Please, hack my account

[Fiel]

My account was compromised - partially

A fellow SP member PMed me to state that he had reset my PIC without needing access to my e-mail. Due to the reset, when I log into my account it now asks for my PIN. Cracking the PIN can already easily be automated, so it would be just a matter of time before my account would be compromised and the 50 million mesos stolen - though this has not happened yet. This is evidenced by the topic here that started it all when a user from BasilMarket gave his account name and password and was hacked in a matter of hours while still using the PIN system. When I entered my PIN and double-clicked on a character, it asked me to provide a completely new PIC.

The other SP member has reported this vulnerability to Nexon. I do not know the vulnerability that the other user took advantage of.

This is done for purely testing purposes. I will be giving out the username and password to a dummy account. The goal is for a notorious hacker to hack this account and steal everything I have by cracking the PIC currently set in place.

Account Name: ChicaFlaca
Account Password: giraffe
Server Name: Khaini
IGN: bisubuild235

Honeypot:
- The hacker who gets to this account will receive 50 million mesos currently on bisubuild235 (I am dueying the mesos now)
- Other users who would like to donate items to sweeten the deal for this hacker are welcome.

I encourage every one of you to spread this account information! Send it on SMegas, tell your friends, and spread it far and wide. I would like everyone to know about this extravagant offer. If my new account is hacked, I will reveal what the PIC was.

If my account is not hacked for fourteen days, I will declare the PIC to be the winner.

Concerning the PIC and account details:
I will not state what the contents of the PIC are.
I will not state how long the PIC is.
I will not state what my birthday is or my e-mail
My personal account has never been hacked or compromised from this recent wave of hackings
The e-mail account is a dummy account
The e-mail account has a separate password from the PIC and Maplestory account password.
The e-mail account has a sufficiently strong password.

Other Related Threads:
Sleepywood: Boom-shack-a-lack-a
BasilMarket: Boom-shack-a-lack-a

[Ssj5will]

Haha, just saw your posts dealing with this. Glad to see you've already begun. :)
I'll spread the word, mate.

The intel has been passed to the land of the lost.

[Solarboy]

Hmm, I see you really are testing the security eh?

Well, Lets hope that the account doesnt get hacked and then we can all rest in peace

[Sarah]

I guarantee the 50m is already gone because Fiel messed up.

edit: oh, he's dueying. Good. Cancel it. You need to remove/change the password, because anyone can reset the PIC from the website can gain access through just the information provided here.

[Fiel]

I guarantee the 50m is already gone because Fiel messed up.

edit: oh, he's dueying. Good. Cancel it. You need to remove/change the password, because anyone can reset the PIC from the website can gain access through just the information provided here.

So how would you recommend I test this?

[Sarah]

The only real way to do it is to post the account name only. If someone can get a decently-complicated password then it proves that account security has been in no way increased. The fact that people can reset our PICs from the website already proves that they're completely unsecure.

Also need to equip it with something so we can track it from the rankings.

[Ssj5will]

I guarantee the 50m is already gone because Fiel messed up.

edit: oh, he's dueying. Good. Cancel it. You need to remove/change the password, because anyone can reset the PIC from the website can gain access through just the information provided here.

And how are they supposed to get the email password to reset the PIC?

If it doesn't even need an email, then nevermind, don't know much about this PIC.

[Jellyflower]

If you want to truly test it, the news has to be spread out more. Just having SP'ers reading it will not be sufficient. I might be troublesome if people know your birthday and keep resetting the PICs though.

[Link]

I don't think they could change the PIC. Sure, they can reset it, but before you can use the account, they'd have to get into the E-mail and confirm the change. With Fiel NOT giving out that info nor the info used to get into the account information, they can't get into the e-mail, so that point is invalid, unless you know of a different way of getting into the e-mail.

[Nightclaw]

Wait, all you need to reset the PIC is the usename/pass? No email? That means the PIC does nothing!

[Sarah]

And how are they supposed to get the email password to reset the PIC?

Oh, it requires an email request? That's fine then. I was unaware of this. I remember with PINs you could just hit "reset pin" and it would go blank. Completely worthless. I assumed this ran on the same system.

CARRY ON NOTHING TO SEE HERE.

[Fiel]

lemme check the e-mail I used. I can't even log on to the account anymore. Not surprised.

EDIT: No e-mails yet.

[Ssj5will]

Oh, it requires an email request? That's fine then. I was unaware of this. I remember with PINs you could just hit "reset pin" and it would go blank. Completely worthless. I assumed this ran on the same system.

CARRY ON NOTHING TO SEE HERE.

For pins, it still needed a link provided by email to reset it.

EDIT: So should I remove the password from the thread?

[Fiel]

okay, just got my first PIC/PIN reset request in the e-mail. I'm going to ignore it.

[Link]

For pins, it still needed a link provided by email to reset it.

EDIT: So should I remove the password from the thread?

No. You're fine. As already stated, there's nothing wrong with what Fiel has put so far.

[Ssj5will]

okay, just got my first PIC/PIN reset request in the e-mail. I'm going to ignore it.

And so the fun begins.

[Nightclaw]

Somebody is trying to hack you already? Then lets make a list of everybody that anybody here has contacted, one of them has to be the hacker.


Unless somebody on SP is just messin around guessing PICs and doin for the lulz.

[Ssj5will]

Here you go to keep track

[Sarah]

For pins, it still needed a link provided by email to reset it.

EDIT: So should I remove the password from the thread?

No, if you got through the password/username part, when the PIN part came up all you had to do was hit "reset PIN" and it would be reset. You MIGHT have needed the pin first but I can't be sure. Either way, you didn't need any email access.

[Sarah]

Basil has your email already. You might want to secure it.