EVE Search - Account Security issue with EveMON

All Channels

EVE General Discussion

Account Security issue with EveMON

» Click here to find additional results for this topic using Google

Monitor this thread via RSS [?]

Pages: [1] 2 :: one page
Author	Thread Statistics \| Show CCP posts - 0 post(s)
Spiderweb	Posted - 2006.06.15 14:55:00 - [1] Edited by: Spiderweb on 15/06/2006 14:56:14 I just got EveMON and installed it. When I run it, My firewall popped up telling me this programm wants to connect to the internet etc. Now I have no reason to suspect a third person app thats been advertised and used by ppl in the EVE forums etc so I clicked OK to let it do whatever with the connection (I figured it might have to do with auto-update etc). Then I saw that one of the options to use EveMON is to type in the Login information . Login information INCLUDING password. I dont know if ppl get it, but: One of the options to use the program (its actually the First 'how to' help window that pops up) it requires to let it use your connection by allowing it THROUGH the firewall and giving it your Login name and pass. I cant really think of a more dodgy way of security compromise than leting a unofficial programm go through your firewall and letting it have your Login info. Of course I didnt let it have my acc, and I instantly stopped its access to my connection as well, however I was concerned about the whole issue so I thought I will be a fair thing to share this with the rest of the community. So take care guys, and I wonder what CCP's stance is on this issue about a programm that is freely available. ----------------------------------------------- We all live in a Yellow Submarine
Aeon Valerii	Posted - 2006.06.15 14:56:00 - [2] There's nothing wrong with it. The code is open source, you can have a look at it. There's a lot of people using it.
HippoKing	Posted - 2006.06.15 14:56:00 - [3] eveMON is open source, and has been confirmed numerous times (unofficially though) to be secure. Its as reliably safe as anything third party can ever be.
Berak FalCheran	Posted - 2006.06.15 14:57:00 - [4] notes: Things that connect to the internet often times have to go through your firewall (omg shock!) Things that access your character sheet also need your login and password (omg more shock!) The program is kosher, as I'm sure many people can vouch. (Not to mention you can just get the source and build it yourself if so inclined) ZOMG switching hosting, fantastic sigs back soon
Kylania	Posted - 2006.06.15 14:58:00 - [5] Originally by: Spiderweb So take care guys, and I wonder what CCP's stance is on this issue about a programm that is freely available. I'd say their stance would be to sticky this 11 page thread where your concerns were asked and answered over a month ago? -- Lil Miner Newbie Skills Roadmap \| Visual Building Guide (Both work in game too!)
Jim McGregor	Posted - 2006.06.15 14:58:00 - [6] Edited by: Jim McGregor on 15/06/2006 14:59:16 It needs the details to download your character info from the eve-online website. I dont use the program, but im sure there are ways to download your character data manually and import it into the program as well. The information is optional. Its not like its a Microsoft program or anything... --- The Eve Wiki Project
GeekWarrior	Posted - 2006.06.15 14:58:00 - [7] This program is open source, so take a look at the code if you want to know what it's doing. I use it all the time. It's perfectly legit. If you don't want it to automate updates, you can login to the eve-o character page and download the XML file(s) manually. ----------------------------- EVE Addict
Mercade	Posted - 2006.06.15 14:59:00 - [8] Of course it wants to connect to the internet. It wants to get your character XML's from myeve.eve-online.com and of course it offers you a place to enter a password. You won't get far past eve-online.coms log in without one. No different then the inputs and behaviors of other great reputable character software like falcon industries character manager. And like people said, open source and checked out. There will always be a limited threat. But this software is defintely not an obvious attempt at info theft. Originally by: kieron ...possible causes for an extended downtime, I think playing WoW would be close to the bottom of the list, probably between shaving cats and having dental work done w/o anethesia.
infraX	Posted - 2006.06.15 15:03:00 - [9] It's all very well saying 'oh but it's open source' - how many of you have read through the entire source code and understood all of it and then compiled your own binary from it? At a guess, I would suggest very few of you. Not that I want to spread F.U.D. or anything, but if you are that paranoid about it, just don't enter your logon details.
Crumplecorn	Posted - 2006.06.15 15:04:00 - [10] If they really just wanted to harvest accounts they wouldn't have wasted so much development time on making it so great. AFAIK it's safe. ----------
Mason X	Posted - 2006.06.15 15:05:00 - [11] firewalls suck. the reason they suck is because clueless people use them and then whine in threads like this. you have no idea what you are talking about.
