Evolve's base drama stuffs..

Okays, Let me start this post with a definition.
Hacker (computer security) someone who accesses a computer system by circumventing its security system

This term is commonly used in place of "Cheater" on Minecraft. There are some very big differences. But, I'll go into that in another rant..

First off, The situation as I've heard about it. Yesterday (7/19/2012) while rocketeer linden and a few other people were playing TF2. Someone Logged on to rocketeer's account and performed a /f unclaim all. Some time after this (I don't know how soon it happened) the land Evolve had claimed was re-claimed by other factions (Shock and Damn apparently).

Upon realizing this some of the land was reclaimed (by linden's brother) while most of their stuff is gone.

Laser, upon hearing about this, ip-banned the IP that logged into the account, but it didn't match up with anyone else's accounts.. So the trail is cold. (Unless of course the second that the land was unclaimed someone started claiming it... that would be pretty suspicious).

Okay, back to the definition.. Somebody used Rocketeer's account by Circumventing (guessing, brute forcing, etc) the password (security system) to gain access to the computer system (swaggercraft server). By definition, that makes the person in question a hacker.

This whole situation, puts laser in a catch-22 position. On one hand, he could declaim the land from the people who claimed it and give it back to evolve.. That would cause all the people who claimed it to start bitching and moaning about preferential treatment and how "SOANDSO DID THAT TO ME 2 YRS AGO AND I DIDN'T GET MY STUFF BACK!" (Even if they were the ones who compromised rocketeer's account)..

Or, He can do nothing, and have the risk of evolve and others feeling like they got a raw deal and realizing that hackers can do whatever they want and Laser can't do anything to punish them/stop them.

What I would have done is roll back the losses immediately. Why? Not because Evolve are my friends, or "bcuz they r powrful" or anything like that.. More Simple logic.. If you reward someone for doing something illegal, are you Encouraging, or Discouraging such actions? Sure, It'd be a bit of a ham-fisted action.. (Realistically if he was using logblock he could rollback specific changes done to the base, and tell the people in question to give back the stuff or be banned for a week or 2).. This is the same course of action MANY other games take, (World of warcraft, everquest, etc..) Because in the long run the bitching and moaning subsides and people who count realize the difference between being *fair* and being preferential.

Of course this would have to be on a case by case basis, to prevent people who had just been raided from having friends log on just for the hell of it to get stuff rolled back.

Doing nothing is exactly the opposite of the above.. It wears the guise of being fair, but instead rewards people who compromise other people's accounts because they get to keep the benefits of their deeds as long as they hide their tracks well enough..

To Evolve: I'm sorry this happened to you =/ The only real advice I can give to help coping with this is to build stronger passwords, don't give them out to *anyone* and don't respond to phishing e-mails and make sure you never use the same password for minecraft as you do for other accounts.. I'm sure most of you already heard the above statement many times. but, second.. I'd probably take this time to change all of your minecraft passwords..
Let me know if I can help with your recovery.

To Shock (bloodtamer) and Damn (Cody, textus): What you did was not glorious, it's honestly nothing to be proud of doing. Look at it this way, You watched someone throw a brick through the window of an electronics store.. and walked in after they were done and took a TV. That's nothing to be proud of, You didn't raid them.. you didn't break in yourself, you didn't kill them down to negative power and claim their stuff.. You took advantage of a bad situation and are now gloating over it. Grats on being bigger douchetards than I originally thought. Oh, and if one of you were the one who hacked his account.. Please, Go choke on some crackhead's warty dick and get aids.

To Laserlag: I don't know if you can rollback what happened, but I'd suggest it.. or you're letting them keep the spoils of what they do.. If you Can't, I'd strongly suggest putting in Authme.. since this is the second time this week an account with extra privileges has been compromised.. I'd also recommend removing the factions.unclaimall permission for anyone but the faction owner.. While it may be easy.. it seems to cause more problems than it solves..

I agree, Authme sounds good.

Doing what they did, isn't it more so cracking?

ShaunDepro wrote:

I agree, Authme sounds good.

Doing what they did, isn't it more so cracking?

Semantics, I'm using terms that are easy to understand by the people who don't know the difference between "White hat" "Black Hat" and "Grey Hat". Not to mention script kiddies and the network security elite.

I agree with Authme. Rocket seems to think there's a way to make it optional, as a second password if you choose. If this is possible all mods, trial mods and admins should be required to use it. While this entire event sucks, I'm glad that whoever was on Rocket's account didn't go on a banning spree.

And thanks for the support, Serin. I appreciate it, and I'm sure everyone else in Evolve does as well. c:

skelly wrote:

I agree with Authme. Rocket seems to think there's a way to make it optional, as a second password if you choose. If this is possible all mods, trial mods and admins should be required to use it. While this entire event sucks, I'm glad that whoever was on Rocket's account didn't go on a banning spree.

And thanks for the support, Serin. I appreciate it, and I'm sure everyone else in Evolve does as well. c:

Everyone is much safer with Authme but what happeneds if someone forgets their password, they wont be able to log in. I also like the idea of only the faction owner being allowed to unclaim all the land.

I am sorry but I think no action should be taken intill the acuseation of hacking is conclusive and the hacker is caught other wise it is just unfair that the people who raided evolve have to give there raided things back to evolve and also have you thought that no one hacked rocket that he/she could have just unclaimed it all for no reason and now wants all the things back? pointless i know but i think people would do it and also cabbage got hacked by miner AS we know but no action was taken and the same thing happend to decimation no one did a thing so just quit your bitching and get on with it other wise i think desimation damn and evolve get all there things back!

Please ignore Tom, he tends to make things worse.

Fire_unknown wrote:

skelly wrote:

I agree with Authme. Rocket seems to think there's a way to make it optional, as a second password if you choose. If this is possible all mods, trial mods and admins should be required to use it. While this entire event sucks, I'm glad that whoever was on Rocket's account didn't go on a banning spree.

And thanks for the support, Serin. I appreciate it, and I'm sure everyone else in Evolve does as well. c:

Everyone is much safer with Authme but what happeneds if someone forgets their password, they wont be able to log in. I also like the idea of only the faction owner being allowed to unclaim all the land.

That's like saying minecraft accounts shouldn't have passwords because people might forget them. Authme is a good idea, and making it optional seems like a good idea as well.

Thank you for the support, serin, we do really appreciate it.

tex you do relise what i am saying is that people should stop makeing a fuss about this and just get on with it as it has happend in the past and no one did a thing so why now if you'er going to undermine me then please refrain from commenting

laser is installing a plugin that only allows someone to log in from the ip they allow. This way no one else can get on your account unless they're on your computer. and you dont have to worry about remembering any passsords. im not sure if he'll just make this avaliable for staff, or if everyone has this option.

I think a much easier, less complicated solution would be to not hand out your minecraft log-in information.

To anyone.

No matter how much you trust them.

Ever.

Mash_Tactics wrote:

I think a much easier, less complicated solution would be to not hand out your minecraft log-in information.

To anyone.

No matter how much you trust them.

Ever.

That doesn't help when someone is using one of those clients that can steal anyones password (yes, they exist).

rocketeer55 wrote:

laser is installing a plugin that only allows someone to log in from the ip they allow. This way no one else can get on your account unless they're on your computer. and you dont have to worry about remembering any passsords. im not sure if he'll just make this avaliable for staff, or if everyone has this option.

Sounds somewhat good but has to be optional otherwise for some people who regularly log in from multiple ips will be restrained.

I also think the damage should be rollbacked or at least evolve should have their base back. The only problem is the factions who still believe Laser favors evolve will rage like little twerps.

naruto85 wrote:

rocketeer55 wrote:

laser is installing a plugin that only allows someone to log in from the ip they allow. This way no one else can get on your account unless they're on your computer. and you dont have to worry about remembering any passsords. im not sure if he'll just make this avaliable for staff, or if everyone has this option.

Sounds somewhat good but has to be optional otherwise for some people who regularly log in from multiple ips will be restrained.

I also think the damage should be rollbacked or at least evolve should have their base back. The only problem is the factions who still believe Laser favors evolve will rage like little twerps.

Those factions being the other 90% of the population that makes up swaggercraft.

rocketeer55 wrote:

Mash_Tactics wrote:

I think a much easier, less complicated solution would be to not hand out your minecraft log-in information.

To anyone.

No matter how much you trust them.

Ever.

That doesn't help when someone is using one of those clients that can steal anyones password (yes, they exist).

We both know that wasn't the case here.

