security irc channel

[Jakov_the_Jakovasaur]

hello!

lately my systems seem to have been catching more unique players using a certain tool to inject weapon code, and usually this will cause them to be disconnected among other potential consequences, but another thing ive noticed is that typically they just log on to another server afterwards where a new set of staff may be oblivious to their intentions

i then realised that through a combination of using both global irc channels and remote control tabbed irc channels, it would be possible to setup a system where servers can report hack warnings to a global irc channel, and then through onReceiveText() any participating individual servers can relay these warnings to a tabbed remote control channel for logged in rc staff to automatically receive

does anything think it would be worth setting up?
it would ofcourse be open to potential abuse, false-positives and potential spam

[PhantosP2P]

The only thing we ever notice on Valikorlia, a server without any economy or anything to abuse with hacks, is that sometimes RC rings off about a user logging in with a proxy or something along those lines (logged in as 127.0.0.1). Is that related, or of any use to share?

[Jakov_the_Jakovasaur]

127.0.0.1 is a users localhost, which is used as part of the weapon injecting mechanism instead of communicating directly between client and server. though it does not necessarily mean someone is injecting code so would be more suitable as a warning than an alert

i have never noticed that message however despite successfully catching a lot of weapon injects through scripted security, surely that is a detection which has been scripted by someone on val?

other than code injections i also still notice the occasional x/y hacking, memory editing of function names to bypass systems like wall detection, and attempts to use the movie gani exploit even though it doesnt work in v6 having worked in v5

[callimuc]

Originally Posted by Jakov_the_Jakovasaur

i have never noticed that message however despite successfully catching a lot of weapon injects through scripted security, surely that is a detection which has been scripted by someone on val?

neither did i ever see it, and we got some hackers and lot's of "hackers" on era iphone. must be a costum script you're using on val

[scriptless]

Originally Posted by callimuc

neither did i ever see it, and we got some hackers and lot's of "hackers" on era iphone. must be a costum script you're using on val

I have seen it on one other server. Not sure if they share the script or if it's a server option that needs turned on.

[NicoX]

Originally Posted by scriptless

I have seen it on one other server. Not sure if they share the script or if it's a server option that needs turned on.

It is a script Stowen shared with GK. I also added it on Val too.

[Jakov_the_Jakovasaur]

hello!

i have now discovered the way that you can tell if someone is relaying data through localhost, does anyone know with 100% certainty if there is a good reason or potential false positive which means you shouldnt just disconnect such players automatically?

thank you!

[fowlplay4]

Originally Posted by Jakov_the_Jakovasaur

hello!

i have now discovered the way that you can tell if someone is relaying data through localhost, does anyone know with 100% certainty if there is a good reason or potential false positive which means you shouldnt just disconnect such players automatically?

thank you!

pm me your method.

[PhantosP2P]

Originally Posted by NicoX

It is a script Stowen shared with GK. I also added it on Val too.

Well that explains that.

Jak: I see this easily 2-3 times a day. We never have people come back or try to communicate with us outside of the client, e.g. on forums, to try to rectify the issue so my assumption is that they are up to no good or otherwise do not belong to our usual roster of 40-60 people.

[Jakov_the_Jakovasaur]

Originally Posted by PhantosP2P

Well that explains that.

Jak: I see this easily 2-3 times a day. We never have people come back or try to communicate with us outside of the client, e.g. on forums, to try to rectify the issue so my assumption is that they are up to no good or otherwise do not belong to our usual roster of 40-60 people.

i would guess that it is 99% certain that anyone relaying data through their localhost is up to no good, however i do not know with 100% certainty whether this could occur for a perfectly valid reason

[xAndrewx]

got a fix on iEra, hit me back if you need it.