SRL Archive - News and General

From: YoHoJo
Powerbots Twitter Page:
IMPORTANT: please dispute any Arbiter/ArbiBots scripts you have bought on PayPal as they contain keyloggers. Over 100 people hacked so far!

Concerning free ArbiBots:

From: YoHoJo
I have no idea, don't use powerbot. But I'm assuming if he keylogs his pay scripts he would probably keylog his regular scripts too.

If you've used ArbiBots at any point, change you're passwords and delete ArbiBots immediately.

Not true from when I looked at his loader and scripts in November 2010. But things change in 4 months.

And powerbot and arbibots are kinda rivals now, so whatever they say about each other should be taken lightly. Since Arbiter owns Arbibots and resigned from powerbot to join Jacmob in making RSBuddy, which will basically compete with powerbot.

Don't user powerbot, but was on their twitter page and this was on top:
http://twitter.com/#!/rsbotorg

From: pyroryan
Not true from when I looked at his loader and scripts in November 2010. But things change in 4 months.

And powerbot and arbibots are kinda rivals now, so whatever they say about each other should be taken lightly. Since Arbiter owns Arbibots and resigned from powerbot to join Jacmob in making RSBuddy, which will basically compete with powerbot.

Would still rather not take the risk though.

Actually i think this should be a little corrected. As i've seen people suspect actually all the blaming on arbiter was fake. The person who "hacked" the accounts is actually a person named Gh0$t and it wasn't just arbibots that were infected, but the whole RSBot v2.22. That is because this Gh0$t guy had access to the repository and somehow managed to include his own things in it, meaning a file dropper and a logger of some sort.
Currently i think that RSBot and RSBuddy are ddosing eachother and there seems to be no end. I'm not 100% sure about this except for the part that Gh0$t actually infected the RSBot client.

Wow, sad :[. Happy nothing like this happens at SRL :D. I guess it's the money aspect?

That's worrying to say the least.
– BP

From: lolislol
Actually i think this should be a little corrected. As i've seen people suspect actually all the blaming on arbiter was fake. The person who "hacked" the accounts is actually a person named Gh0$t and it wasn't just arbibots that were infected, but the whole RSBot v2.22. That is because this Gh0$t guy had access to the repository and somehow managed to include his own things in it, meaning a file dropper and a logger of some sort.
Currently i think that RSBot and RSBuddy are ddosing eachother and there seems to be no end. I'm not 100% sure about this except for the part that Gh0$t actually infected the RSBot client.

well actually Gh0$t is an alias/worker for arbi they put it all on him, but arbi and jacmob made over $10,000 by RWT the stolen gp

Wait, so he has the passwords to my RS accounts?

Wow…Just wow. That's why you've gotta love SCAR/Simba/SRL.

Oh my god.

More power to SRL, in my opinion. Someone had to teach these guys a lesson.

Explains why many accounts of people I know IRL got hacked (from a US IP). Someone most likely ran the infected version.

This could just as easily be done here…

People are acting like it isnt even possible and thats just ignorant.

From: kitchenrange
This could just as easily be done here…

People are acting like it isnt even possible and thats just ignorant.

Wondering how you'd do that. :)

From: Wizzup?
Wondering how you'd do that. :)

Well, I certainly wouldnt be able to do it. But you could. :)

MSI stores it plaintext in players.ini or whatever. Just add some http thing in MSI (there's no default enabled firewall anyways) and tadaa, you got a dozen of passwords.

From: Markus
MSI stores it plaintext in players.ini or whatever. Just add some http thing in MSI (there's no default enabled firewall anyways) and tadaa, you got a dozen of passwords.

Why the fuck does MSI store it as plaintext…

Well, you store it in plaintext in your script as well. But I think we should assume that people won't run random scripts that will just upload their files etc.

From: kitchenrange
Why the fuck does MSI store it as plaintext…

How are you supposed to log onto RS with an encrypted login file?…

From: Harry
How are you supposed to log onto RS with an encrypted login file?…

Well, I guess its true that its stored in most scripts I use as plaintext as well. Just seemed like there could be some sort of encryption/decryption process, but w/e.

