PSA: Live vulnerability discovered, account details stolen via multiplayer games

[samsepiol]

From Jellyneo:

Jellyneo has recently been given information on a live hack on the Neopets website. Playing the multiplayer games Kacheekers, Geos, and Armada can lead to your account details being maliciously stolen.

This information has already been reported to TNT via ambassadors. Until a fix is confirmed, do not visit any pages for Kacheekers, Geos, or Armada.

If you have played these games in the last several days, we recommend changing your password ASAP.

How it works (allegedly):

During a multiplayer session of one of these games, the hacker injects malicious code which redirects the player to their petpage which displays a fake login page and then spits that information onto the coding for one of your own pet's petpages, allowing them to view your credentials in plain text.

TNT appears to be actively removing (not disabling, REMOVING) these games on the fly. As of today, these games may become lost media.

[Evelynn]

All I can say to this is lmao

[Loona]

Thanks for posting about this!

Wtg Neopets lmao

[samsepiol]

I'll add more details to this post as this develops but there's some discussion suggesting that the vulnerability forces your active pet's petpage to update with plain text of your credentials.

[xCarRadio]

Ahhh I'm so glad I don't play those games anymore. What the actual heck?!!!

[Donatella Versace]

the way i was playing these earlier........... oop

[samsepiol]

the way i was playing these earlier........... oop

Update your password AND pin to be sure. Playing the game in general doesn't mean you were exposed but it's better to be safe. I also updated the post with the info we have about how it supposedly worked. Being presented with a fake login page during the game would be a giveaway.

[pikapika]

Thanks for head up, went to check all my petpage to be sure.

[Halloqueenie]

Not me desperately trying for a kacheekers trophy

[Shawn]

Sounds like a pretty genius way of manipulating the site's inputs