1
Hacker! - Help required [Urgent!]
Hello everyone, I'm here today because I have a huge problem with a hacker.
Every day he joins my server and CRASHES it. He said he found an exploit and will keep using it to lag and crash it. We have no idea how he does it, he just stands still in the spawn, then the server starts lagging and finally crashes.
I require your help Planet Minecrafters, PLEASE, does anyone have an idea on how he does that? He will keep crashing my server if I don't find how to stop him ASAP!
Thanks everybody! Any suggestion/idea would be greatly appreciated!
Every day he joins my server and CRASHES it. He said he found an exploit and will keep using it to lag and crash it. We have no idea how he does it, he just stands still in the spawn, then the server starts lagging and finally crashes.
I require your help Planet Minecrafters, PLEASE, does anyone have an idea on how he does that? He will keep crashing my server if I don't find how to stop him ASAP!
Thanks everybody! Any suggestion/idea would be greatly appreciated!
172
The hacker hasn't crashed us since 2 days now!
Yeah!!!
No no guys, it's up! I haven't seen the hacker today.
He may be DoSing it now. ._.
CorsicamanTheShadbusherCorsicaman
First, he can't op himself. Secondly, /save-all doesn't make my server lag at all, I often use that command... But thanks for the suggestion.
Your server's down right now. Is he still at it?
No it's not down...
It's down for me...
TheShadbusherCorsicaman
First, he can't op himself. Secondly, /save-all doesn't make my server lag at all, I often use that command... But thanks for the suggestion.
Your server's down right now. Is he still at it?
No it's not down...
Corsicaman
First, he can't op himself. Secondly, /save-all doesn't make my server lag at all, I often use that command... But thanks for the suggestion.
Your server's down right now. Is he still at it?
argentum alaeIf whoever it is can op them self, a command that might be able to lag you up so bad as to cause end of stream is probably /save-all which results in all chunks being force saved to the world data.
First, he can't op himself. Secondly, /save-all doesn't make my server lag at all, I often use that command... But thanks for the suggestion.
Are you guys absolutely certain it isn't something completely vanilla command wise. I think I know what could cause, but I might be totally wrong. If whoever it is can op them self, a command that might be able to lag you up so bad as to cause end of stream is probably /save-all which results in all chunks being force saved to the world data. If you used repeatedly on a large server it could probably kill it. I am a noob to server plugins though. As far as the multiple minecraft accounts thing, all you have to do is either buy a second account, or "borrow" someone elses username and password.
Block his IP on your firewall, if its hosted see if your host can do it.
They don't know his IP for sure. He's most likely using a proxy.
Did updating Craftbukkit to 1.6.2-R1.0 help?
What that would do is either eliminate his alts (he exploited the bug in the pervious version you were using), or cut back on his alts (he has alts, but also exploited the bug).
Once we cut back/eliminate his alt accounts, we can figure out his true account and ban that.
To new posters: we have already determined that this is not a DoS or DDoS attack, so don't suggest it is.
What that would do is either eliminate his alts (he exploited the bug in the pervious version you were using), or cut back on his alts (he has alts, but also exploited the bug).
Once we cut back/eliminate his alt accounts, we can figure out his true account and ban that.
To new posters: we have already determined that this is not a DoS or DDoS attack, so don't suggest it is.
OK! I HAVE BEEN HERE!!!!
Go into his profile file in the server files
get his IP
./banip [Ip]
Go into his profile file in the server files
get his IP
./banip [Ip]
omg, have you not ready what we said to people that said that?
He has proxies and multiple alts.
He is probably ddosing you. If I were you I would go ahead and ban this person's IP
(/seen (player name) to fine his IP)
This was he cannot go on another account he has and do this.
If he does continue to "ddose" you (which sends pings to your server ip and crashes it)
You do have his IP from the /seen which you can then provide to the authorities and allow them to track down this hacker and possibly throw his butt in jail lol
Ddosing is a felony which can be held with a 10 year prison sentence.
(/seen (player name) to fine his IP)
This was he cannot go on another account he has and do this.
If he does continue to "ddose" you (which sends pings to your server ip and crashes it)
You do have his IP from the /seen which you can then provide to the authorities and allow them to track down this hacker and possibly throw his butt in jail lol
Ddosing is a felony which can be held with a 10 year prison sentence.
