hrtbrk Posted June 15, 2009 Share Posted June 15, 2009 I saw a couple of people, on a couple of different sites, noticing the same thing... there's a cookie grabber scam going around and it's already happened here. These scammers post a link to 'Tarla' claiming she's giving out an AMAZING prize but it actually is a link to take your cookies. So don't click any Tarla links unless you're 100% sure it's the link. (When the scammer posted here, they said she was giving away a 100 dubloon coin). They try to fool you by posting her actual link, but if you click it, it takes you elsewhere! There's also one about duplicate items but I don't know all of the details - anyone? Just thought everyone should have a heads up and to report it if you see it anywhere. :) (I searched and didn't see this posted anywhere else) Quote Link to comment Share on other sites More sharing options...
Ruto Posted June 15, 2009 Share Posted June 15, 2009 Thanks, heartbr3ak. :) If anyone sees ANY suspicious link being posted around here, do NOT click it. Report it to a moderator immediately, please. These links are usually included in posts promising free items or neopoints. As a precaution, it's always wise to check where a link goes BEFORE you click it. ;) Quote Link to comment Share on other sites More sharing options...
kss15 Posted June 15, 2009 Share Posted June 15, 2009 What happens when someone takes your cookies Quote Link to comment Share on other sites More sharing options...
Lia Seeya Posted June 15, 2009 Share Posted June 15, 2009 ^ It's possible that they can gain access to your account, I believe. Not exactly sure how it works. :( But thanks for the heads up! :D I'll be sure not to click any Tarla links unless the alert actually comes up for me. Quote Link to comment Share on other sites More sharing options...
Lion Posted June 15, 2009 Share Posted June 15, 2009 Oh my ... Why would someone take MY cookies? They are in a cookie jar! Oh... wrong cookies. Thanks anyway for the heads up, heartbr3ak, I've clicked on a Tarla link before but it was perfectly fine. I don't use it now, but maybe this will help when I do use it again. ^_^ Quote Link to comment Share on other sites More sharing options...
ΩCCΩ Posted June 15, 2009 Share Posted June 15, 2009 Thanks for the headsup, it is useful to know it before it is too late. Hopefully TNT will fix this problem soon. Quote Link to comment Share on other sites More sharing options...
Sapphy the Swamp Witch Posted June 15, 2009 Share Posted June 15, 2009 Thanks for the notice heartbr3ak! I'll make sure to keep that in mind :). Quote Link to comment Share on other sites More sharing options...
antiaircraft Posted June 15, 2009 Share Posted June 15, 2009 In case anybody's curious (and assuming you don't already know xD ), the term 'cookie' is used to refer to a piece of information a website can store on your computer via your web browser. Neopets (and many other websites) store cookies with your username and password on your computer so that it can tell if you're logged in (otherwise you would have to enter your username and password on every page). So in theory, a cookie grabber that manages to read a Neopets cookie could obtain your username and password. (Actually your password isn't stored directly in a cookie, something called a 'password hash' is used instead, but that's a different story) Quote Link to comment Share on other sites More sharing options...
Lion Posted June 15, 2009 Share Posted June 15, 2009 Neopets (and many other websites) store cookies with your username and password on your computer so that it can tell if you're logged in (otherwise you would have to enter your username and password on every page) Don't forget that TDN, and most other websites with a log in system use them as well. :P Quote Link to comment Share on other sites More sharing options...
antiaircraft Posted June 15, 2009 Share Posted June 15, 2009 That's true, but I would hazard a guess that Neopets is using an outdated (and vulnerable) hashing algorithm, like MD5, as opposed to a modern one like SHA1. :yes: Quote Link to comment Share on other sites More sharing options...
Lion Posted June 15, 2009 Share Posted June 15, 2009 That's true, but I would hazard a guess that Neopets is using an outdated (and vulnerable) hashing algorithm, like MD5, as opposed to a modern one like SHA1. :yes: I'm thinking that too. Maybe they should update them one day, if they can. (I don't know much about this stuff) Quote Link to comment Share on other sites More sharing options...
antiaircraft Posted June 15, 2009 Share Posted June 15, 2009 Well it should be simple in *theory* if they didn't hardcode too much stuff to rely on MD5... and SHA1 hashes are almost completely impossible to crack - although a couple of supercomputers could probably do it in a year, so make sure to change your password a bit more frequently than that. xD Quote Link to comment Share on other sites More sharing options...
