LOL here is your thief

dank

Careful with these links he can reactivate the script at any time.

massive.web44.net/screenshot.jpg
massive.web44.net/screenshot.gif
massive.web44.net/logfile.txt

Sorry I blew off the jpg. Someone is stealing your cookies. If you looked at this site log out of SK asap. Change your password when you get back in.

dank

It's proof that it is a cookie stealer. Do not click on those links while signed into sk they are all active. Only click those if you know what the hell you're doing.

http://hellofhackerz.forumotion.com/t172-hack-any-a-c-id-by-cookies-stealer-easily

Pretty much all you need to do is read this website and download live http headers for firefox to replay the cookies. Then it's money.

dank

Think he's playing with it now. Yes it only applies to the browser you are using.

dank

It's a really old exploit that defies belief if it isn't patched in this forum, but everyone clicked that jpg? I clicked all of those links with .jpg .gif and even .txt they all went to the same picture. Either I had an LSD flashback or that's the problem.

DarkFort

Seems as if FC is behind this.

dank

Don't turn this into a troll thread yet. BCart needs to patch that or they'll keep doing it. Probably has to disable something.

jesterawx

So who posted them originally?

DarkFort

Cheater_Hunter

Blitz0s

It affects the browser your are using. What exactly does it affect within that browser? Gains it access to all your cookies, or just the ones you are using at that time, or does it only affects the SK cookie?

That if affects the browser ur are using isnt very reassuring.. I mean I sometimes have 10-15 tabs open with all kind of business..

LewsTherin

The links should be disabled...I just clicked it...

Darubian

Wait a second. Do those links steal sk cookies only or should I be concerned with other online passwords?

Darubian

Shut the fuck up amog. I want the question answered. I have sensitive information loaded on my browser and if someone has that info I need to know.

Dank, does someone have access to my bank account?

LewsTherin

Shut the fuck up amog. I want the question answered. I have sensitive information loaded on my browser and if someone has that info I need to know.

Dank, does someone have access to my bank account?

Your bank is safe. Its your others that you should be cautious about such as Gmail, FB, Twitter (if you are gay enough to use it).

pos

I've looked into this a little bit.

It doesnt appear that the starkingdoms cookie stores any of your account information like passwords or emails. It only stores your session id. (Which to be fully secure should always compare with something in the database etc - isn't happening here if this is true) (check your own cookies if you dont believe me - if you are using chrome then when ingame: right click->inspect element->resources tab->click the cookies link and then www.starkingdoms.com. other browsers i wouldnt have an idea)

if this whole thing is true then i'm assuming that the person is using your session information to access accounts. (uses your session = website thinks he is you).

So I don't think passwords are at risk but it depends on a few more things we dont know. if you are concerned then change your password.

Also as far as I know your other website cookies shouldnt of been taken. Web browsers would consider that a huge xml vulnerability if it was possible. The only cookies this type of vulnerability takes are those from the website its hotlinked from.

Think of this vulnerability as being similar to those facebook like links you see everywhere. They work in the same way except it uses your cookie to initiate a like on facebook.

LewsTherin

I've looked into this a little bit.

It doesnt appear that the starkingdoms cookie stores any of your account information like passwords or emails. It only stores your session id. (Which to be fully secure should always compare with something in the database etc - isn't happening here if this is true) (check your own cookies if you dont believe me - if you are using chrome then when ingame: right click->inspect element->resources tab->click the cookies link and then www.starkingdoms.com. other browsers i wouldnt have an idea)

if this whole thing is true then i'm assuming that the person is using your session information to access accounts. (uses your session = website thinks he is you).

So I don't think passwords are at risk but it depends on a few more things we dont know. if you are concerned then change your password.

Also as far as I know your other website cookies shouldnt of been taken. Web browsers would consider that a huge xml vulnerability if it was possible. The only cookies this type of vulnerability takes are those from the website its hotlinked from.

Think of this vulnerability as being similar to those facebook like links you see everywhere. They work in the same way except it uses your cookie to initiate a like on facebook.

Yeah I had thought so. But wasn't sure.

dank

The guy disabled the script shortly after I made the thread. So I just left those 3 links up for the Cart to see what transpired. It steals your most current session info. He cant get into ur bank info no worries. It works for the server ur targetting only cuz he knows ur on SK. Kind of a hit or miss. He didnt get every person to click the link. Also probably didnt have full access to ur kingdom but a few things worked like suiciding probes. Prolly desired to sucide u all but couldnt.

Persona

my understanding is he is sending people links on AIM that do the same thing

dank

He could potentially hide these in pictures, and many other places. Until BCart patches the forum don't click any links or pics. I wouldn't even click on a youtube link. When the dust settles our youtube fun is likely over along with inserting html into the pages. All we'll be left with is a butt ugly forum.

LewsTherin

He could potentially hide these in pictures, and many other places. Until BCart patches the forum don't click any links or pics. I wouldn't even click on a youtube link. When the dust settles our youtube fun is likely over along with inserting html into the pages. All we'll be left with is a butt ugly forum.

Could he insert them into the PF avatar pictures? So whenever we see his post we get it.

Qwjvfiil

@BcartFall

If only it was that easy to get him to fix stuff haha

dank

He can't really do it to his avatar it has to be a spoofed link. Your avatar has to be uploaded to the server. He could do it with a banner in a sig, but BCart had already disabled that option. What happened is BCart tried to give us more functionality and kewl things like youtube links and the ability to insert html. In the process it opened the site up to this vulnerability.

Dogtown

Didn't this happen on the old forums too?

Tyrsis

My bad guys I won't do it again.

dank

Yes, this is a very old exploit. This is the reason external links were removed from avatars, banners, and in the forums signatures were removed. He had corrected this problem. I suspected it might be active in Vanilla forums but I didn't have a desire to hack you guys. It was only a matter of time before somebody else tried.

So here is what I'm wondering. Somebody ddos'ed Kesha. Beanland mentioned that it hit him as well. Now we have somebody hacking users from the forum. I also saw Kesha mention that his bot wasn't creating all of these accounts to fill up 8 galaxies. I'd like to know if that is true and if we have some competition on the server now. This is one of the things I was warning about. When Kesha is over here building a giant bot the only competition is another bot. We might have a new hacker on the scene that wants to throw down a challenge to his reign.

If so welcome aboard whoever you are. Sorry to rain on your parade but you hit Darubian and Lews who are homies. Otherwise I wouldn't have said a thing.

Tyrsis

Lynog is running the other bot.

dank

I for one welcome our new scouse overlords.

Damdred

kesha vs mysterious person?

Tyrsis

All lynog did was talk about how he wanted someone to make a bot that would make farm KD's to keep SK alive. He even would say he would make it himself sometime. If it isn't him it's someone close to him.

Zeality

Wasn't just lynog, there was like forty of us who said it would be a fantastic idea :-p
I say that cause lynog is too computer-stupid to make a bot himself, could be any number of people that was in [Scallywags] or even someone who had the idea beforehand.

Either way, queer made me spend a 2 robs on rebuilding, I would like compensation in the form of a max bank.

Tyrsis

This was many rounds before scally. I see what you are saying though and it could be a variety of people but again who would actually waste their time on it?

Zeality

I just mean that big collective conversation happened, then the next round it appeared. Of course it was discussed earlier. As for who, dunno but i dont much care. I thank them