Artasi & Southperry - What Really Happened.

[SaptaZapta]

More than a month ago, I told Artasi that there's a security issue on the official site that allows people to gain access to this kind of information (I posted the stuff about the hyper tele rock/ryude's sword wayyy before the official announcement, mmbryan confirmed it here on southperry too) and he got pretty defensive saying that it's patched when it clearly isn't and that I must be doing it through some "nefarious" means. (http://www.basilmarket.com/Name-Chan...AX0-4#comments)

Nobody likes to be taunted, especially in public. And some people and companies don't enjoy a challenge, and would rather be spoonfed.
In other words: They feel that if you were serious about helping them with their security issue, you should have contacted Artasi in private and given him the technical details of the vulnerability, rather than humiliating him (and Nexon) in public, going "ha ha I can still get in, try again".

[ShinkuDragon]

Nobody likes to be taunted, especially in public. And some people and companies don't enjoy a challenge, and would rather be spoonfed.
In other words: They feel that if you were serious about helping them with their security issue, you should have contacted Artasi in private and given him the technical details of the vulnerability, rather than humiliating him (and Nexon) in public, going "ha ha I can still get in, try again".

funnily though the second way has been proven to be the best way to get nexon to react and fix something however, make a big enough pomegranatestorm that they actually notice.

[Marksman Bryan]

Nobody likes to be taunted, especially in public. And some people and companies don't enjoy a challenge, and would rather be spoonfed.
In other words: They feel that if you were serious about helping them with their security issue, you should have contacted Artasi in private and given him the technical details of the vulnerability, rather than humiliating him (and Nexon) in public, going "ha ha I can still get in, try again".

He has tried contacting them privately and was ignored, like all attempts to contact them.

[SaptaZapta]

He has tried contacting them privately and was ignored, like all attempts to contact them.

I see.

[Secun]

Ah joy, more of the sound decision making I've come to know and expect of good ol' NexAM.

Seriously though, where do they keep finding these people and how do they manage to train them when it's so painfully obvious there's hardly enough up there to function, let alone train?

[SkyTheBM]

[Deleted post]

[SaptaZapta]

Pastewrong is being unhelpful in this approach. As well as Bryan. If they truly wanted to point out the problem, and fix it, they would tell us what this security exploit is. What sort of exploit it is, how to do it.

Make it known to the general public, then Nexon can swoop in and fix it once hell breaks loose. Problem solved. A drastic step, but needed if Nexon won't respond in private, and if Pastewrong/Bryan/whoever else is using this forum exploit actually wanted the problem fixed. But right now, it seems like all they want to do is spite Nexon by leaking out bits and pieces of information through using their forum security exploit to get into the closed Nexon forums.

What makes you think it's a forum exploit?
She's getting into wherever they put their announcements before copying them to the public web server. Or they're already on that server but under some protection that can be circumvented. Either way, nothing to do with forums.

[ShinkuDragon]

This is what I thought at first. But then...


Alright. Fair enough, so what if you actually want Nexon to fix the problem? Well...


This may be the only solution, which is probably what Pastewrong's trying to do. Not a bad idea, really. However...

Pastewrong is being unhelpful in this approach. As well as Bryan. If they truly wanted to point out the problem, and fix it, they would tell us what this security exploit is. What sort of exploit it is, how to do it.

Make it known to the general public, then Nexon can swoop in and fix it once hell breaks loose. Problem solved. A drastic step, but needed if Nexon won't respond in private, and if Pastewrong/Bryan/whoever else is using this forum exploit actually wanted the problem fixed. But right now, it seems like all they want to do is spite Nexon by leaking out bits and pieces of information through using their forum security exploit to get into the closed Nexon forums.

Also...if the MLC uses the Nexon forums to have conversations...this may be the source of the MLC leaks rather than an actual spy in the MLC. Potentially.

And defacing websites doesn't make you cool. Just saying. While some website administrators may be nice and thank you for going straight to the exploit and defacing their website, others may not be so nice.

Sorry if I came off as rude. Just wanted to share my thoughts on this whole defacing and exploitation thing.

ingame there's been several times when an exploit is OBVIOUSLY going, people know the people who are exploiting, and reporting to nexon (before MLC) did absolutely nothing.

but it took unti the hack or whatever went public and EVERYONE started crashing servers or whatever for nexon to come in and fix it within 24-96 hours (main example here is several duping hacks)

if you want another example of stuff that doesn't get fixed even though it's been reported constantly, several character skills are broken and don't function correctly. i think it was hayato that had one that lasted for years.

[Pastewrong]

And defacing websites doesn't make you cool. Just saying. While some website administrators may be nice and thank you for going straight to the exploit and defacing their website, others may not be so nice.

Sorry if I came off as rude. Just wanted to share my thoughts on this whole defacing and exploitation thing.

There must be some misunderstanding so let me clear this up for you. Defacing a website that has a XSS vulnerability is one of the least inappropriate things you can do besides responsible disclosure (and I did mention that I'm starting to do that--been in touch with Mr. Basil about basil's XSS issue). " Everything from account hijacking, changing of user settings, cookie theft/poisoning, or false advertising is possible." (http://www.cgisecurity.com/xss-faq.html)

Regarding all the other stuff:
First of all, I am not getting paid for any of this and despite Nexon being a multibillion (?) dollar company, they don't allow third party testers to poke around their stuff or offer some kind of bug bounty program-- I even inquired about this (senior GM atquei responded) and they informed me that I can still be banned and they can still take legal action even if I did a responsible disclosure. The moderator contact forum lacks transparency since you can't see any follow ups.

