Fuck i read this thread while i was at work and i freaked out. I came home undownloaded Swiftkit and ran 3 virus scans/checked processes. I hope im safe ^^
To all Swift Kit users
- Thread starter Laptop65
- Start date
Strider must be choked that like 30k people simultaneously uninstalled SwiftKit :laugh:
On-Topic: Any new updates on this today?
On-Topic: Any new updates on this today?
Man.. This is some scary stuff...
I would be extremely cautious when using an external client now.
I would be extremely cautious when using an external client now.
- Joined
- Oct 31, 2010
- Sythe Gold
- 18,211
- Messages
- 25,909
I've actually checked the website, and according to the "owner" of SK, everything seems to be running smoothly now, that is according to the owner of SK. There's an article that can be found there, but here's the gist of ot.
What had occured was the hacker(Luit) got access to the SK website domain by creating a type of fake Identification and then got in contact with the domain host and managed to convince them he was the owner and got a password reset and took the domain for himself.
It took about 5 hours to take the domain back and I believe they installed a Rat into the new downloads for SK(or something like that, don't quote me) because they claimed that the client itself is completely safe and everything is fine.
Anyone who didn't run SK during those 5 hours +- maybe another 5 hours for safety (15 hour total) period, should be fine. Just make sure that if it asks you to run a java applet, its from SK, not some random thing. As far as virus/rats are concerned, I know nothing about FUDs and finding them or whatever but I THINK as of now, everything is in the clear.
Thanks for the updates Dave.
I hope the gist of that is true information, as that would be fairly good news to a lot of people (including myself) who used the client but didn't initiate any fresh downloads or java applet requests.
I'm still kind of scared to load up SK though lol.
How would they profit off pretending to be hacked?
This is actually a very bad scenario for them, and they have already had thousands of people uninstall Swiftkit in a panic. I don't think they would ever pull a stunt like this on purpose because of all the users they could/would potentially lose who think the client is unsafe.
- Joined
- Oct 31, 2010
- Sythe Gold
- 18,211
- Messages
- 25,909
How would they profit off pretending to be hacked?
This is actually a very bad scenario for them, and they have already had thousands of people uninstall Swiftkit in a panic. I don't think they would ever pull a stunt like this on purpose because of all the users they could/would potentially lose who think the client is unsafe.
Not to mention this isn't the same as someone hacking a gold buyers msn lol. Swiftkit's owner couldn't care less about RSGP. I'm sure his main source of income is advertisements and such, the guys not a Sythe gold seller.. Lol.
Also, I know of Luit and his friends. I've seen some of the work he's done and that photo from the OP with that girl is his signature. I've seen him take control of other domains, this hacking was for sure real.
The hacking was real, and I have 'friends' who would confirm that. They managed to take over the domain for 5 hours. To my knowledge one person who was involved currently has infected 800+ people with the RAT.
While it's looking now that it's all starting to get sorted out, I advise everyone to still use caution when using Swift Kit for the next day or two.
I remember a few years back Jagex were going on about how 3rd party clients are never 100% safe and everyone should use caution when using them, now you know why.
While it's looking now that it's all starting to get sorted out, I advise everyone to still use caution when using Swift Kit for the next day or two.
I remember a few years back Jagex were going on about how 3rd party clients are never 100% safe and everyone should use caution when using them, now you know why.
- Joined
- Oct 31, 2010
- Sythe Gold
- 18,211
- Messages
- 25,909
Here's a link to Strider basically explaining the full story and telling users how to check for infections.
http://forums.zybez.net/topic/1556987-swiftkit-website-issue-explained/
http://forums.zybez.net/topic/1556987-swiftkit-website-issue-explained/
So what he said was, the website was the only thing hacked. Not the swiftkit client itself?
It would seem so, I only put that up just in case though. Anyone who downloaded it from the site or pressed 'ok' to any Java pop ups should probably scan their PCs right away.
I don't understand how Luit hasn't faced any law suits.. he is bragging about it and has a "Swiftkit loot so far" post on bugabuse...
yeah he hacked over 8bil so far -,- i dont understand why people do this kind of shit. Ruin the game for other people.