The point I was making is that it could be done here easily.

If the loginplayer function has access to the decrypt function, then the password stealing function would have access too. So encryption/decryption wouldn't work.

What does work, is having an open source system that is easy to read. Easy for users to read, and easy for an automated script verifying script to scan through scripts and includes to make sure that Declareplayers/playerform and loginplayer are the only things using the password variable.

So, you are saying that it couldn't be done?

Someone with commit access couldn't change something that would be updated using the hourlies that everytime declareplayers was called, it sent the password to somewhere?

Even if you could catch them it would be afterwards. I don't know the inner workings of the system, but it seems like that could be done easily.

From: kitchenrange
So, you are saying that it couldn't be done?

Someone with commit access couldn't change something that would be updated using the hourlies that everytime declareplayers was called, it sent the password to somewhere?

Even if you could catch them it would be afterwards. I don't know the inner workings of the system, but it seems like that could be done easily.

Yes, that is possible. Eventually I'll make the updater use tags, so they'll have to be verified in advance. At the cost of getting the updates with some delay.

From: kitchenrange
So, you are saying that it couldn't be done?

Someone with commit access couldn't change something that would be updated using the hourlies that everytime declareplayers was called, it sent the password to somewhere?

Even if you could catch them it would be afterwards. I don't know the inner workings of the system, but it seems like that could be done easily.

It could be done, but you can catch them beforehand, by checking the code after every update and new script. Of course people don't take time to do this, but the point is, encryption wouldn't help.

I think there is a on update hook for SVN, don't know anything about Git though…
Somebody could write one and Wizzup could add it. Basically it would be what Boreas said and just scan through all the core files + maybe SMART, for the decryptpassword function being used in any function other than the allowed ones. If it doesn't exist anywhere else, commit, else flag or deny.

It wouldn't do it for scripts because that is the user's responsibility..

The easiest way to do this would be for the developers to pack some code in the .dlls to steal your accounts. Or wizzup could simply pack similar code into simba on release, although that possibly could be picked up by virus detection.

From: Boreas
It could be done, but you can catch them beforehand, by checking the code after every update and new script. Of course people don't take time to do this, but the point is, encryption wouldn't help.

I concede on the encryption/decryption :).

But my main point was that it could be done, I keep seeing posts, one by you yourself I believe saying that good thing this cant happen at SRL or something similiar. I just didn't want the communities eyes to be closed to the possibility.

From: kitchenrange
I concede on the encryption/decryption :).

But my main point was that it could be done, I keep seeing posts, one by you yourself I believe saying that good thing this cant happen at SRL or something similiar. I just didn't want the communities eyes to be closed to the possibility.

I don't remember saying it can't happen (I investigated password stealing incidents quite a bit in 2007). Agreed, everyone should be aware of the possibility.

_____________________________________

There should be a tutorial on how to check for password stealing. Something along the lines of:
Your password is stored in a variable called Players[<NUMBER>].Pass. (<NUMBER> is which player in the array, often the variable CurrentPlayer.) It is a global variable in Players.simba, and can be accessed by other parts of SRL, and scripts that include SRL. AFAIK plugins can not access this variable unless it is passed as a parameter of a function in a plugin, called from a script that can access it. The following locations in SRL access it … The following are ways scripts can access it…. The following are ways it could be stolen…

From: Matsetst
http://oi52.tinypic.com/nqtkwp.jpg

Funny name to call it.. stealthbot

that's a battle.net bot :O

anyways.. yea.. whatever really did happen (people on SRL say he didn't do the keyloggers) anyway, change your password if you used any powerbot IMO

On IRC I joined #RSBOT and it had ~30 people, time went on I went to bed I Woke up and it had over 200 people, and I had a PM from some random which said "rsbot got hacked go here to see whether your account is safe" and it was the RS login page (phising lol)
The LINK BELOW IS TO A SITE THAT WILL STEAL YOUR PASSWORD. IT IS SAFE TO CLICK ON IT AND LOOK AT IT, BUT DO NOT ENTER ANY ACCOUNT INFORMATION.

