Silkroad Online Forums

Currently if you guys have not notice there have been a big hacking feast on all servers, presently I play on the server tibet aka tibot. There is a exploit where by only the login name of the account is needed for the account to be hacked no secret answer needed. I believe it is something to do with SQL insertion code which has open up on the new http://www.joymax.com/portal.

You guys might think oh he deserve it as he bot etc sadly I dont bot as my account is only level 68 and I have lost all my gold and items SOSun etc. I have spent over 2000$ on this game and joymax refuse to acknowledge the problem to fix it.

What has happened so far.

1. My login was the same as my ingame character name so errr does not take a genius to know what happened.
2. Contacted bug reports no responses.
3. Posted on the official forum - if you go to the user problem section there are over 1000s of post there is one with 140 replies with this problem.
4. Contacted by phone it was like talking to a bunch of idiots who as soon as you mention the word hack... err it is not our fault and it is in the terms and condition that if you account is hacked we will not help you.

*** News flash for joymax ***
It is not my fault your server is bug with no SSL and support password changing which is easily exploited with packet capture and packet insertion.

From what I see on the server as soon as the login is known to the user you get hack instantly. Your password is changed and you are booted from the server and you loose your account. Joymax will not reset the password on your behalf... but what is the point in resetting the password when it get hacked in like 1 second.

Joymax promised me to do some investigation but this is just a hoax to get you off the phone and not disturb them charging silk. They will ask you for your email and 10 minute later email you back saying there is nothing wrong on their part.

My suggestion is, if you do still enjoy playing the game and yes the game is very addictive is to stop playing as you will be next the username can be obtain some how. The next is all your item is listed on *****.com if you guys are not aware. If you have any nice item then it is gone.

1. Make a noob account hold all your gold.
2. Sell all your item for game money
3. Open a gold selling account and sell the gold back to them get some money back.
4. Charge back all your silk dont say that it was used for fraud, say you did not recieve the product.
5. Book a ticket to go on holiday because you need it.

************ Stop playing this bug infested game with all the exploits all your hard work can be lost in 1 second **********************
As I am writing this some more account have already been lost they will not recover your gear or your account so it just a waste of time.
Just quit and go to WOW or something if you like mmorpg. Good luck everyone this is not a complaint or bitching but just to let you guys know to stop playing hope admin can sticky this so everyone is aware of this serious problem.

I think this is the main problem... In other games, ever if you know a id, you cannot hack only with that...

EXAMPLE: Diablo2 in battlenet, when you talk all can see your char name and your account id... and all others see that also. That means that they have a greater chance of getting hacked? HELL NO!

I only talk with ppl in the msn since I have been banned for chargeback, and I guess this is indeed turning in a hack fest... Lots of people have been hacked and joymax doesn't want to tell that THEY SCREW things up... more than usually



I really dont believe in that, if all people stay together, joymax have to do something about that...

guess what your a new in this game i think.

hacking or scamming is part of this game you can hack me and we can hack each other..

That's wise actually, of course I wouldn't do though =/








Buddy, in behalf of most of the SRF community, piss off, please.

Your fault to have your character name same as your ID.

wow warning by mj fans

It's funny how none of my accounts, ever, on any game I've played, got hacked. Maybe it's because I never use my char name as my ID

I wouldn't be suprised knowing Joymax. If their login script
is unsecure it's about as simple as putting "SELECT * FROM *"
in the password box. Funny because it's as easy as using md5()
to encrypt something, atleast in php and i'm sure they have it in
microsofts asp p.o.s

best advice ive seen in a while; sell your shit, sell your gold, quit. s'what i plan on doin. sro is crap compared to all the other games out there. i play a buggy ass free wow server with a few thousand people on it, run and maintained by just a handful, and their "customer" service still blows joymax's out of the water.
plus the xp rate is 10x higher than normal so im already almost at cap

everyone should just quit silkroad. joymax doesnt deserve another penny. my monkey's been dead for 2 weeks. its got some of my gear in it but i dont care. i refuse to give joymax any more of my money.

until i need the shit in my monkey.

