.png files can log ur runescape password?!?

[neo_bahumat]

okay i was speaking to some guy on msn from my runescape days, and he was going on about how jagex were sueing him etc, i asked outta interest how he managed to get keyloggers onto there comps, he sed that he simply posts pictures onto forums, in the form of .png and he can do somin or other to make it so the .png file hides some kinda installer, that cant be detected by firewall or VS, he claims to have hacked 450 people this way or somin :(

 

 

 

 

 

 

 

now i g2 say that it all seems pretty unreal, but hes currently going thru a lawsuit wiv jagex (or so he says) and i just want some guys who know there stuff to reasure me it is bs

 

 

 

 

 

 

 

sry to post it, but ive been hearing quite alot of stuff about .png logging and just wanted some reassurance as to wether its some geeks making lies for fun, or if there is some kinda threat :D

 

 

 

 

 

 

 

-=neo=-

[Pyro]

There have been issues in the past with exploits relating to viewing of images, so I suppose it's not impossible. I'd wager he's just pulling your leg though.

[zonda]

Yes, this is entirely possible. However, they was you decribe it is incorrect.

 

 

 

 

 

 

 

First off, I would just like to state this is for interest purpouses only, and not to actually be used... Also, by using any of the given information would lable you as a script kiddie, meaning you are a moron. Secondly, anything you do on the internet is trackable, including hacking. In otherwords, you could get caught for this stuff and be in leagal by many people, including vitims, your ISP, local law enforcement, and any term that you violate in the process with a corperation.

 

 

 

 

 

 

 

There are programs out there called binders. Generally they will take 2 exacutable (exe) files and make it 1 exe file. That way you sucesfully could make someone run a game or something, and at the same time that they are playing the game, they are also having the other exe being installed on their computer.

 

 

 

 

 

 

 

This could be a trojan, keylogger, or downloader...

 

 

 

 

 

 

 

Trojans open ports to your computer, allowing the hacker to gain access to pretty much anything. Keyloggers will log keys, and either send them to the hacker via e-mail or FTP, or need to be manually obtained (physically or by use of a trojan)

 

 

 

 

 

 

 

A downloader is actually fairly new, what it does, is when the program has been executed it will go to the internet and download a trojan or keylogger onto your computer with out you knowing. The reason to do this? Well its more hassle but downloaders are much harder for a virus scanner to detect. They are very basic programs as well, and can easily be made by any programer, and binded with the various binders out there.

 

 

 

 

 

 

 

Anyways, there are also advanced binders that allow you to bind it with any file, for instance a png or jpg. Gif's bmp's, music files, or media files.

 

 

 

 

 

 

 

So yes, its possible, however I doubt your friend is being persued by Jagex. If anything he hacked 5 people, POSSIBLY got caught, and had his account banned, end of story.

[neo_bahumat]

kind of worrying, i had no idea of the danger :shock:

 

 

 

 

 

 

 

also he once showed me 1080 mil, i dont think hes bs'n when he claims to have logged 450+ people :(

 

 

 

 

 

 

 

is there any causes i can take to prevent it :?:

[Veiva]

He could have gotten a JPEG, but instead of using the standard .JPG extension, it used the PNG one.

 

 

 

 

 

 

 

Try it.

 

 

 

 

 

 

 

Here is an example. You know the oops emoticon? Well, here it is as a PNG:

 

 

 

 

 

 

 

Right click > Properties on the picture and it will say it is a PNG file, yet PNG is incapable of anamition (MNG is though).

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Here is the property in Firefox (Fx for short):

 

 

 

 

 

 

 

 

 

 

 

 

 

 

To prevent it, keep you version of Windows UP TO DATE! Run a hardware firefall and a software run, use Ad-Aware and Spy Bot S&D (use the tea timer app if you use IE), run a AV and keep it up to date. Also, try and use Firefox, Opera, K-Meleon, Maxthon, Advant (the latter two are ok), etc, and not IE.

 

 

 

 

 

 

 

Don't go to suspicous websites, nor download suspicous stuff. Be wary on MSN of people sending you stuff, and anything you download you must scan it for ad ware and viruses.

 

 

 

 

 

 

 

Also, don't run useless junk. Run only what you need, and that is all. If you don't need some weather thing, don't use it! Same goes for anything else you don't need.

