Slashdot Mirror
Scammers Target Neopets Users
An anonymous reader writes "If you have children that play on the popular virtual world game Neopets, you might want to warn them of a social engineering scam gleefully targeting 12-year-old kids. Neopets users looking for rare items are sent private messages from the scammers, who direct them to sites hosting keyloggers & trojans. They then use the infected PC as a means to get to data the parents might have stored there, be it credit card details, Paypal accounts or online banking. Seeing the screenshots of some of these people talking about putting these children into botnets is just unbelievable — if ever you wanted proof that people up to no good online will go to any lengths to get their hands on some money (or even just feel good about outsmarting a 12-year-old), here it is."
Jeeze, all scammers are scum of the earth. Why would you expect them to be any different with 12 yo kids?
[John]
Shit better not happen!
Is extreme, but assuming they can be found, I think a revival of "indentured servitude" might be useful. At least until they can pay back all the money that they stole. And not to the government, either, to the victims.
BTW - feel free to disagree with this. I don't mind. Do __try__ to be polite. Name calling is not usually very helpful and generally only reflects poorly on the poster. Not that such care.
My kids never got into Neopets, but they have been really into Webkinz for the past year or so. I like the way Webkinz handles things a lot better...there are no open areas where people can chat about just anything. They can chat in common rooms, but only by picking things to say out of a list. There is no possibility of sending links or other such nastiness.
Even sites that do have forums like Nick.com have moderators approve every post. I'm sure it's more expensive to run it that way, but I would think if your site is built to cater to young children, it's incumbent on you to either moderator-approve every posting like Nick does or limit postings to pre-approved phrases like Webkinz does. Anything else is just asking for trouble.
LOL
Setup whitelist of sites your children can go to.
One way of doing this is via your router (Newer D-Links have this feature).
You can also use opendns.com, set it to filter everything desired, then make exceptions if needed.
This prevents them from going to domains without you first checking them out. I suggest you ask them to write a sites they frequent or check their browser history to get a base whitelist.
Probably already is one of these, but can we get a plugin for Firefox that dumbs down the browser for them.
I think one of the toy company's had a toy/software setup where kids could visit a limited amount of sites using a special controller. Something to keep them out of trouble.
I want to give my kid a login with just a link to firefox and this plugin on the desktop. They click it an are presented with a list of safe sites. Any attempt to go outside of the domain is blocked and the sound card goes crazy with ("hey mom and dad get your ass in here and watch your kid")....hell have it text me. If the domain is safe I simply type a password and it gets added.
Sure just surfing in Firefox will prevent some of this, but I don't want any chance of any sort of firefox bug getting exposed. Remember that even firefox can fall victim to some sort of buffer overflow.
A little offtopic, but I think a Live CD of Ubuntu that accomplishes this would be great. Just give my kid an older computer with no harddrive and the CD and let them go...
My daughter spent an entire road trip (two days in the car each way) unlocking her NeoPet. The beeping was enough to make you drive with your elbows so you had both hands free to pull your ears off. Now I can simply say, "honey, if you play with your NeoPet character online, bad people will take all Daddy's money away and we'll have to live under a bridge." Aaaahhh, another aggravation averted. Thanks, scammers!
It is pitch black. You are likely to be eaten by a grue.
Whatever you do, don't blame the parents for:
1. Putting sensitive info on their computer, then
2. Letting their kid use that computer unsupervised, while
3. Leaving that computer relatively unguarded against intrusion.
Sure, not every parent can be expected to be a genius, but if you're going to let children use a computer on the internet, you have responsibilities to act as a sysadmin.
Not to mention responsibilities to act as a guardian. Just as with TV, the computer is not a babysitter. Worse, a net-connected computer is a social interaction tool where every pervert and scammer in the world has direct access to your child. And you're really going to just let them hang out alone with those people?
Amputation. At the hip. Preferably sterilization. And THEN let them do public service for the rest of their lives.
Ok, ok, a wee bit drastic. Or is it? It's the only way I can think of (the sterilization thing, anyway) which gives humanity a chance somewhere in the future, if not now.
A positive attitude may not solve all your problems, but it will annoy enough people to make it well worth the effort.
as long as its not links to porn
The real solution is for the kids to have their own computer. And the adults do not use it for online banking, or anything else.
It's hard to believe the cost would be a problem, but if a netbook is too dear, old PCs are being given away. Put Linux on it, and it's their online playpen.
No need to argue about porn and whatnot. All of those concerns can be addressed depending as the age of the computer's owner varies.
Seriously: " who direct them to sites hosting keyloggers & trojans.", not much of social engineering - if your basic setup is secure, it wouldn't work
Targeting the weakest link in the security chain? Who would have thought the spammers would do that? Alright, it's scummy to target this towards kids, but it has happened since the start of the internet. Think back to the bad old days of AOL and Compuserve chats, or telling scriptkidz that your ip address was 127.0.0.1 and to 'hack me if you dare'.
What does surprise me, is that people are letting their kids play on websites while logged in as administrator. How computer savvy do you have to be to realize this is a bad idea. Admin on their own computer, maybe. If you make them clean up their own mess and just smile when they lose their Neopet.
We could just get our kids real pets...
Having no idea what Neopets was, I decided to Google it. A quick glance at the front page www.neopets.com tells me it's sort of an MMO for young kids.
