Hello guys,
Unfortunately account hijacking or (hacking to some people who don't know the real term) is rife within the RuneScape community. Don't think a close knit community like ours is any better. There are always people who want to steal accounts, mainly for their items, etc.
There are several ways people do this and I'm going to let everyone know how, so you can protect yourselves.
The easiest way is by using your email address, if you use the same email for everything, whether the password is different or not, you're making it easy for a "hacker" to gain access to your account. One simple method they could use after finding out your email is to send you $0.01 via paypal. Paypal is a huge hub for information, upon sending the money the person will know your name, address, email, and from knowing that they can find out your ISP. Find your Facebook, should you have it and that way find even more information about you. Basically, the "hacker" is trying to gather as much information as they can about you in order to recover your account.
How can you ensure safety? Make a separate email address which isn't linked to your RuneScape account on clan forums, and even here. Pure Warfare only needs a valid email address for two reasons, to stop spam bots and so you can recover your forum account should you forget your password. So you don't need to use your main email address here, or anywhere for that matter.
Once they know your email address and quite a bit of information about you, they can get even more information about your RuneScape account. They can gain access to your email address quite easily, by recovering that. Many people pay their membership through Debit/Credit cards so your email will have the payment information they need to help recover your account more successfully.
tl;dr: Use a different email address for clans, forums, etc, than what you use for your RuneScape, Paypal, Facebook.
Whenever you register on a forum, whenever you post, your IP address is logged. If you register on a rival clans forum, they will have this information and could sell that information to help further with the recovery of your account.
If you've read this far, well done. So far from knowing your email address the hacker now has:
Your full name
Your address
Your ISP
Your payment details
Your IP address
They could even have enough information to guess your recovery questions, or simply check the box saying "I didn't set these".
Now, another way people attempt to gain access to your account is by putting a java drive-by. This is a download which happens without your knowledge and is an attempt at keylogging you. Most people that use this method will try to use a "silent" java drive-by. Basically, this is one that is invisible to your antivirus, this could be done by obfuscating the code. These are hard to find and get rid of. If you do think you have one, either do a system restore or try to find an expert to help you locate it. A RAT is similar, it installs without your knowledge and gives the "hacker" remote access to your system. It also will try to hide itself from any antivirus you have.
The best way to ensure you don't get these is to have an antivirus and keep it updated at all times. You could also attempt to block port 3389 on your computer, which is the default port for remote access via your firewall.
In order to ensure complete safety make sure you have all of these steps covered.
Have an antivirus and keep it up to date
Don't visit random websites which don't look secure
Keep a separate email address from your real life
Change your IP address regularly
Don't publish so much information on social networking sites, or at least, keep them set to private/friends only.
Make sure you set recovery questions on your RuneScape account
Keep your email address secure
Block port 3389 on your firewall
Securing your facebook:
Go to privacy settings:
Change the default privacy to friends, then go through each of the settings below and make them friends only, or hidden completely.
I hope this has helped people to ensure their account remains safe. A lot of this is just common sense, but anything you put on the internet can and will probably be used against you at some point.
Regards,
Karl