Hacker

[radio_active]

I have recently had a user hack my site.

IP Address = 90.200.99.157

Email = [email protected] ( may not be valid ) or this [email protected]

I believe he may have used a URBAN injection in which he got into userid number 2s account who is admin. I have fixed the economy but i need to know who he is, do you know?

[radio_active]

Re: Hacker

I would also like to request code which means you cannot remove ID 1 from admin. I believe its just a query but i cannot write it seen as im on a german keyboard which does not have square brackets.

[-Matt-]

Re: Hacker

Password protect your staff panels...

[ShizzleNizzle]

Re: Hacker

Oh yea Krafty i've seen him before.

Likely exploit is forum's.

[radio_active]

Re: Hacker

Yes my forums are exploitable most likely, i will take them down now.

[Tezza`]

Re: Hacker

 

I would also like to request code which means you cannot remove ID 1 from admin. I believe its just a query but i cannot write it seen as im on a german keyboard which does not have square brackets.

this would be silly, as if your where to be hacked again... they would be able to do as much damage as they want....

your best approach would be to lock your ip either for your account.. or for the admin panel.... meaning only YOUR ip (computer / household) can go on either id 1's account or the admin panel.

[radio_active]

Re: Hacker

My IP changes everytime the internet connects to a new IP. So i cannot do that and i am not at my house, i am in germany for 3 more months then i go home so it is rather innaprops for now.

Matt's suggestion seems most logical to me at the moment dash get some new forums!

[mdshare]

Re: Hacker

so look at a way how to solve that with a dynamic IP

example

login > check previous logged in IP if not the same > mail validation

validate, updates your new IP and you can login

[radio_active]

Re: Hacker

That would mean i will most likely be having to validate my account by email every time i login or everyday, i have removed the forums and i will either use phpbb3 external or floydian if he will sell me a copy.

After all it was not my account that was hacked but ID 2, so thats why i wanted it so i cannot be removed or demoted by staff as its just a hassle having to go t phpmyadmin when you dont have your laptop and give a little "update users set user_level=2 where userid=1" if it is hacked. Hopefully not again though.

[Tezza`]

Re: Hacker

 

That would mean i will most likely be having to validate my account by email every time i login or everyday, i have removed the forums and i will either use phpbb3 external or floydian if he will sell me a copy.

 

why do you mind....

if it kept my game secure i would login to validate everytime i logged in.

[Floydian]

Re: Hacker

adding phpbb3 to an existing game would be difficult.

just take the password that needs to be stored in the phpbb users table. it uses a different hash than mccodes and since I wouldn't have a list of passwords for all your users (since presumably you have them stored as a hash only), I wouldn't be able to automatically set up your existing users with accounts.

You could automatically log them into the forum, but they wouldn't ever be able to login to the forum by itself, and they wouldn't be able to change their password on the forum (since they wouldn't know it).

Thus, you're only viable option would be to force existing users to sign up to the forum and then link their accounts to the game account. Not a pretty picture.

So, I don't think I'd be taking on that job without sufficient pay (more than $100 USD for sure).

[toufail]

Re: Hacker

"Password protect your staff panels..."

any clue on how i approach on doing that, any one

his name is Fahim Miah ([email protected]) aka [email protected] he tried it on mine as well

but i dont have a secound person as admin but still he came in as a normal user then added a announcement Get Help @ [email protected]

[radio_active]

Re: Hacker

 

adding phpbb3 to an existing game would be difficult.

just take the password that needs to be stored in the phpbb users table. it uses a different hash than mccodes and since I wouldn't have a list of passwords for all your users (since presumably you have them stored as a hash only), I wouldn't be able to automatically set up your existing users with accounts.

You could automatically log them into the forum, but they wouldn't ever be able to login to the forum by itself, and they wouldn't be able to change their password on the forum (since they wouldn't know it).

Thus, you're only viable option would be to force existing users to sign up to the forum and then link their accounts to the game account. Not a pretty picture.

So, I don't think I'd be taking on that job without sufficient pay (more than $100 USD for sure).

Im not actually re-questing anythng here, lol. If i was to add a phpbb3 forum as i have done before i have no intention to get users signed up and have all who sign up to the game automatically get an account, it would simply be if you want your opinion put down you sign up and post away.

 

"Password protect your staff panels..."

any clue on how i approach on doing that, any one

his name is Fahim Miah ([email protected]) aka [email protected] he tried it on mine as well

but i dont have a secound person as admin but still he came in as a normal user then added a announcement Get Help @ [email protected]

Yes i got him off the site before he could do any damage, all he did was post an announment and gave everyone 2.147bil crystals, money and ddays which is a simple fix really, especially if you have backup. So i used the cpanel's IP Deny manager.

Floydian, what i posted was about the in game forum code that you made for Cove of Pirates. :-)

[DeaTH_RideR]

Re: Hacker

well i can add my self to this list he hacked in through id#5. i have also banned his ip from the site but he came back today asked me if i wanted his help to add him to my msn i did i want to find out what the heck is going on .

[Modern-Empires]

Re: Hacker

to get this correct his name is Kevin

[raushan2007]

Re: Hacker

He hacked my site to...how the hell do i get back my account? PLS HELP ME

[AlabamaHit]

Re: Hacker

use your Database.....find the IP of the person logined in on ID 1...Make sure its not yoru IP....if its not...Use you cPanel IP Ban That IP

Now go into users and chage the password back...

just make up a work.say use password for your password..

its md5 so you have to hash , it, simple,

google md5 has, find a sign to give you the hash the word password..

Now you have your passsword back, AND the hacker is IP banned.

If the user name is changed, just change it in th cPanel.

