A History of AppSec through Neopets.com - Katie Paxton-Fear

Hello everybody. It is my pleasure to be here uh presenting a history of apps through neopets.com. Um I asked a second ago, how many people here have played Neopets? I'm very surprised that so many people have come to a Neopets talk without actually ever hearing about Neopets. Um so hopefully I'm going to tell you a lot about my childhood today. uh and kind of the reason why I got into tech and it's actually for those in uh the audience who are fem presenting it's probably the reason you guys got into tech as well. It's a very common like gateway into technology for women >> uh for women of my uh generation if you like. Um, now if you have played

Neopets, you will appreciate the amount of work I've put into these slides. Um, if you haven't, it's this is going to look very weird as a slide deck. Uh, but let's do an introduction. Who am I? What's Neopets? Why am I talking about Neopets? Um, so my name is Dr. Casey Paxton Fear. I'm a security advocate at a company called Semrap. I used to be a security researcher at Harness. Um and then prior to that I was a lecturer in cyber security at Manchester Metropolitan University. And this is why I got into programming. Um I was playing Neopat, probably way too young to be using the internet. Um and I uh remember asking my dad, my dad was a programmer as well. Um

a huge transition in project management. But uh I was asking him um how does it know? Like how does the website know? He's like what? I'm going to need some more context there. Um, and I was asking him, I'm like, well, you would play these flash games. Don't worry, I'm going to talk about plenty of the Neopets economy throughout this. Um, so he was uh he was like, show like I was like, that you can get you played these games, you get Neo points. How does that work? How does it know? And my dad being somebody who was a developer who then transitioned into project management was like, this is a child that's just got a

job. um knowing that you know there's this weird especially with kids in tech there's this weird pipeline where they choose the job they want to get at like six and then you just kind of train them up to do that job so by the time they get to university and study computer science they already know everything about it uh so I used to be a developer prior to this um and this is really my excuse for playing Neopets during work hours but it's not the PhD you're interested in you want to know my actual credentials this is my real Neopets account as you can see it's 15 and 1/2 years 15 and 1/2 yeah 15 and 1/2 is I

have been playing Neopets on my actual account. Again, if you've never played Neopets, this is going to be really confusing. I have the Snowagger um avatar. And if you don't know what that avatar means, that means I spent an awful lot of time um hitting the daily reset on a game until I eventually got a random generated chance that I think is 0.01 off the top of my head. Um but this is my credentials. This is how much money I have in my Neopets bank account. That's uh 27 million Neo points. That's a lot of Neo points. Um and there is definitely this pipeline here of like how many years experience in developing do you have? Uh yes, I have 18 years of

experience because I was developing my Neopets website as as a child. But again, if you've never heard of Neopets, this is probably not quite enough context. So what is Neopets? So, Neopets was this browserbased game for kids that was really popular around 2002 to 2007. The idea is is that you would adopt pets. You would then play flash games and you could submit your score to get amounts of Neo points, which is their in-game currency. Um, they've got this world that you can explore. You can buy items like food and toys for your pets. Don't worry, your pets don't actually die. This is a children's game and dealing with pet death is probably a bit

too sad. So, your pet will starve, but it will not starve to death. Um, now if you know uh much about Neopets, uh it's probably for its gambling for children. Uh very well known. You can do so much gambling on Neopets. Wheels of Fortune, yes. Horse racing, yes. Um you can play uh uh casino games like cheat, yes. This is a children's game, by the way. um has a lot of gambling and a lot of in-game ads. So, you do like a lot of these collabs with a lot of brands. Um uh and this is how Neopets has kind of evolved and this is one of their map screens. You can see it kind of went

from being very bad MS Paint art to being like animated now. Uh but it hasn't changed that much. Now, before we can really go into like apps, we need to talk about the economy, not the actual economy, the Neopets economy. So to make money in Neopets, you play these small flash games. This is Turac Roll. Put your hand up if you remember Turac Roll. Nobody, one person. Okay, this is like the classic like Neopets game. So what you would do is you'd play this game. Um I'm not very good at Turac Roll. So you'll see me die in a second uh as I collect one of the valuable berries. Uh and go Oh man, I should go straight into

