Habbo staff acount hacked!

[Michael]

You may have seen the decrease in rares such as typewriters and purple dino eggs on the marketplace, with rumours aflow of an old staff account being hacked, people just did not want to believe it. However it looks like things have taken a turn for the worst, as the rumour was indeed reality.

http://oi58.tinypic.com/68akq9.jpg

[Shorty]

You say ex-staff, yet powertoo says staff account? Which one is it, as I fail to see why an old staff account would still have staff privileges in the first place?

[sexpot]

Old staff accounts can't be hacked, afaik they're perm banned after they quit

[Michael]

You say ex-staff, yet powertoo says staff account? Which one is it, as I fail to see why an old staff account would still have staff privileges in the first place?

Oh oops, must've read it on the group forum.

[Phil]

Is RadMatter staff or was she just a victim?

[Absently]

anyone know who the staff member was?

[Mr-Trainor]

Habbo demonstrating its lack of security once again.

[Storking]

so it was a current staff member, not an old account who still had privileges (which seemed highly unlikely)

what steps have been taken now? are they tracing stolen items that were sold on? besides that, I would've thought staff accounts had extra layers of security to prevent hacking.

[Michael]

This was the original starting post, as you can see from powertoo's reply she says the rumour is correct, and the rumour is about an ex-staff account.

http://oi60.tinypic.com/2z5kbc6.jpg

[Red]

Can't they trace the items? :S
awful tat they took peoples furniture instead of just stuff that was on the acc

[Mr-Trainor]

Wait so does that mean a lot of items purchased via the marketplace may have been stolen items which could be removed from the possession of the buyer? For example, lets say a typewriter I bought.. if it was picked up using this staff account, does that mean 1) I could have it taken from me, or 2) I could be banned?

[Storking]

Well if she's confirming that rumour.. wow. What logic do they have to leave an ex staff account with privileges like that? A 6 month old chimpanzee has more common sense and could recognise the issue there.

[Kardan]

But surely an ex-staff account would be both banned and have its permissions removed, so surely it's a regular staff member that was hacked?

[Storking]

Wait so does that mean a lot of items purchased via the marketplace may have been stolen items which could be removed from the possession of the buyer? For example, lets say a typewriter I bought.. if it was picked up using this staff account, does that mean 1) I could have it taken from me, or 2) I could be banned?

I highly doubt they have the time or people to trace the rares sold on via MP and possibly traded on after that, and they would have no grounds to ban you over buying an item innocently from the marketplace.

[Mr-Trainor]

But surely an ex-staff account would be both banned and have its permissions removed, so surely it's a regular staff member that was hacked?
You'd assume that, and yes that'd definitely be logical. But this is Habbo/Sulake we're talking about :P.

It doesn't seem clear whether it's a staff account or an ex-staff account though.

- - - Updated - - -


I highly doubt they have the time or people to trace the rares sold on via MP and possibly traded on after that, and they would have no grounds to ban you over buying an item innocently from the marketplace.
But it's likely they could be removed from my possession, so I'd be at a loss for the credits I paid for them.

Didn't that happen with the whole Silver Trophy thing? Or were people reimbursed on request?

[lRhyss]

Wait, I thought staff accounts with those types of privileges we're only accesible if they were logged in while in the office... Or is this a rumour?

[Mr-Trainor]

Wait, I thought staff accounts with those types of privileges we're only accesible if they were logged in while in the office... Or is this a rumour?
It seems as though that's not the case.

[lRhyss]

It seems as though that's not the case.
Well that's stupid really isn't it...

[Mr-Trainor]

Well that's stupid really isn't it...
I guess it depends on which (ex) staff member it was and whether their role enabled them to work from home or not, but aside from that I agree and it would be a sensible safety measure.

[Kardan]

Well that's stupid really isn't it...

Not really - Habbo have had emergencies in the past when staff need to log in ASAP, so it would be quite silly to have to travel to the office to do that.

