1  |   Order by index

Dec 3, 2000, 12:12am

Good aftternoon everyone,

I had a tourist enter my world, saying he had a new bot for download. Well I
think I have figured out what oeri us up to. His "bot" is looking for
citzenship passwords. Looking at my world logs, both oeri and his so called
bot used the same IP address and no citizen number (0).

Joeman had stated this in his message:


----- Original Message -----
From: "joeman" <redjuggler at yahoo.com>
Newsgroups: worldbuilders
Sent: Saturday, December 02, 2000 8:45 AM
Subject: Re: Bots without bot rights


Ok, i started the bot to see what it would do. It gave me an error message
and then i went back to the chat window, and the bot had typed Joeman:
ERROR INITALIZING .. Code: ERRb3f8975115

this is weird....

Thank you
Joeman

While oeri was in my world, he kept asking us to look in our AW.ini file and
give him the passcode listed under our citzen name. I think if Joeman was
his AW ini file, I would bet that b3f8975115 would be the passcode listed
under his citizen name.

So this so called "bot" is nothig more that a script he wrote that will try
to steal once's identity (by getting there password and plugging it into an
aw.ini file)

I have included a a chat log from when oeri enter my world last night.

Be careful out there....do not trust people asking for passwords.

Arley Canterbury
(Doctor Midi)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~~~