❤❥❤❥
Forum Addict
- Joined
- May 29, 2012
- Sythe Gold
- 0
- Messages
- 384
Yes but do a couple virus scans with norton/malwarebytes etc just to be sure.. it's supposedly over but you can never tell
Formerly known as Po3ion
- Joined
- Sep 13, 2011
- Sythe Gold
- 30
- Messages
- 826
One down side to SwiftKit being as popular and successful as it is, means that it has a giant target on its back. Today we unfortunately experienced the effect of that., which is a shame really as we only exist to offer a free helpful tool to players...It really is unfortunate. As always though, we aim to be as transparent about the situation as possible.
At around 3am this morning it came to my attention that someone had gained access to the domain register's account that hosts SwiftKit.net. This allowed them to transfer the SwiftKit.net domain off our account and onto their own. Once they did this they were then able to change the webserver the domain points at, to their own malicious site. The problem was that it took around 5 hours for the domain to be rightfully returned back to us. So during this time the SwiftKit.net domain was pointing to a malicious website. We'll definitely be moving to a different domain registrar in the near future.
How was the intruder able to gain access to our domain account? By using a fake ID, or identity document to convince the domain hosting company to reset the e-mail address to their own. Then all they had to do was perform a simple password reset. We're very concerned that this could even happen in the first place, and that it took so long to re-gain control. We'll be looking forward to getting as far away as possible from this domain host.
So what does this mean for you as a user? Not too much, SwiftKit itself wasn't affected at all, just the domain. However If you were unfortunate enough to click accept or yes on any JAVA popups that came up I suggest do you a virus scan straight away and once clean change your password. You should never accept any JAVA requests from sources you don't trust. (It states the source in the popup)
We have seen this specific malware can be detected and removed by Microsoft Security Essentials. If you believe you have loaded SwiftKit in this small window and accepted any rogue Java confirmations, then it would be a good idea to run a full system scan and perform the steps at the bottom of this post.
SwiftKit itself has several layers of protection built into the updater to prevent anyone from being able to push out bogus updates. The only way you could be harmed is if you download or accept something yourself.
As it stands we now have full control of our domains and have taken temporarily steps to prevent such a situation from occurring again. DNS changes have been successfully apllied to many users and they should now be directed to the right, normal site. If you still are redirected incorrectly, try clearing your browser's history and cache, and also by going to Start > search for "cmd", and type in "ipconfig /flushdns". This will ensure the right DNS address is obtained from the server. In the coming future we will be looking to implement some permanent changes to further prevent such an occurrence, abandoning our current and frustrating registrar is one of them.
We understand our well-earned reputation has been tarnished by this horrible incident, and we understand many are wary using our products in the future. That trust is going to have to be earned back, and I know for some it will be difficult. I want to personally let everyone know the safety and security of all of our users are our #1 priority. The entire SwiftKit staff, including support from our users and Jagex moderators have hopefully showed everyone that we are serious about security.
If you have any hesitations or questions please don't hesitate to ask.
---------------------------------
Long story short?
Someone managed gain access to the SwiftKit.net domain at our domain host for a few hours today and point it to another website, which had harmful software popup asking to install. SwiftKit itself and the webserver remained untouched. They managed to do this by impersonating myself and providing my host with fake identification documents. Everything is now back to normal.
---------------------------------
Unsure if you're infected? Read below
As a result of the fantastic work buy a number of people, we have dissected the malware that attempted to get into the computers of SwiftKit users. Here is a way to definitively check to see if you are indeed infected:
1. Open Start
2. In search, type "regedit" and hit Enter
3. Navigate to "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows" using the folder dropdowns.
4. If there is a file or entry in the Windows folder called "Adobe Drivers", than you are infected and you require removal. If it doesn't exist, you are not infected.
Removal:
1. Right-click the taskbar and select "Start task manager"
2. In the Processes tab, end any process named "winsyl.exe"
3. In the Registry Editor window you still should have open, right-click the "Adobe Drivers" folder and select Delete
4. Open Windows Explorer, enter in the URL %AppData%\Microsoft\Windows\
5. Delete the folder "Drivers"
6. As a safety measure, run a full system scan using a reputable anti-virus such as MSE.
Edited by Strider3282, Yesterday, 06:46 PM.