[lRhyss]

Not really - Habbo have had emergencies in the past when staff need to log in ASAP, so it would be quite silly to have to travel to the office to do that.

Would there be a way to give them a special laptop that's connected to some sort of server that only allows them to log in from that laptop?

or is that impossible haha

[Kyle]

It must be a very old or high powered account because going by cupcaek, newer and lesser staff members haven't been given permissions to pick up others' items in quite some time.

Anybody got any info as to what staff account it was or which hotel they were from?

[xxMATTGxx]

Not really - Habbo have had emergencies in the past when staff need to log in ASAP, so it would be quite silly to have to travel to the office to do that.


Would there be a way to give them a special laptop that's connected to some sort of server that only allows them to log in from that laptop?

or is that impossible haha

Some sort of VPN (I forgot if that's the correct term) before they could connect via their account? Not sure.

[Kardan]

Would there be a way to give them a special laptop that's connected to some sort of server that only allows them to log in from that laptop?

or is that impossible haha

As far as I'm aware, staff already need some sort of security certificate to be able to log in, but don't quote me on that.

[Mr-Trainor]

Some sort of VPN (I forgot if that's the correct term) before they could connect via their account? Not sure.
Yeah I was going to suggest the same thing, similar to how I connect to my university's network from home.. surely that'd work?

Either way, I don't think we should be jumping to conclusions anyway. We don't know who was hacked, whether they were an ex or current staff member, or how they were hacked :P.

[lRhyss]

Some sort of VPN (I forgot if that's the correct term) before they could connect via their account? Not sure.


Yeah I was going to suggest the same thing, similar to how I connect to my university's network from home.. surely that'd work?

Either way, I don't think we should be jumping to conclusions anyway. We don't know who was hacked, whether they were an ex or current staff member, or how they were hacked :P.

Thats what I was meaning D: haha sorry, I forgot the term D:

But yeh, there should be better security

[Kyle]

bring fingerprint scanning in

[Yawn]

thats rly exciting and v smart plan on the hackers part

[GrandpaJoe63]

As far as I'm aware, staff already need some sort of security certificate to be able to log in, but don't quote me on that.

This is true. I've seen expired security certificates leaked in the past.

[Zak]

Habbo demonstrating its lack of security once again.

You thought they'd implement some sort of internal security measure so that staff are only able to login on a staff account in the office or something. I can't believe how stupid they are... and will they do anything about it? No.

The Habbo(s) involved have already sold on the furni and traded the gbs for irl money I bet.

EDIT: I'm amazed they can't track the culprits down?

[xxMATTGxx]

I thought they could trace the furni and that's how they banned people for that gold bar bug? Unless I am mistaken. I wonder how many people this has affected.

[Matt]

I thought they could trace the furni and that's how they banned people for that gold bar bug? Unless I am mistaken. I wonder how many people this has affected.
GoldenMerc; was the one that got away ^^^^

--
They spelt 'market' wrong in the forum post too!

I just assumed the decrease in rares was because of casinos closing :o

[Mr-Trainor]

@GoldenMerc (http://www.habboxforum.com/member.php?u=26925); was the one that got away ^^^^

--
They spelt 'market' wrong in the forum post too!

I just assumed the decrease in rares was because of casinos closing :o
That would have still had an impact too, but certain rares started dropping at a considerably fasert rate, e.g. Typewriter and dragon egg, which was most likely because of this.

[Matt]

hmm ok,

So would habbo take legal action against these 'hackers' or is that not likely to happen lol (assuming they'd be able to track them)

[Hannah]

I honestly doubt that Sulake will take much action for what has happened, blame partially falls on themselves for not having increased account security for particular accounts with privileges.

[Zak]

I thought they could trace the furni and that's how they banned people for that gold bar bug? Unless I am mistaken. I wonder how many people this has affected.

You would have thought so. I know it's not the same game but Runescape track down all the bug abusers and ban them quite successfully as far as I know. Sulake probably don't have a clue what they're doing.. hence a stupid security breach that shouldn't have happened.


