Post Wed Feb 12, 2014 3:55 pm

WARNING: Serious security problem in Haypi Support!

Hello everyone,

I would like to inform All players and Haypi support Team of a serious hole in they ingame Support system:

1. Everyone can read the support messages..

1.1. How? Simply by extracting the ID from a message, using your own system from
  Code:
"http://news1.haypi.mobi/***Censured***_monster2/****Censured***?action=mailcontent&***Censured***"


I censured the full link to prevent any abuse of this information...

1.2. I simply tapped on one of your links ingame and got the full link path of your Mailing system..

1.3. Prof? Here is few of the messages from a players: (I censured the full text for privacy of the player)



  Code:
From: support201
Date: 2014/01/10 05:26
Subject: Re:This kid keeps using inappropriate language

Dear ***Censured***, We have given him a ban. He cannot chat in the chat room in the next 48 hours. Thanks for your support very much. Enjoy your game. Teresa The Lost Tower Team

Blakk kept calling me names and swearing in world chat and all I tried to do was help him find a cygness. But he won't stop so I'm reporting here's some screen shots, Thank you



  Code:
From: support501
Date: 2014/01/27 08:20
Subject: Re:捕捉


你好 不是所有的关卡都可以捕捉宠物,某一关卡中,如果有可以封印的宠物,在屏幕右下角会有封印的提示图标,点击后会看到封印详细。尽可能地降低宠物HP值可以有效提高封印成功几率。 vikings 海湃 团队

怎么捕捉宠物


  Code:
From: support151
Date: 2014/01/28 01:42
Subject: Re::( harassment


Thanks for the picture. I will take measures. Regards Winona

I'm being harassed :( this person won't leave me alone



1.4. I will only inform the full steps of this bug to a support member on a private message service.. so donnot ask me to give you info for abusment or any kind of actions that are not safe for players or the game!



NOTE: I strongly advice you not to write any personal or billing information on the ingame Help -- Support system!

Insted use the haypi E-Mail: monstersupport@haypi.com
mltsupport@haypi.com




Haypi Team ... Please upgrade your system to prevent this for being abused!... This is a serius bug in your system not a HACK .... if i can do this then anyone can!!!

Please Conntact me ingame or on some message service so i can share full information about this issue! Till then i will not use your Help system at all!



Yours BlackCRO!

Thank you!
Image