Spiderweb	Posted - 2006.06.15 15:12:00 - [12] Edited by: Spiderweb on 15/06/2006 15:14:02 The fact that is open source also means that there are some problems with its use: all that is needed is 1 person to change the code appropriately and in the right moment to repost "Useful progs in EVE etc" in the forums for ppl to dl How many ppl you think will RECHECK the whole code for any underhand code ? I agree that probably this isnt a program intented to be used that way, but Imo its just naive to think of it as green light. Im not a scammer and I already got quite a few ideas how to use this program to scam. Including net cafe scams and others which I wouldnt want to share for fear of advertising them. Critism on security shouldnt be taken lightly, and also its a sign of what could be done better. ----------------------------------------------- We all live in a Yellow Submarine
Euye	Posted - 2006.06.15 15:12:00 - [13] Originally by: infraX It's all very well saying 'oh but it's open source' - how many of you have read through the entire source code and understood all of it and then compiled your own binary from it? Actually I did...
BoinKlasik	Posted - 2006.06.15 15:13:00 - [14] Originally by: Mason X firewalls suck. the reason they suck is because clueless people use them and then whine in threads like this. you have no idea what you are talking about. but firewalls try very hard, untill people hit allow on every popup doh, I broke my edited sig :/ cries this signature was lacking pink, I'll provide it for you. There. Looks better doesn't it? -Eris Fixed it for you. Oh, btw, yarr! ~kieron Didn't I tell you? The damsel moved in with me, we're having a great time. - Wrangler The damsel may not be distressed any more, but how many times does the informant have to be silenced before he gets the message? - Cortes
Nials Corva	Posted - 2006.06.15 15:16:00 - [15] Originally by: Euye Originally by: infraX It's all very well saying 'oh but it's open source' - how many of you have read through the entire source code and understood all of it and then compiled your own binary from it? Actually I did... As did I. Not that hard to look for socket connections and make sure they're going to known places.
Jim McGregor	Posted - 2006.06.15 15:24:00 - [16] Originally by: Spiderweb Edited by: Spiderweb on 15/06/2006 15:14:02 The fact that is open source also means that there are some problems with its use: all that is needed is 1 person to change the code appropriately and in the right moment to repost "Useful progs in EVE etc" in the forums for ppl to dl How many ppl you think will RECHECK the whole code for any underhand code ? I agree that probably this isnt a program intented to be used that way, but Imo its just naive to think of it as green light. Im not a scammer and I already got quite a few ideas how to use this program to scam. Including net cafe scams and others which I wouldnt want to share for fear of advertising them. Critism on security shouldnt be taken lightly, and also its a sign of what could be done better. Its still alot safer than trusting a binary. Even if alot of people dont have the energy to go through the code, there are always a handful of people that does. So if 10 different people say the code is OK, its more likely to be OK than a company saying it is, but not letting anyone see it. --- The Eve Wiki Project
Euye	Posted - 2006.06.15 15:26:00 - [17] Originally by: Spiderweb Edited by: Spiderweb on 15/06/2006 15:14:02 The fact that is open source also means that there are some problems with its use: all that is needed is 1 person to change the code appropriately and in the right moment to repost "Useful progs in EVE etc" in the forums for ppl to dl The same issue arises if someone hacks any software and attempts to republish it, so its not a problem because its open source. I probably will be looking at diffs to see what (if any) code has changed in weird places, but then I'm a kinda open source fan geek with too much free time
Yukiko Kura	Posted - 2006.06.15 15:29:00 - [18] Jeebus, if you're so worried about it simply use the xml import. Problem solved.
Hamshoe	Posted - 2006.06.15 15:29:00 - [19] I guess if you hand out your login and password to any non-CCP app, you get what's coming to you. No point in griping about it, it's not like it came to your door and beat you up for them. Kicked in the head by a horse, what's your excuse?
Waragha	Posted - 2006.06.15 15:31:00 - [20] What is more stupid is that you download a program off the internet and you come here to whine about it having NO F**** idea of what its doing. Go download a virus.
Jim McGregor	Posted - 2006.06.15 15:33:00 - [21] Originally by: Euye The same issue arises if someone hacks any software and attempts to republish it, so its not a problem because its open source. Its actually surprising that there are so few attempts to distribute hacked versions of software. With bittorrent etc you could easily distribute a hacked version with a trojan in it. Most people seem to click "Allow all access" to programs using the internet in their firewall, since the documentation often is shady when it comes to what ports or internet addresses the software uses. --- The Eve Wiki Project
Spiderweb	Posted - 2006.06.15 15:42:00 - [22] People underestimate the amount of people that have money stolen from the because they were tricked, by some times silly ways, into giving their pins. But now I see a few reasons to understand how people can disregard the obvious for that sense of personal security or the resistance to think of somethink which might make them feel uncomfortable. Any way my intention was not to demonise the work of a member of the community to help us, but to pinpoint the caveats, and discuss about their 'severity' level. Its when you are informed better that your decisions count more. ----------------------------------------------- We all live in a Yellow Submarine
