Jagex mod got hacked

[Sy_Accursed]

I find this all quite unlikely.

1) We know jmods accounts can only be logged into from jagex HQ

2) Theres no videos of it

3) There NOTHING anywhere about runeHQ getting hacked, or locking down due to an attempted hack in response to the way this password was supposedly gotten.

 

All there is, is this forum post with 1 gif animation that could easily be faked.

Look at the post above you I even posted the password in this thread so you can look it up yourself.

 

But you can type any password in and get the account locked message once the account is locked, doesn't matter if its right or wrong; unless something got changed quite recently.

[RU_Insane]

I find this all quite unlikely.

1) We know jmods accounts can only be logged into from jagex HQ

2) Theres no videos of it

3) There NOTHING anywhere about runeHQ getting hacked, or locking down due to an attempted hack in response to the way this password was supposedly gotten.

 

All there is, is this forum post with 1 gif animation that could easily be faked.

 

Yes, you can log-in to the account from Jagex HQ, but you get locked-out if you login anywhere else. This is what happened to me when I tried it. The .GIF animation posted in the OP is real, I've seen the same result myself.

 

The question is, if there's no news about this (and a Google search confirms this objection), what's the panic for? If it took eight hours for Jagex to lock the account, I agree, someone would have had video or at least a few screen-shots glorifying their spoils. So I think it's been established that the .GIF is authentic insofar as that's what you should expect when you attempt to login outside of Jagex HQ. What's totally false is the claims that go along with it, except for the claim that the password was decrypted from RuneHQ (otherwise, how did they get the password?)

 

And no, Sy_Accursed, the password does work. I got "Invalid username or password" when I tried to login with other passwords. I got "Your account has been locked" when I logged in with the password posted.

 

The password is authentic, the .GIF posted is authentic, the only thing stopping anyone from logging-in and causing panic is that you can't login from outside of Jagex HQ.

[_YB_]

I find this all quite unlikely.

1) We know jmods accounts can only be logged into from jagex HQ

2) Theres no videos of it

3) There NOTHING anywhere about runeHQ getting hacked, or locking down due to an attempted hack in response to the way this password was supposedly gotten.

 

All there is, is this forum post with 1 gif animation that could easily be faked.

Look at the post above you I even posted the password in this thread so you can look it up yourself.

 

But you can type any password in and get the account locked message once the account is locked, doesn't matter if its right or wrong; unless something got changed quite recently.

You get password wrong message if you use other password.

 

Also the point is that the runehq db is leaked but its Decrypted in md5 which is one way encryption and only a bruteforce can decrypt it.

[RU_Insane]

[hide]

I find this all quite unlikely.

1) We know jmods accounts can only be logged into from jagex HQ

2) Theres no videos of it

3) There NOTHING anywhere about runeHQ getting hacked, or locking down due to an attempted hack in response to the way this password was supposedly gotten.

 

All there is, is this forum post with 1 gif animation that could easily be faked.

Look at the post above you I even posted the password in this thread so you can look it up yourself.

[/hide]

 

But you can type any password in and get the account locked message once the account is locked, doesn't matter if its right or wrong; unless something got changed quite recently.

You get password wrong message if you use other password.

 

Also the point is that the runehq db is leaked but its Decrypted in md5 which is one way encryption and only a bruteforce can decrypt it.

 

Ah, okay. So the perpetrators bruteforced to get the password. lol. I think it's sad that some of the JMods don't even follow their own procedures for account security. I mean, it doesn't matter in the end since the system prevents unauthorized logins. But really?

Edited October 9, 2011 by ForsakenMage
Shrinking the quote blocks

[Kthx]

[hide]

I find this all quite unlikely.

1) We know jmods accounts can only be logged into from jagex HQ

2) Theres no videos of it

3) There NOTHING anywhere about runeHQ getting hacked, or locking down due to an attempted hack in response to the way this password was supposedly gotten.

 

All there is, is this forum post with 1 gif animation that could easily be faked.

Look at the post above you I even posted the password in this thread so you can look it up yourself.

 

But you can type any password in and get the account locked message once the account is locked, doesn't matter if its right or wrong; unless something got changed quite recently.

Nope. Type in something random (like "klajflsdjh4w") and you get the "this is an invalid account or pass word, nov 26 email change, etc." message. Type in [the password] and you get the "this account is locked" message [/hide]

 

Edit: put hide tags because it's already been mentioned trillions of times for easier reading management

Edited October 9, 2011 by Kimberly
Removed for Rule 1.7 - Volunteering Personal Information

[Makoto_the_Phoenix]

[hide]

I find this all quite unlikely.

1) We know jmods accounts can only be logged into from jagex HQ

2) Theres no videos of it

3) There NOTHING anywhere about runeHQ getting hacked, or locking down due to an attempted hack in response to the way this password was supposedly gotten.

 

All there is, is this forum post with 1 gif animation that could easily be faked.

Look at the post above you I even posted the password in this thread so you can look it up yourself.

 

But you can type any password in and get the account locked message once the account is locked, doesn't matter if its right or wrong; unless something got changed quite recently.

[/hide]

You get password wrong message if you use other password.

 

Also the point is that the runehq db is leaked but its Decrypted in md5 which is one way encryption and only a bruteforce can decrypt it.

