My theory on how this "remote hack" works if it is real

basilmarket.com forums : General Maple Story | 11 posts archived

thread starter CTBlack Jul 17 2009 + PM | QUOTE | PERMALINK | REPORT

Read a lot of posts from people that gotten "hacked" by this latest hack. The key thing in most of them is involes CCing. When you change channels, you are actually connecting to another server on Nexon system, this is similiar to the login logic but AFTER all the login procedure is verified and you then select a channel to connect into. There might be a possible exploit the hackers uses as the new channel server is expecting the victim to connect with (probably) minimum of identication info needed. So I am guessing this hack does not need to know the victim's IP, but the victim must do a CC themself to allow this hack to work. I think it is fairly simple how this hack works now! They (the hackers) just need to capture their own CCing packets and look at the info in it, then replace it (probably just the IGN) with the victim's and spam the new channel server(s) with it until the victim do a CC. To be safe, "DO NOT CC" when you suspect someone is targeting you for the hack, either logoff or just ignore them. If Nexon is trying to fix this expoit, they would need to add extra authenication info into the CCing logic to makesure the new channel server is accepting the actual user and not someone that is faking it. This probably would invole both server code and client code changes. I posted this on SW forum, but those moderator locked for some unknow reason.

MomoMuffin 07/17/09 + PM | QUOTE | PERMALINK | REPORT

They locked it because there's no valid proof...

Wrath 07/17/09 + PM | QUOTE | PERMALINK | REPORT

You do realize, half of basil won't understand what you are saying, right? But props to you on giving details on how it could be real.

Recreated 07/17/09 + PM | QUOTE | PERMALINK | REPORT

This is only about the 800th post about how this hack works. Whether you believe it or not, there's no reason to post all these extra threads about it. Stick to the guidelines of staying safe and forgot about it being real or not for a second, and just wait til one it proven. No reason making up your own theories.

noobstink 07/17/09 + PM | QUOTE | PERMALINK | REPORT

this is interesting cuz i have had alot of lag/dcing when i cc....

CTBlack 07/17/09 + PM | QUOTE | PERMALINK | REPORT

MomoMuffin said: "They locked it because there's no valid proof..." There is more than my thread that talk about this hack on there, but those are not locked. Of course there isn't any valid proof, as there are only a hand full of hackers using this and tonnes of Maplers playing, not everyone will be using a video capture program on their playing session. Anyways, I am not saying if it was real or fake, I am just looking at it from a technical stand point on how it can possible be done and on how to avoid it.

Weeroberto 07/17/09 + PM | QUOTE | PERMALINK | REPORT

noobstink said: "this is interesting cuz i have had alot of lag/dcing when i cc...." That's the database saving all of your info to prevent rollbacks. The more you CC, relog or don't play Maple at all, the less chance of being rollbacked

Chanor 07/17/09 + PM | QUOTE | PERMALINK | REPORT

So when someone tells me "Cc17 FM entrance", cc17 fm will be their custom server?

Sebastianrod 07/17/09 + PM | QUOTE | PERMALINK | REPORT

The real "hack" is in how hackers can hack, break the rules, and make money off legit players. ya?

mashavsapir 07/17/09 + PM | QUOTE | PERMALINK | REPORT

REMOTE HACK DOESNT WORK. Hacks which work: 1. Hacks which involve the hacker and maplestory only (fly-hack, vac hack, godmode etc)- because nexon receives data from the hacker 2. Hacks which involve the hacker and the guy who gets hacked not through maplestory- some1 hacks your comp, gets data about everything you are doing including when you type your account details and then hacks you Hacks which doesn't work- Hacks which involve the hacker, and the guy who gets hacked through maplestory- because the guy who gets hacked doesn't get any information from other users. The information passes through Maplestory's servers which obviously have serious anti-hack defenses. If some1 can hack other people in this way (which is impossible)- it means that he can break through the servers so he can make everything he wants to do- including making himself a GM, granting himself endless meso and impossible items (9001 att wg or w/e)- just like in pizza slices. This has rarely happened and nexon (or wizet) fixed it in a short time because it can actually damage the company itself. Anyway, right now- IT ISN'T HAPPENING.

CTBlack Jul 17 2009 + PM | QUOTE | PERMALINK | REPORT

Chanor said: "So when someone tells me "Cc17 FM entrance", cc17 fm will be their custom server?" No, channel 17 will still be Nexon's server, but because of the lack of authenication (from my guess) need for changing channels, the hacker can fake it as you changing channel into 17. To the poster above me: mashavsapir said: " Hacks which doesn't work- Hacks which involve the hacker, and the guy who gets hacked through maplestory- because the guy who gets hacked doesn't get any information from other users. The information passes through Maplestory's servers which obviously have serious anti-hack defenses. If some1 can hack other people in this way (which is impossible)- it means that he can break through the servers so he can make everything he wants to do- including making himself a GM, granting himself endless meso and impossible items (9001 att wg or w/e)- just like in pizza slices. This has rarely happened and nexon (or wizet) fixed it in a short time because it can actually damage the company itself. Anyway, right now- IT ISN'T HAPPENING." It is ture from a fresh login that if your info is not know then the hacker cannot get access to your account, but in this case it is "AFTER" the login verification has taken place and security is at their lightest where a possible security hole was found by the hacker to take advantage of. The hacker don't need to break throght the server as they are already logged in, they just need you to do a CC and vola they are on your character.