Protecting against Neopets Cookie Grabber (CGer) Guide

Submitted by saudor on Sun, 17/05/2009 - 8:13am

Welcome to the in-depth guide to avoiding cookie grabbers. This page has been generated from background information of how it works, reverse engineering of various neo CGs and 1st hand research. (plus losing 800k + trades along the way, but hey, it's priceless!!)

[SHORT VERSION]

For the in-depth version, please see http://www.neopets.com/~punchback_bob
Remember that Internet Explorer is vulnerable to on-site cookie grabbers (on neopets)
Opera users should use the userjs file called BlockScript. It's sorta complicated but it's here

Get firefox here: http://www.mozilla.com/en-US/firefox/firefox.html?from=getfirefox

Recommended Firefox Add-ons
"NOSCRIPT" This helps block malicious scripts from running. 
Don't forget to whitelist neopets.com and any other sites that you trust (like hotmail.com) (see attachment)

FLASHBLOCK This allows you to selectively load adobe flash player objects. If you need flash to play games, simply click the arrow to enable that object. This is allowed since most browsers don't even come with flash. Do not whitelist neopets as one type of CG uses a redirection of http://images.neopets.com/flash_version_check_v1.swf? to steal cookies.

KEYSCRAMBLER ADD-ON. For protection against key loggers (programs that record everything you type) It's no use changing your password if every key you press is being sent to the "hacker"

ADBLOCK. It allows you to block ads... and other things (like CGs) See attachment for more info

REQUESTPOLICY. RequestPolicy is an extension that improves the privacy and security of your browsing by giving you control over when cross-site requests are allowed by webpages you visit.

 

Think you got CG'd?

If you THINK you were CG'd, the first you should do is LOG OUT. Why? Because this invalidates the cookie that the "idiot" took. Try it yourself. Log into neo in another browser. You will see that you can browse neopets for a bit on both web browsers. Now click the log out button of one browser and see what happens. Contrary to popular belief, clearing cookies will do nothing for you. Just log out, get the keyscrambler add-on (if you can get it), and then log back in and THEN change your password

 

AttachmentSize
Image icon whitelist-neopets.gif74.73 KB
Image icon ablock-instructions.gif43.8 KB
Forums: 
Neopets Misc
  • 230759 reads

oh yeah, and another question, is safari vulnerable to being cged, or is it safe?
------------------------------------------------------------------------------------------------------------- Go check out my battle, training, magic, and cures shop! http://www.neopets.com/browseshop.phtml?owner=hhh565
hhh565 | Sat, 04/07/2009 - 9:20am |

Premium will not save you from CGers and all browsers are vulnerable. It's just internet explorer is worse since they make use of the + symbol in URLs
----------------------------- [color=purple]Protect your account[/color] http://www.neopets.com/~punchback_bob CG information & more
saudor | Sat, 04/07/2009 - 10:26am |

ok, thanks:) :)
------------------------------------------------------------------------------------------------------------- Go check out my battle, training, magic, and cures shop! http://www.neopets.com/browseshop.phtml?owner=hhh565
hhh565 | Sat, 04/07/2009 - 11:10am |

Pm Me If U know about hacking programs plz its urgent
Slightlyking | Sun, 05/07/2009 - 2:44pm |

Dmitri, you are a DOLL! Thank you so much for pointing out all of the available add ons to help protect us. I had one, but not the others. *Hugs you till you turn funny colors*
Saundratoo | Sun, 05/07/2009 - 3:12pm |

Has anyone ever had any kind of issue with NoScript when trying to submit to the Neopian Times? I have neopets.com whitelisted but I keep getting an error where it says Noscript detected a filtering error and then I am unable to submit my story =/ I even tried allowing the whole page and was still unable to submit maybe its just a glitch I'm just nervous because I clicked on a fake tarla board recently didn't click the link though
Spare a CC vote please? :* http://www.neopets.com/games/caption_browse.phtml
Pip | Sun, 05/07/2009 - 5:15pm |

try using another browser for that. and guys, update your cookie jars. two new CGs added. I blocked the entire 110mb.com domain (it's a free hosting site) since Cgers are using it like crazy. No one needs to go free hosting anyways lol
----------------------------- [color=purple]Protect your account[/color] http://www.neopets.com/~punchback_bob CG information & more
saudor | Sun, 05/07/2009 - 9:02pm |

main page updated with new information
----------------------------- [color=purple]Protect your account[/color] http://www.neopets.com/~punchback_bob CG information & more
saudor | Mon, 06/07/2009 - 12:34am |

Thanks.. all updated :)
perpette | Mon, 06/07/2009 - 7:59am |

So typically we've seen CGers putting code on their userlookups and shops. Someone just said there is a gallery with CGing code in it as well. But I was thinking.. Wouldnt it make sense that any place you can enter code is at risk for CGers? That means they can put the code on userlookups, shops, gallery , pet lookups and petpages?
[hr][size=11]Training, Luck & Medicine! ^_^ www.neopets.com/browseshop.phtml?owner=_jaspeh_&misc#c [/size]
_jaspeh_ | Mon, 06/07/2009 - 10:49am |

Pages