Have you updated?
http://www.planetminecraft.com/blog/psa ... mediately/
This could be the exploit he is talking about.
http://www.planetminecraft.com/blog/psa ... mediately/
This could be the exploit he is talking about.
I understand. Access to the computer would be given through the IP address. Thus, he could just log in to the host website and change the bans and commands.
The only major way the hacker could crash an Internet site and your Minecraft server was if he knew your computers IP... unfortunately, thats available information. This is an odd idea and most likely wrong, but try disconnecting from the Internet all players who have access to console and the site. He might not be able to get a connection through your computer. This is all coming off the program I have on my desktop that if anyone opens, I have immediate access to everything they own. Its 4 lines of code, and I learned it in the semester of Computer Programming I took.
EDIT: Backup statement; he only seems to hack when you(you general peoples) are online. Unless you didn't say, there haven't been any reports of him hacking when you aren't online, as in Internet connected.
EDIT: Backup statement; he only seems to hack when you(you general peoples) are online. Unless you didn't say, there haven't been any reports of him hacking when you aren't online, as in Internet connected.
We have a 24/7 host, the server is not hosted from his computer.
He is right. He is crashing the server using an external program as a mod, we don't know exactly what.
Also, now this is important: make sure you're running at LEAST Craftbukkit's 1.6.2 recommended build. Prior to this (if you didn't already know), there was bug in all variations of the Minecraft server that allowed players to log in as anyone they wanted.
Make sure it's updated to this before we make any other moves, as this could prevent him from using alts.
What does using /version in-game or on the console tell you?
Make sure it's updated to this before we make any other moves, as this could prevent him from using alts.
What does using /version in-game or on the console tell you?
Aright, you guys are saying delete "his" files, do you guys not get he has a ton of alts, most of them are banned, and the rest we don't know hat the exact username is so we can't ban them.
Does the console/log say he executes any commands when he's on the server?
If not, then he's using some sort of hacked client to do this.
If not, then he's using some sort of hacked client to do this.
No, you already asked did a few pages before didn't you? He doesn't type any command that the console can see, check the spoiler I made to see what is displayed in the console.
I have no access to the console, I'm just helper on the Server, only the owner does (Corsicaman) otherwise I would tell you.
I'll help you guys tomorrow, I know a loophole to this "problem"
Thanks but I won't be online tomorrow so if you want to help could you send me a message? Thanks!
Um...OK...Either this guy is really good at this or the solution needs to smack us in the face because it has been sitting there the whole time. GOD I HOPE IT'S THE SECOND ONE.
btw It's down atm, he crashed it.
XZW72 > We don't know his ip, that's the problem! Moreover, we believe that he can crash the server without joining it.
TheShadbusher > I always left the server before it kicked me since it takes several minutes of lag before the server really crashes. And yes, I NEED to restart it.
TheShadbusher > I always left the server before it kicked me since it takes several minutes of lag before the server really crashes. And yes, I NEED to restart it.
If the server requires a restart, then he's not (D)DoSing the server. He's causing it to crash. There are several hacked clients out there (mostly custom, unreleased ones) that can cause this, but I haven't seen nor heard of any recently.
Try using my plugin to keep him from chatting, using commands, etc. and see if that helps.
Also, someone mentioned earlier that he may be modifying his player location somehow. Delete his player.dat file(s) in the world's main folder, and delete his player.yml file(s) in Essentials's player data folder (or whatever it's called) and see if that helps.
Try using my plugin to keep him from chatting, using commands, etc. and see if that helps.
Also, someone mentioned earlier that he may be modifying his player location somehow. Delete his player.dat file(s) in the world's main folder, and delete his player.yml file(s) in Essentials's player data folder (or whatever it's called) and see if that helps.
How can I do that if I don't know his name nor IP???
TheShadbusherKnightsabersHonestly, this is the plugin noob response; if he's typing in his commands directly into the chat, just make sure he can't type. Heck, if you have to, setup a /kill command for his IP every time he logs on. Don't know if thats possible, but hey.
I do have a plugin up on BukkitDev that prevents people without a certain permission from doing anything outside of walking around (no chat, commands, damage, etc.).
Load it up, make sure he doesn't have the permission (tsbgl.graylisted), and see if that stops him in his tracks. If not, then he's not doing anything Bukkit is capable of.
Plugin: http://dev.bukkit.org/bukkit-plugins/theshadbushers-graylist/
NOTE: I would never try to advertise any of my work anywhere it's not supposed to be advertised. I sincerely think this will help us determine how the guy is managing to crash the server.
