Security Flaw
 

Apparently it is possible to log into RC from the Graal Client if the IP listed in ranges are not correct.

http://i.imgur.com/i33rw.jpg

I noticed this a while back...I think I posted somewhere on the forums. Maybe not, idk.

The security flaws i've pointed out in the past were ignored, so maybe I didn't post about it.

Jazz :blush:

$10 says your IP ranges are correct. Have someone check your client's PCID—chances are it's different than your RC's, which is why the scripted RC works and the external one doesn't.

I hate how each different wifi spot I go to I need someone to set my RC :'[
ZeroG told me that I could go onto my client RC and edit my IP like that... but I'd rather not mess with it.. Personally I don't even want to work on the client RC either.. although I kinda just want to do gfx rather than scripting right now... lol

Anyway, so the client RC works off your PCID instead of IP address?

RC does too, just make sure you have your RC PCID in your IP ranges. It tends to differ from your client PCID if you're on a 64-bit version of Windows or are using the Mac RC.

I dunno, when I tried to use client rc while on vacation-- my laptop-- someOe had to change my IP in order for it to work...

clientrc checks if the pcid is the correct one too- not just the ip like RC does.
if this was removed, pcid in your iprange would be useless, no?

this may be a securityflaw, but it is also a savior when your ip changed and you need to get on RC ASAP, and you can change your own iprange.

I noticed that, and it's annoying. Is there even a way to figure out the RC PCID? It didn't auto-fill-in IP ranges on Atlantis for a while now (used to when you set it to *.*.*.* and the player logged on, but doesn't anymore for some reason).

could have sworn i saw this thread a while back...

I think it only fills out the *.*.*.* if you log on client, but I could be wrong on that.

To find the RC's PCID, log off client while on RC and /openaccess yourself (or have someone do it if you don't have ban rights).

This is not a security flaw—what are you guys talking about? :confused:

Both the external and scripted RC check the PCID. My IP ranges on Era right now are pc:1737432,pc:2867920,pc:1752737,pc:2128206,pc:518 5163,pc:5142287 because my computer triple-boots, and each of those OSes have two PCIDs (one for client, one for RC).

There's racism in your pic. :rolleyes: