Cookie Grabbed?

[ribossoma]

So I was browsing neopets with around 500k neopoints on hand. I change tabs and start reading an article a friend sent me, which took me a couple minutes to finish.

When I moved back into the neopets tab, I tried to go to the boards but couldn't because I was logged out. I logged in just to find out my 500k were missing and my trades cancelled (items were still in the inventory, just not on the trading post).

I'm not sure this was some bug/glitch/whatever or if someone broke into my account. If it was indeed someone I guess I interrupted their business because the neopoints in the bank, my weapons and the sdb seem to be untouched.

Oddly enough, my cK account also got logged out. I was writting a PM (I tend to write them and only send them after a while, I'm weird like that) and when I tried to send it, it failed because I wasn't logged in. This was what made me think of cookie grabbing.

Changed my password, set PIN on all areas neopets let us and logged out and logged in again.

UPDATE: After writing this and before hitting "Submit New Thread" I tried to go on neopets again and was logged out again. Failed to log in so logged in on a side to check if my account was frozen - it is. Probably just for protection but I'm still curious about what just happened.

[fairydust201]

change your password... just to be safe. and clear your cookies.

[Maison]

omg that is so sad D: People are still doing these things!!!

Clear your cache!

---------- Post added at 11:38 PM ---------- Previous post was at 11:37 PM ----------

I MEAN COOKIES

[Mophead]

That's really odd.

I'd assume someone got in and started the raiding process, got kicked out when you got back in, they logged back in before you could change the PW, and then self iced the account before the PW change registered in the DB?

That's definitely odd as hell.

[Bowsette]

That's really weird :/

[Bettser]

Do you post on the boards by any chance or were the items in your trades intense?

Someone attempt to steal my account a couple days ago but were unable to due to my monthly pin change tendacies ;D

[damian002]

How do you usually log in to clraik? did you tick the 'remember me' when you logged in to cK? because if you didn't you might probably got automatically logged out after a certain period of time.

[ribossoma]

That's really odd.

I'd assume someone got in and started the raiding process, got kicked out when you got back in, they logged back in before you could change the PW, and then self iced the account before the PW change registered in the DB?

That's definitely odd as hell.

I think I read somewhere that logging out and logging in again renders the stolen cookies session useless, so they couldn't go back in again after I changed my password, right? Because I logged out and in right after that. Only if they somehow managed to extract the password from the cookie (I don't even know if that's possible, just brainstorming xD).

I'm excluding that they guessed my password because it wasn't an easy one. I mean, it was the producer code of a random grocery store bought egg 12 random numbers and letters, some capped, some not. Probably should have added a symbol, but I don't think brute force works on neopets so didn't bother.

Do you post on the boards by any chance or were the items in your trades intense?

Someone attempt to steal my account a couple days ago but were unable to due to my monthly pin change tendacies ;D

I do, but rarely. Only on a couple lending boards and that "avatars pet in the pound" board. And no, not really. The most expensive one was a ~2 mil stamp.

I also change the pin pretty often, only had this one for like 2/3 weeks :/

How do you usually log in to clraik? did you tick the 'remember me' when you logged in to cK? because if you didn't you might probably got automatically logged out after a certain period of time.

I usually tick it. Could've forgot this time though, yeah