Backdoor ANY AVA account before selling (access it forever)

**27ecastudent** · 07-27-2012

Ok, allow me to explain this, since the secret is now out.

I don't know if you remember (or if any of you were even around), but on the Ijji forums back on about last August, somebody posted a tutorial on how to bypass the Reactor entirely.

What basically happens with the login system is this:
1) You log in to Reactor (this is still the same, even with Ignite)
2) A packet was loaded into your RAM
2) You then start the game
3) The Reactor (or Ignite) process sends a packet (the aforementioned data packet) of random alphanumeric data (a HUGE string a numbers, symbols, and letters) to the server. Each account has a different permanent string assigned to it. This data packet that contains the string tells the server what account is logging in, and VOILA! The game starts, and because of that packet, the server accurately logs you in and you're playing.

What this user had done (It may have been MastaGunZ, I don't remember) is they used a program (I forget what it was) that intercepted the packet, copied the string, and then set it to automatically inject it whenever AVA started, which bypassed the Reactor entirely. You could just start AVA.exe with the injection program running in the background, and you could login without using Reactor.

Ijji patched it in a week (because you could, in theory, bruteforce random accounts), but the theory still stood.

When you linked an AVA account with your Steam account, and logged in, Steam Reactor recorded and stored this string, sending to the server with every log in. It doesn't matter if you change your password, the string remains the same.

I've sold several AVA accounts (linking them to a Steam account beforehand). I changed the email for the account to the one of the person I was selling it to, gave the people everything they asked, them not realizing I had effectively backdoored the account I was selling with Steam.

Even after selling, I could login whenever I wanted with Steam (because of the little packet that was still stored in the Steam files).

So, yeah. That's how it works. You could (in theory) design a virus that dumps this file onto your computer from an infected one and gain access to their account, with there being no way to stop you (since changing the password and/or linked email do nothing).

Access forever. Enjoy!

(This has been around since AVA went on to Steam, I've been using it since then)

Cat's out of the bag...

tl;dr Before selling an AVA account, link it with a Steam account. You'll be able to access the AVA account you sold forever.