I'm no parent, but hell, the intended audience of this game should be PLAYING OUTSIDE and PRACTICING SPORTS, not learning to get hooked on MMOs. I know I was, even though my parents got me an Atari, I still had to go to swimming lessons at 6 a.m. before school (oh yeah, no heated swimming pool).
And they wonder why obesity rates are at an all-time high, geez!!
Is this just an XP thing. How about Vista? I'm assuming Mac and Linux are safe?
My 28-yo girlfriend plays it, and so do many of her 20-30-something friends... there are plenty of adults on Neopets...
12 year olds have no business being unsupervised on a computer with internet access.
Don't forget a separate "kid only" login. That way, they can't accidentally delete mommy & daddy's Quicken info, and their unprivledged account will be less likely to be able to jump into other accounts and/or the system. Maybe.
Please help metamoderate.
If they picked on kindergartners that would be a fair fight.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
I was on Neopets as a twelve year old (nay, 10 year old). More or less unsupervised. People have been trying to scam neopets users for literally FOREVER. This is nothing new. The original scams were fake login pages, and were pretty tame (ie, evil.com/login.php that actually harvests your info and then drops you back into neopets). I actually hacked into one that had a web-based control panel (hacked is a strong word, it was totally unprotected. Just guessed the URL).
Moreover: Knee-jerk "Don't let your kids online unsupervised, duh." comments are useless. How did I get into messing about on the internet? Messing about in Neopets. A bit of HTML knowledge, at least when I was on, was absolutely necessary in order to make a cool looking shop/user page/guild page. After HTML, CSS, Then why not Flash? That used to be allowed, so I made cool flash based applet that let you stream in outside info to a Neopets page. I created a guild (a group of people with a page, messageboard etc) and put together a crappy website and put it on my ISP's webspace. And so on and so forth, and now I'm half decent at programming.
This is all in like 5th grade, all on my very own. I never did any serious damage to our computer. I admittedly may be a special case though...
Neither is any other Slashdot poster. Think about it.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
I'm twelve years old and what is this?
Honestly, I think that's pretty funny. I had no idea neopets still existed.
...except that people who run Firefox are probably (just guessing here) more likely to perform better computing habits anyway.
Making Firefox safer for surfers is like trying to make people who live in the country safer from street crime.
http://www.hackforums.net/showthread.php?tid=88856
The 1337 h4x0rr profile :)
http://www.hackforums.net/member.php?action=profile&uid=58608
Exception Duck - may or may not contain chicken.
...and we're planning to build him an Ubuntu box for his birthday. He doesn't really read yet, he just likes playing Flash games. But you can be damn sure we're going to strongly supervise web browsing early on, not to prevent him from seeing bad things (oh noes, boobies will turn your kids into murderers!!), but to prevent him from making naive mistakes about trust and security.
"Destroy science and religion. Science would re-emerge exactly the same; but not religion." - Penn Jillette, paraphrased
Technically, under 13 year old kids are not allowed to interact with other users on Neopets. Not that they couldn't have lied about their age, but at least there is protection intended. The boards are pretty well monitored as well.
Wait.. Neopets requires credit cards now? back in the day i never needed to have a card registered so i could fail at getting stuff from the donation tree..
20 minutes? really? Way back in the stone-age, when I was a kid we'd spend hours exploring what our amazing Commodore 64s and Apple IIs could do. We'd dial into BBSs, and run our own. We'd write our own software, and tinker with other peoples' code. Sometimes we'd end up in places we weren't welcome (Hello Joshua, shall we play a game?). Our parents hadn't the vaguest understanding of what we were up to (boys? Why is the phone making a funny whistling sound? Did you hook up that video game thing to it?). We're the application developers and software engineers, the IT architects, and the hardware engineers now. Our understanding of how these machines work come from all the hours we spent exploring them as children.
It's fun to demonize children "wasting their time" on the internet, but it's part of our world, and worthy of exploration. I hear all the time about how "this latest generation" is made up of computer geniuses since they grew up with them, but honestly, most of the ones I talk to know virtually nothing about these machines other than day-to-day use. They can't fix'em, they can't upgrade'em, and they still make horrible messes of them that leave an actual power-user scratching their heads. Maybe, just maybe, the whole idea of heavily supervised "play-dates" with their computers plays into this. At their most curious ages they're told not to touch, not to explore, and in the end they turn out not really learning any of the really cool things that they could do.....
Some bring out the best in others, some the worst. Some bring out far more.
My girls had SSN's within months of being born, it's used for our tax returns, their college savings plans.
While the loss of neopets items and whatnot might be a bummer to your kid, losing your banking info would be worse to the family on a whole.
For this reason, my kids have their own machines... All 4 of them. They range in age from 5 to 15 and they all use old P3-850 machines. If something happens to one of their boxes I simply reimage it and they're up and running again. Their accounts on those machines are also restricted "User" accts, so anything that needs to be installed has to go by me first. This cuts down on infections, but doesn't eliminate them 100%. However, it keeps any potential infection from ever reaching MY PC's since they're never on my machines to begin with.
Fifty watts per channel, baby cakes.
I am 12 and what is this?
Since when is this news? All social networking sites whether gaming, personal, business content are exposed to this kind of phishing or directs to spam/malicious software. Neopets for sure have been suffering with this for a while. We were contracted by them a couple of years back to look at trialling more secure login methods. Look at WoW as well, more scammers, spammers and crackers than you can shake a stick at... I guess the only caveat here is that Neopets is geared towards the younger user so parents may need to give their some kind of phishing 101 training.