At around 3am this morning it came to my attention that someone had gained access to the domain register's account that hosts SwiftKit.net. This allowed them to transfer the SwiftKit.net domain off our account and onto their own. Once they did this they were then able to change the webserver the domain points at, to their own malicious site. The problem was that it took around 5 hours for the domain to be rightfully returned back to us. So during this time the SwiftKit.net domain was pointing to a malicious website. We'll definitely be moving to a different domain registrar in the near future.
How was the intruder able to gain access to our domain account? By using a fake ID, or identity document to convince the domain hosting company to reset the e-mail address to their own. Then all they had to do was perform a simple password reset. We're very concerned that this could even happen in the first place, and that it took so long to re-gain control. We'll be looking forward to getting as far away as possible from this domain host.
So what does this mean for you as a user? Not too much, SwiftKit itself wasn't affected at all, just the domain. However If you were unfortunate enough to click accept or yes on any JAVA popups that came up I suggest do you a virus scan straight away and once clean change your password. You should never accept any JAVA requests from sources you don't trust. (It states the source in the popup)
We have seen this specific malware can be detected and removed by Microsoft Security Essentials. If you believe you have loaded SwiftKit in this small window and accepted any rogue Java confirmations, then it would be a good idea to run a full system scan and perform the steps at the bottom of this post.
SwiftKit itself has several layers of protection built into the updater to prevent anyone from being able to push out bogus updates. The only way you could be harmed is if you download or accept something yourself.
As it stands we now have full control of our domains and have taken temporarily steps to prevent such a situation from occurring again. DNS changes have been successfully apllied to many users and they should now be directed to the right, normal site. If you still are redirected incorrectly, try clearing your browser's history and cache, and also by going to Start > search for "cmd", and type in "ipconfig /flushdns". This will ensure the right DNS address is obtained from the server. In the coming future we will be looking to implement some permanent changes to further prevent such an occurrence, abandoning our current and frustrating registrar is one of them.
We understand our well-earned reputation has been tarnished by this horrible incident, and we understand many are wary using our products in the future. That trust is going to have to be earned back, and I know for some it will be difficult. I want to personally let everyone know the safety and security of all of our users are our #1 priority. The entire SwiftKit staff, including support from our users and Jagex moderators have hopefully showed everyone that we are serious about security.
If you have any hesitations or questions please don't hesitate to ask.
---------------------------------
Long story short?
Someone managed gain access to the SwiftKit.net domain at our domain host for a few hours today and point it to another website, which had harmful software popup asking to install. SwiftKit itself and the webserver remained untouched. They managed to do this by impersonating myself and providing my host with fake identification documents. Everything is now back to normal.
---------------------------------
Unsure if you're infected? Read below
As a result of the fantastic work buy a number of people, we have dissected the malware that attempted to get into the computers of SwiftKit users. Here is a way to definitively check to see if you are indeed infected:
1. Open Start
2. In search, type "regedit" and hit Enter
3. Navigate to "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows" using the folder dropdowns.
4. If there is a file or entry in the Windows folder called "Adobe Drivers", than you are infected and you require removal. If it doesn't exist, you are not infected.
Removal:
1. Right-click the taskbar and select "Start task manager"
2. In the Processes tab, end any process named "winsyl.exe"
3. In the Registry Editor window you still should have open, right-click the "Adobe Drivers" folder and select Delete
4. Open Windows Explorer, enter in the URL %AppData%\Microsoft\Windows\
5. Delete the folder "Drivers"
6. As a safety measure, run a full system scan using a reputable anti-virus such as MSE.
Edited by Strider3282, Yesterday, 06:46 PM.
- Joined
- Nov 23, 2007
- Sythe Gold
- 0
- Messages
- 833
Thank you for the warning. Luckily I have never really used swiftkit. But this is still scary and a good thing to note for those who do use swiftkit