MAJOR Password Logging Scheme

[Guren]

Re: MAJOR Password Logging Scheme

This happen on valefor yesterday!

[InuTrunks]

Re: MAJOR Password Logging Scheme

Not having knowelege about idenity safety IS infact the users responsiblity.

If you mess up, it's your fault, not SE's, not your banks, not your mothers.

It's yours.

[Omniblast]

Re: MAJOR Password Logging Scheme

Two things are infinite: the universe and human stupidity; and I'm not sure about the universe.

or

Two things are infinite: the universe and human stupidity and I'm not sure about former.

I never said it was the user's fault.
It's how you interperate it. I could mean that it's M$ IE's fault for not coding it right. I could mean it's the operating system that their using giving them so many pop up messages that they don't bother reading. I could mean it's the web host's fault. There's too many variables. A lot of it has to do with Human error.

To err is to human no?

[Mhurron]

Re: MAJOR Password Logging Scheme

Not always stupidity, not having the knowledge is not the users fault.

Ya it is.

[hongman]

Re: MAJOR Password Logging Scheme

Not always stupidity, not having the knowledge is not the users fault.

[Omniblast]

Re: MAJOR Password Logging Scheme

No matter how well a program is coded...
No matter how many prompts a person gets...
No matter how careful a person can be...

HUMAN STUPIDITY ALWAYS WINS.

[Theyaden]

Re: MAJOR Password Logging Scheme

I've found everyone ends up getting burned sooner or later, just a question of when and how. I get a kick out of people that go on about how others that get screwed deserve it since they are usually the ones wailing the loudest when it happens to them in an area they are less knowledgeable about.
Thanks for the heads up I haven't seen it myself, but I can warn my younger brother who also uses my terminal just in case.
BTW Yes a person should be careful but I don't think it's good to react with glee to someone getting nailed either.

[InuTrunks]

Re: MAJOR Password Logging Scheme

IE requests approval before activating ActiveX and certain Javascript controls. It prompts before downloading and doesn't automatically run files after they've been downloaded.
Everybody needs to get off the bandwagon already. It doesn't matter what you use, if you're an idiot you're going to screw yourself no matter what browser you're using.

Thank you, someone finally sees the light. I havn't been using IE for years, but that's because of the memory leaks it's had for the longest time frame. Hell, even everyones beloved FireFox has horrible memory problems now, atleast, it did in 1.5.x (with multiple tabs open, I'd be using over 100,000 K of memory (hell, with 3 tabs open right now i'm using 120,000 ish, it's horrible).

No matter what you use, you're going to have secruity risks. Over on the warcraft boards, people feel that it's Blizzards fault for having secruity problems for account safety.

I'm glad that S-E is taking the right approach here.

<b>IT IS NOT SquareEnix's RESONSIBILITY FOR YOUR ACCOUNT, IT IS YOURS, AND ONLY YOURS</b>

That being said, don't be stupid on the internet, and you won't get burned.

[Telera]

Re: MAJOR Password Logging Scheme

This happened on Ifrit, too. I remember a LS mate talking about it.

Joke's on any idiot that would send the /tell to me, though.

1. They'd get reported.
2. My FFXI is on my PS2, lulz on them.
3. I never visit any links given to me by anyone, including my b/f, unless I know what they are in advance. I.E. being a youtube video, or some other well known site.

That's just me though. I don't 'surf' or 'browse' the web. I go to a few forums, and that's about the extent of it.

[DakAttack]

Re: MAJOR Password Logging Scheme

Except that any well-designed web browser won't allow a website to do that kind of monkeying with your local machine without user approval. There are security restrictions placed on web content running on local machines for exactly that reason.

Which sort of brings us back to "don't use IE".

IE requests approval before activating ActiveX and certain Javascript controls. It prompts before downloading and doesn't automatically run files after they've been downloaded.

Everybody needs to get off the bandwagon already. It doesn't matter what you use, if you're an idiot you're going to screw yourself no matter what browser you're using.

[hongman]

Re: MAJOR Password Logging Scheme

Which leads us to the whole identity theft thing.

My business card got ganked a month ago, only just found out about it through the bank ringing me up.

Funny how it's never an issue until it happens to you -.-

[InuTrunks]

Re: MAJOR Password Logging Scheme

Kar, Just because you don't use IE, dosn't automaticly make you safe, There are workarounds in old Firefox (1.5.x) as well which have been found and fixed in 2.0 (which you should upgrade to). Also, a simple setting turned on in Firefox (which can be programed to by a simple click of a button) makes it auto run scripts, <b>WITHOUT USER APPROVIAL</b> because you already have it.

Also, this keylogger isn't jsut targeting your POL ID (common misconception), it's infact logging everything you type, including windows, and what not. This is an old scam which can easilly be used to steal your idenity.

[Karinya]

Re: MAJOR Password Logging Scheme

Except that any well-designed web browser won't allow a website to do that kind of monkeying with your local machine without user approval. There are security restrictions placed on web content running on local machines for exactly that reason.

Which sort of brings us back to "don't use IE".

[Olorin401]

Re: MAJOR Password Logging Scheme

Some people in my LS also got this message. "/sarcasm dl it and open it, because nothing bad ever comes from teh intarweb"
Seriously though, at what point does this Trojan actually install/activate?
-Just visiting the link? I would imagine you get prompted for a download, unless your browser is set to automatically dl/open .zip files (which would be a bad idea).
-If the file is downloaded, is it self installing? Not running a scan at this point is going further into bad internet habits.
-Is there an actual program inside the zip that has to be activated by the user? If that's the case, they have stumbled beyond faux pas.

Well I suppose that's the trick here.. You don't necessarily have to download the file yourself, nor do you have to unzip it yourself.

If the person/people running this scheme have any amount of talent, they probably wrote cookies, ActiveX controls and/or Javascript into the webpage itself that would automate all that action behind the scenes. Even if someone visited the website out of curiosity, and knew enough not to get the file on their own, you would still get compromised and not know until it was too late.

[Arctic Wolf]

Re: MAJOR Password Logging Scheme

A friend of me got hacked too lately. He never gives his password to anyone, and changes it every month. I don't remember him saying anything about having received a /tell though.

These are his 2 characters:
*Removed Link*
From FFXIAH: Bierzwerg & Icequeen

All his items got sold, and his password changed back to what it was before, it all took about 3 days before he could login again, with no equipment and no gil. He called PlayOnline, but after a long phone call, the only result was "We're sorry for the inconvenience but we can't help you."