"oeri": anyone wanna try my new bot ?
Doctor Midi: hello oeri
"oeri": Hello Doc, wanna try my bot?
"oeri": it has world hosting features - auto eject, onclick things
"oeri": trivia
"oeri": scrambler
"oeri": random sounds and midis
dreamer2: hiya oeri :)
"oeri": how bout u dreamer?
"oeri": wanna give it a whirl?
dreamer2: sorry -----still scared of build bot LOL
"oeri": you should just try it though ;]
"oeri": it's not a buildbot dreamer
"oeri": http://www.microconnect.net/~achobani/oeribot.zip
<~~ download oeribot - first release - ver 1.0
dreamer2: coolness :)
dreamer2: oeribot :)
"oeri": ;]
"oeri": try it !
dreamer2: you build it yourself from scratch?
"oeri": yeah with visual basic and winsock
dreamer2: really - was it hard?
"oeri": some parts of it
dreamer2: geeeeeeez - I bet
"oeri": once you got it connected to the AW server it was pretty easy from
there
"oeri": it's a tourist bot, so you dont need to be a cit to use it
dreamer2: is it easier than the other bots?
"oeri": it logs in as a tourist
"oeri": i'd say it is
dreamer2: really ? lol
dreamer2: it's a Dj too?
"oeri": yeah, it's user friendly and customizable
"oeri": yeah, sounds and midis dj
dreamer2: but not a builder?
"oeri": you can even have a separate guy come in and move his hands around
"oeri": act like he's rappin
"oeri": no i didnt make a builder her
"oeri": *yet
"oeri": *builder yet
dreamer2: ahhhhh ------well that is cool
dreamer2: you made it for tourists to use too?
"oeri": Some features dont work for tourists
"oeri": Like 100% of the world hosting, trivia messes up sometimes
with the quotes on the tourist names....
dreamer2: really?? so you need to be a citizen to use all features
"oeri": All features are available to a cit
dreamer2: ahhhhhh - coolness :) I have used Xelagot ----
but never did learn to build with her
"oeri": give it a try.... im open for constructive criticism
dreamer2: do many use oeribot?
"oeri": only a few people have downloaded it so far --
it's hard for people to trust tourists they dont know
dreamer2: and is it compatible with 3.0?
"oeri": you dont need to be logged in to AW at all
"oeri": it'
"oeri": it's like its own separate client
dreamer2: ahhhhhh - is this the first one you've built?
"oeri": yep
dreamer2: cool
dreamer2: why did you want to?
"oeri": to build one? for the challenge
dreamer2: really? well congrats then
"oeri": http://www.microconnect.net/~achobani/oeribot.zip give it a look
"oeri": will ya?
dreamer2: to tell the truth -----ask Doc ---I am dangerous with bots lol
"oeri": lol it's really easy to use
dreamer2: he has teased me - big time
"oeri": my mother could use it !
"oeri": doc said no already
dreamer2: hahaha - he did
"oeri": it's not a building bot, it won't screw up your world...
"oeri": what's there to be ascared of /
"oeri": ?
dreamer2: well ----I don't have bot rights here - so wouldn't make a diff
"oeri": like i said
"oeri": it's a tourist bot
"oeri": you can set it to be a [bot] or a "bot"
Doctor Midi: I will download to a computer removed from my network,
and give it a whirl
"oeri": ok doc.
"oeri": dreamer?
dreamer2: don't think Doc allows bots here - but haven't asked him either
lol
"oeri": use it in a diff world
"oeri": hm
"oeri": wait a sec
"oeri": it defaults to the [bot] setting .. you need to have a stored
password
"oeri": got that doc?
"oeri": Hello.
Doctor Midi: yes
Doctor Midi: I thought you said this was a tourist bot
"oeri": then go to Login > citizen again, and it should say
****************** (being your stored password)
"oeri": it's both, but defaults to citizen bot
"oeri": then u can change it
Doctor Midi: well, I have a stored cit password
"oeri": it is stored?
Doctor Midi: of course
"oeri": try running it again
"oeri": the bot
Doctor Midi: not until I debug and look at the code......
you said you wrote in Visual basic correct
"oeri": yes, correct, and i compressed the EXE .. so debugging might be
tricky
"jovi": oeribot 1.0 entered DrMidi
"oeri": rename oeribot
"oeri": geez im lagged
"oeri": kill
dreamer2: (to Doctor Midi) good god ----what is wrong with him?
"oeri": done yet ?
Doctor Midi: so you are an AOL user I see from your IP addy
"oeri": correct.
dreamer2: (to Doctor Midi) oeri poofed
Doctor Midi: ejected his bot..it got him as well
dreamer2: OOOOOOO lol
dreamer2: what's up with him?
Doctor Midi: do not undertand it.this world has no bot rights.but somehow
his bot got in here
dreamer2: that is what I thought