Twixie Posted June 15, 2009 Share Posted June 15, 2009 :l Quote Link to comment Share on other sites More sharing options...
Masaryk Posted June 15, 2009 Share Posted June 15, 2009 Safe browsing everyone! :) Having your account stolen is no fun. Quote Link to comment Share on other sites More sharing options...
Ashbash Posted June 15, 2009 Share Posted June 15, 2009 Thanks for the info, hopefully no one has this happen to them. Quote Link to comment Share on other sites More sharing options...
naalaro Posted June 15, 2009 Share Posted June 15, 2009 Hey thanks for the info, i was just discussing about this with a friend of mine, glad you guys here now of it too. Quote Link to comment Share on other sites More sharing options...
Deepti M. Posted June 15, 2009 Share Posted June 15, 2009 Luckily, I have my own Tarla Alert button, so I don't click other peoples. I think I'll go change my password though just in case. You don't have to listen to me, but I advise everybody else to do the same. Even if you haven't clicked on a tarla alert link, it could be something else you clicked, that could steal your cookies. Quote Link to comment Share on other sites More sharing options...
onime_no_kai Posted June 15, 2009 Share Posted June 15, 2009 "But that's why we all should get Firefox and NoScript." Good to have and worth getting, but just remember it's not magic or invincible -- I have it (along with several other safety measures) and my old account was still stolen in March without me doing anything "wrong" that would have explained how someone got on it; to this day I don't really know how they did it. People need to be *so* careful nowadays, it's really sad. :( Always read all links very carefully before you click (the ones appearing on the Neoboards that have to do with this scam say Neopets in them, but they are not .com links); and even if it looks ok, hover over any link before you click to make sure it's sending you where it says it's sending you. And if you have any reason to suspect the link at all, just don't risk it. Also, in my personal opinion, it's best to stay away from user-editable areas in Neo as much as humanly possible unless they belong to someone you really trust (and even then be careful) -- I believe that may be where my account info was stolen, though I can't be sure. Also, another CGer question for those who know -- how much info do they actually take? That is -- say I'm CG'ed on Neo, but I logged into my email at some point in the day. Does the CG'er get only my Neo info, or can it take my email info too? And, assuming it *can* take my email info -- will it only be able to take it if I stayed logged in, or can it somehow get it even if I logged back out, as long as I'd logged in at least once (once you log in, is there trace info CG's can take until you clear your data, or do you have to be actively logged in for the info to be there?) Apologies if these are idiotic questions, but my knowledge of these things is basic at best. :P Quote Link to comment Share on other sites More sharing options...
Deepti M. Posted June 15, 2009 Share Posted June 15, 2009 omg. I just saw one on the boards. Thanks for the heads up, I almost clicked it. Luckily, people know about this because the first person to post said CG. Quote Link to comment Share on other sites More sharing options...
Masaryk Posted June 15, 2009 Share Posted June 15, 2009 After getting my account stolen, I read that some people have been cookie grabbed in user lookups or user shops, so it's important to be careful everywhere on Neopets, not just the boards. Some people will insert malicious code into their shop stock, so that when you click on an item to buy it, it redirects to a CG or a fake login page. This sort of thing is probably what happened to me, but it's hard to say for sure. Just remember to pay attention and be careful. Quote Link to comment Share on other sites More sharing options...
SarafinaWolf7 Posted June 15, 2009 Share Posted June 15, 2009 Thanks for the heads up and the info. I'll make sure to not click on any Tarla links (I use the Firefox Tarla Alert button anyway). After getting my account stolen, I read that some people have been cookie grabbed in user lookups or user shops, so it's important to be careful everywhere on Neopets, not just the boards. Some people will insert malicious code into their shop stock, so that when you click on an item to buy it, it redirects to a CG or a fake login page. This sort of thing is probably what happened to me, but it's hard to say for sure. Just remember to pay attention and be careful. Oh man! We have to be careful on user lookups and user shops too? Why do people do this? Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.