<aFrX> rsbot was hacked check if your account is in danger http://powerbothacked . tk

E: Added spaces between the .tk so you don't accidentally click on it then accidentally click on the phising link and then accidentally write in your username and password

From: cycrosism
On IRC I joined #RSBOT and it had ~30 people, time went on I went to bed I Woke up and it had over 200 people, and I had a PM from some random which said "rsbot got hacked go here to see whether your account is safe" and it was the RS login page (phising lol)

Just put in an account "gull" pass "ible"

:sasmokin:

This is probably the most HILARIOUS thing thats happened this year! Gho$t is my idol. However i got to say, close call. I couldve lost my level 136 (however unlikely due to the fact they could just get other level 138 with 1b+ net worth.), and i wouldve…not cared cause i quit and i didnt even put any REAL effort to my account other than paying electric bills if you know what i mean ;p

To people complaining saying Gho$t is an ass and what not.. Sure he is! But hes the good kind of ass that just taught everyone to be more careful with their accounts. Personally, hes done Jagex a favor about trusting bots.

I just made the user and pass aaaaaaaaaa and it actually redirected me to a proper article.

Its funny how on the fake RS login screen it says ONLY login if you see the green HTTPS bar on the top, too bad there was none.

Also, runescape-services? epic fail lol, its runescape.services

pretty good phishing site, lets spam it with swear words to make their eyes bleed when they read the logs! lol

anyone else lose anything? i lost about 80 million on two accounts and that was the first time i downloaded powerbot/rsbot

Stick to Simba and you'll never have to even worry about future hacks like this, there's no safer method to botting than Scar/Simba.

It can still happen here. It's happened before and it's bound to happen again.

So much hacking going on these days..

Wikileaks, Egypt hackings, Runescape Hackings….

From: i luffs yeww
It can still happen here. It's happened before and it's bound to happen again.

True, but it's a lot harder to do it discretely here, and get away with it.

Gold4rs owns powerbot right? Maybe they have involved in this somehow… And now selling the gold.

From: Rich
True, but it's a lot harder to do it discretely here, and get away with it.

I'd say it's just as easy if not easier here, as you can pretty easily hide stuff in scripts. It wouldn't be on the scale as it happened on rsbot, unless someone distributed their own version of simba, but code can be hidden in scripts quite easily. Especially since it'd only take up one line.

(Not that you can't hide things in java scripts, but people are generally trusted here so people won't be as cautious.)

From: i luffs yeww
I'd say it's just as easy if not easier here, as you can pretty easily hide stuff in scripts. It wouldn't be on the scale as it happened on rsbot, unless someone distributed their own version of simba, but code can be hidden in scripts quite easily. Especially since it'd only take up one line.

(Not that you can't hide things in java scripts, but people are generally trusted here so people won't be as cautious.)

This is true. Anyone who's released a script could release a new version with a simple GET page in it. It would also be easy for anyone who's got MSI committing rights to do that for MSI.
Luckily there's no-one in MSI that would do such a thing.

:p People trusted people who did this in the past but it still happened.

All I'm saying is that it's not like this is rsbot's fault or anything, it's quite an easy thing to do, hacking that is.

I suppose the only safe scripts are user-made then. Our usernames and passwords are stored within the script itself (with the exception of MSI I believe?). I've always been a fan of creating my own scripts and using them, as opposed to other's work for this reason especially. Just take a good look at a script before you use it, it could mean all the difference.

I'd be more worried about MSI tbh, since so many people have access to it and so the chances are higher that one of them would get hacked and someone would do bad things with the access they now have.

From: i luffs yeww
I'd be more worried about MSI tbh, since so many people have access to it and so the chances are higher that one of them would get hacked and someone would do bad things with the access they now have.

So many people..? There's only 6 of us including RM.

6 > 1.