EDIT: What does it say in your Minecraft client when you lose connection? End of Stream? If so, then it's probably a DoS attack (or a DDoS, though unlikely).
And yes, they did arrest him. It was a denial of service of a commercial service (both the server and the hosting company).
I still need to know whether or not the server is responsive (AKA it's still running when the attack ends, and you don't need to (re)start it).
I was replying to the original, first post question. I don't like to read through 11 pages of chatter :l
Good response though xD
KnightsabersHonestly, this is the plugin noob response; if he's typing in his commands directly into the chat, just make sure he can't type. Heck, if you have to, setup a /kill command for his IP every time he logs on. Don't know if thats possible, but hey.
I do have a plugin up on BukkitDev that prevents people without a certain permission from doing anything outside of walking around (no chat, commands, damage, etc.).
Load it up, make sure he doesn't have the permission (tsbgl.graylisted), and see if that stops him in his tracks. If not, then he's not doing anything Bukkit is capable of.
Plugin: http://dev.bukkit.org/bukkit-plugins/theshadbushers-graylist/
NOTE: I would never try to advertise any of my work anywhere it's not supposed to be advertised. I sincerely think this will help us determine how the guy is managing to crash the server.
EDIT: What does it say in your Minecraft client when you lose connection? End of Stream? If so, then it's probably a DoS attack (or a DDoS, though unlikely).
And yes, they did arrest him. It was a denial of service of a commercial service (both the server and the hosting company).
I still need to know whether or not the server is responsive (AKA it's still running when the attack ends, and you don't need to (re)start it).
You can edit the command blocks every time he logs as someone else.
Use this for ANY Ip he uses and hopefully he will eventually run out.
KnightsabersHonestly, this is the plugin noob response; if he's typing in his commands directly into the chat, just make sure he can't type. Heck, if you have to, setup a /kill command for his IP every time he logs on. Don't know if thats possible, but hey.
/testfor [playername][radius [server size]] /ban command blocks. Yes, this could make your server a bit laggy, but probably not as much as the hacker would.
TheShadbusher1. IP ban him (he may be using proxies though)
We don't know his ip. He never talks in the chat and crashes the server without joining.
TheShadbusher2. Report his IP to the authorities (local police, FBI, etc.)Police doesn't care about minecraft servers... I don't even have a proof that he is hacking...
TheShadbusher3. Change IPs
I already said that it was impossible. :/
TheShadbusher4. Wait it out
That's probably what I'm gonna do... I sent a message to my host, they might be able to help...
TheShadbusherAlso, a while back my friend's server was DoS'd (which is what this attack is most likely; no one's gonna bother to infect computers to create a botnet to DDoS a Minecraft server), and we reported his IP to the FBI, who subsequently arrested the guy.
The FBI arrested a guy who hacked a Minecraft server? No offence but it's hard to believe...
TheShadbusherThough, what error message to you receive when he "crashes" the server? Knowing that could help determine the type of attack. It would also help to know if the server literally crashes or not (you can't use the console, commands input don't resolve, etc.).
There is no error message, is just spams that and the server crashes after a few minutes...
