SRL Archive - Discussions and Debates

I was talking with Timer a while back and he told me that even without entering our Pin into Powerbot, it'd still be able to "sniff" it.
Is this a fact or am I just in the butt end of a joke?

[4:32:18 PM] Joe: I used to automatically add accounts and pins
[4:32:20 PM] Joe: username, pass, and pin
[4:32:21 PM] Shay: I've used Java before
[4:32:25 PM] Shay: at Buddy
[4:32:25 PM] Joe: it creeped people out so I stopped doing it
[4:32:25 PM] Joe: LOL
[4:32:32 PM] Shay: What
[4:32:33 PM] Shay: o.O
[4:32:35 PM] Shay: LOL
[4:32:37 PM] Joe: yeah
[4:32:40 PM] Joe: once you login to the game
[4:32:47 PM] Joe: the bot can access your username, pass, and pin
[4:32:51 PM] Joe: even if you didn't add them
[4:32:53 PM] Joe: the game stores them
[4:32:57 PM] Joe: and we hooked the values :P
[4:33:27 PM] Joe: that's why i said
[4:33:31 PM] Joe: even if we did hack
[4:33:41 PM] Joe: not putting details in the account manager doesn't keep you safe
[4:33:41 PM] Joe: :P
[4:33:45 PM] Shay: hmm
[4:33:54 PM] Shay: I don't enter my pin while in PB though ;P
[4:33:59 PM] Joe: doesnt matter
[4:34:00 PM] Joe: game loads it
[4:34:00 PM] Joe: :P
[4:34:02 PM] Shay: Im *trying* to stay cautious lmao
[4:34:07 PM] Shay: Isnt it server sided?
[4:34:08 PM] Joe: no
[4:34:14 PM] Joe: it stores it locally
[4:34:29 PM] Joe: it's why the pin screen got sped up
[4:34:32 PM] Joe: used to be slow
[4:34:34 PM] Joe: now it's instant
[4:34:55 PM] Shay: Hm
[4:35:05 PM] Shay: brb xffering items off and running Waterfiends 24/7
[4:35:11 PM] Joe: srs bro don't worry abou it
[4:35:15 PM] Shay: I still can't get over the hacking incident, you'll hav to excuse me on that
[4:35:15 PM] Shay: :L
[4:35:18 PM] Joe: if you use an SDN script you're safe
[4:35:28 PM] Shay: I guess haha
[4:35:33 PM] Shay: Im here because Kiko says its alright
[4:35:39 PM] Joe: lol
[4:35:52 PM] Joe: but the 30k people who use our bot
[4:35:56 PM] Joe: isn't enough?

I am not a pro at java, but I would guess you are at the butt end.

Yup, that's what I was thinking too :p

Still won't trust a java bot that is closed source.

Wow that's bad news if he's being serious. I've been using iDung and trying to be safe by logging in manually and not adding my password/pin to PB.

Thought this was me..

It's serious.

Kiko's dungeoneering bot had my username printed on it, and I didn't save it anywhere, implying they can take it.

From: NKN
It's serious.

Kiko's dungeoneering bot had my username printed on it, and I didn't save it anywhere, implying they can take it.

We could get your RS character name with Simba… Reading that off the screen doesn't mean that you can obtain someones password and pin.

I think NKN is talking about his Email/Username,
What would stop their client key logging?

From: leetsxc
I think NKN is talking about his Email/Username,
What would stop their client key logging?

Well if you put it in terms of keylogging, then absolutely nothing would be stopping them since it's closed source. In fact, it's very possible that they are in fact doing that. Just don't ever enter your pin when using the powerbot client is my advice!

From: Mjordan
Well if you put it in terms of keylogging, then absolutely nothing would be stopping them since it's closed source. In fact, it's very possible that they are in fact doing that. Just don't ever enter your pin when using the powerbot client is my advice!

I remember seeing something about tx using reflection to get bank pins when I was admin on PB. That of course is like keylogging though, and not just "finding" your info in the client.

Your PIN is probably saved in your client when you have onced filled it in and send automatically to RS when you open your bank again.
That would mean that they could try 0000 to 9999 pretty fast, and we already know that it's possible to make their client keylog our username/pass..
This is only a guess from what I have heard though.

From: Chris
Your PIN is probably saved in your client when you have onced filled it in and send automatically to RS when you open your bank again.
That would mean that they could try 0000 to 9999 pretty fast, and we already know that it's possible to make their client keylog our username/pass..
This is only a guess from what I have heard though.

Would think they would only store like a SHA1 sum locally or something… So that even if they got the code it would be scrambled. Maybe Jagex is less secure than I thought though…

Seems pretty unlikely in my opinion that they would store something like that client side.

It's stored on the RS servers(duh) and when you login, it gets retrieved from the server and stored in the client. So, yes, you can access the pin, password, display name, and login email/name with reflection/injection. They are actually really easy fields to find in the client.

That's naughty.. ^
Wow I can't believe theirs such a security floor..

From: leetsxc
That's naughty.. ^
Wow I can't believe theirs such a security floor..

How is it a security flaw? If you load the client from their website, then you will have no problems with it.

Well damn there's no need to be careful and manually log into PB then lol. Looks like I just need to move all my valuables.

I wouldn't trust timer with $5

anyway, I know if it has been input, password/pins can be got pretty easily, they aren't encrypted last I read.. but without it even being input? I don't think so O_o

so in reality, putting in the pass yourself (on reflection/injection bots) vs having them put it in for you really makes no difference

Of course they can grab the data, even if it's not saved. That's the reason why Injection clients took off, because they can grab any data about anything that relates to the game.

I think they can grab it as you enter it. I don't think they can grab it from some cache because it'd be stupid of jagex to store that in a cache file..

Well it is pretty fast these days, I can pretty much just spam click my pin and it will go through.

From: Brandon
I think they can grab it as you enter it. I don't think they can grab it from some cache because it'd be stupid of jagex to store that in a cache file..

It's not in a cache file, they can grab it the same way they can find objects or anything else. It's stored in the client class, well at least it was when I was actually looking at the client.

From: mormonman
It's not in a cache file, they can grab it the same way they can find objects or anything else. It's stored in the client class, well at least it was when I was actually looking at the client.

Jagex should say some stuff like this when they announce something about the bot nuke, most users think they are 100% safe from being hacked if they don't put their details in the client.
If I were them, I would also safe the username, password and PIN from all the accounts which have ever logged in using your pc/cache, somewhere in the client. Just to tell everyone that all of their accounts can easily get hacked if they use a client other than the official RS client ;)

From: Chris
Jagex should say some stuff like this when they announce something about the bot nuke, most users think they are 100% safe from being hacked if they don't put their details in the client.

They do say that you will get hacked using bots. People just ignore them thinking they know better.