the the thing sometime soon. There we go. Um so what happens? you get a score and you can you can then send your score and convert that to NEO points. So the conversion rate depends on the game. Um but in general the max you can get is 300 Neo points three times a day. Um so for reference to understand how bad the Neopets economy is there are stamps that do absolutely nothing. You just collect them that are 100,000 to uh 500,000 uh million Neo coins. Um, gambling is how you actually make money on Neopets. There is so much gambling. Um, there's a stock market. Uh, you can play a slot machine. Uh, there is like the kind of

like loot box style gambling. Um, there is a wheel of fortune style gambling. And there's also just buying items and then reselling them at a profit to the uh, community. Um, and you're probably like, "Okay, yeah, I can see how this is a game. W at least something wrapped in the veneer of a game. There are quite a lot of other game aspects that aren't gambling related. Um you can go and do like what are called sitewide events. So certain times of year there'll be like Halloween event or you can go trick-or-treating. There's a Christmas event where you go through an advent calendar and every single day you get a prize. Um you can change the color of

your Neopat. So if you look at the bottom there, this is my actual Neopet. His name is Gross. Uh I adopted him from the Neopet uh adoption agency. Um so he's not one I've created, you know, adopto shop. Uh and I've painted him in this uh event tide color which set me back quite a million Neo points or so. And you can get these paintbrush, you can paint your pet, you can dress them up, um and you can go and do quests. So there's there's like a an interesting game element here. But what I think Neopets is really interesting and the most surprising thing about Neopets is that it's really still around today. It got it's been revived quite a few times.

Um it was uh owned by this Church of Scientology for a while. Then it was owned by um the conglomerate Viacom who owns Nickelodeon. Then uh Viacom realized this this website is not going well. um and then sold it and now it's owned by a bunch of people who played Neopets as children who have now become software engineers and the cycle continues. Um and in 2024, Neopets actually celebrated its 25th anniversary. You got some cool stuff. The actual website itself, like the actual backend code, has gone through this really weird cycle where it's been developed, then forgotten about, then developed again, then forgotten about, then had ads put in it massively, and then forgotten again. And it's this

weird mismatch of technologies and eras. So I want to show you an example. This is one of the web pages. You see how the design suddenly changes from this like nice responsive UI to um this. This happens all the time on the iPads because there are certain pages that have just never been updated in the 25 years. They've never been looked at before. Suddenly you're exploring and the entire website will change. And so I want to use Neopets as a time capsule to look at how far AppSac has come since the days of Neopets. And I want to start that story with authentication because Neopets is kind of a unique threat model. Uh because everybody is a child um especially back

in the day. Obviously kids are really really dumb. If you ask them you know oh if you type in your Runescape password um it will come up as stars. Children unfortunately believe that. Um, and that's where the Hunter 2 meme came from. So, this is what Neopets used to look like. Um, it was a very basic login. It had a username and a password. And if you forgot your password, you could do a a password reset. Username was like public facing on the website. The passwords were not hashed. Um, I'll tell you how we know they weren't hashed in a second. Oh my god. So, Neopets is quite well known for these uh uh these

like random events that trigger. So, we've got 50 Neo points from a rich slog. So, um when you typed your password in on Neopets in a message to another user, it would say stop. You have sent your password to another you. This is how we know that it wasn't it wasn't uh hashed in any way, shape, or form. Um, so the other way we know is because the developers uh didn't hash their password either and just put it in this was in 2020 by the way. This is not like 1990s. Uh, they just had this in their source code. They've been breached a few times. Um, it's quite funny because I'll show you this in a second because they say

