Ok so I got hacked...

[Cheeter]

I never thought the day would come. I never thought it could happen to me. I've fought so many scammers trough out the years. But here I am. Just sitting quiet in front of my computer screen.

"Where am I? Where are my items? Why am I naked?? I'm always wearing my full black (g) these days. I don't have room in my bank, I can't even put it in." The eyes are slowly filling with tears as I come to the realization of the only possible answer.. I have been hacked.
But how? I thought I had a secure password. Am I keylogged? How can I be so unlucky that my keylogger is owned by one of the few that play RuneScape. I simply do not understand..

I don't play RS anymore. I login about 3 times a year just to check on things. Today I logged in for the last time.
I cannot stand this happened. It was just a bit over 150m and a easter egg but still. I worked so hard for it. So hard.. It was my baby! I feel kinda raped tbh...

I will probably leave all of RS behind me due to this, including sythe.org (which won't be much different) from now..).
I was thinking about picking it up when I had time but now that won't happen.

There is a big chance that my hacker is here on sythe.org and if so. Please.. tell me what I did wrong...

This is my goodbye letter to the world of RuneScape I once knew and loved. But I never thought it would end like this..

Sincerely yours,
Cheeter / Charlie

 

[Flamedog]

2fa? Think about your password, is it guessable? If your account has been recovered by someone else id say to try your luck by emailing jagex

 

[Cheeter]

2fa? Think about your password, is it guessable? If your account has been recovered by someone else id say to try your luck by emailing jagex

No shit? You don't have to lecture me on internet security.. And like I said I don't play anymore. Did not know there was 2FA. I must have used same password as some compromised site. Almost every fucking site on the internet have been hacked.

 

[Master]

Damn, so sorry mate. That's why I use 2 step security in rs and my email. If I didnt have a DNT I would give you those items...

Its always sad to see people leaving. I hope you change your mind..

 

[I Bleed Duke Blue]

No shit? You don't have to lecture me on internet security.. And like I said I don't play anymore. Did not know there was 2FA. I must have used same password as some compromised site. Almost every fucking site on the internet have been hacked.

Well if you don't want to get lectured on internet security you probably should have taken the proper steps to secure your account even if you don't play much. Not knowing about 2fa for Runescape is slightly understandable (although it has been out for like..2 years..) but using the same passwords on multiple websites is a big no no especially as you said..in this day and age tons of databases are being breached. I know Myspace, Yahoo, and Twitter have been among them.

Was your account tied to an email? Perhaps it was compromised through a breached email. You should 2-factor authenticate all accounts on anything that supports it. Someone probably got your details in a DB leak and cashed in.

I see a common theme throughout people that get hacked + sometimes hacked and banned because the hacker bots on the account: They're gone for long periods of time and rarely check up on their accounts. Another big one is not having 2 factor authentication. If you know you're not going to be playing much it makes little sense not to have 2FA. Though I suppose if the "hack" was done through your email, it's moot anyway. They could have just disabled an authenticator if they compromised you through that way.

Still don't understand why you would have the same password cross websites though. Or not update your passwords regularly. Most data breaches contain ancient information relative to the actual time period they release, one simple sweep of password changes highly mitigates your risk of falling victim to any breach/db leaks.

In the end, sorry you got hacked. At least is severs permanently your ties to a game you really didn't care about much anyway anymore. And what you lost really isn't worth much rl monetary value. So if you ever got the itch to return you could pretty easily, whether by making it back in game or buying it back.

So unless you downloaded anything shoddy, which it doesn't sound like you did or would, probably just an unlucky victim of a DB leak that either A: had your same RS password or the more likely in my opinion B: was an email tied to your RS account that they could recover your RS account using it.

 

[Floridian]

Sorry for your loss

 

[Cheeter]

Well if you don't want to get lectured on internet security you probably should have taken the proper steps to secure your account even if you don't play much. Not knowing about 2fa for Runescape is slightly understandable (although it has been out for like..2 years..) but using the same passwords on multiple websites is a big no no especially as you said..in this day and age tons of databases are being breached. I know Myspace, Yahoo, and Twitter have been among them.

Was your account tied to an email? Perhaps it was compromised through a breached email. You should 2-factor authenticate all accounts on anything that supports it. Someone probably got your details in a DB leak and cashed in.

