rcon hacker!

a guy named Penner. using this ip 87.146.254.6:65451 always kicked people of our server. he wasnt in fruit clan! i dont know his usgn! i dont know how he get our rcon? somebody told me he hacked our rcon but i dont know. well i try now to find out who this guy is..
IP Information - 87.146.254.6
Host name p5792FE06.dip.t-dialin.net
Country Germany
Country Code DE
Region Schleswig-Holstein
City List
Latitude 55.0167
Longitude 8.4333

Admin (ban?) *DEAD*: Hello can i join fruit?
[15:28:52] |fruit| banana killed |fruit| Apple with M4A1
[15:28:53] |fruit| Apple *DEAD*: ahh
[15:28:55] |fruit| Papaya ~ *DEAD*: no
[15:29:01] |fruit| Papaya ~: we are full
[15:29:01] Admin (ban?) changes name to Penner.
[15:29:03] Penner.: why?

thats what apple wrote me:

1bonp User
hey , i spotted a hacker on our servers ,
his name was AN , and he telled me he can hack Rcon of all servers , by seeing the memory of admin"s console ...
he didnt know i was an admin , i was named "Justin Bieber Gay"

i still dont belive him he can hack , i think he just typed xxxx / xxxx , cause our rcon is easy ...
maybe we must change it ...

The AN data is this :

# 1, AN, IP 87.146.240.244 , USGN #40641

i banned him of aim server .

thats his usgn data:
usgn: 40641

btw,. i changed now rcon of all servers
user: Leonie
registered since: 22.12.10 13:31:02
last time visited unreal software: vor 1 Woche

maybe i switch the servers to usgn only.

thats a nice Idea!! so we can ban precise and easyler!
Make this!

Ban an IP range just like banaan Suggested..

Cuz our IP changes everyday.

ok ok ,

who thanks all hehe . ? heh ?

Who u below all apologies ? heh ?
xD

banaan wrote:

According to a single unreliable source, it is possible to 'hack' about 10% of the simplest rcon passwords.
It is, however, a lot more likely that the rcon was passed on to this person, either on purpose or accidentally, e.g. by saying rcon_pw [yourrcon] without the trailing slash.
The best thing you can do is change the RCon password and then ban his IP.

I searched through the logs for a bit, I got zillions of hits, thousands of lines, that much even that I couldn't finish the search and had to abort because otherwise the output would become too much (100s of MBs after just a few seconds, far from done). He is german according to his IP address, his USGN ID is 40641 (name Leonie). Another name he used was RealLife.
He also used the name |fruit| BlackBerry*. I don't know if it's one of your members, if it is I'd consider kicking him

His actual IP is 79.236.255.11 btw.

Wait I found something: RCon was told by |fruit| Coconut to |fruit| BlackBerry* in-game on the 9th of January. That's also the first RCon usage by this guy I could find.
Other names I found were »Raz0rZ« # Marcel*, »AcerZ« # Marcel*[R], »Raz0rZ« # Player*, razorzgaming.tk, »un[4]life' | Leonie, UFC, »Leonie, AN, |fruit| 0rang3, [s.clan] Lumqi, traiN, AdmiN, |fruit| Player*, |fruit| Cherry, LAST, |fruit| MABYE LEAVE -.-', Admin here. And those were only the first 2000 lines (out of 72208 before I aborted the search :S)

He's been clanhopping (or faking) quite a lot btw, wearing four different tags through each other.

I might add a grep function to the webFTP in the future so you can do some searches yourself. This was an easy one - he played via a proxy but forgot to log out of USGN at first so I could catch him.

Hope that's enough.

Greetings,

Banaan



Op 30-1-2011 17:05, danny llerena schreef:
- Zitierten Text anzeigen -
Antworten | Allen antworten | Weiterleiten | Drucken | Löschen | Original anzeigen


Ihre Nachricht wurde gesendet.
danny llerena <kingmathers616@gmail.com> 30. Januar 2011 20:44
An: Banaan <fruitpapje@live.nl>
Antworten | Allen antworten | Weiterleiten | Drucken | Löschen | Original anzeigen
M&M3 wrote:
huh?? omfg thank you!! black berry was in our clan!!! we will ban
him!! he is crane! he was with me in gR| clan his name was nobody!!
thank you very much banaan! really helped me! yes i wanted to search
for myself. i downloaded some logs but i only could download 1 log
file.. i tagged all logs but then i saw there is no download button
:-P

TO ALL MEMBERS NEVER SAY RCON TO ANYBODY!!! I AM THE ONLY WHO GIVES RCON AWAY!!

@ ash please ban Player* of our website! he didnt hacked the rcon password bc he had the rcon! he was the abuser!

Wait I found something: RCon was told by |fruit| Coconut to |fruit| BlackBerry*
Coconut gave Blackberry the RCon? -.-

I just can say a big
I've also thought about why Blackberry isnt to see on the Servers... but this, omg....

Thank you Banaan, very good work!!

i gave blackberry too rcon but then i had to change bc he abused

ye that was the really old rcon, but the newest rcon i dont gave him, ive hadnt seen him for a few weeks until yet

that was the only on, where i make a mistake, he was asking all the time ._.

thats what i already said ! Dont accept new users on our clan after the Application !
U know , we must trust only people who we know about long time :

(ex: I know ^emo since i started to play |about 4 months ago|, and M&M3 , i seen him on .nl server ; maybe he can remember me as Angel, 1bnop)

But , i already said , dont accept all users !
Yes , at test hes maybe good , but u must know him ... u know , seen him on servers etch ... but if u see him for the first time, i feel something sospecious abiut new people i meet ..

U know , this is internet , all can happen ! Maybe , i m a hacker , and trying to hack the pw of M&M3 servers ! No jk xD

maybe we should ask |Kebab| clan for one script :

u know , on theirs servers , when u connect , it says :

Ex: I connect , and says , Apple is a |fruit|

and when a faker connects , says

Player is not a |fruit| , kick him , and he gots banned xD

Why not ? =)

to much work for me to update everything.
btw.: blackberry asked me everytime for rcon. he was so annoying. happy he isnt anymore a fruit

Can you send me the new rcon password please? I still see hackers sometimes, though less than before.