However, to say I'm "unhelpful" is a bit unfair since I did make it EXTREMELY obvious that there's something going on that's allowing me to gain access to information I shouldn't have. So pointing out that there's an issue should be enough-- why should I spend my own time documenting the exploit if I'm just giving them evidence of me possibly breaking the ToS which could result in a ban? Also, feel free to look through some of the past posts I made on the official forums--many of them are in the bug report section.

Also, I'm not leaking the information to "spite" nexon. If you check most of the releases, they were the controversial ones that I felt were extremely unfair and that, with enough support, things could be changed. The full marvel release I did after Nexon didn't do anything about the Tower stuff in Marvel despite many MLC members' disapproval was just a middle finger at Nexon. I was about to do the same thing this time around because of the Ultimatum ring since we just had a huge community discussion as to why Tower stuff in Cash shop/NX stuff is a bad idea.

Oh and, no it's not a forum exploit since that would mean something like privilege escalation and that would be absolutely hilarious for anyone with a sense of humor.

Or they're already on that server but under some protection that can be circumvented.

Pretty much this but I actually wish there was actually some protection for me to circumvent...

Even though I did not use the extractions, I decided to take a look at the extractions anyways after that comment about how the black friday sale was leaked 2 years ago due to some of it being in the extractions. Turns out that most of the Daily Black Friday box rewards are there this year as well so....I really don't know what to say.

"5532446 - Waterwheel Chair Exchange Coupon
5532447 - Slimy Scene Chair Exchange Coupon
5532448 - Superior Gollux Ring Exchange Coupon
5532449 - [A] Nebulite (LUK %) Exchange Coupon
5532450 - Magnificent Vellum Soul Exchange Coupon
5532451 - Unique Potential Scroll 30% Exchange Coupon
5532452 - Froggie Water Slide Chair Exchange Coupon
5532453 - Spinning Teacup Chair Exchange Coupon
5532454 - Ultimatum Ring Exchange Coupon
5532455 - [A] Nebulite (STR %) Exchange Coupon
5532456 - Magnificent Murgoth Soul Exchange Coupon
5532457 - Ferris Wheel Chair Exchange Coupon
5532458 - Tiny Toy Mansion Chair Exchange Coupon
5532459 - 5 Star Enhancement Scroll Exchange Coupon
5532460 - [A] Nebulite (INT %) Exchange Coupon
5532461 - Gyrofrog Drop Chair Exchange Coupon
5532462 - Midsummer Night's Dream Chair Exchange Coupon
5532463 - Unique Potential Scroll 80% Exchange Coupon
5532464 - [A] Nebulite (DEX %) Exchange Coupon
5532465 - Special Watermelon Bowl Chair Exchange Coupon
5532466 - Cat Camping Car Chair Exchange Coupon
5532469 - Giant Ducky Chair Exchange Coupon
5532470 - Docile Whale Chair Exchange Coupon
5532471 - Magnificent Cygnus Soul Exchange Coupon
5532472 - Shining Star Airplane Chair Exchange Coupon
5532473 - Bunny Camper Chair Exchange Coupon
5532474 - Battle-Roid (M) Exchange Coupon
5532475 - Battle-Roid (F) Exchange Coupon
5532476 - Outlaw Heart Exchange Coupon"

[SkyTheBM]

[Deleted post]

[dowie]

Nexon isn't dense, they are ridiculously lazy

[Spiral]

Wow. This is fun.

My reaction, sequenced:

1. Logs on to see how Southperry is doing
2. Sees a new announcement
3. Realizes it's about Artasi
4. Takes a moment to realize MapleStory is still...functioning?
5. Laughs

The whole thing is pretty hilarious. You'd think they'd have bigger things to worry about, y'know, like the fact that no one plays MapleStory anymore. But hey, what better way to improve your game than to attack one of the few fan sites that genuinely gives a pomegranate and still exists. pineappleing idiots.

Annnnnnnnd, this still has a grand total of 0 effect on Southperry. They really stuck it to ya, huh, Eos.

[Fiel]

Southperry's fansite status: "I live. I die. I live again!"

Is Nexon like this with their other games, or is it limited only to Maplestory? Never have I heard of a game silencing its own users for critiquing the game. Perhaps it's because they don't do any development and it takes a LONG time for them to fix anything?

Thank you, Eos, for not silencing users.

[Eos]

Is Nexon like this with their other games, or is it limited only to Maplestory?

They're like this with all their games. Sabina constantly attacks MabiWiki for 'enabling hacking by revealing item flags' and similar crap, because like Maple, if you edit the flags in the game files you can change the game client side. Their poor development is consistent. Their treatment of fansites is consistent. Their ineptitude all around is consistent. And they consistently punish the people who try to make it better. Gold star company all around.

Thank you, Eos, for not silencing users.

Not a lot of those to worry about these days given the state of extractions and the game in general.

[noreply]

They're like this with all their games. Sabina constantly attacks MabiWiki for 'enabling hacking by revealing item flags' and similar crap, because like Maple, if you edit the flags in the game files you can change the game client side. Their poor development is consistent. Their treatment of fansites is consistent. Their ineptitude all around is consistent. And they consistently punish the people who try to make it better. Gold star company all around.

Funny, no CMs have dropped by the MapleWiki at all, and I don't think PirateIzzy or I have been contacted by them ever. However, it's being promoted on the main website in the navigation. Sounds pretty inconsistent there.

[Eos]

Funny, no CMs have dropped by the MapleWiki at all, and I don't think PirateIzzy or I have been contacted by them ever. However, it's being promoted on the main website in the navigation. Sounds pretty inconsistent there.

The extractions at Southperry have more in common with MabiWiki than MapleWiki does, and Nexon has definitely had problems with both.

[Five Second Pose]

This site has also far outlasted any of his predecessors and will surely outlast him if the game even continues much longer.

Well, I guess you were right huh

[VerrKol]

Well, I guess you were right huh

Bow before my psychic powers!