str1_test was a Roblox account that was used by Jazwares to test Roblox toy codes to ensure they worked as intended before their release to retailers. The account is mainly notable for being the first user to redeem the Deadly Dark Dominus. An unauthorized user, known as Rifaldi Gaming on YouTube, gained access to the account on the night of June 15, 2019 by a tactic known as password guessing.[1]
Password guessing[]
A screenshot of Rifaldi Gaming's channel and the video which showed Rifaldi accessing the account
Rifaldi seen telling a user to join him in a scam game that promised "free Robux"
On the night of June 15, 2019, str1_test was password guessed by a YouTuber known as Rifaldi Gaming, who had 8 subscribers at the time.[1] The YouTuber uploaded a now-deleted video titled how to hack the account and break the pin2019. In the video, he showed himself supposedly logging into the account via the Inspect Element tool in his browser. While he did actually log into the account when the video was recorded, the final video uploaded to his channel excluded the part where he entered the account's password.
Shortly after the video was published to his YouTube channel, Rifaldi changed the account's avatar to wear the rare Deadly Dark Dominus as well as many other toy items to make players tempted to give Rifaldi their login information. He accepted many friend requests on the account and used the chat feature to tell the account's friends to join him, when he would be in a scam game that promised "free Robux." Rifaldi also played Trade Hangout, where he claimed to be a Roblox administrator and that he would buy a player a Dominus if they let him "borrow" their account.
While Rifaldi had access to str1_test, he joined {{Group link|[LIN|911751}} Linnettinnian Armed Forces], a military-themed roleplay group using the account. The group is owned by iiDominus_Rexii, who some speculate to be an account owned by Rifaldi.
Media coverage and awareness[]
The only member of the Roblox Video Stars Program at the time known to publicly address this incident was StarCode_RealKreek on Twitter,[2] where he quoted a now-deleted Tweet by ItzAndreAgain.
In Kreek's Tweet, he claimed that all games the account had played while hacked were logging other users' IP addresses,[3] but this cannot be proven and is probably an assumption by Kreek himself. He retracted this claim over an hour later,[4] quote Tweeting a now-deleted Tweet by DevUItra that probably contradicted Kreek's earlier claim.
Soon after, a video was uploaded to YouTube which shows users in a "free Robux" scam game that Rifaldi had led them into using the str1_test account. For the first few minutes, KreekCraft walks around the game and makes the players aware that it was a scam. Meanwhile, Rifaldi tries to convince the players to walk to a certain place in the game where a GUI would appear asking for the player's login information.
Faave uploaded a YouTube video a few hours after the account was stolen covering the incident, with most information received in a Twitter direct message that was sent the day beforehand. iSoToxic also uploaded a YouTube video covering the topic thereafter.
Termination[]
A few hours after Rifaldi password guessed the account and used it to attempt to scam players, Roblox noticed that the account was compromised and terminated it forever.
Succeeding incidents[]
STRtest2 and STRtest3[]
On August 19, 2021, STRtest2 and STRtest3, accounts also used by Jazwares to test Roblox toy codes before their release, were compromised in a similar fashion to str1_test. The accounts accepted all friend requests sent and created Chat Groups to promote a scam website that promises "Free Robux" to the accounts' friends. Roblox has not yet taken action on the accounts. People speculate that the passwords to the accounts were extremely common and easy to gain access into which explains why every Jazware toy code tester account was hijacked.
References[]
- ↑ 1.0 1.1 DefaultBrain (n.d.) . DefaultBrain on Twitter. Accessed August 21, 2021. Archived from the original on August 21, 2021.
- ↑ KreekCraft (n.d.) . KreekCraft on Twitter. Accessed August 21, 2021. Archived from the original on May 31, 2021.
- ↑ KreekCraft (n.d.) . KreekCraft on Twitter. Accessed August 21, 2021. Archived from the original on August 21, 2021.
- ↑ KreekCraft (n.d.) . KreekCraft on Twitter. Accessed August 21, 2021. Archived from the original on August 21, 2021.