Billy Sastard	Posted - 2006.06.15 15:42:00 - [23] What EveMon does is, at the core of things, essentially the same thing that you would do if you wanted to download the XML for your character. I don't see people freaking out because they have to enter their username and password when they log in to these forums.. Yea it is the CCP website... BUT you are entering the username and password in your web browser!!11!1oneone ZOMGz firefox is going to steal my password and ***** my EVE!!! Just relax guy, there are thousands of people using EveMon with nothing but praise. If the software was shady, I am sure that with the Eve community being as vocal as it is, there would be many many many people screaming not to use it. I personally am too lazy to go through all the code to verify for myself, but if 3 people that I know and trust have done so and say it is legit, I will take their word for it.
Splagada	Posted - 2006.06.15 15:45:00 - [24] just make sure you download it from the actual correct place one of the favorite tricks of *******s is to clone websites to get people download bogus versions with trojans - Member of [AAST] Owner of eve-corps.net evemail me if you need a free forum for your corp
HippoKing	Posted - 2006.06.15 15:49:00 - [25] Originally by: Spiderweb People underestimate the amount of people that have money stolen from the because they were tricked, by some times silly ways, into giving their pins. But now I see a few reasons to understand how people can disregard the obvious for that sense of personal security or the resistance to think of somethink which might make them feel uncomfortable. Any way my intention was not to demonise the work of a member of the community to help us, but to pinpoint the caveats, and discuss about their 'severity' level. Its when you are informed better that your decisions count more. I never use tools like this, but should I choose to use eveMON, I would look for the connections it makes in the source (not very hard if you have a copy of Visual Studio 2005) and compile my own binary. Total time used: not long checking the code, compiling while I'm asleep.
Jim McGregor	Posted - 2006.06.15 16:16:00 - [26] Originally by: HippoKing I never use tools like this, but should I choose to use eveMON, I would look for the connections it makes in the source (not very hard if you have a copy of Visual Studio 2005) and compile my own binary. Total time used: not long checking the code, compiling while I'm asleep. I usually just check the destinations of the connections it wants to make in my firewall. Even faster. --- The Eve Wiki Project
HippoKing	Posted - 2006.06.15 16:53:00 - [27] Originally by: Jim McGregor Originally by: HippoKing I never use tools like this, but should I choose to use eveMON, I would look for the connections it makes in the source (not very hard if you have a copy of Visual Studio 2005) and compile my own binary. Total time used: not long checking the code, compiling while I'm asleep. I usually just check the destinations of the connections it wants to make in my firewall. Even faster. i don't have a software firewall. quick, flame me!
Emily Spankratchet	Posted - 2006.06.15 17:01:00 - [28] As mentioned briefly above, you don't have to give evemon your login and password. The alternative is to: Download your character details as XML from the My Character Page When you add a character, use the "Saved Character XML" option Er, profit?
Hllaxiu	Posted - 2006.06.15 17:12:00 - [29] Originally by: Jim McGregor Originally by: HippoKing I never use tools like this, but should I choose to use eveMON, I would look for the connections it makes in the source (not very hard if you have a copy of Visual Studio 2005) and compile my own binary. Total time used: not long checking the code, compiling while I'm asleep. I usually just check the destinations of the connections it wants to make in my firewall. Even faster. Ethereal hasn't been mentioned yet. You can see where the packets are going. --- Our greatest glory is not in never failing, but in rising up every time we fail. - Emerson
Jim McGregor	Posted - 2006.06.15 17:16:00 - [30] Originally by: HippoKing i don't have a software firewall. quick, flame me! I dont believe in flaming as a method of education. --- The Eve Wiki Project

Pages: [1] 2 :: one page
First page \| Previous page \| Next page \| Last page

COPYRIGHT NOTICE
EVE Online, the EVE logo, EVE and all associated logos and designs are the intellectual property of CCP hf. All artwork, screenshots, characters, vehicles, storylines, world facts or other recognizable features of the intellectual property relating to these trademarks are likewise the intellectual property of CCP hf. EVE Online and the EVE logo are the registered trademarks of CCP hf. All rights are reserved worldwide. All other trademarks are the property of their respective owners. CCP hf. has granted permission to EVE-Search.com to use EVE Online and all associated logos and designs for promotional and information purposes on its website but does not endorse, and is not in any way affiliated with, EVE-Search.com. CCP is in no way responsible for the content on or functioning of this website, nor can it be liable for any damage arising from the use of this website.