Attention Graal Players
 

Someone with the screen name HawkRider88 is going around telling people that he is the accounts admin and hes accusing people of hacking and he asks for your password to your account. I beleive he plays on mal because he IMed my frined. And my frineds AIM was in his profile and he only plays the server Maloria. So if you get an IM from HawkRider88, ignore it. Heres some of the things he said.

HawkRider88: Hello, I am a new recruit for Graalonline for Account Admin. I have just received a couple IM's and a few E-Mails that someoen on account: _____(dont wanna give out frineds account). Please fill out this form so we cannot jump to the step of just banning you to finding out what ip it came from. Thank you.

1) Last time played prior to today.
2)Nickname(s)
3)Last used account.
4)Email/Password (For protection and securty from hackers)
________
As you know, staff arent supposed to ask for passwords. He did.
________
HawkRider88: Thats unless we have proof of hacking on accounts, stolen IP, hacked accounts.
HawkRider88: We only ask when one of those happens, otherwise we will NEVER ask.
HawkRider88: We are trying to prevent this from happening.
________

So be careful and players should know staff arent supposed to ask for passwords.

:rolleyes: If you ignore him, people won't have the problem.

Is it even possible to steal an IP?

You can mask it.

Thats just masking, I mean actually STEALING one. Meh, probably not.

If you set it to someones current IP, technically, thats stealing it.

That's just playing on the ignorance of the player. It's sad that things like that happen, but then again -- Even getting an email of that format isn't any better -- There was an account database leak some time in the past, revealing everyone's account and email. Thereby, it isn't possible to judge the authenticy of such acts, and by cause, shouldn't be trusted.

Something the globals could do against such people is creating an account and leaving security means such as this one accessible. The player in question would log onto the playerworlds with it, (obviously enough), and their IP would display -- These people may and should be IP banned unless their IP is too dynamic.

Other locations not to enter passwords in: Ingame data information should never handle your passwords. If they request a password, never put it as the one for your account. If they ask for your account password -- Simply discard the request. If you suspect your account has been stolen or hacked, use the site's password changer, or contact the Accounts Admin via Support Desk. (If the playerworld in question asks for the account's password, this act should be reported as well)

So if you masked your IP, how would the servers you try to talk you be able to respond to the real you and not to the host that actually has the IP as which you mask your own?

[QUOTE=Velox Cruentus]There was an account database leak some time in the past, revealing everyone's account and email.


I have that still :o. It was in 2001.
The password that was listed under my account was not even my correct password.
No less, I never even changed it since my acct creation in 1999-2000.

So I have a feeling those account's were changed:
A) Someone changed part's of the password
B) If they were encrypted on the database they failed to decrypt it all correctly.
C) He found a fake database (probally not but I need another idea on what to say lol)
D) Found and replaced a couple of letters with diff numbers/letters.


And it wasn't only my account, it was like. All my friends,cuzin's,brother's accounts aswell that were not correct ;O.





Off Topic: Like my signature ;-P?

It would be kind of nice if Graal scanned your text for your password and then popped up a warning if you seemed to be sending it somewhere. Assuming people don't have passwords like 'hello'.

Also. Kuji: Read the damn rules.

Well I don't know about stealing, but its pretty easy replacing it as another ip. Hackers do that alot, one of the basics to not be caught. It's really easy too.

I dont think spoofing your IP is possible, even if it is, graal servers run on systems with spoof protection

Again you are speaking about things that you don't understand :\

The closest thing I can think of about spoofing an IP address is finding a proxy server with a fairly similar address, two out of four subnets maybe, and claiming you are someone else and that your IP is dynamic.

Yes, that's correct. If a Graal Administrator needs verification of an account being yours, all they need to do is ask for you're email. Being on the account you want modified is enough verification.