SRL Archive - RuneScape News and General

Be forward, this is a rant, aimed at the negatives of free trade, which I have just experienced…again


FUCK! Hacked, 14M is down the drain, and I am not at all happy. Lost 8M in coins 22k coal 5k mith ore 1k iron ore, full rune and scimitar. I have the following remaining, a handful of gems, rune pick and hatchet, and random junk.
Without Free trade, I was safe from this feeling, knowing others couldn't benifit from hacking me and taking my stuff, and I was safe. within HOURS of free trade being back, I have lost almost everything. and I am not happy about it.
Bring back my safe and happy runescape.

I don't want free items, I just want a rant. This happened on my main, I don't bot on it, and my bots will never "feed" it. If you excuse me I will be changing my password

Shoulda had a pin, bro. Good luck next time :(

Bad luck but people have always had ways of taking your money even with the trade limit. Don't blame free trade for your misfortunes.

Lets just say with the years of no free trade, it hadn't happened, within hours of it being brought back I lost almost everything…

Its cause of free trade…

Didn't expect to see such a thread this soon.

From: EvilChicken!
Didn't expect to see such a thread this soon.

I didn't either.

Had you told anyone your password?

Just watch, I am saying that price will go up. Obviously stuff getting merched by clans are gonna go down, but most stuff like claws and shit is gonna go up cause no one will be out there getting them and every one is gonna be losing them in the wild.

From: Main Ftw
Just watch, I am saying that price will go up. Obviously stuff getting merched by clans are gonna go down, but most stuff like claws and shit is gonna go up cause no one will be out there getting them and every one is gonna be losing them in the wild.

Thing is, items don't disappear in the wild like they did on PvP worlds. Very little items will be physically lost, due to the killers picking them up.

Now you know not to give out your password anybody. My friend was planning on hacking his "friend" who had 80m when free trade came out, but that person decided to spend all their money on 99 prayer (already had 95 I think) and is now begging people for money, lol.

Yea, you have right to be angry. but don't BLAME free trade. You would have been just as pissed off if someone logged into your account and dropped all your stuff when there was no free trade.

As I see it, you should be blaming security measures and maybe some other factors.

I'm sorry for your misfortune. You should have always had a pin on all of your accounts. No matter if there was trade limits or not. Most people when faced with the option of greed, they take it, sadly. So always be wary of who you are friends with.

I highly expect password stealing scripts to come back. Which I know is cruel to say about possible current and new members. But nice people can be very cruel when given the chance and if they need the reward.

I hope you recover from this hit on you and it never happens again.

I don't like the term "hacked". There was no computer nerd hacking into jagex's systems to steal your password. It would have to be carelessness on your part in order for you get duped. Possible computer virus, or a friend knowing easy recoveries or even your password. There is always an explanation.
Sucks you lost it. Back when I was younger I fell for quite a few dupes and lost everyone on my main on 3 different occasions, lol. I just look back and take away what I learned.

Been playing 7 years and had no problem because I have a secure password and computer.

Those things can only get you so far. A person also needs common sense along with those things of which you listed.
Human engineering is easy, especially on games like RuneScape because of the majority of the players being young people that have yet to experience life and the people of it.

From: IceFire908
Been playing 7 years and had no problem because I have a secure password and computer.

I have a randoms army that have pretty well known usernames and passwords.

Today I logged into one of them to find that they weren't at yesterday's autoing spot, they were standing next to the bank in Lumby castle. And all the goods they had been collecting over the last couple of days were gone.

Kind of bizarre if you ask me, but I guess a mill or two there for the taking is too much of a temptation to some people.

From: tarajunky
I have a randoms army that have pretty well known usernames and passwords.

Today I logged into one of them to find that they weren't at yesterday's autoing spot, they were standing next to the bank in Lumby castle. And all the goods they had been collecting over the last couple of days were gone.

Kind of bizarre if you ask me, but I guess a mill or two there for the taking is too much of a temptation to some people.

Please tell me you got their IP. Would be interesting to see what higher ups would do such a thing.

Don't be on any third party runescape site while logging in.. flash ads can and will keylog you when they get the chance, that was a huge problem in WoW

Watch out for that… noscript addon (for firefox) is an amazing tool

^ What about SRL :p

From: Brain
I don't like the term "hacked". There was no computer nerd hacking into jagex's systems to steal your password. It would have to be carelessness on your part in order for you get duped. Possible computer virus, or a friend knowing easy recoveries or even your password. There is always an explanation.
Sucks you lost it. Back when I was younger I fell for quite a few dupes and lost everyone on my main on 3 different occasions, lol. I just look back and take away what I learned.

this annoys me as well people claiming to be hackers or w/e while they actually obtained the password trough a scam or the stupidity of the owner.

From: tarajunky
I have a randoms army that have pretty well known usernames and passwords.

Today I logged into one of them to find that they weren't at yesterday's autoing spot, they were standing next to the bank in Lumby castle. And all the goods they had been collecting over the last couple of days were gone.

Kind of bizarre if you ask me, but I guess a mill or two there for the taking is too much of a temptation to some people.

You should considering transferring all the worths to your mule until we can figure out who it was.

From: tarajunky
I have a randoms army that have pretty well known usernames and passwords.

Today I logged into one of them to find that they weren't at yesterday's autoing spot, they were standing next to the bank in Lumby castle. And all the goods they had been collecting over the last couple of days were gone.

Kind of bizarre if you ask me, but I guess a mill or two there for the taking is too much of a temptation to some people.

I would say check the last IP's on the rest of them. Pretty much every time I check your acc's I notice the same IP logged onto them all prior to me.

From: Rich
^ What about SRL :p

I have no script on so I don't see your adds.. but for a few days the adds on battle.net and blizzard.com had keylogging software, these can't / are not complex.. so alt coded letters don't show up etc but simple text does, I believe adobe did a fix for this so I couldn't tell you how popular they still are but I can tell you thousands of WoW accounts were victims


adobe really has the worst history of bug / exploit fixes though..

From: tarajunky
I have a randoms army that have pretty well known usernames and passwords.

Today I logged into one of them to find that they weren't at yesterday's autoing spot, they were standing next to the bank in Lumby castle. And all the goods they had been collecting over the last couple of days were gone.

Kind of bizarre if you ask me, but I guess a mill or two there for the taking is too much of a temptation to some people.

Wow someone here did that O_o I never thought of anyone here doing that type of stuff =/

I blame free trade because the incentive is there now to do it. before it wasn't.
I don't have a pin, cause I have been smelting, which is slown down ridiculously by having a pin.

Also, I know not to give my password out, except to the odd person here at SRL who was developing randoms…..

Anyone else had this hacking problem? Can we have IPs? and perhaps a crosscheck? I am not accusing someone here, moreso a pissed off ex-member…eg CStrike

From: Bad Boy JH
I blame free trade because the incentive is there now to do it. before it wasn't.
I don't have a pin, cause I have been smelting, which is slown down ridiculously by having a pin.

Also, I know not to give my password out, except to the odd person here at SRL who was developing randoms…..

Anyone else had this hacking problem? Can we have IPs? and perhaps a crosscheck? I am not accusing someone here, moreso a pissed off ex-member…eg CStrike

Should I be changing my passwords after I give them to the RS randoms team?

I changed my mains password today, just for security reasons, I haven't changed it for a few years. I have never given it to anyone, but still, its good to be on the safe side.

When I give my accounts to anyone first I change the password from the original and when I get back it I change it back. I was thinking it's common.
Not because I don't trust them, but if my account some gets stolen I will know that they weren't the ones.
Anyway I never ever lost accounts. My computer is clean and I never give out my original pass.

From: Sabzi
When I give my accounts to anyone first I change the password from the original and when I get back it I change it back. I was thinking it's common.
Not because I don't trust them, but if my account some gets stolen I will know that they weren't the ones.
Anyway I never ever lost accounts. My computer is clean and I never give out my original pass.

I only bot on my botting accounts so I could care less if the whole forum knew them.. if no one would take anything :P

but yea I'd be doing the same thing if it were an account I played a lot

you only have to enter the PIN once per log in….takes like 3 seconds total.

From: grats
I only bot on my botting accounts so I could care less if the whole forum knew them.. if no one would take anything :P

but yea I'd be doing the same thing if it were an account I played a lot

I never ever played legit actually, but I care about my little botted main(s).

From: grats
Should I be changing my passwords after I give them to the RS randoms team?

Yea, but you really shouldn't give an account you are worried about people robbing its password. I.e. your main. Instead worthless slave accounts.

i nearly experienced the same thing. my pw was changed, however, i was logged in the whole time, and managed to realize it was changed and thus didnt lose anything. someone got a pretty nice hacker thoo.. >_<

From: donkey60000
i nearly experienced the same thing. my pw was changed, however, i was logged in the whole time, and managed to realize it was changed and thus didnt lose anything. someone got a pretty nice hacker thoo.. >_<

http://en.wikipedia.org/wiki/Password_cracking

9/10 an account is stolen due to user negligence.

edit:
The link is because I had no idea what you meant by "hacker". You're using the wrong vocabulary. :)

From: IceFire908
Yea, but you really shouldn't give an account you are worried about people robbing its password. I.e. your main. Instead worthless slave accounts.

Yea that's pretty much all of my accounts.. I do have a main but I'd still let you guys on it.. lol, never get randoms though

lol, I lost 20m + staking today. I didn't really mind though, I had a lot of fun staking it, since I just fluctuated around losing a mill for like two hours, then I said, f it, and put the rest of my money in for one boxing match. That match came down to the wire. We both had around like 5 hp left and he got the hit before I did :) Oh well.

On the hacking side, one time some guy hacked me through aim :o

RS accounts can be hacked, the meaning of the word is correct on the subject, as there are forums and other sites, that users register, enter username, password and email address, when a hacker sees a vulnerability in these sites, he gets the database, now some sites store passwords in plain text, others use basic MD5 hash which can be brute forced or searching from online crackers, like www.md5decrypter.co.uk (It has quite a big database).

After this, usually the hacker tries the same password or variations on the email address that was used to register, 75% of the time the password is the same, now that they have access to the email, they can pretty much steal ("hack") any account that is registered to that email, including: steam, runescape, forums, sites, paypal, etc.

There is not much you can do about this, just make sure you never use the same password on the accounts/sites you value.

Protection against website vulnerabilities is important, keeping your forum software up-to-date and looking for possible exploits from time to time to your forum software, and if found, just disable the forum for that time (Or the vulnerable file).

Most hackers use proxies, so theres no point in getting the IP, but yeah, some skiddies don't know shit about anonymizing themselves.

You can get everything from the database, heres an example:

	user_email	user_pass_convert	user_passchg	user_password	username	username_clean	user_id
	postmaster@choicemeds.info	0	1282368414	eba76df3******8addebd3161081d59d	Ameteuncene	ameteuncene	791
	debovann3@aol.com	0	1282433045	a38d4b1f79459071d943e39******fd6	KillaInc.	killainc.	792
	havoc-disciple@hotmail.com	0	1282503881	a0a4992bae******ebfb911fe4a92c1	havoc-disciple	havoc-disciple	793
	mattistookool@me.com	0	1282509011	03e09363c15f9e29******28d4bc9904	deajsa	deajsa	794
	g.it.u.lh.ooo@gmail.com	0	1290082035	acdb0014a01******941e3179d335911	ridener??m	ridenerm	1080
	ms130@live.com	0	1288649225	dcfee42fa1811ab22be9******51dd4a	mac_attach	mac_attach	1050
	stunna_superman@yahoo.com	0	1282275217	516b******6654e478a2584516e1d0b4	young-star	young-star	789
	mesisca89@yahoo.com	0	1282271513	4a998132e095611f6******185fe38da	Mesisca89	mesisca89	788
	shannunnery@ymail.com	0	1282041050	33ecb762027025b******706163025f1	Miltown_414-Goo	miltown_414-goo	781
	kevinhadzic@yahoo.com	0	1282160904	7000a6920e7ff9c0******d5bd1ffce1	shooter-027	shooter-027	783
	bookworm3655@yahoo.com	0	1282173597	b23088b566431a******23a360a212f1	canusurviveme	canusurviveme	785
	mesisca89@yahoo.com	0	1282271513	4a998132e******f6e2b6e4185fe38da	Mesisca89	mesisca89	788
	stunna_superman@yahoo.com	0	1282275217	516bc9f884******78a2584516e1d0b4	young-star	young-star	789
	mdvann2@aol.com	0	1282354410	e4f831c7dd5eb92950******abb2191f	deathbringer27	deathbringer27	790
	underarmor79@yahoo.com	0	1282514085	1616b4035******954ea98b880ae27ff	A7X_Soldiers	a7x_soldiers	798
	allyg@gmail.com	0	1282517907	a854bfb3fb4e7c621f******56dec101	Al_sharpton	al_sharpton	799

Those were achieved by a blind SQL injection.

Basic vulnerabilities are SQL/Blind SQL injections and RFI/LFI (Remote File Inclusion/Local File Inclusion).

Links for information:
Blind SQL injection
SQL injection
RFI
LFI

From: Frement

75% of the time the password is the same

All I read was "User Error"

From: Brain

From: Frement
75% of the time the password is the same

All I read was "User Error"

People don't understand how important it is to select strong passwords, and even if my password would be "thread1", I should at least use "post2" on my email, that way hackers only get one of your accounts, the site/forum account that they hacked the database from, but chances are they are not interested in them, they are seeking combos (list of usernames and passwords) or emails to hack into PayPal or other services. Isolating your email from your other passwords is important and should not be ignored.

depends on whether you trust the member or not, you could change it before you give it to them to something else, then when you get it back, change the password back, means you don't need a new password.