A person or a group of people have been trying to access KoA forum accounts.
Some of the accounts they are trying to access have been inactive / disabled for quite some time. So it is likely the source of any information gathered is from outside of KoA. Possibly the old hacked databases of zybez and runehead or something simular.
It seems that most of these attempts have been fruitless - we believe that one KoA forum account has been compromised - this account has been deactivated.
The way they seem to be doing this is by gleaning information found on the web ( facebook, koa forums, fansites etc.. ) to either guess the password of a user or guess what their recovery questions may be. IE: if you have it on facebook that your favourite food is paella and one of your recover questions on your email is what's your favourite food - by building up a profile of someone over various sites - they may gain access to your email then reset your password on koa or runescape via your email.
Several KoA users have reported that someone has tried resetting the email password.
We've taken several steps to combat this. Some of these include - removing birthdays from the calendar. making sure there is no way of seeing your email address. Setting a complexity level on new/changed passwords.
If your account security is good - this should not affect you.
Security tips:
Make sure your password is secure - IE: of a length at least more than 8 characters - when possible use special characters - not using words - using a mix of upper and lower case - Use different passwords everywhere!Tamal wrote: Securing your Email
Email security is not just about having a good password, it's also about having good password recoveries. If your email account works off birthday (or some other piece of personal information that can be discovered on the internet) then it's a good idea to change your password recoveries to information that is not discoverable. If birthday is a part of your password recovery process then is a good idea to remove your birthday from your KoA profile and Facebook/any other social network.
for more information on how to make a secure password - please see here: http://netsecurity.about.com/cs/general ... 12103b.htm
It doesnt seem to be the case that virus's or trojans etc.. are being used.. but with the possibility that there may be compromised accounts on KoA or rs players you know on facebook etc..- if someone sends you a pm with a link or posts a link on the forums, just be sure what you are clicking (mouse hover).
Don't post personal information used in recovery questions on the web.
If any of your accounts koa - email - facebook etc.. have had someome try to recover your account via recovery questions it should in some way record some information on this - ie send you an email. If this happens please let us know.
Just to re-assure they've only tried logging onto a few accounts - mainly today - this is something we're pro-actively dealing with.
EDIT:
for hotmail and I believe yahoo email accounts you can set them to not use recovery questions but set up a phone number for it to call or text with recovery info.
People nowdays are just ****ed up! Thank you for being on top of it! I <3 you guys!
]