 

MD5 is a one-way hash, not an encryption scheme. If the hash was unsalted (which isn't good in practice anyway), then a rainbow table could be used to match the hash with a phrase much faster than bruteforce.

 

Anyway.

 

JMods can only log in through the network that Jagex has. Unless you're on Jagex's internal network (like their VPN), knowing their login credentials is pretty useless.

Edited October 9, 2011 by ForsakenMage
Shrinking the quote blocks

[Sona]

... How would the OP know Jagex locked down the account after 8 hours?

[Cheefoo]

Eh, so the JMOD was a bit foolish for using the same password at another place thats runescape related. But if their inbuilt security blocked anything from happening, whats the big problem?

 

Because Jagex is stupid boohoo fart fart stink lines

[RU_Insane]

... How would the OP know Jagex locked down the account after 8 hours?

 

He's more than likely lying about it. Good question though.

[The Observer]

You cannot login to staff accounts outside of Jagex HQ or even recover them. If you try to recover it you get the message 'You cannot recover staff accounts.' It is a big problem for the staff member in question because he let his guard down, however, overall nothing happened because Jagex's security worked.

[Pirkka]

The guy who knew the password should've traveled to Cambridge, hack their wi-fi and log-in there for massive lulz. Although hacking their wlan would be quite impossible, if their password isn't gaben.

[_YB_]

... How would the OP know Jagex locked down the account after 8 hours?

To be honest I made a mistake it got leaked 20 hours ago made mistake with AM and PM. The original post of the leak on different forum got posted on 1:04AM GMT +1

[Kimberly]

Jagex moderators are human too.

 

If anything, hopefully it spurs them to change their account recovery process a bit more now that they know they're not completely immune.

[RU_Insane]

... How would the OP know Jagex locked down the account after 8 hours?

To be honest I made a mistake it got leaked 20 hours ago made mistake with AM and PM. The original post of the leak on different forum got posted on 1:04AM GMT +1

 

So Jagex locked the account after 20 hours? O_O

[The_Fray]

I wish I had access to a JMod account, I would happily go and ban all the bots at my favourite haunts all across Runescape. Wouldn't make much of a difference as they would come back after a few hours but it would be still worth it to have a few bot free hours.

 

I know this isn't exactly on topic but there is so little to discuss in this thread.

[Krampell]

So let me get this straight.

A J-mod got his pass leaked, people tried it but a Jagex lock prevented them from using the account and it was locked 20 hours later.

They never got access to anything ingame with the account.

What's the big deal about that? It's the same deal as if someone got a hold of a admin account here on tif but not actually using it.

 

Also, are people certain that you can use ALL of the J-mod powers from any computer if there was no lock to begin with?

What if the tools were only accessable from Jagex HQ?

Either way a J-mod didn't think clearly and it bit him in the ass, but it lead to nothing, boring...

[RU_Insane]

I wish I had access to a JMod account, I would happily go and ban all the bots at my favourite haunts all across Runescape. Wouldn't make much of a difference as they would come back after a few hours but it would be still worth it to have a few bot free hours.

 

I know this isn't exactly on topic but there is so little to discuss in this thread.

 

I agree. Let the players ban bots. That'd help a bit, even for a while. ^_^

[Tim]

The guy who knew the password should've traveled to Cambridge, hack their wi-fi and log-in there for massive lulz. Although hacking their wlan would be quite impossible, if their password isn't gaben.

http://www.youtube.com/watch?v=B9rrS32ctQk

 

So apparently someone in Jagex had their Account password breached and all we have is this one GIF basically showing NOTHING and not a single video...

 

:|

[Pete Party]

The only concern here is that runeHQ needs some plumming.

[Makoto_the_Phoenix]

The only concern here is that runeHQ needs some plumming.

 

No, I don't think RuneHQ needs to find a place to put an air shaft. If it really is the case that RHQ's MD5 password table was compromised/leaked, they could do with a sweep of the server administrators.

[Saradomin_Mage]

I kind of chuckled when I saw Mod Kelvin's password as only being 6 characters long :P

[brunokiller]

The only concern here is that runeHQ needs some plumming.

Lol, as if tip.it, zybez.net, and a [cabbage]ton of other sites aren't hacked.

[Piu]

^ I remember that very well lol. Was 2006/2007 I believe?

[Pete Party]

The only concern here is that runeHQ needs some plumming.

Lol, as if tip.it, zybez.net, and a [cabbage]ton of other sites aren't hacked.

 

That is the past and I think that is not what we are discussing here.

Right now (or yesterday) runehq was hacked and their password got decrypted by hackers, not on tip.it zybez.net or any other site. (according to op)

 

What is runehq's next move/what did they do to prevent this in the future.

[The Observer]

The only concern here is that runeHQ needs some plumming.

Lol, as if tip.it, zybez.net, and a [cabbage]ton of other sites aren't hacked.

 

That is the past and I think that is not what we are discussing here.

Right now (or yesterday) runehq was hacked and their password got decrypted by hackers, not on tip.it zybez.net or any other site. (according to op)

 

What is runehq's next move/what did they do to prevent this in the future.

 

They completely wiped their database and started fresh so that there's no longer any old code that can be used to compromise the site.