I honestly doubt that Sulake will take much action for what has happened, blame partially falls on themselves for not having increased account security for particular accounts with privileges.

Agreed. More security should have been in place.

I'm guessing this is how L1C's thrones and typo were stolen. Habbo just don't care though, that's what annoys me.

[Hannah]

Agreed. More security should have been in place.

I'm guessing this is how L1C's thrones and typo were stolen. Habbo just don't care though, that's what annoys me.

Habbo only cares when it comes to poor publicity or lack of income. Poor publicity works towards lowering income.
It's nothing like it used to be.

[Kardan]

I thought they could trace the furni and that's how they banned people for that gold bar bug? Unless I am mistaken. I wonder how many people this has affected.

Habbo definitely can trace furni, each piece of furniture has a unique ID. Not sure how complicated it gets when the marketplace gets involved though.

[GoldenMerc]

Habbo definitely can trace furni, each piece of furniture has a unique ID. Not sure how complicated it gets when the marketplace gets involved though.

True but when 10,000 furni has gone, think of the admin time that needs to be into it.
I imagine most are being sold on a site thats black and has a market, but who knows

[Hannah]

By this point, tracing the furni would just cause an uproar for those who bought it innocently.

The best way Habbo can deal with it is to replace the furni taken and actually start improving their security features - anything else will most likely cause upset and anger.

[Absently]

You would have thought so. I know it's not the same game but Runescape track down all the bug abusers and ban them quite successfully as far as I know. Sulake probably don't have a clue what they're doing.. hence a stupid security breach that shouldn't have happened.



Agreed. More security should have been in place.

I'm guessing this is how L1C's thrones and typo were stolen. Habbo just don't care though, that's what annoys me.i recently was only doing his maze and was wondering why all his thrones and furni was gone/misplaced. i just assumed he'd come on and taken them

[Mr-Trainor]

True but when 10,000 furni has gone, think of the admin time that needs to be into it.
I imagine most are being sold on a site thats black and has a market, but who knows
This.
Tracing every item of furniture involved and dealing with each of them would be come at a cost for Sulake. I feel sorry for those inactive account owners who had left rooms on Habbo, and now their rooms are gone thanks to this :(.

[Okeanos]

is this why missalice's rooms look so empty? the dinos in her xmas room are all gone - i just assumed she donated them to habbox comps... did she not?

[Hidden]

hate fingerprint scanners, mine never works for my laptop so i tried to delete it and it doesnt work so i just avoid it at all costs.

[Zak]

i recently was only doing his maze and was wondering why all his thrones and furni was gone/misplaced. i just assumed he'd come on and taken them

Yeah I doubt he would have come on and sold them. They've been sitting there for years and he has been inactive for quite some time.. I'm doing a replica of his room that's when I found that the thrones and typo were gone.

Though it is strange because he wasn't exactly rich in a supers/thrones/LTDs sense

[Absently]

Yeah I doubt he would have come on and sold them. They've been sitting there for years and he has been inactive for quite some time.. I'm doing a replica of his room that's when I found that the thrones and typo were gone.

Though it is strange because he wasn't exactly rich in a supers/thrones/LTDs sense
On his last login it says 9 months ago, so it could be very possible that it was him, unless he was hacked?

[Zak]

I can't imagine its been 9 months and I wouldn't have noticed but it could have been! Depends when they went missing.

At least the hackers didn't take :Jin:'s? Blank Habbo Tower Trophy :D

[Laurensh1]

Staff needs certificates for housekeeping, but not for the client as far as I know. On the client, they have powers too of which one is picking up furni in every room.
Wonder what staff account. I figured they banned all after leaving, being fired, etc which is the policy. Guess someone forgot to do the dirty work again.

