COD4 Server [FIXED]POSSIBLE COD4 SERVER HACKED?!

[mandinghino]

I don't want to raise any false alarms but something VERY VERY strange happened today around central European time (7.50pm)!

 

We were having fun on one of our beloved F|A Beginners server(108.61.21.94:28934) when all of a sudden the RESTARTED in a middle of a game(something usually only a high up admin has the power to do) then this S.O.B hacker(can't remember the name) stared wallhacking/aimbotting everyone without reserve! What caught my(our) attention was that every time the S.O.B. killed someone the hackers nick changed to that name(i.e. when I was killed the hackers name changed to Mandinghino!) so his name changed continuously and I even saw my name like others listed as banned etc. Very strange indeed!  

 

Can someone please check the server logs for any suspicious behavior? It could be false alarm but I'm seriously worried that the server(s) might have been hacked!

 

PEACE.

 

Mandinghino

Edited April 17, 2016 by mandinghino

[Diggity]

Mandi, in the future can you in your most soberest attempt (lighthearted US humor) take a demo when something like that happens?  It would be very helpful and you could even post it on our forums in the Cheaters section.  If you are not sure how to take a demo and then post it on our forums let me know and I will PM you the basics.  

[speedfact]

I'll look into it tomorrow night when i have free time. I checked the server and everything seems to be working as of right now....

[Bow_In_Honor]

Mandi, the next time something like that happens, or anyone you feel is hacking comes on the server, just take a demo and submit it on the Cheater Report thread. You're a long time regular on our servers and I'm glad you stay active on the forums. If you don't know how to take a demo and submit it than take a look at

http://fearless-assassins.com/topic/16512-things-you-can-do-to-help-catch-a-cheater/

And if you need help beyond that, like finding the demo on your computer, and submitting it then please ask me or another admin, on the server, or on forums. My message box is always open for questions, especially from our regulars like yourself.

Also, any information you can collect about said player, like the time and date they connected to the server, is extremely helpful. Even if it's just a screenshot of the console, it's better than nothing.

[redy.]

Thanks for the report mandinghino! It is because of regulars like you that we get information and feedback so fast.

[mandinghino]

Mandi, in the future can you in your most soberest attempt (lighthearted US humor) take a demo when something like that happens?  It would be very helpful and you could even post it on our forums in the Cheaters section.  If you are not sure how to take a demo and then post it on our forums let me know and I will PM you the basics.  

 

LOL! I swear it happened so fast I didn't even have the time ... Nobody was expecting the server restart(just like when an admin restarts a map mid game) least the other crazy special effects haxxor name changing to everyone's nick on the server at that moment + a list saying they were banned before Houdini(the haxxor) suddenly vanished into thin air. It all happened in a split second and my only thought was to warn the admins through the forums. I was also hoping somebody else who saw what happened(and I can assure you there were many) would come here and testify the event too.

I totally agree with you, there needs to be proof (screenshot,video etc..) before posting anything but because of the severity of the episode, I thought it would be quicker to check the server just in case :-)

 

I'll look into it tomorrow night when i have free time. I checked the server and everything seems to be working as of right now....

 

Thank you sir, I'm sure the server logs can say if the server was restarted suddenly(about half an hour before I posted on the forum) and other strange stuff. I wasn't that tipsy at the time so I'm sure it wasn't seeing thing LOL!

 

Mandi, the next time something like that happens, or anyone you feel is hacking comes on the server, just take a demo and submit it on the Cheater Report thread. You're a long time regular on our servers and I'm glad you stay active on the forums. If you don't know how to take a demo and submit it than take a look at

http://fearless-assassins.com/topic/16512-things-you-can-do-to-help-catch-a-cheater/

And if you need help beyond that, like finding the demo on your computer, and submitting it then please ask me or another admin, on the server, or on forums. My message box is always open for questions, especially from our regulars like yourself.

Also, any information you can collect about said player, like the time and date they connected to the server, is extremely helpful. Even if it's just a screenshot of the console, it's better than nothing.

 

Ok thanks for the heads up.

 

Thanks for the report mandinghino! It is because of regulars like you that we get information and feedback so fast.

 

You're welcome redy <3 I'm sure most would report the same if it happened again

 

PEACE.

[Muumipappa]

This very same event of map reload/map restart happened earlier yesterday also. Around 3-4pm CET.

 

Manuadmin also restarted before that and informed that "manuadmin is watching", so is it hole in manuadmin or is the rcon pw compromised.

 

First i thought it was some admin just doing something on server, but seems like not.. 

[speedfact]

This very same event of map reload/map restart happened earlier yesterday also. Around 3-4pm CET.

 

Manuadmin also restarted before that and informed that "manuadmin is watching", so is it hole in manuadmin or is the rcon pw compromised.

 

First i thought it was some admin just doing something on server, but seems like not.. 

that was me lol. was doin some server maintenance while i had the chance...so i restarted all the servers for some quick fixes....didn't think anyone was on lol.

 

Anyways checked logs, seems it was a server crash. Should be fixed now. As for the hacker, he was banned for too many name changes...added to ban list and what not. None of the regular players were banned so all is fine.

Thanks to you and rude we shouldnt have anymore server crashes for a while.

Edited April 20, 2016 by speedfact

[Muumipappa]

that was me lol. was doin some server maintenance while i had the chance...so i restarted all the servers for some quick fixes....did think anyone was on lol.

 

Anyways checked logs, seems it was a server crash. Should be fixed now. As for the hacker, he was banned for too many name changes...added to ban list and what not. None of the regular players were banned so all is fine.

Thanks to you and rude we shouldnt have anymore server crashes for a while.

Damn you

 

Well good it's not hacked then

[Diggity]

that was me lol. was doin some server maintenance while i had the chance...so i restarted all the servers for some quick fixes....didn't think anyone was on lol.

 

Anyways checked logs, seems it was a server crash. Should be fixed now. As for the hacker, he was banned for too many name changes...added to ban list and what not. None of the regular players were banned so all is fine.

Thanks to you and rude we shouldnt have anymore server crashes for a while.

 

Ah, so Speed broke it is what I take from all of this!  HA!  Thanks for taking the time to look into and fix it.  Big thanks for banning hacker as he was beyond annoying!  

[TTFr]

I read in the forum something Lady *Raewyn* wrote, a quick way to make demos:

 

 

"A helpful tip for recording demos!

 

Use binds. So if something happens and you want a really fast demo, you only need to press two buttons. ^.^ I often use most keys centered around L.

 

Examples...

 

Open console and type:

 

/bind O record

/bind P stoprecord

 

And voila! You now have instant start and stop buttons for recording! :)"

 

TTFr

[Muumipappa]

This is what i have in my mp_config.cfg

//Demo Toggle Script
seta demo_start "record; seta demo_fa vstr demo_stop"
seta demo_stop "screenshotJpeg; stoprecord; seta demo_fa vstr demo_start"
seta demo_fa "vstr demo_start"

Just very top of the file before unbindall.

 

And then just same way bind it to some key.

bind P "vstr demo_fa"

What it does is that when P is pressed it toggles record on and off and takes one screenshot before stopping recording.