 

 

 

 

 

 

 

Hope that could help.

[Karvinen]

Trojans open ports to your computer

 

 

 

Not every trojan (malicious program disguised as legitimate) opens ports. Keyloggers are also Trojans (information stealers).

[miketheguy]

 

 

 

 

 

 

 

also he once showed me 1080 mil[\quote]nice, a bilionare with cash, unlike duke.

[Jumara3]

Jpeg of Death (H) Exploits are fun you can blaim microsoft for their [cabbage]ty updates, and releasing a Os before testing it :)

[DaN]

 

 

 

also he once showed me 1080 mil, i dont think hes bs'n when he claims to have logged 450+ people :(

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Look I have A huge pile of money it mine honestly :roll:

[Futurama]

they post a link to the .png file, you click the link, it goes to a php script instead, it downloads a keylogger and you have no idea whatsoever.

[Pyro]

they post a link to the .png file, you click the link, it goes to a php script instead, it downloads a keylogger and you have no idea whatsoever.

There is nothing within the php-standard that would allow a website access to your computer. There are vulnerabilities in different browsers at different times, but it's no way near as simple as you try to make it sound.

[DahVid]

Anthony?..

 

 

 

 

 

 

 

Yes, There are publicly available source codes to compile that can change the header of an executable.

 

 

 

 

 

 

 

I havn't seen any with keyloggers in it, but it's possible. I wouldn't take too much security looking at images though.

[DaN]

Ive only once fallen for a torjan I killed the process within seconds of activating the trojan.

 

 

 

 

 

 

 

 

 

 

 

I was caught by the file name it was something.jpg but the real name was something.jpg[Caution: Executable File] but windows hides known extensions something I forgot about.

 

 

 

 

 

 

 

Its also possible for someone to put as many spaces as they want befor the extension a file name could be.

 

 

 

 

 

 

 

runebank.jpg

 

 

 

 

 

 

 

[Caution: Executable File]

 

 

 

 

 

 

 

note the [Caution: ExecutableFile] wich wouldent be seen due to the lenth of the file name.

[Karvinen]

 

they post a link to the .png file, you click the link, it goes to a php script instead, it downloads a keylogger and you have no idea whatsoever.

There is nothing within the php-standard that would allow a website access to your computer. There are vulnerabilities in different browsers at different times, but it's no way near as simple as you try to make it sound.

You can just name a directory like "dir.jpg" and put index.html file in it.

 

 

 

 

 

 

 

Currently, only Internet Explorer downloads trojans automatically from websites (security hole).

[Pyro]

 

 

they post a link to the .png file, you click the link, it goes to a php script instead, it downloads a keylogger and you have no idea whatsoever.

There is nothing within the php-standard that would allow a website access to your computer. There are vulnerabilities in different browsers at different times, but it's no way near as simple as you try to make it sound.

You can just name a directory like "dir.jpg" and put index.html file in it.

 

 

 

 

 

 

 

Currently, only Internet Explorer downloads trojans automatically from websites (security hole).

You could name a directory like that, but in the end the only result would be that the victim entered a specific html page. You could just name it index.html and post that link to start with in that case. The security holes in IE is mainly what I meant with the last statement in my original reply.

[MageUK]

Just use a browser that isn't IE and you decrease the chances of any dodgy scripts etc by about 99%.

 

 

 

Also, I laugh at the idea of binding a keylogger with a PNG image on the net. It wouldn't work because your browser doesn't "execute" the images, it would just display the image as invalid. He's pulling the wool over your eyes.

[zonda]

Just use a browser that isn't IE and you decrease the chances of any dodgy scripts etc by about 99%.

 

 

 

Also, I laugh at the idea of binding a keylogger with a PNG image on the net. It wouldn't work because your browser doesn't "execute" the images, it would just display the image as invalid. He's pulling the wool over your eyes.

 

 

 

Uhhh... okay I must have been wrong then, along with 1000's of others? :roll:

 

 

 

This was something entirely possible 2 years ago... when this topic was created. Why are you bumping something so old?

[Mercifull]

Like Pyro, id also wager my house that hes bs'ing

[Phil]

This is a very old thread so I'm going to lock it.