it's never happened. [snorts] Now, Neopets as a um kind of economic situation um the like games as we've talked about reward very small amounts of money. Obviously, the best way to get rich in the OPEC is gambling. Um gambling is very effective. But here's the thing, right? There's something called food club. It works like horse racing. People post spreads of what you should gamble to get the most out of it. This is how most people make money. The problem is you're limited to how much you can gamble based on the age of your account. So, if you're a child who maybe got the account in the 1990s and you were dumb and didn't set a very good password, you

have a really old account that can make a lot of money gambling. So, there's a market for the Neopets black market. Um, the other thing you can get is these are called unconverted pets. So, this is the old design of Neopets. Um, so they used to be like very like different looking uh and then they changed it so they all look the same so they could put like outfits on them. Uh, and people buy old accounts because they want these unconverted pets because it's something you had to do yourself. Um, so there's a quite a big Neopets black market for both the gambling and also for uh these unconverted pets. And Neopets has been the victim of quite a few data breaches.

Here was their uh statement at the time. This was back in oh I want to say this was 2019. [snorts] Um and they were like yep so all of the all the Neopets accounts have been compromised. Um contrary to what many people claim this is from Neopets's website. No one has ever hacked Neopets. Yeah. Yeah. Yeah. So that's breach forums by the way. Um and this prompted Neopets to actually do something about it. uh they ended up implementing OOTH. Now they implemented OOTH fairly recently. It was last year they implemented oorthth um and made it uh compulsory. It's still not compulsory for every single account. And it's primarily to stop people from having multiple accounts and doing gambling

multiple times a day cuz what people do is they'll register multiple accounts and go gamble every possible way. So that way again they just trade money between accounts and they can make a lot of money on the open. There's a lot of cheating for what is essentially a incredibly like basic game. Um, but this was something new. And a lot of people, by the way, at Neopets, like people who play the game still do not like the change to um, Oorth is actually considered like quite a negative thing by the community. There's lots of people who haven't transitioned their accounts to the new Oth system. So, a lot of them are worried about their side accounts.

So, OWolf is still a challenge at Neopets, but they do have it in there. Now, let's talk about Flash because Neopets and and websites like it really did pioneer interactive content on the web. Long before we had, you know, HTML 5 and YouTube could run on an iPhone, we had Flash. And Neopets wasn't alone. I'm pretty sure maybe some of you put your hands up if you use Newgrounds. See, a lot more people have done that and play Neopets and Mini Clip as well. Very common for flash games. um websites like them were very common for uh indie flash games and animations. But as it pushed the animations forward, a lot of like animators who work in the

cartoon industry now got their start in um in like Newgrounds, etc. Um this really held the web back in terms of security vulnerabilities. Flash, if you don't know, is essentially just an executable that you run on your computer. Um, it's essentially just untrusted input that is being run on your computer. So, it's, you know, the same kind of threat model as you downloading a random file, but you only need to access it. Um, and the performance depends on how good your computer is. The access the accessibility was horrible. Like, if you were blind, you would basically go to websites and see nothing. And Neopets relied on it really really heavily. All the games were made in Flash. Um, and

anybody who knows the history of the web probably knows where this is going. So, this is Steve Jobs's thoughts on Flash. This is a uh piece he wrote um that was all about why Apple didn't choose to make iPhones compatible with Flash on Safari. Um uh but long before like this happened, Flash was kind of already on its way out. Um this has an incredibly long list of security vulnerabilities. And even before that, like Flash in general, it wasn't very compatible with things like smaller screen sizes. It wasn't very compatible with things like screen readers. And at the time, Google um was penalizing websites that didn't have accessibility in terms of like SEO rankings. So, a lot of websites were

very motivated to get those numbers up. And in 2020, um Adobe finally killed Flash uh dead. and Neopets as a website that had like 20 years of Flash content um suddenly lost most of its content um and uh they were rushed to convert what they could to HTML 5 as quickly as possible but many of the pages were just not accessible anymore. Um so you can see here this is me um kind of browsing one of these new pages. So this is using not Flash. Um, but if you go and you uh try and go to a flash page on the OpEds, you get this little flash rip little gravestone. And so the game essentially