 

Now with that said....STOP MAKING GAMES WITHOUT PROTECTION

Secure yourself BEFORE you release the game...No game is released fast..

If you bought the codes, and released the game in less than a week, you WILL get hacked...cause you have not had time to code your game....Just take your time and secure it,

DONT ASK HERE HOW...

Search the Forums there are tutorials....if you ask here you will get called a moron and told to use the search feature.

[radio_active]

Re: Hacker

If you can login to your account and your not staff use this in the SQL in the DB.

update users set user_level=2 where userid=1

else if you cannot login, make a new account and do the same SQL only changing the 1 (userid) to the number of the new account.

If he credited everyone money and crystals use this

update users set money=10000;

update users set crystals=2

That should hellp

[Floydian]

Re: Hacker

 

Im not actually re-questing anythng here, lol. If i was to add a phpbb3 forum as i have done before i have no intention to get users signed up and have all who sign up to the game automatically get an account, it would simply be if you want your opinion put down you sign up and post away.

My point wasn't to "sell services", but rather a simple comparision. I.e., if I wouldn't do a job for $100, then it must be a hard job to do.

Make sense? ;)

 

I can't really comment on all the hacking going on. If I did, I would sound like I'm being harsh.

I.e., it might go something like this ----

There are two sorts of folks that routinely fall victim to hacking. Naturally I am talking about people that run games based on mccodes. Now the two types of mccodes game owners that fall victim to hacking on a regular basis are the ones that can't code and want other people to write up solutions for them pro bono. And then there's the folks that either can't code or are poor programmers that don't have the funds necessary to pay someone to secure their site.

There is no "catch all" solution that prevents hacking. Remember, the Pentagon is hacked on a daily basis. So obviously, you simply can't prevent it all. Password protection? How about a brute force attack. Sessions, how about session fixation attacks. Oh, you're on a shared server, then your temp files containing tons of information like session ids are voulnerable to any of the 1000's of folks sharing your shared host.

Ah, so you've figured out how to prevent all of those. Have you gone through every script and every file on your game and have you understood completely what the code there is doing? If you haven't, then you haven't even begun to secure your game.

mccodes was and still is full of security wholes. Dabom just didn't know squat about secure programming methods. Just consider the fact that dbs2 requires magic quotes, or it dies. lol that's beyond laughable.

 

So, folks use a hellaciously insecure platform and are amazed when they find out they get hacked over and over again. Folks pick up free scripts and are amazed that the person that made the free script wasn't too concerned about the quality of the code.

 

There really isn't anything one can say to help here because the only viable solution for folks that lack the necessary programming skils and/or the funds to pay for the services of someone that does have those skills is to tell them to try and plug a boat with more holes than swiss cheese with a rubber stopper.

 

But if I said that, folks would think I'm being harsh. And in reality, I sympathize with the hobbyists that run games in their time off from school, or whatever the case may be, who have trouble with the azzholes that go around trying to see if the same old hacks that worked on the last mccodes game works on the next one.

I sympathize with the fact that hobbyists aren't going to be able to afford a professional solution to their problems and aren't likely to posses the necessary skills to solve it themselves.

The best advice I can offer the hobbyists out there, is learn how to run a MySQL query.

If you can do something like this:

update users set user_level = 2 where userid = 1

Then you never have to worry about being dethroned from your staffly dais and not being able to regain your former position.

 

Learn how to use do something like:

update users set password = "gobbledygook" where userid = someone to perma ban

Useful when you are locked out of your staff panel and you just want to lock someone out of the game by preventing them from being able to log in.

If you had databased sessions, you could even log them out using

 

delete from sessions where userid = someone to log out

 

And if you're royally pissed, log them all out

 

truncate sessions

lmao

 

And if you're feeling generous,

update users set money = money + 9999999999

 

Learn your MySQL. If you can't be bothered to learn anything else, learn how to run a few queries. All the power is held in the query. Period.

[radio_active]

Re: Hacker

Not really but okay, that was just such a massive post and was a few days ago when i posted about that so i really cant remember what it was about and my lazyness is telling me not to go back and read...lol :-)

[Floydian]

Re: Hacker

That's how I win, massive posts ;) :P

[radio_active]

Re: Hacker

It certainly works, lol :lol:

[Hash-Op]

Re: Hacker

 

"Password protect your staff panels..."

any clue on how i approach on doing that, any one

his name is Fahim Miah ([email protected]) aka [email protected] he tried it on mine as well

but i dont have a secound person as admin but still he came in as a normal user then added a announcement Get Help @ [email protected]

 

to get this correct his name is Kevin

Yss his name is Kevin, not Fahim Miah

And I know Kevin

He's some guy I had to deal with about a year ago, he's alright once you get to know him.

Anyways, stop being a jerk

I've talked to him right now, and he left a warning on your staff notepad, written from your user account.

 

Kraftyz e-eh-echoless says: I lft him a big warning about an hour before my launch bro. He was online then so were other staff, ther just priks tbh. I told them I'm in and they should contct me quik to get help, or I'l jus attack coz am not in a good mood init

Hanif says: Ah..good job then.

I blame YOU for not checking your notepad when you were clearly online, so were other staff!

Kevin doesn't go around harming, without a warning, and by the looks of it, he has given a warning.

And also, it wasn't via the forums. He has no damn idea how to get through to it by the forum, he uses 'other' methods.

Anyways, nice to see your all back up and running.

[Becon]

Re: Hacker

I dont know if it helps or not but when I made my game...there are admins....and I made myself an OWNER account which was kinda like admin used to be but I limited everyone else. But since Im the only OWNER account...all the admins cant do squat to me. Then again Im sure some hacker can still get me some how. Thats what they do.