Server Hacker 9/23/07

[hladgunnr]

Greetings Elite Rifles Clan,

I want to express my thanks to one of your clan members. Last night one of your members appeared on our servers after we suffered another Plutoniumserver hacker banning everyone. Identified as member ~El!te:.Lt.Premium, he or she let us know that you guys had also just been hacked. Thanks to Lt. Premium, I was able to find a similar person on our servers during the time our server was compromised by searching through our server log. "Noob" was the only person left on our server once the bans were activated. These two pieces of information convinced me that "Noob" was the right person to ban.

Here is the information I gleaned:

1224202 noob

The other names that have appeared with that guid are:

^2'^7sP^2|^7Srm^2.^7Defa^2u^7lt
^1'^9sP^1|Srm.^9Glitch
^^99'^^77sP^^99|Srm.^^77Glitch
^^99'^^00sP^^99|Srm.^^00Equinix

A quick run through of our logs indicates that sP|Srm. also recruits for the clan iPx~ Clan (that's his old clan I believe) . Hopefully that will help you guys sort out anymore bad guys. The last two players left on the server with "noob" were:

1404539 ^1<^7.:EK:.^1>^9.^1D^7uck|ldr
1633615 [MOK] Col.Farrow

If these two players were also present when your server crashed, please let me know. For all I know, this hacking is a team effort. We've also disabled downloading on our plutionium server to protect against the flaw in the game engine that allows people to get our server passwords.

The only other thing I'd like to add is this snip from a forum that I read back when we were first ban hacked a little over a week ago.

------------------------------------------------

Q: DOES ANYONE KNOW PERSON INGAME NAME an innocent bystander
HES GOIN IN MY SERVER SCREWING IT UP MAKIN PLYERS RUN REALLY FAST CHANGING MAPS SHUTTING MY SERVER DOWN ASWELL DONT KNOW HOW HELL DO THAT BUT DOIN IT IN OTHER SERVERS TO WHO EVER IT IS PLZZ DONT DO IT IN MINE
DONT DO THAT SCREW PEOPLES SERVERS UP SHUT SERVER DOWN ETC MIGHT NOT EVEN BE ANYONE IN HERE JUST SAYIN LIKE

A: He's probably using the CL_BeginDownload exploit, I made my own version of it and managed to get the rcon password from a CoD 2 server before.

You've just got to make sure your rcon password isn't in your config_mp.cfg file for your server. If you're running a mod then you need to check your mod folder for the appropriate config_mp.cfg file.

Q: my pass word is in game fs folder file name server.cfg so wot can i do to sort this out

A Ok I have no idea about setting up servers seeing as I've never done it, but basically...you need to put the server's config file either in a different folder to the IWD files that are loaded on the server (because the location of the IWD files is the location of the files that are possible to download from a server...and you don't want your config file being accessible to download), or take out your password from the config file and just write it in (if you have access to be able to do so).

------------------------------------------------

Hopefully this information is useful to you guys. Let me know if you want me to check up on any other potential server hackers within our server log. I co-admin our Rifles server with Doc Phil just so you know I'm legit.

Thanks again Elite clan and ~El!te:.Lt.Premium for sharing information with us. It was very helpful.

Sincerely,

-=USAF=- Colonel Hladgunnr

P.S. Please add me as a contact in your xfire. Thanks xfire = hladgunnr
I found more "info" from the first hack but I don't want to repost.

[Cpt.Premium]

no problem, i handled the situation best i could, and i didn't want you guys to get hacked too! thanks for the information too! =]

[Gen.Wright]

I already dealt with the problem in early september. The exploit you mentioned does not allow direct access to your servers cfg files, just read only access. A competent person that can get the rcon password from that file may be able to screw things up badly on your server, but it is quite simple to repair as all that is required is to restart the server from the TCAdmin panel. There are other less well know exploits out there that are harder to defend against and for that reason I will not go into detail about them.

[Gen.Wright]

Also with the second suggestion, moving the config file will cause problems when you try to restart your server unless you know what you are doing. And a competent "hacker" would still be able to access the files. This suggestion just turns it into a game of hide and seek for the cfg file. The best solution is to either manually change your password via rcon or to disable downloading on your server.

[Gen.Wright]

prem1um said:

no problem, i handled the situation best i could, and i didn't want you guys to get hacked too! thanks for the information too! =]

oh are you saying someone modified a copy of rcon tool to send them the pass?

[Cpt.Premium]

er... no idea... lol =\

[Gen.Wright]

if the prior 2 messages of mine make no sense to you, simply ignore them, if you understand, then great

[hladgunnr]

Yep, we disabled downloading. That's seems to have worked. Thanks for the information and the help. I appreciate it.

-=USAF=- Colonel Hladgunnr