trucked along after this. Um, there's lots of reasons why Flash was uh kind of killed. Um, but obviously for the Neopets community, they just lost most of their content. So then comes Ruffle. So Ruffle is a Flash emulator. Um, so it's essentially a complete rewrite of Flash using web assembly in Rust. You know, you've got Rust in there. So it's definitely um top of whatever the top of the the the food chain for things. It runs in the browser sandbox though rather than being run as like a binary. So it doesn't have the same security vulnerabilities. So you can now download Ruffle and you can go and see. But this isn't really a true replacement for HTML

5. Fundamentally, this is like yet another like plaster on like the death of Flash. And this is likely still going to affect Neopets to this day. Neopets does not have money. They have enough money to keep the site trucking along. They do not have enough money to replace 20 years. Um, so thanks to stuff like Ruffle, you can still access some of these old pages. Um, but there was a point where before Ruffle came along, the Neopets was essentially inaccessible. You would just see all these dead flash signs everywhere. Uh, though thankfully the websites that if you sent the URL cuz it had the get parameters in it, they would tell you like how to complete the flash game. Um,

because for whatever reason the submitting wasn't in Flash, it was like below it. Um, and so what you could do is you could get the URL, paste it into another website, it would then tell you what to press on the Flash. You could do that on the the thing below because you couldn't see the content and then submit it and then you would still get your gambling points. There's a lot of gambling in Neopets. Um, now HTML is kind of what Neopets is probably most famous for. Um, and it's really HTML injection as a feature rather than a bug. So when I was playing Neopets, uh, this is what Neopets websites often look like. So, this is

why it became a gateway. On a few different pages on the OPEC's website, like your shop, your pet homepage, your guild, um, you could embed custom HTML. And kids like me who saw this were like, "Oh, yes. I'm going to add marquees everywhere. I'm going to add little MIDI files of specifically The Nightmare Before Christmas." I don't know why The Nightmare Before Christmas was so popular. Um, but I was obsessed. I was obsessed with doing this. Um, so this here, this top one, this is what someone's shop used to look like. This bottom one, you might be thinking, "Wow, that's some terrible design." That's not a user. That's the default option Neopets gave for this particular

species, which is called a loop. Um, and these pet pages became free web hosting. a lot of people because they were just like um kind of like dash and then um cur uh the curly uh hyphen and then your pet's name kind of like a home directory almost. Um you could host whatever you wanted here. What did most people host on them? Betting odds. There's a lot of gambling in Neopets. People still mainly use this to host their food club picks of the day. Um though most people use Reddit now and it's very telling of the generation because uh the Reddit the person who does the Reddit odds there's a whole like food club bet where well it will

tell you like your chances of breaking even in like a very nice graph. You can track how much you've bet and won each day. There's a lot of gambling in your bets. It's kind of concerning. So what this ended up is people's first jobs. So some people uh especially those kind of like 10 years old would sell shop layouts like if you had a really good design you could sell it like for actual real money. Um and that's what people would do and they or they'd have them on their website like a little freebie but you can contact me for commissions. Um and they would basically you know provide these uh layouts. They were essentially um images uh that were cut

up using something like Photoshop and then stitched back together with an HTML table. Um nowadays when we think about being able to uh just put HTML into a random web page that's not owned by us, uh we call that a vulnerability. That's HTML injection. Um you know like these are these were not pleasant websites to use. Like the UI the UX was horrible. Um, there's like animations, there's mares everywhere. Um, and there's loud MIDI files that just start randomly playing. Um, and this produced like quite a lot of security vulnerabilities. Oh my god, we got a lottery ticket from the nice man. Great. Um, clickjacking, fishing, third party embeds like flash files. And what people do now is they

