SRL Archive - News and General

As you may know, Jagex limited has had a case against impsoft (ibot) owners for a while. I have not seen any news about the case in a while.

The Snellman brothers were being sued for multiple thousands of dollars, could it be possible that they settle out with Jagex by giving them all the usernames of Nexus users?


Remember, iBot is the only closed-source Java bot :)

It's not the only closed source java bot.

RSBuddy is closed source, scripts and bot.

From: tofurocks
As you may know, Jagex limited has had a case against impsoft (ibot) owners for a while. I have not seen any news about the case in a while.

The Snellman brothers were being sued for multiple thousands of dollars, could it be possible that they settle out with Jagex by giving them all the usernames of Nexus users?


Remember, iBot is the only closed-source Java bot :)

I doubt that Jagex would be willing to drop the case over the names of a few thousand bot accounts.

And no, iBot isn't the only closed source bot.

Why would jagex choose usernames of $$$?

besides, i registered my username on all Bot sites to not match my main. Unless they some how get stored usernames that are saved on there.

That doesn't seem to make sense, like someone above said why take usernames over cash? It's not like banning those accounts would make a huge noticeable effect either, the users will simply make more accounts and use other bots. Money means a lot more than a list of usernames.

It would kill botting for a long time if they banned all iBot users.
They basically monopolize the paid bot market.

Also, Jagex sued them just to make the snellman brothers have no money to host the site/bot, they don't expect to win. It's something companies do a lot to small organizations like this. They sue them until they go out of business.

But also, Overtime, runescape usernames and passwords are cached in the client unencrypted, even if you don't let the bot log you in. So it doesn't matter if you never say your usernames or have them stored in the bot's script manager or whatever, since that's not how they'd get the names/passwords.

I don't think this would happen though.

Jagex needs neither money nor account names. What they need is one less java bot.

From: Smartzkid
Jagex needs neither money nor….

ALL of their recent actions say otherwise.

They don't even need to pay the snellman brothers. All they need to go is to Varrock and see all the ore and essence botters.

Do you even think bots log the usernames of people who use it?

From: cycrosism
Do you even think bots log the usernames of people who use it?

Only time it happened with a Java bot, was when someone hacked the SVN and added a keylogger of some sort, and uploaded that Rsbot and people downloaded it. I think 100's of people got banned that day.

But no the original makers of these bots don't log user details.

From: kingarabian
Only time it happened with a Java bot, was when someone hacked the SVN and added a keylogger of some sort, and uploaded that Rsbot and people downloaded it. I think 100's of people got banned that day.

But no the original makers of these bots don't log user details.

The client DOES store the usernames and passwords.
How else do you think it logs you in?

-Boom

From: Dynamite
The client DOES store the usernames and passwords.
How else do you think it logs you in?

-Boom

I'm talking about the bots - something else.

But as soon as you close the bot your details are gone I believe since details are kept server side. If clients stored details forever then we could all deob the latest Rs client and hack everyone including zezima and chessy.

Good thing I stay away from all javabots. I have nothing to worry about. (:

Remember awhile ago when I said JagEx (producers of RuneScape) were suing a bot developer? They didn't quite follow in Blizzard's footsteps, as they left out tortious interference - and they had a nifty trademark claim from the bot guys selling "runescape.su" email addresses to help phishers deceive people. They did, however, go right for the personal liability. As before, I believe that practice will stop when someone winds up dead, which tends to happen when you corner people.

Turns out they survived a preliminary injunction motion. It doesn't decide the whole case, but it's pretty damn close to a win for the bot guy. They will definitely be able to keep selling their product, if they choose to.

Unfrozen caveman lawyer analysis:

1) JagEx got smoked on the copyright claim because they didn't register the game in the Copyright Office. Comedy gold. The court conveniently sidesteps the whole "someone made a RAM copy somewhere while violating a term in the EULA!" thing by saying there's no copyright to infringe. One key point is JagEx mentioned that they did register the copyrights to some of the game art, which does get copied around in RAM, even if the game code itself isn't registered. The judge didn't seem to latch onto that quite the same way our guy did.

2) JagEx lost on their DMCA claim because there was nothing to circumvent. The court pretty much said "if you had something like Warden, maybe there's a DMCA violation". But RuneScape doesn't really have a Warden, or at least it wasn't presented very well to the court if it does. There's no real legal analysis of what access-control or copy-protection is, so it doesn't really mean much other than 1) RuneScape needs some kind of Warden or 2) JagEx needs better counsel to explain how their Warden-like thing works. Mind you, I'd still think the bot guy should win in the face of such Warden, but it's a moot point without.

3) JagEx somehow lost on the "runescape.su" trademark infringement claim, since the defendant isn't doing it any more. I'm no trademark master, but it sure seems like a shitload of damage was done before with that domain name. Maybe there's a different claim they have to assert.

TL;DR
Bot guy won, kind of on some technicalities.