[Scotland]

If i were Sulake/Elisa I'd put on a bit of a battle with the hacker(s) and try sue them, or what ever is a good punishment.
Doing so would maybe prevent other people from wanting to attempt to do this sort of thing in the future.

[MissAlice]

Having had my account stolen during the merge of 2010, due to circumstances out of my control, and now discovering furni had been picked up from some of my rooms yesterday I was going to just let it go, as I don’t play anymore, and have little or no interest in the game.

I have now slept on it, and will battle once again to get it back, and if successful this time I won’t bother to rebuild my rooms. I know of a better cause.

How long does it take to get a response from Habbo?

[Hidden]

Having had my account stolen during the merge of 2010, due to circumstances out of my control, and now discovering furni had been picked up from some of my rooms yesterday I was going to just let it go, as I don’t play anymore, and have little or no interest in the game.

I have now slept on it, and will battle once again to get it back, and if successful this time I won’t bother to rebuild my rooms. I know of a better cause.

How long does it take to get a response from Habbo?

It would depend on if staff would see your post here or if they were informed. Usually without awareness a few weeks if they were alerted of your ticket number it would take a few minutes to hours or even days depending on how busy the office is.

[MissAlice]

It would depend on if staff would see your post here or if they were informed. Usually without awareness a few weeks if they were alerted of your ticket number it would take a few minutes to hours or even days depending on how busy the office is.

Thank you, I have sent a ticket, will give it a few days before I start politely attacking them lol.

[Mr-Trainor]

Having had my account stolen during the merge of 2010, due to circumstances out of my control, and now discovering furni had been picked up from some of my rooms yesterday I was going to just let it go, as I don’t play anymore, and have little or no interest in the game.

I have now slept on it, and will battle once again to get it back, and if successful this time I won’t bother to rebuild my rooms. I know of a better cause.

How long does it take to get a response from Habbo?
Good luck with that, I hope that you're able to get through to them! I'm still in ongoing discussions (must be over a year now) with them regarding unauthorised access to my account too and I'm yet to get a straight answer from them. As for response time, my latest ticket got a response in two weeks so I'd say it'll take around that length of time :).

[passion]

Crazy how this happens time and time again. I asked a current staff member if the compromised member was an old or existing staff member. They said they can't comment which makes me think it's a current staff member. I've checked all the old staff I can think of and none of them have logged in recently. Obviously it could be an account I have never heard of, similar to the cupcaek fiasco. However, I have a feeling it is someone who is still a staff member because surely Sulake / the security team wouldn't be stupid enough to keep 'proper' powers on an old account. By proper, I mean picking up furni power, which to my knowledge is not something that all staff can do. Then again, all existing staff should have to use security certificates to log in.

All I know for sure is that this happens way too frequently and as always there's no official announcement about it. Loads of people could have had furni taken and not even realise anything has happened. One forum post by staff, tucked away in a thread created by a normal user is not adequate IMO.

Sulake and their terrible security shine again.

[Zak]

How can we demand an answer/improvements to their security because passion is right. It happens time and time again.

The sad thing is all MissAlice; has done is try and be nice to people and it happens to her and I'm sure others like her? Not on.

Then for them to ignore people requesting their help, seriously? I think we should be the customer support team for Habbo. Every time I've asked for help here its been done quickly and professionally - I know we're not on the same scale but other games do ok and they have many more members than Habbo Hotel.

[Kittysoft]

Having had my account stolen during the merge of 2010, due to circumstances out of my control, and now discovering furni had been picked up from some of my rooms yesterday I was going to just let it go, as I don’t play anymore, and have little or no interest in the game.

I have now slept on it, and will battle once again to get it back, and if successful this time I won’t bother to rebuild my rooms. I know of a better cause.

How long does it take to get a response from Habbo?

I've heard that Habbo won't look at cases older than 6 months any more, so I wouldn't count on a reply from them.

Edit: Didn't see that others had replied to you, best of luck getting it sorted.

[Sian]

I've heard that Habbo won't look at cases older than 6 months any more, so I wouldn't count on a reply from them.

