[SPLIT] Server hackers

[Killroy]

Hackers are hacking both Alter's and Soduka's.

User name of Zetanor. Ban on site, he can kick admins.

[ball2hi]

Hackers are hacking both Alter's and Soduka's.

User name of Zetanor. Ban on site, he can kick admins.

Did you get his steam ID?

[Killroy]

Nope. As a matter of fact, he was permabanned. Several times.

He kept voming back.

[ball2hi]

Nope. As a matter of fact, he was permabanned. Several times.

He kept voming back.

It would appear that DNR is getting hacked atm too.

[ball2hi]

From what im understanding, all TTT servers are being hacked and loaded with viruses. Here is what i was being told by someone in steam chat.

NOU | Pure Ownag3 |: I MIGHT HAVE SOME INTELL FOR YOU
Xbye: que?
NOU | Pure Ownag3 |: ON "BLACK OPS"
Xbye: ?
NOU | Pure Ownag3 |: ORANGE TANG , DRAGOON HACKED SODUKA GAVE EVERYBODY SUPER ADMIN THEY ARE FROM AN INFAMOUS ORGANIZATION CALLED BLACK OPS
Xbye: I see
NOU | Pure Ownag3 |: ORANGE TANG AND DRAGOON ARE GOOD HACKERS
NOU | Pure Ownag3 |: I KNOW I SEE THE PROGRAM FILE
NOU | Pure Ownag3 |: AND FOR SOME REASON RANCOR FORM THE OTHER TTT SERVER THEIR UNBANNABLE
Xbye: Rancor?
Xbye: NOU | Pure Ownag3 |: AND BLACK OPS THE DUDE THOUGHT THEM HOW TO DO I
NOU | Pure Ownag3 |: T
NOU | Pure Ownag3 |: RANCOR PROX
NOU | Pure Ownag3 |: ALTERS
NOU | Pure Ownag3 |: OTHER TTT OWNERS

Could this be because we're doing something with Fretta or w/e?

[Wat?]

I believe its releated to this.

http://www.facepunch.com/showthread.php?t=854605

[Blan21]

http://steamcommunity.com/id/zetanor - his profile
http://www.zetanor.net/ - in his steam profile
http://www.freedownloadscenter.com/live/hack-tool-by-zetanor/zetanor.html - a hack made by him

In his steam profile he plays gmod the most, so........

EDIT: more: http://steamcommunity.com/profiles/76561198005944683 - dragoon's profile confirmed

http://steamcommunity.com/profiles/76561197998168867 - confirmed orange tang's profile

both orange and dragoon are in the "Black ops" group, not zetanor though :/ and black ops is fretta centered. If server owners see fit, ban everyone on this list. (i would personally)

[Ajunk]

People hacking the shit out of TTT servers because of the fretta competition, or fretta alterations being used to exploit servers? The latter seems impossible, and the former seems unlikely.

In the end it doesn't really matter at all, just find the server owners and shut it down. There's very little I hate more than hackers. People are donating their time and money for our enjoyment and these assholes decide to fuck them over because they think they're badass or something. Fucking losers.

EDIT:

I believe its releated to this.

http://www.facepunch.com/showthread.php?t=854605

Nice link, it's got lots of ways to deal with this. Hopefully this finds its way to alters.

[ball2hi]

EDIT:Nice link, it's got lots of ways to deal with this. Hopefully this finds its way to alters.

I see how it is! Dont mention Soduka's eh!

[darkhazz]

Oh and if you want to use a Lua module instead, you can find mine in my site's files directory (chrisaster . net/files/gm_netchannel.zip).
This also allows you to send files to clients whilst they are in-game.

fan-fucking-tastic

[ball2hi]

fan-fucking-tastic

Now this does not look too good.

[tehshadow]

the dnr server is safe for the moment. i've been joining on and off for the last hour or so

[Ajunk]

I see how it is! Dont mention Soduka's eh!

This appears to be in Soduka's thread, and you seem to be on top of it, so I can only assume that every effort as been made in that regard already. I can't say I see the same for alters, at least not on these forums, so all I can do is hope things are under control.

Related: I'm not sure if I'm glad I uninstalled steam for exams. On one hand I can't really help, but on the other hand I'm not getting frustrated/viruses.

[Erscheinung]

I've managed to get my server back up and running and have banned the two people I mentioned earlier. If other server admins want proof that these two were responsible, I will gladly provide my server logs. It's possible more people than just these two I posted in Sodukas' thread though, hacked servers too. If any server admins have problems fixing their server and don't want to reinstall, I managed to solve my problem so I think I can solve yours too if you want to add me to steam.

[Ajunk]

I think that maybe this is the wrong thread for this discussion. Perhaps shift it over to the server threads.

[Bad King Urgrain]

I've split off the hack stuff discussion to its own thread.

From what I understand at this point, without having read the facepunch topic yet, is that it's a Source exploit that (perhaps amongst other things) allows hackers to gain RCON access, which allows them to do anything. It is not TTT specific, or anything to do with Fretta (the current TTT build has nothing Fretta-like in it yet).

edit:
http://www.mail-archive.com/hlds@list.valvesoftware.com/msg40151.html

So does not work in TF2, but does in GMod and L4D2.

That email thread has a few possible fixes, including this server plugin.

[FF|NedStar]

I've managed to get my server back up and running and have banned the two people I mentioned earlier. If other server admins want proof that these two were responsible, I will gladly provide my server logs. It's possible more people than just these two I posted in Sodukas' thread though, hacked servers too. If any server admins have problems fixing their server and don't want to reinstall, I managed to solve my problem so I think I can solve yours too if you want to add me to steam.

Would you kindly post those steamid's, I'm going on a "ban first" basis on this one.
Currently reading up on the security, thanks for the heads up guys.

Edit*

Juiced up the security. I'll get back to you if I run into any problems.

[Secone]

I was gone for one night and this shit happens? What the christ.

[Erscheinung]

L 12/04/2009 - 18:34:51: rcon from "66.131.104.4:55202": command "lua_run Entity ( 3 ) : Remove ( )"
L 12/04/2009 - 18:34:52: rcon from "24.45.106.43:50020": command "lua_run for _, p in pairs ( player.GetAll ( ) ) do p : SetFOV ( 360, 0 ) end"v


[18:36:44]Client "sniper112" spawned in server (24.45.106.43:27005)<STEAM_0:1:3307510>.
[18:36:44]Client "zetanor" spawned in server (66.131.104.4:27005)<STEAM_0:1:8562485>.

These two are the responsible ones on my server Nedstar. Notice how they have the same IP's as the ones using console commands.

[Rotinaj]

Find where they live and hack them in real life

to pieces