Hey everyone,
My Discord account got hacked. Please don't reply to anything you receive from me, until further notice.
For the safety, you might want to remove me from your friend list, too.
Thanks!
And apparently, i got hacked too because of it.
Oh my, I hope you manage to get it sorted out soon.
Do you know how it might've happened?
I am curious about it too, and also if using two-factor auth helps or not (I've seen apps that had session hacks that bypassed any login as long as the session token was valid)
@Kastchey, it looks like you're back on Discord. Can you tell us how you got into this mess so we can prevent it?
@eri0o, it seems that 2FA does not help because the tokens are getting hijacked. Just don't trust friends who send you things. In any case, I did change my credentials and added 2FA.
I'm back on Discord, but with another account. The main one is still in hands of the account thief, so stay on guard.
The thief got lucky by hitting the right moment with the right account from a familiar server (not AGS). I was expecting someone to send me something, and the file they sent didn't trigger any alarms (I did scan it with anti-malware and anti-virus, both reputable and up to date).
The fact that the threat may (and often will) come from a source you trust makes it a whole lot more dangerous.
Same happened with Duals I guess, we share links and files every now and then, so he could have easily thought it was legit.
2FA helps, but it's not a guarantee so don't rely on that. Same with anti-virus software. Sometimes it will detect a threat, sometimes malware will slip through defenses.
I guess the only way to protect yourself is always triple check if you are really speaking with the person you know. Even if the person fits the profile and had sent you safe files or links before. Ask questions and if something feels off, confirm via another channel, like email or another social platform.
Don't rely on technology to protect you.
Quote from: edmundito on Sat 20/04/2024 18:29:33@eri0o, it seems that 2FA does not help because the tokens are getting hijacked. Just don't trust friends who send you things. In any case, I did change my credentials and added 2FA.
That's a good call. This reminds me if anyone is wary of someone sending an AGS game, remember you can run others AGS game with a run-time, ScummVm or agsjs - I may need to update the website to the latest version but anyway it usually works.
Quote from: eri0o on Sat 20/04/2024 20:58:22That's a good call. This reminds me if anyone is wary of someone sending an AGS game, remember you can run others AGS game with a run-time, ScummVm or agsjs - I may need to update the website to the latest version but anyway it usually works.
That is true, but always remember that danger may also come from plugins. You can never tell what plugin does. It may have a standard plugin name, but hacked to do something else.
OTOH there's a super dangerous ags_shell plugin, which should not exist at all, in my opinion, because it allows to run almost any Windows command (at least the old one did, idk if there have been any safer rewrites).
For this matter, any ags game should never be run with administrator rights.
I was contacted by "Kastchey" when the account was hacked, but the whole interaction raised some red flags straight away:
Quotehii
> ...
how are u?
> ...
good
do u have a 5 min?
I don't know if the hackers can read the past message history, but that's not a very good Kastchey impression.
Quote from: Crimson Wizard on Sat 20/04/2024 21:14:36That is true, but always remember that danger may also come from plugins. You can never tell what plugin does. It may have a standard plugin name, but hacked to do something else.
OTOH there's a super dangerous ags_shell plugin, which should not exist at all, in my opinion, because it allows to run almost any Windows command (at least the old one did, idk if there have been any safer rewrites).
For this matter, any ags game should never be run with administrator rights.
ags_shell is terrible I am sorry for having resurrected it, but this is why I made the safer agsappopenurl (or whatever I named it) that can only be used for open a website in the browser. But anyway, I also do just remove plugins when running a game as this usually works alright - or I run with my own builds of the plugins.
This gave me an idea, maybe we should add a command line option for the engine to ignore plugin files and go straight to stubs.
E.g. "--no-plugins".
Oh, yeah, that would be a nice one
Quote from: Snarky on Sat 20/04/2024 21:19:07I was contacted by "Kastchey" when the account was hacked, but the whole interaction raised some red flags straight away:
Quotehii
> ...
how are u?
> ...
good
do u have a 5 min?
I don't know if the hackers can read the past message history, but that's not a very good Kastchey impression.
That is a very good point. If you know someone well enough to recognize their expression patterns, you're already well equipped to detect a red flag.
And if you don't know the person that well, you should probably not click or download anything they send you.
In practice, it may not be that easy because scammers may coincidentally speak in a fashion that's not very far off from the person they are pretending to be, or use some cunning social engineering tactics that just happens to strike the right chord. But it's a good question to ask yourself the moment you receive something from someone.
Yeah, there's clearly a large component of random chance in whether an approach will seem plausible or not. It's like those "Hey, I lost my phone and now I'm stranded without money, please help!" scams. 99 times out of a hundred they'll be an obvious lie, but every now and then the real-world context will match up well with the story, and the target can be fooled.
And scammers have already started using ChatGPT and other AI tools (including voice cloning and even video facechanging) to mimic the person being impersonated, so we can't rely on recognizing the person we're communicating with in any case.