Edit: Didn't see that others had replied to you, best of luck getting it sorted.

when did you hear about that, 2 months ago habbo dealt with my thing which happened like a year and a half ago and it was sorted.

but yeh, ridiculous how that happened.

[Zak]

I remember I was perm banned until 2016-18-20? (I'm not sure anyway). I left the account for 4 years, appealed it and they unbanned me.

[MissAlice]

Thank you to everyone that has replied.

I last signed in early April, and my account was intact. So I know it has happened in the last month.

It won’t be a difficult task to trace my thrones, since they were all purchased for me in August 2010 when I got my account back, and have not moved off my account, or been in circulation. They will have their own unique identity numbers and simply checking their database will give them a clear trail, although I do also appreciate they may have been traded to innocent Habbos. So I expect them to be replaced.

I appreciate the immense amount of work this will cause, but it is theft, even if it is only a game!

I have not fully checked what is missing, but what is immediately noticeable, are my thones, dinos, white pillows if that is what they are called, and possibly a red birdbath, maybe a typo or two, I need to check old screen shots of my rooms.

[GoldenMerc]

Thank you to everyone that has replied.

I last signed in early April, and my account was intact. So I know it has happened in the last month.

It won’t be a difficult task to trace my thrones, since they were all purchased for me in August 2010 when I got my account back, and have not moved off my account, or been in circulation. They will have their own unique identity numbers and simply checking their database will give them a clear trail, although I do also appreciate they may have been traded to innocent Habbos. So I expect them to be replaced.

I appreciate the immense amount of work this will cause, but it is theft, even if it is only a game!

I have not fully checked what is missing, but what is immediately noticeable, are my thones, dinos, white pillows if that is what they are called, and possibly a red birdbath, maybe a typo or two, I need to check old screen shots of my rooms.
I feel for your loss, But it isn't theft. Everything is owned by Sulake, including your user

[Zak]

I feel for your loss, But it isn't theft. Everything is owned by Sulake, including your user

Any decent company would reimburse the user if it was legitimately their fault that a users stuff was stolen. If not in furni, then equivalent in credits.

I didn't know each piece of furniture had its own unique identifier? MissAlice;

[GoldenMerc]

Any decent company would reimburse the user if it was legitimately their fault that a users stuff was stolen. If not in furni, then equivalent in credits.

I didn't know each piece of furniture had its own unique identifier? MissAlice;

This is sulake after all
Yeh every piece has a unique ID.

[Zak]

This is sulake after all
Yeh every piece has a unique ID.

:P

... hmmm I wonder how they'd go about tracking them down then? Is furniture associated with a user in some way to identify it as theirs?

If so get a database backup, trace the unique identifier then query the database now to see where it is..... then again if its been sold to an innocent that's not going to be much good. Surely they take snapshots of the database every so many hours or they could check the transaction log?

If it's purely database work and they have a decent structure it shouldn't be that difficult?

[GoldenMerc]

:P

... hmmm I wonder how they'd go about tracking them down then? Is furniture associated with a user in some way to identify it as theirs?

If so get a database backup, trace the unique identifier then query the database now to see where it is..... then again if its been sold to an innocent that's not going to be much good. Surely they take snapshots of the database every so many hours or they could check the transaction log?

If it's purely database work and they have a decent structure it shouldn't be that difficult?

I imagine it will say, potentially

[MissAlice]

:P

... hmmm I wonder how they'd go about tracking them down then? Is furniture associated with a user in some way to identify it as theirs?

If so get a database backup, trace the unique identifier then query the database now to see where it is..... then again if its been sold to an innocent that's not going to be much good. Surely they take snapshots of the database every so many hours or they could check the transaction log?

If it's purely database work and they have a decent structure it shouldn't be that difficult?

It's not difficult, just very time consuming, as I experienced last time.

GoldenMerc
It is treated as a criminal offence, as some of the furni will have been purchased using real money.