+1 QFT

Have fun quitting *hands over flower*

Very very important: WoW sux.


R u playing on WOWscape/legion/crack? lmao! My school buddies insisted so bad that I had to install that piece-of-shit-game-compared-with-sro. Made a char, did lvl20, bored, made another one, lvl20, bored, then another one. WoW suxxx... still, if you play on one of these servers, Imma give u my 150 gold I got as a present from school buddies xD In return, I want the garment u got from u-know-who jk anyways, just wanted to say SRO is a brilliant game in its core. It just needs ppl to maintain it, but I guess those would be bots too lol

+1 or we just don't have a hack me! sign on our backs. hehe

What the hell are you upto to post two similar posts across the forums with that content. PS Erasmus died a long time ago.

Well if you are brave then do it and you will know I am not sure what server you play on but trust me it is the truth. You can say what ever you want but when it happens to you I hope the guys here will give the same respect as you have given us. Please treat others the way you want to be treated stop being an ass. I am trying to help the guys protect their account and hard work. There is a bug and hacking have happen and people have lost the account.

or you might get "touched" ...

Zulu, sorry to hear that your account got hacked. ign and userid being same is a definite no no. this was brought up very long time ago. i guess you were living on the knife edge when you didnt get hack previously when sql injection in the sro official forums could reveal enough info for account hacking.

to quit sro is not a bad idea. cheers to spending more time in real life ... or at least away from sro.

\

I checked that and it said, "Email does not match." so it must only be some accounts...

I checked an account that does have email verification on it.

Ok, well it doesnt work then or only one some accounts like you stated.

problem is in insecure connection when logging in on joymax site , to be exact there is no ssl or https or any secure link when logging in. Its all being sent in regular http.
So , what hacker did , is get your username , change some data in packet on his side and send it to login database as it doesnt check the data he sent. That way , he practically logs in with any random password.
The other way is the email thing on joymax site. Somehow , email thing for forgot password dont work for all accounts (although they have been verified). On some accounts you can type in any random email and get the code sent to it and on some you cant.

People have called joymax , and they say like "its not our fault , our policy bla bla" , but they are closing their eyes on 2 things:
1st : IT IS their fault , THEIR site is bugged , its THEIR insecurity side that is being hijacked.
2nd: They obviously havent talked to lawyers about their terms of policy : once you change accepted terms onesided (and they have done it multiple times) the terms are not valid anymore , i mean , thats the basics of business law ffs.

anyway , tibet is ruined , theres handfull of high lvls left now (besides goldbotters)


edit : wow my topic that even had screen of all hacked items got deleted.. nice job mods , you on joymax payroll ??

lol yea im on wowcrack. its way more fun than sro. i play with an old sro guildmate. and i have no idea what garment youre talking about lol did i miss something?

I tried several of my spare accounts and I was able to hack all of my own verified ones but got that "does not match" error on the non verified ones.

Maybe it depends on the date it was verified

The topics were similar so I posted it in both.

Don't get me wrong I didn't post my findings with any bad intentions, it just seemed a lot of people are still clueless that this bug exists, perhaps even JM are unaware of it, I thought if I showed what it was exactly then more people would report it and a fix would maybe come quicker.

Dunno which Erasmus your thinking of, mine is very much alive



So people who haven't done the verification can be hacked just as easy as well?

It seems your not safe either way then

Dude wth I didnt disrespect anyone U got me wrong. I think u got hacked because ur pw was too easy. Am I right, was it?
Anyways, not brave enough to global it. Why would I risk anyways.

this seems like an awful bug...good thing i don't own any sun XD

Ok it's good to get people aware of this, just don't post things with that much details, people might get bad ideas

Oh and i'm talking about one of the greatest (Dutch) humanists / theologians ever Dunno who do you mean though
http://en.wikipedia.org/wiki/Erasmus

Yeah maybe a bit too much information.

My Erasmus is from:

http://en.wikipedia.org/wiki/House_of_Hell

Not a living thing but not the dutch dude either

lols if thats the dude in your avatar he's scary