Habbo security issue (user details leaked!)

[edible]

There was a tool that allowed you to see the email and birthday of the account you want. It could be used with Habbo.COM, Habbo.ES and HABBO.COM.BR (if I remember correctly), so by using it you could know the email and birthday of the any account.

Me and BelieveMeSafety were the ones who reported it to powertoo at night, she was totally unaware about it and she hadn't idea what was going on, so we gave to her the email she had in her account as proof. We considered the best was to keep secret as much as we can, so we didn't share it. Afortunatelly no much people got it, there wasn't a big problem.

You don't have anything to fear at all. Someone only could get the information of your account if he had the tool, and if he used it to check your account specifically.

However, I know for a fact that people who have replied in this thread knew about this exploit and used it. It was widely used and you are wrong and naive to say "you dont have anything to fear at all". When Habbox users have 100% used it then everyone who uses Habbox / well known on Habbo have every reason to fear.

[Abdicators]

Is anybody able to shed a little more light into what has actually happened? Not full specifics but a little more detail would be nice. Was it another faux pas on the zendesk side of things or to do with the client itself? What details were actually exposed? How long was it possible? @edible; @Shorty; @Abdicators;

Hey,

Based on communication that was found between the scripts author and other "bad" Habbo users, it has been possible for a while. That is not to say however that it has been being used.

The user who found and exploited the bug had not actually divulged its existence to the majority of "bad" Habbo users until around the 11th Sep 2013, there may have been a handful who knew about it prior to that but I believe that group of people will have been very small.

As for more specifics to do with the bug, it was not the fault of Zendesk and was a bug in Habbos own software. It was quickly fixed as soon as staff really became aware of the issue.

I think the most scary thing is that tied with information that is available after using other tools (such as those on Habbies.nl), one would've been able to collect almost all the information the needed to convince customer support agents that they owned your account.

That being said, a user would've had to target you specifically in order to get your information so unless you was worth more than 90% of Habbos, your account is probably just as secure as always. However if you are worried at all, changing your email would really help you!

It might be worth pointing out, that it is also important to ensure that the emails tied to your accounts still exist and are active. If some one happens to find an email that is tied to your account, and no longer exists, they will be able to create it and from their take ownership of your account. You have to stay ontop of that.

[Plutonioo]

However, I know for a fact that people who have replied in this thread knew about this exploit and used it. It was widely used and you are wrong and naive to say "you dont have anything to fear at all". When Habbox users have 100% used it then everyone who uses Habbox / well known on Habbo have every reason to fear.

I know there were more people that used it, I never said we were the only ones.

With that I mean with that is that it wasn't something like a whole list with all the account's information. So with the "at all" is because someone only could get your information if he specifically wanted to know the information or your account, which the possibilities are not really much.

Do you really think someone could be interested on knowing that kind of information of your account? If so, I'm sorry, I didn't know you were so famous

[Red]

with the amount of times info has been leaked, people practically have all the info they need to use the helptool. I wanna change my dob ugh lll

[edible]

I know there were more people that used it, I never said we were the only ones.

With that I mean with that is that it wasn't something like a whole list with all the account's information. So with the "at all" is because someone only could get your information if he specifically wanted to know the information or your account, which the possibilities are not really much.

Do you really think someone could be interested on knowing that kind of information of your account? If so, I'm sorry, I didn't know you were so famous

The flaw has been about to exploit for numerous years. It is unclear when it was first exploited as it was only spread to a wider audience recently. As I said, there is someone in this thread who has used it and less than 20 people out of the thousands of use Habbo have replied. That shows how wide spread it was. To your sarcastic end comment: yes, I have no doubt I'd be in the top 10 or 20 of Habbos searched. Apology accepted.

[Scotland]

There was a tool that allowed you to see the email and birthday of the account you want. It could be used with Habbo.COM, Habbo.ES and HABBO.COM.BR (if I remember correctly), so by using it you could know the email and birthday of the any account.

Me and BelieveMeSafety were the ones who reported it to powertoo at night, she was totally unaware about it and she hadn't idea what was going on, so we gave to her the email she had in her account as proof. We considered the best was to keep secret as much as we can, so we didn't share it. Afortunatelly no much people got it, there wasn't a big problem.

You don't have anything to fear at all. Someone only could get the information of your account if he had the tool, and if he used it to check your account specifically.

ey eye eyyy, i reported this before jake lol

[jakey,,]

For those that are wondering the information that was leaked from habbo, this is what happened when you searched a user:

Show Hide

Nick	powertoo
Email	****.*****[a]sulake.com (Clique aqui para buscar no facebook por esse email) (not sharing personal info
Data de nascimento / birth date	**/***/****(not posting personal info on habboxforum)
Hash	************************************************** *****(asterixing it not sharing personal info)
Status	offline
Criado em / joined	Apr 2, 2012
Missão / motto	Iku-Turso!!!!
Último login / last login	1 hour ago

Suggestion if you are worried and the e-mail you had is the e-mail that created your account contact customer support on https://help.habbo.com/request/new and tell them to disable e-mail changes to your account via customer support. If it's not your original e-mail address you have nothing to fear.