Pink Poogle Toy Forum

The battledome chat board at Neo and people at the IDB forums are saying there's a bad security problem right now and people are able to use cookie grabbers in neomail. I'm not positive this is true (haven't heard much yet, as night-time at Neo is rather slow), but I'd recommend changing your preferences so only neofriends can contact you, just to be safe. Apparently just reading the neomail is enough to get grabbed. And anyone who has more details, post here!

Edit: I found a post from someone who got frozen:



And apparently others are receiving neomails with lines of code in them, but no one would post the code, so I dunno.

So... not sure whether this is all hysteria due to that one guy getting frozen + the code neomails, or a legitimate threat.

Well, it would be interesting to see how they would get javascript running in a neomail and actually getting the cookie past all of Neopet's firewalls to the sender.

Yeah, I'm thinking it's probably typical neoboard hysteria. One guy gets frozen, he happened to have received a neomail with some gibberish in it, and that equals OMGCOOKIEGRABBER! We'll see.

Just choose to recieve only Plain Text Neomail, you won't have any problems if it is true.

I doubt it's true.

But if it was, it's no big deal.. I don't bother with neomails much anyway.

Err... I just tried to do this, but I couldn't seem to figure out where it was. However, aren't all neomails plain text? At least the ones I've gotten are (even the scam website one I got yesterday)... Unless my settings are already on plain text...

Hcnage to plain text under

Help => Site Preferences

Check the 8th box down

Thanks! I was looking under neomail and user preferences on the neoboards main page...

If the account was accessed thru a messenger program, it sounds like somebody picked up a malicious payload while using an IM. All the IM programs are experiencing attacks lately, including AIM, MSN Messenger, and Yahoo...

I think that seems more likely.

That or other sites that you might think should be safe, I was image searching for a friend 4 days ago and yep, got cookie grabbed. Miraculously I didn't lose anything permanent. They did get most of my email programs that are associated with 3 of my websites, got into my gmail and hotmail accounts. Also got into my yahoo account. Who ever it was is very persisitant since I keep getting reset your password links in my hotmail.

Sounds like paranoia to me. I was messing with my user look up last night and a bit of the code was off (a missing } bracket) and the error page told me about the security features to prevent that very kind of thing.

Still, if you're worried, disable neomails from non-friends. I rarely ever get them so I don't even worry about it.

I wouldn't really believe this considering neopets has a large ammount of firewalls and protection but you would also need to use special codes and as far as I know they won't even work on neopets.

Better safe than sorry, right?

I'd rather have plain text and avoid opening mail from strangers than lose my account.

Hehe, clearly you weren't here for the last cookie-grabber fiasco where people were putting them on userlookups and in shops and getting into all kinds of people's accounts.

I agree that this time it sounds like paranoia, however. I haven't heard anything new since my original post.