I see a common theme throughout people that get hacked + sometimes hacked and banned because the hacker bots on the account: They're gone for long periods of time and rarely check up on their accounts. Another big one is not having 2 factor authentication. If you know you're not going to be playing much it makes little sense not to have 2FA. Though I suppose if the "hack" was done through your email, it's moot anyway. They could have just disabled an authenticator if they compromised you through that way.

Still don't understand why you would have the same password cross websites though. Or not update your passwords regularly. Most data breaches contain ancient information relative to the actual time period they release, one simple sweep of password changes highly mitigates your risk of falling victim to any breach/db leaks.

In the end, sorry you got hacked. At least is severs permanently your ties to a game you really didn't care about much anyway anymore. And what you lost really isn't worth much rl monetary value. So if you ever got the itch to return you could pretty easily, whether by making it back in game or buying it back.

So unless you downloaded anything shoddy, which it doesn't sound like you did or would, probably just an unlucky victim of a DB leak that either A: had your same RS password or the more likely in my opinion B: was an email tied to your RS account that they could recover your RS account using it.

I have 2-factor on fucking everything. Just didn't know it was available on runescape. As i never play it it just never occurred to me to check.

And honestly I didn't use the same password. I just used the same combination in another order. What are the odds that they try to flip the order? If they would try that on every account when they fail their first try its soo much more work.

 

[I Bleed Duke Blue]

I have 2-factor on fucking everything. Just didn't know it was available on runescape. As i never play it it just never occurred to me to check.

And honestly I didn't use the same password. I just used the same combination in another order. What are the odds that they try to flip the order? If they would try that on every account when they fail their first try its soo much more work.

Hmm. Not sure then. I just know it's very common for accounts that don't get logged into much to get compromised. Not sure how but it's pretty common. I tend to actually believe most of the "my account got banned for botting" after a long break because generally hackers will bot on the accounts they hack to try and make even more profit.

I assume none of your skills were touched? Just cleaned?

 

[Cheeter]

I assume none of your skills were touched? Just cleaned?

I still got that low-ass mining and woodcutting level so I don't think so. Fishing is strong as always but it's the same. So it looks ok.

 

[I Bleed Duke Blue]

I still got that low-ass mining and woodcutting level so I don't think so. Fishing is strong as always but it's the same. So it looks ok.

Ya that's pretty strange. I didn't mean for my original message to sound smart-assey btw. Just a lot of people say they know or had full on security when they didn't/don't. I'm honestly not sure in this case if 2FA on your RS account would have saved it anyway. But it sounds like only that was compromised and not any emails. So maybe it would have. I guess it doesn't really matter now :/.

Did they play on 07 at all? Might have botted there.

 

[Cheeter]

Ya that's pretty strange. I didn't mean for my original message to sound smart-assey btw. Just a lot of people say they know or had full on security when they didn't/don't. I'm honestly not sure in this case if 2FA on your RS account would have saved it anyway. But it sounds like only that was compromised and not any emails. So maybe it would have. I guess it doesn't really matter now :/.

Did they play on 07 at all? Might have botted there.

Ugh can't be bothered to log into 07 today. I'm on Linux and client must be installed manually.

I know security. But like every other person I'm a lazy comfortable fucking idiot.

 

[getonmylvl]

shit happens, move on boss. Perhaps phished? or an old mate you lent a pass to?

 

[Cheeter]

shit happens, move on boss. Perhaps phished? or an old mate you lent a pass to?

No no no phishing. No friends have been on my account since 2004 and this password wasn't invented until over 10 years after. None of my current friends even know how to log in to RS.

 

[Matt Hasty]

Maybe you emptied your account yourself one night and forgot? It doesn't sound like you were hacked it sounds like something happened on your end.

This is why I stopped logging into anything when I'm drunk.

 

[PodolskiFTW]

 

[Itachi.]

Words to live by

 

They probably got you via a database leak, its how so many people nowadays are getting hacked, even if you have 2step. If the dataleak provides IP, name and passwords that you may have used, this may be enough if they can track your internet provider because they will just go on twitter, and request access to your account via jagex support.

 

[Pok3r]

Wise words.