Source:

http://vforums.mmoglider.com/

~Home

From: tofurocks
Remember, iBot is the only closed-source Java bot :)

From: mormonman
It's not the only closed source java bot.

From: TomTuff
RSBuddy is closed source, scripts and bot.

Not to mention the bots that the developers simply don't advertise and use privately among themselves.

From: kingarabian
I'm talking about the bots - something else.

But as soon as you close the bot your details are gone I believe since details are kept server side. If clients stored details forever then we could all deob the latest Rs client and hack everyone including zezima and chessy.

YOUR username and password is stored in the runescape client while you're logged in on your computer. That's how the whole RSBot thing happened. They didn't use a keylogger, they just got the user/pass from those hooks, afaik. If they did use a keylogger, that's just stupid and they don't know much about the client.

They're not stored forever, but if you use a bot (even Simba can do this), even if you don't let it log you in, it can get your user/pass while you use it.

From: i luffs yeww
YOUR username and password is stored in the runescape client while you're logged in on your computer. That's how the whole RSBot thing happened. They didn't use a keylogger, they just got the user/pass from those hooks, afaik. If they did use a keylogger, that's just stupid and they don't know much about the client.

They're not stored forever, but if you use a bot (even Simba can do this), even if you don't let it log you in, it can get your user/pass while you use it.

No, the infected RSBot client decrypted and read the file that RSBot uses to store account information.

Simba or nothing. I trust SRL completely, Smart as well. TRiBot also because it's built by TRiLez, he seems like a pretty cool guy. I've no trust for any other bot, and that's how it's gonna stay for me.

From: Method
No, the infected RSBot client decrypted and read the file that RSBot uses to store account information.

lol why would they do that?

Regardless, it's still possible to upload the user/pass of accounts without them being stored in an account thing like RSBot has/had.

From: i luffs yeww
lol why would they do that?

Regardless, it's still possible to upload the user/pass of accounts without them being stored in an account thing like RSBot has/had.

So they could get the login information of all of a user's accounts, not just the ones they happened to use.

Oh, right. Well I think I'd rather just upload it when you log in, as everyone expects some lag at that point. And that way you only get the ones that are used! :D

From: i luffs yeww
Oh, right. Well I think I'd rather just upload it when you log in, as everyone expects some lag at that point. And that way you only get the ones that are used! :D

Why would there be any lag associated with sending account information to a third party? All you need to do (and what was done, as far as I am aware) is start a new thread that connects to an irc server and listens for commands (e.g. one to send account information).

Take from RSBuddy Website.

How safe is storing my password in RSBuddy?

RSBuddy stores your account information in a hidden folder on your computer, but when it comes to your passwords, it takes additional steps to protect this information just in case someone has managed to hack your computer with a virus that you don't know about.

If you are running RSBuddy without a forum account, no information will be stored on your computer and you will lose what you enter into the account manager as soon as you close the bot.

If you log in with your RSBuddy account to start the bot, your RSBuddy password will be used to encrypt all of the passwords in your account manager. This way a hacker will have to work out your forum password as well as get full access to your computer and have a keylogger installed before they can take your information. We also change the way your information is encrypted over time so that hackers have a very hard time getting hold of anything. Using this system to store your passwords is more secure than entering the information yourself every time you log in.

Again, there are two hooks for getting the user/pass that people could put in their scripts so it doesn't matter what the bot does to stop it.

What about scripts?

We review all script submissions for malicious code before allowing them to be loaded by RSBuddy. We strongly discourage using any bot that doesn't have a system like this in place.

What about other applications?

If you have ever used another bot that doesn't require you to enter a 'master password' to store your account information, we highly recommend that you delete all information stored by these applications, so that your passwords are not left unprotected on your computers. The way these other bots encrypt your passwords are easily reversed by hackers and many thousands of accounts have been hacked this way.

Taken from site.

Timer has told me he has somewhat malicious code in his scripts, and I was going to go test it out (reads chat text and responds with information about run time and what not), but didn't care enough. I believe him though.

Albeit what he said was in the scripts weren't anything TOO malicious, it shows me that they don't do too thorough of a check for me to trust them.

Timer is anal.

If thats true, ill just report it to RSBuddy to ban him.

Whether he really did it or not, I still don't see why people couldn't. Especially when there's somebody who gains trust and then puts something in their script in an update and it gets overlooked.

I just don't trust closed-source things as often as open-source things (not that open source stuff is inherently, 100% going to be virus free at all, it's just I can figure it out without trusting others to do it for me).

From: i luffs yeww
Again, there are two hooks for getting the user/pass that people could put in their scripts so it doesn't matter what the bot does to stop it.

I'd love to know how scripts are going to access that information without having access to any accessor methods to retrieve it. Furthermore, scripts are automatically and manually verified before being pushed live on the servers, so any code using reflection would definitely raise some red flags.