[Okeanos]

Thank you to everyone that has replied.

I last signed in early April, and my account was intact. So I know it has happened in the last month.

It won’t be a difficult task to trace my thrones, since they were all purchased for me in August 2010 when I got my account back, and have not moved off my account, or been in circulation. They will have their own unique identity numbers and simply checking their database will give them a clear trail, although I do also appreciate they may have been traded to innocent Habbos. So I expect them to be replaced.

I appreciate the immense amount of work this will cause, but it is theft, even if it is only a game!

I have not fully checked what is missing, but what is immediately noticeable, are my thones, dinos, white pillows if that is what they are called, and possibly a red birdbath, maybe a typo or two, I need to check old screen shots of my rooms.

your furni was gone over a month ago. i was looking in your xmas room over a month ago and the dinos were gone. im not sure why you think they should bend over backwards to get your stuff back, id rather they tried to get the furni back of users who still play. did you know Steph was hacked too (also not her fault), all her trophies were lost - nobody helped her... you should count yourself lucky they helped you the first time let alone a second time.

[GoldenMerc]

It's not difficult, just very time consuming, as I experienced last time.

GoldenMerc
It is treated as a criminal offence, as some of the furni will have been purchased using real money.

Doesn't matter, its likely done as a "donation / gift" in return for a lease of the items. You'd get laughed out of the police station not being rude

[Hidden]

MissAlice; I told staff that you've sent a ticket in and to re-direct it to the correct people. There was no reply but they were active so it's unsure if it was seen or not. Good luck on getting your items back tho.

[Daltron]

It is treated as a criminal offence, as some of the furni will have been purchased using real money.

You're right. It's a commercial transaction where you have given your money to Sulake in return for product. They can write up all the terms of service they like but it's misconduct on their behalf if they don't reimburse you.

If they refuse to help you I would be contacting companies like BBB and other external entities. So what if it takes too much time to track the furniture and items, they are at fault, not you.

I wish I could sit here and say Sulake will pull through but I think we all know the chances of that are slim. Sulakes customer service is disgusting and that's probably a compliment. There should have been an official announcement on this by now outlining sulakes plan to remedy.


Sent from my iPhone using Tapatalk

[Coryza]

There's still a handfull of ex staffs who still have their ADM powers (no I won't name them). As an example, oa still had staff powers for over 2 years áfter he left the company. Rumours go it was Ceissi, but Ceissi's ADM powers were removed in 2013, and the account never got it back.

[MKR&*42]

when did you hear about that, 2 months ago habbo dealt with my thing which happened like a year and a half ago and it was sorted.

but yeh, ridiculous how that happened.

Habbo don't deal with bans older than 6 months, not cases :P

[RyRy]

For what Habbo is, I'm very surprised authenticators haven't been introduced into the game. There's a lot of Habbos who'd love to have something like that given they've sunken so much money into the game. Sure it's an inconvenience but for security? It's a well needed one. Staff seem to need it too.

If you don't know what an authenticator is, a good example of it being implemented is here: https://us.battle.net/support/en/article/battlenet-authenticator

To further add to that, authenticator is either a mobile app or a physical device on your keychain. Banks like Barclays have PINsentry which is kind of the same thing.

[Meowingtons]

Clearly it is true, Ive just checked one of my old banned accounts. Casino room is missing 1 typo and 1 throne.
Not really fussed as the account has been banned for over 6 years and I stopped playing around the same time.
But goes to show how good there security is.

Also just noticed gold bars are missing as well.

[akeel$]

habbo used to be so fab there was like no staff constantly playing like powertoo and beeches or whatever lol now they got all this staff; okay we had ppl like grecian9 but they didnt always *REMOVED* interferre like *REMOVED* off anfd bring back the old habbo lol x

i'm tewlling you this game is turning more and more into club penguin every day lol x

Edited by Derrener (Forum Moderator): Please don't avoid the forum filter.