Give me ideas

MaxOff · 04-14-2008, 07:32 AM

The Weakness in the Login System is still not fixed

so im asking u guys what should i do to get the attention of outspark!
So that they will FINALLY fix that serious design flaw.

Give me your ideas

I though about blocking the gms from logging in, by hijacking every session i get and whitelisting everyone who hasn't a char named after a known gm. So u can log in after a 2nd try.
Or maybe i should send whispers to all your friends online ? ;-)

Give me your ideas!!!

ps.: i already tried talking and the results are already documentated here. And outspark never, i mean never tried to get in contact with me.

**Yosei** · 04-14-2008, 08:13 AM

Have you provided screenshot proof to Outspark? Maybe you should screen how you do it and send it to them.

Then again.. they may still be trying to fix it.

I can't and won't tell you to hack peoples accounts.

MaxOff · 04-14-2008, 11:22 AM

i provided them with a proof of concept. If they would have asked, i would have provided my source code too.

But like with the SHN-Viewer, Outspark does not speak directly to me(Well Steam did...). I really have tried to get in contact with them.

Mhh i guess i got some funny ideas.

When it will happen i will warn u guys before, so u know what will happen lol. And maybe outspark will fix the weakness before that

And if they throw i awaw what i send them, i will gladly give it away again.

p.s.: of course i wont harm any player in any way in the process.

Pedobear · 04-14-2008, 11:32 AM

i like that idea of blacklisting GMs. just seems so funny.

Kreain · 04-14-2008, 11:32 AM

yeh hes tellign the truth (well everyone knows allready) but yeh ghostly proved it to me by making my fiesta account say multiple logins detected when i asked her to show me on msn.

btw umm how bout logging on an admins account and using the command /area 999999999999 for liek exp n stuff then they wud get mad and have to listen to you.

**Lady-Loki** · 04-14-2008, 01:42 PM

btw umm how bout we don't talk about specifics of any hacking on these forums?

Maxoff - e-mail support@outspark.com with links to images and such and maybe PM one of the GM's we have in these forums through the PM box here since the FF PM box is probably not as overwhelmed as the PM box on the officials.

**Hyper** · 04-14-2008, 02:52 PM

I always get a response from a GM... Maybe you should go on to one of their accounts, and move their items around, or something? Or make chests spawn?Just something to show them how big of an issue it is. (Because no one likes the idea of someone else on their account.)

Originally Posted by Lady-Loki

btw umm how bout we don't talk about specifics of any hacking on these forums?

Maxoff - e-mail support@outspark.com with links to images and such and maybe PM one of the GM's we have in these forums through the PM box here since the FF PM box is probably not as overwhelmed as the PM box on the officials.

I wouldn't really call it specific... It's not like he's describing how he does it, right? And I thought that /area thing was common knowledge... (if that's what that was directed at)

MaxOff · 04-14-2008, 11:29 PM

Originally Posted by Draein

yeh hes tellign the truth (well everyone knows allready) but yeh ghostly proved it to me by making my fiesta account say multiple logins detected when i asked her to show me on msn.

So ghostly used the hack already? hehe hope he never understood how to handle reconnects

. Thats the only thing i never made public, but it shouldn't be hard to figure out.
And it was ghostly who inspired me to look into a weakness i knew since some time.
1st i hijacked the same account.
2nd i hijacked account under my control
3th i hijacked ghostly account to proof it working lol

but it don't think using a gm command like "/Area" would be a smart idea. I can not test run a mass hack, and then even using something like that could be fatal. But it is a good idea, combined with the idea to constantly d/c the gm's.

**Spirit** · 04-15-2008, 01:47 PM

Ok, I must first state that I DO NOT condone hacking in any way and although I have followed this thread closely to make sure it does not go beyond the rules of our forums, I have tried to stay out of this discussion. With that said, I must say NotMyWay's suggestion cracked me up.

GM_Dakkon - Psst... SnakeEyes, It's me Dakkon.
GM_SnakeEyes - wth you just left your computer to go get coffee....
GM_Dakkon - I am a hacker I have taken over this account
GM_SnakeEyes - Quit messing with me, did you install a computer in the break room?
GM_Dakkon - Doh....
GM_SnakeEyes - I'll have some of that coffee you're having in there man.

NotMyWay · 04-15-2008, 02:40 PM

lol @ Spirit, but no i wasnt exactly expecting something like that...

actually what i was thinking was after the other GM replies "Quit messing with me, did you install a computer in the break room?" or something like that, you could reply "no, i am serious", then explain the vulnerability and how it can be fixed.