE)

[Siniroth]

Screw that, an annoying OTP needed from token in the game before dbox transactions and trades is even more secure. I do not know if that was intended as sarcasm.

I don't think he was being sarcastic, though I can tell you are... it's true, as long as you had to input two OTP at seperate times it would certainly stop this method if what they're doing is hanging program and ganking your current OTP

Actually... maybe not, maybe you keep restarting POL and keep inputting PWs and you input a second, congratulations they have two OTPs

[dejet]

we wont get a real answer but lets ask anyways. People getting hacked that have no hope of coming back. do you have a bot that you DLed ~_~'

[Corrderio]

we wont get a real answer but lets ask anyways. People getting hacked that have no hope of coming back. do you have a bot that you DLed ~_~'

I only used windower! I swear!

[Guppy]

IE is SE's worst 3rd party program enemy.

It definitely is, but don't forget there are other ways to get pwnt. Adobe Flash & Acrobat Reader gets compromised on a regular basis. Microsoft Office is another good example of a perpetual security hole.

Even if you're very careful with them, if you're playing on the family PC it can be almost impossible to keep family members from opening stuff their friends sent them.

[Snprphnx]

I got bored and tested, it took 30 seconds, so yeah it'd slow down login, but I don't think it'd be that terrible if it stopped this kind of thing

or you can bring up the on screen virtual keyboard and enter your passwords once that way, so the only thing the scripting program is getting is a record of thr left mouse button being clicked X-number of times. takes maybe 10 seconds extra

[Gere]

happened to a buddy of mine, he was in dynamis and he d/c'ed. He said his FFXI was acting weird and disappearing on the task bar when trying to get back in and when he was able to get back in he found himself in sandoria missing 2m gil and some sellables.

he has one of those security tokens and all happened within a 3-4min span.

Did his character disconnect completely and drop party? Or just red dot for a second and then warp out?

or you can bring up the on screen virtual keyboard and enter your passwords once that way, so the only thing the scripting program is getting is a record of thr left mouse button being clicked X-number of times. takes maybe 10 seconds extra

A good logger will also record the cursor position meaning they get your password either way.

[Shenrien]

http://i28.tinypic.com/25jblo9.jpg

Hah! this will stop them hackers!

[Avarice]

A good logger will also record the cursor position meaning they get your password either way.

Not saying what you're saying isn't true (since I really don't know much about keylogging at all, to be honest), but what about resizing the POL window to be somewhat small, and then moving it to a random location on the screen prior to click-entering your password?

[Jotaru]

they'd still get relative motion

I had my password emailed to me in a mumbo jumbo mix of about 500 characters, and would copy+paste just the 6 that were my password into the box. Win.

[Siniroth]

If they can calculate your cursor position, they can just copy your exact actions while resizing as well, so it wouldn't do anything, it'd need a randomly generated soft-keyboard

[Gere]

they'd still get relative motion

I had my password emailed to me in a mumbo jumbo mix of about 500 characters, and would copy+paste just the 6 that were my password into the box. Win.

It can also easily capture the clipboard.

There is no good way, only better ways.

Or to put it simply: Once your computer is sufficiently pwned you are SCREWED no matter what you do.

[Darte]

If they can calculate your cursor position, they can just copy your exact actions while resizing as well, so it wouldn't do anything, it'd need a randomly generated soft-keyboard

If i recall correctly, Maplestory employs this, after each click on the virtual keyboard, each key is randomized and would be quite effective. I kept wondering why Square's own keyboard was so shittily implemented.

[Corrderio]

If i recall correctly, Maplestory employs this, after each click on the virtual keyboard, each key is randomized and would be quite effective. I kept wondering why Square's own keyboard was so shittily implemented.

It's Square, isn't that a reason enough?

[dejet]

http://www.bluegartr.com/forum/attac...1&d=1251038773 thats all you need ~_~: - the proxy LOL

[Thorny]

A proxy doesn't do shit to protect you from most common methods of getting a keylogger onto someone's computer. You're an idiot.

[Siniroth]

If i recall correctly, Maplestory employs this, after each click on the virtual keyboard, each key is randomized and would be quite effective. I kept wondering why Square's own keyboard was so shittily implemented.

Honestly MS was the only thing I could think of that had one, I'm sure others do, but MS' is nice

[Cream Soda]

Would the HDD/Partion make any diff? for example, would it be more difficult to be hacked if my web browsing was on a separate hdd/partition as my ffxi ?

[Siniroth]

Not unless you have some form of security

[Aikar]

Remember when we were all being cynical twats when the token came out, and someone proposed that this was a possibility haha.

You guys need to think before you post I knew about this the entire time as a possibility but never said anything so it wouldnt give the RMT any ideas.

RMT prolly saw who ever mentioned it and then implemented it.

[Yabby]

Viewing this post: "RMTStealingYourIdeasLawls"