use this to cheat. So you can't you can still on Neopets add HTML to like jazz up your page, but it's not um how most people are using HTML now. Um so if you're not familiar, this is Tampa Monkey. It allows you to edit the HTML page uh of a specific website and it allows you to inject uh their own code into these. So this is one of them. This is the post office. By the way, I took this screenshot when I was uh on the airplane um going to the US one time. Uh unfortunately, I was on plane internet. So, you see these stamps here. So, stamps can be worth quite a lot of Neo

points. Uh this red stamp is a trick. So, the red stamp, cuz I've got the cheating user script turned on, that's telling you that this stamp is incredibly poor value for money. It's worth less than what you pay for it. These green stamps down here mean they're worth significantly more. These were million neopoint stamps and I tried to buy them or at least one of them and it didn't work because I was on plain internet and it was too slow. So I did not get my uh very expensive stamps. And this is how people cheat in Neopets. They run these user scripts to do things like API calls in the background. So that way they can essentially figure out

the value of things before they buy them. They can get more Neo points. They're going to then use those Neo points probably to gamble. It's a lot of gambling. Um, bet on Food Club, use someone else's spread where they tell you there's 100% chance of you get making out with it. Let's talk about capture now. Um, and just to remind you, you know, Neotopian economics. So, stamps that do absolutely nothing are worth hundreds of thousands of Neo points. Okay. Um, and the way they get sold is in NPC shops. So that's what I just showed you was the stamp uh god what's it called? The post neotopian post office. Um so if you can spot one

of these rarer stamps maybe you buy it for 25k but you resell that for millions. And this is really how people get money. So this one here is uh 25k but if you look it's actually worth 1.5 million. This is again another third party website. Um, and then you know, you try and haggle for it. And technically, cheating and botting is against the rules. And also, you can't trade Neopet stuff for real life money. Practically though, it's not. Oh, look. We got some uh Neopet Neo points on the ground there. [snorts] So, what you do is you get a bot to scrape this to get all the valuable Neo points. But how do you stop

bots from scraping things? before you obviously use a capture. Um we've seen captures evolve from like you know these random tech wavy text into um you know now you know click every every bicycle. Uh so the way captures look on Neopets though is like this. So you have a little you have a little picture and then you have a little pet and it says you need to click on the bloomer. That's the name of this pet here. Uh that's how captures work in Neopets. Now, you might be thinking, "Okay, that seems like a ridiculously easy capture to break." Don't worry, people still cheat. They remove the white, they remove the background to make it easier for them to

see and click on. Um, now obviously like the future of this is not that we use bots in order to achieve things digitally, but in fact that you use um digital things to hire humans to do tasks that that they can't complete. Um, and obvious then now we have like way more bot protections. So things have definitely moved on surprisingly enough in 25 years. But what is next for Neopets? H, that's another stamp. That's great. That might be worth some money. You know, I'm going to make an obligatory AI reference. AI is coming. Okay, let's move on. [snorts] You don't you don't want to hear another talk about AI. Don't worry. I know we've come really far since the uh oughties

here, right? Like no longer do our Neopets look like this. This was genuinely a design when the website launched and our like online games don't have maps that look like this. And security in that time has changed. You know, we don't consider security uh quite a somebody's going to kill someone's going to steal my Darian pet that I paid millions of meal points for. Um, we do more than by web applications than ever before. And Neopets isn't the only legacy software out there. There are tons of legacy software that is held up with duct tape, hopes, dreams, and some guy who has worked at the company for 35 years. Uh, or alternatively, some guy who used to work for the company for

35 years who gets brought out of retirement to please fix your cobalt code. Thankfully, now we have AI to do that for us. So, we don't need uh anybody out of retirement anymore, of course. Um, but it's not the only legacy software out there. And in the same way that Neopets or any old website has managed to keep tracking for this long, there are a lot of software that have these like patches on them. And before we can really think about how AI is going to change everything, how AI is going to do this and that and oh my god, we need to think about everything else underneath it because it's very easy to get distracted by AI when actually you

know we could be doing gambling. Thank you very much everybody. [applause]