dreamer2: hmmmm - kind of dangerous -- to be able to enter without bot
rights
Doctor Midi: only three of us have bot rights
Doctor Midi: you, me and Taz
dreamer2: told him - I didn't have them lol
dreamer2: well - I don't like the fact - he can bring one in - without
permission
"oeri": Why was i kicked earlier ?
"Danae of Llyr": hello
"oeri": hi.
dreamer2: hi there
"oeri": dreamer who kicked me
"oeri": u or dr
dreamer2: bot was kicked -------guess it was connected to you
dreamer2: so kicked both
dreamer2: no bot world here
"oeri": oh sorry
"oeri": did my bot work for you guys?
dreamer2: didn't try it myself ------was working on av's
"oeri": did you ever get an extended err code -- like ERRfdjdfjdslkfd ?
"oeri": or just ERR
"oeri": im interested to see what kind of errors there were
dreamer2: sorry Doc is in programs ---- doesn't see the chat
"oeri": ok
"oeri": dreamer give it a try
dreamer2: hahaha - really oeri - me and bots don't mix :)
"oeri": aw geez what have you got to lose?
dreamer2: well ------I find bots disturbing lol
"oeri": splurge and try one
"oeri": TrY tHe BoT
"oeri": or do you want me to configure it for you
dreamer2: no thank you oeri -----believe me -----not into bots
"oeri": !
dreamer2: think they are cool -----but not into them myself
"oeri": can i have your passcode to try my bot out on ?
"oeri": (not password, passcode)
dreamer2: sorry ---- lol
"oeri": its a buncha letters in your aworld.ini
"oeri": under [citizen]
"oeri": it says
"oeri": pass=dfslkjfdskjfdsjkdfsakjfdsa;ljfdsak;jldfas;jkdafsj;lfdsa
dreamer2: well aworld.ini - is my citizen id too
"oeri": and 'pass' is the passcode
Doctor Midi: that is an encypted version of your password.you give that,
he has your citzenship
Doctor Midi: I think tis guy is trying to steal citizenships
dreamer2: sounds like giving away my citizen id - dude ------and you should
NEVER ask that
"oeri": can i get it ? it's just used for bots
Doctor Midi: I just sent a letter to aw
"oeri": no not a cit id
"oeri": it's like a priv pass, but less than that
"oeri": only used for bots
dreamer2: in fact - think it could actually cause problems for you - if you
ask anyone that
"oeri": nah the bunch of letters is harmless
dreamer2: well ----tis not cool - to ask anyone for world .ini --anything
"oeri": i dont want the ini
dreamer2: how old are you oeri??
"oeri": 19.
dreamer2: ahhhhhh
dreamer2: you are not a citizen in aw?
"oeri": used to be
"oeri": rain splash
"oeri": was my old name
"oeri": expired a week ago
dreamer2: ahhhhh ic
"oeri": actually i had rain splash, rain0, and rain1
"oeri": 3 names
dreamer2: did you own a world?
"oeri": yes.
"oeri": still do
"oeri": cant maintain it w/o cit
dreamer2: why aren't you re-upping citizenship?
"oeri": im pretty much sick of AW
dreamer2: why is that?
"oeri": ive been here day after day since version 2.0
Doctor Midi: that is crap, the free citizenships you get with
your world EXPIRE when your world does
"oeri": and i just got a bot done and i cant even use it well
dreamer2: goodness ------sounds like you must re-up citizenship
to have full rights again
"oeri": dont feel like it
"oeri": just need the passcode
"oeri": no one will give me theirs
"oeri": they dont understand it's harmless to give out
dreamer2: ahhhhhhh -----well believe me ----no one in their
right minds would give it out
"oeri": Geez it's a code used for bots
"oeri": whoopie
dreamer2: well you must understand the right to say no thanks
"oeri": yeah yeah
"oeri": oh well i quit i cant get anywhere with people
"oeri": bye
dreamer2: cyas :)
dreamer2: (to Doctor Midi) was that something or what LOL
dreamer2: a very persistant 19 yr old - lol
Doctor Midi: he wanted to steal passwords
dreamer2: yes - sounded like it to me too
Doctor Midi: SO, my guess is, if I would have downloaded on system, it would
have given out the info from my aw.ini file
dreamer2: but he did give me more info about himself -------his old cit
names
Doctor Midi: then this kid could plug that info into any aw ini file.and
then become ME
dreamer2: yesssss - gheesh
Doctor Midi: who is to say that is correct info
dreamer2: true lol
dreamer2: but a 19 that smart - is kind of scary
Doctor Midi: I BCC you on the letter I sent to AW
dreamer2: yes read it
dreamer2: goodness ------if he is so disenchanted with aw --------have to
wonder why he comes back
Doctor Midi: no clue
Doctor Midi: anyway.I have to go
Doctor Midi: I am tired
dreamer2: yes -late for you
dreamer2: niters Arley - sweet dreams