Click to reveal
2013-09-21 19:37:08 [SEVERE] Reached end of stream for /199.127.223.142
2013-09-21 19:37:09 [SEVERE] Reached end of stream for /199.7.156.142
2013-09-21 19:37:15 [SEVERE] Reached end of stream for /71.95.184.144
2013-09-21 19:37:16 [SEVERE] Reached end of stream for /122.57.13.4
2013-09-21 19:37:39 [SEVERE] Reached end of stream for /70.181.251.28
2013-09-21 19:37:40 [SEVERE] Reached end of stream for /199.7.156.142
2013-09-21 19:37:49 [INFO] Read timed out
2013-09-21 19:37:49 [SEVERE] Reached end of stream for /67.143.228.242
2013-09-21 19:37:53 [SEVERE] Reached end of stream for /67.143.228.242
2013-09-21 19:37:54 [SEVERE] Reached end of stream for /199.7.156.142
2013-09-21 19:37:55 [SEVERE] Reached end of stream for /173.78.18.154
2013-09-21 19:37:56 [SEVERE] Reached end of stream for /92.26.34.193
2013-09-21 19:37:58 [SEVERE] Reached end of stream for /172.249.119.35
2013-09-21 19:38:06 [SEVERE] Reached end of stream for /67.143.228.242
2013-09-21 19:38:24 [INFO] Read timed out
2013-09-21 19:38:31 [SEVERE] Reached end of stream for /108.73.100.186
2013-09-21 19:38:36 [SEVERE] Reached end of stream for /67.143.228.242
2013-09-21 19:37:09 [SEVERE] Reached end of stream for /199.7.156.142
2013-09-21 19:37:15 [SEVERE] Reached end of stream for /71.95.184.144
2013-09-21 19:37:16 [SEVERE] Reached end of stream for /122.57.13.4
2013-09-21 19:37:39 [SEVERE] Reached end of stream for /70.181.251.28
2013-09-21 19:37:40 [SEVERE] Reached end of stream for /199.7.156.142
2013-09-21 19:37:49 [INFO] Read timed out
2013-09-21 19:37:49 [SEVERE] Reached end of stream for /67.143.228.242
2013-09-21 19:37:53 [SEVERE] Reached end of stream for /67.143.228.242
2013-09-21 19:37:54 [SEVERE] Reached end of stream for /199.7.156.142
2013-09-21 19:37:55 [SEVERE] Reached end of stream for /173.78.18.154
2013-09-21 19:37:56 [SEVERE] Reached end of stream for /92.26.34.193
2013-09-21 19:37:58 [SEVERE] Reached end of stream for /172.249.119.35
2013-09-21 19:38:06 [SEVERE] Reached end of stream for /67.143.228.242
2013-09-21 19:38:24 [INFO] Read timed out
2013-09-21 19:38:31 [SEVERE] Reached end of stream for /108.73.100.186
2013-09-21 19:38:36 [SEVERE] Reached end of stream for /67.143.228.242
Honestly, this is the plugin noob response; if he's typing in his commands directly into the chat, just make sure he can't type. Heck, if you have to, setup a /kill command for his IP every time he logs on. Don't know if thats possible, but hey.
EDIT: Tried jailing him? It would block anything he could do chat-wise.
EDIT: Tried jailing him? It would block anything he could do chat-wise.
Proxies and alts....
For the 100th time, we don't know his ip and he has several accounts.
We tried waiting it out, 3 weeks isn't enough for him.
Well, here are your options as I see them:
1. IP ban him (he may be using proxies though)
2. Report his IP to the authorities (local police, FBI, etc.) (again proxies)
3. Change IPs
4. Wait it out
If you can think of something better than these, that'd be great.
Also, a while back my friend's server was DoS'd (which is what this attack is most likely; no one's gonna bother to infect computers to create a botnet to DDoS a Minecraft server), and we reported his IP to the FBI, who subsequently arrested the guy.
Though, what error message to you receive when he "crashes" the server? Knowing that could help determine the type of attack. It would also help to know if the server literally crashes or not (you can't use the console, commands input don't resolve, etc.).
1. IP ban him (he may be using proxies though)
2. Report his IP to the authorities (local police, FBI, etc.) (again proxies)
3. Change IPs
4. Wait it out
If you can think of something better than these, that'd be great.
Also, a while back my friend's server was DoS'd (which is what this attack is most likely; no one's gonna bother to infect computers to create a botnet to DDoS a Minecraft server), and we reported his IP to the FBI, who subsequently arrested the guy.
Though, what error message to you receive when he "crashes" the server? Knowing that could help determine the type of attack. It would also help to know if the server literally crashes or not (you can't use the console, commands input don't resolve, etc.).
I think thats allowed in canada.
Lucky for you and I corsica!
Anyways, I know there are two hackers, that unicorn person and Benstone, cris told me he went on skype with them once, and they were friends or something...
Lucky for you and I corsica!
Anyways, I know there are two hackers, that unicorn person and Benstone, cris told me he went on skype with them once, and they were friends or something...
Is it a DDoS? That is a federal crime, and well punishable by prison. So in reality you won't be seeing him for a while xD
Well you know... It's like saying that downloading music illegally is punishable by the law... billions of people still do it because they know the police won't waste time chasing them...
Who does this? Do people really have lives so sad that they feel that their only escape is trolling/hacking people on the internet?
It's just easier to destroy than create, being able to ruin someone's work makes them feel important easily. In real life they're probably rejected little kids, bullied by their mates; hacking is unfortunately the easy way they found to express their frustration.
Yep, he thinks "he's evil" cause he does this, but standing in front of a monitor doesn't mean you're evil.
View 77 more replies