It is what it is. Things are slowly returning to normality, have not received my account back nor will I ever it seems.
If the virus copies your session tokens, it might be a good idea to change the passwords of every account you're currently logged into. (nod)
By the way, thanks for telling us what happened.
Quote from: Danvzare on Sun 21/04/2024 16:58:08If the virus copies your session tokens, it might be a good idea to change the passwords of every account you're currently logged into. (nod)
Already did. Formatted my entire PC, too.
Quote from: Danvzare on Sun 21/04/2024 16:58:08By the way, thanks for telling us what happened.
Sure. It's embarrassing to openly admit to being scammed, but I wanted to alert everyone whom the thief might be reaching out to, as well as raise the general awareness. As a game making community, we are extra vulnerable because we do share files as part of our hobby. Or work, in case of some.
I'm still gutted that I didn't manage to get through to Dualnames before the "hacker" did. I hope everyone else is safe.
Quote from: Dualnames on Sat 20/04/2024 11:06:46And apparently, i got hacked too because of it.
me too this night with the message via your discord and the pirate who takes your account... :(
Quote from: Dualnames on Sun 21/04/2024 13:56:03It is what it is. Things are slowly returning to normality, have not received my account back nor will I ever it seems.
I saw this post too late...your hacker hacked my discord too tonight...I really thought it was you since it was a game for him to test...arg....
Then he hacked my X account... but I managed to recover it...
I created another discord account to warn him on my server...he asked me for money to get the account back...I cut everything off and dropped the discord...
FYI it's a 2d pixel art game he's asking to test. Obviously when you click, you get screwed...
I'm usually suspicious, but as it was from the nice Dualnames team with whom we'd done a lot of dev work...well, I was fooled...
I'm sorry to hear that it happened to you. Like I said, this coming from a person you know (or so you think) lowers your guard.
I tried to reach everyone I could via my new Discord account, but I did not remember all the people I spoke to over Discord specifically, or their Discord names. Contact Discord support from your original email that was used to create your account, and hope for the best. Fingers crossed.
Having had a close call with this type of attack a while ago, and knowing it's likely too little too late, here's what small advice I can give to people as a way to try and avoid falling victim to this kind of thing:
If you are ever requested to download and install something or to follow a link that seems even the slightest bit shady, despite coming from a seemingly trustworthy source, try to confirm via a second channel of communication that the request is genuine.
For example, if a link is sent via discord, try to verify it through email or via a PM here on the forums if possible. It adds a bit of extra security, as the attacker must have breached more than one account to convince you at that point.
As always, though, more security means less convenience. That's what makes it so easy to fall victim to these kinds of attacks, as we all crave a bit of convenience and dislike the hassle.
As for my experience with this:
Spoiler
An old friend of mine messaged me out of the blue on Discord, asking me to do a favour. His 'friend' had 'worked so hard' on developing a game and nobody was playing it, so I was sent a link to download and try it out and maybe leave a review. In my case the attack was crude and the 'game' the link sent me to was a Chinese knock-off MMORPG that I bounced off enough that I didn't download anything and called my friend out, only later realising I'd barely avoided a mess just by being picky with what I'd download based on the images on the website that acted as the source of the dangerous files.
Be safe out there, folks!
Looks like Honza's Discord account might have got hacked, everyone please be wary of any DMs from him.
It's true, both my Discord and Itch accounts are currently hacked (happened through a link I got from Kastchey's hacked account). Losing Discord history hurts, but the Itch one is the bigger disaster, hope I manage to retreive it :( - got all my games, access to revenue, etc. there. The fact that the hacked account is still active after *months* is baffling :-X
Months and multiple support requests with Discord, mind you. They're useless.
My most recent request to them that hasn't been fed to the bots yet is to delete my old account, as all attempts to recover it so far have failed. I fully expect them to decline on the basis that I don't have access to it or the email currently associated with it (duh), but we will see.
@Honza have you reported somewhere to itch Io support?
Yes, with several updates (they've since deleted two of my games, replaced the other two with malware and changed my name to Kastchey's). Nothing but one automated response so far.
Seems I got my Discord back though - shocked by that after Kastchey's experience, they responded and let me reset my password
@Honza try reaching out directly to Leafo (https://leafo.itch.io/) or some other itch dev to see if it works faster.
Thanks, DMd him on Twitter about an hour or two ago, no response so far. Has anyone communicated with him before? He might not be getting messages from people he doesn't follow.
I had mailed him when I posted and he mailed me back with "Thanks for notifying me, we'll follow up with the account owner.", so hopefully he will get in touch with you.
You're a star, eri0o. They did reply and Honza got his account back.
Quote from: eri0o on Sat 27/07/2024 19:56:10I had mailed him when I posted and he mailed me back with "Thanks for notifying me, we'll follow up with the account owner.", so hopefully he will get in touch with you.
Awesome, thank you so much! I got the account back.