Dec 3, 2000, 12:39am

....Especially do not trust tourists with a bot. As far as I know, a bot cannot log in as a tourist
(tourists dont have priv passes) (unless he has found some crack). Besides why would a tourist have
a bot with all these world rights features and stuff when he can't even access world rights
anywhere? If it seems wierd, dont trust it.
_________________________
John Viper
http://www.jtsoft.net
"Microsoft C# - so 'Sharp', it'll poke your ass over to Java so fast you wont know what crashed!" -
Aaron Bockover - www.crevasoft.com

[View Quote]

Dec 3, 2000, 1:34am

This person is full of crud. This bot is a sham! Dont download it, if you
did, change your passwords!

Thanx
Joeman


[View Quote]

Dec 3, 2000, 2:23am

<!doctype html public "-//w3c//dtd html 4.0 transitional//en">
<html>
yes this guy was going everywhere and a tourist that makes a bot..well
you shouldnt trust him in the first place and also..hows he gonna test
it? it would probably be so buggy if it were a bot it wouldnt be worth
the time
[View Quote]

Dec 3, 2000, 2:29am

Well, from all that I've heard, this is what is trying to be accomplished:
1) The "bot" is downloaded and run.
2) It opens your aworld.ini file according to a registry entry that has your AW directory in it.
3) The "bot" tries to find the AW window and then outputs a string with your encrypted password in it (this only works if you store your password).


If you take this password and use it with the proper citizen name, it's just like having someone's real account password.

PS - I've tried this out a couple of times and it only seems to work properly when in Alphaworld, not any other worlds.

-Agent1


[View Quote]

Dec 3, 2000, 11:01am

Obviously the kid is desperate for a password. Then when you email him with the encrypted password in the chat saying it won't work, you give him your
AW password. As for his bot that entered the world, did it actually have brackets around it's name? Or was it just another tourist-his partner? This is
probably the single most creative scam I've ever seen.

[View Quote] > Well, from all that I've heard, this is what is trying to be accomplished:
> 1) The "bot" is downloaded and run.
> 2) It opens your aworld.ini file according to a registry entry that has your AW directory in it.
> 3) The "bot" tries to find the AW window and then outputs a string with your encrypted password in it (this only works if you store your password).
>
> If you take this password and use it with the proper citizen name, it's just like having someone's real account password.
>
> PS - I've tried this out a couple of times and it only seems to work properly when in Alphaworld, not any other worlds.
>
> -Agent1
>
[View Quote]

Dec 3, 2000, 5:46pm

Dies ist eine mehrteilige Nachricht im MIME-Format.
--------------681E8DE0123B44A8E3F3AEA0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit

There is not really a [bot] - the program seems to be a "remote control"
for the browser.
It looks for the window containing "Alphaworld", taks the crypted
password ("pass=") from aworld.ini and has several dialog handling
functions built-in although it doesn't contain any dialog.
Next what could have happened after starting it in Alphaworld (this part
is guessed) is that the crypted password is sent through the chat line.
It was just offered as a bot, hoping, that someone would start it.
--------------681E8DE0123B44A8E3F3AEA0
Content-Type: text/x-vcard; charset=us-ascii;
name="vha.vcf"
Content-Transfer-Encoding: 7bit
Content-Description: Visitenkarte für Volker Hatzenberger
Content-Disposition: attachment;
filename="vha.vcf"

begin:vcard
n:Hatzenberger;Volker
x-mozilla-html:FALSE
url:oct31.de
adr:;;Bornheimer Strasse 15;Bonn;;53111;Germany
version:2.1
email;internet:vha at oct31.de
end:vcard

--------------681E8DE0123B44A8E3F3AEA0--

Dec 3, 2000, 7:01pm

Dies ist eine mehrteilige Nachricht im MIME-Format.
--------------35C091A422E0CC77F63F8368
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit

I wrote

> It looks for the window containing "Alphaworld" ...

This was the version I analyzed, but off course it can have been
modified for any world - so be careful!
--------------35C091A422E0CC77F63F8368
Content-Type: text/x-vcard; charset=us-ascii;
name="vha.vcf"
Content-Transfer-Encoding: 7bit
Content-Description: Visitenkarte für Volker Hatzenberger
Content-Disposition: attachment;
filename="vha.vcf"

begin:vcard
n:Hatzenberger;Volker
x-mozilla-html:FALSE
url:oct31.de
adr:;;Bornheimer Strasse 15;Bonn;;53111;Germany
version:2.1
email;internet:vha at oct31.de
end:vcard

--------------35C091A422E0CC77F63F8368--

1  |   Order by index