I'm not anticipating to get our stuff back, nor do I really care that much. But I'm sick of people getting into others accounts and "raiding" them. It has happened to us twice now, and multiple times to other factions. There isn't enough done about it, plain and simple. You can tell it was planned, and in cases like this, I think it's fair to punish the whole faction until someone spills the beans on who did it. Because on a case by case basis, to me this is as bad as duping in my eyes. Imagine a faction with a ton of obviously duped items and they refused to respond to you who did it... Would you interrogate them or just be like.. Meh whatever.

It wouldn't be as bad if they just took items, but they unclaimed all too. I think that's the main thing here. People get into others accounts and steal what isn't theirs, but I think this is the only time unclaiming all has happened. That makes it so much worse, and why this is raising such a mess.

I think Laser needs to be stricter on punishment because I do not want this to happen again. To us, or any faction. Even if an enemy faction, or even the ones that did this to us, got hacked or whatever, that's still not right. It's a raid/PvP server, not a hacking server. [But it's certainly starting to look that way.]

The amount of times this has happened is ridiculous and still nothing is done. What's the point of building up if it can just be taken away illegitimately? There are clients you can use to find people's passwords, and even things like session stealing, or attempting to session steal which I wish were all made very illegal. I can't do the IP thing, I'm going away to college and will probably have a spoofing IP there. I can do AuthMe, but I'm still going to be iffy either way.

I don't expect our base back, because they'll just cry laser favors Evolve again. I think we're all pretty sick of that. x/ I'm just glad we got on in time to claim the spawners again that Skelly donated USD for. I'm very confident in our ability to build up again from this- the question is, do I really want to if it can all be easily ripped away with no punishment to those involved?

We all know that laser is so scared to punish them. Also he won't ban those fags because they are donors and laser could lose money

We cannot punish people for getting on an account and wreaking havoc if the information was handed to them.

In every player's .minecraft folder there is a file called lastlogin.

If you were to take that file and replace your own lastlogin file with it, you now have the latest login information of the last person to log in using that file.

That is not hacking. That is giving away your log in information. That is carelessness.

Never, ever share your .minecraft folder with anyone.

As far as I'm aware, that's what happened yesterday. And until some new information is presented, I'm going to assume that's exactly what happened.

I want you guys to all understand something. Myself and Laser are the two biggest targets when it comes to hacking. If these clients could magically pull your login information out of thin air, our server would be non-existant. They would hack our accounts, and ruin EVERYTHING.

As you can see, that is not the case. Myself and Laser have never had any serious security breaches, aside from the one from a couple weeks ago, where Mojang's authentification servers were compromised. We have been safe all of this time because we are very careful with our account information. We do not share it, we do not download things from other players, and we do not give out personal information.

If these clients really could steal session ID's, you'd see more hacking then there is. A lot more.

Ahhh, the perfect cover up story. Nope, I don't believe that, sorry. If it's who I think you're talking about, he didn't do it.

And for the record there IS clients out there that can steal a password. What's stopping anyone from getting that and logging in to someones account? [Well, besides having a conscience.]

You don't believe your own faction member?

Rocket admitted last night to giving his .minecraft folder to Niner for whatever reason. Unless he was lying, and I certainly don't see why he would be, then there is no reason to believe that this was a hacking attempt.

Furthermore, if there are clients that can pull session ids and login information out of the air, I still haven't been fully explained to about WHY they haven't targetted the two people with the most power on the entire server.

I very much believe he gave Niner the files. I don't believe Niner did anything except take the macro mod.

We don't know that he didn't.

As far as I'm concerned, that account was compromised the second he shared his information with anyone.

Mash_Tactics wrote:

We don't know that he didn't.

As far as I'm concerned, that account was compromised the second he shared his information with anyone.

Thing was buddy, I never shared the info. So nice try.

Niner256 wrote:

Mash_Tactics wrote:

We don't know that he didn't.

As far as I'm concerned, that account was compromised the second he shared his information with anyone.

Thing was buddy, I never shared the info. So nice try.

Just out of curiosity, do you have a polygraph machine attached to your computer that prevents you from lying over the internet?

You don't know that he did, either. So it's not safe to assume that either. I know it's s safer bet, and makes more sense that this would be the cause. But why can't anyone look into this more than assuming? And since this was now publicly posted that Niner had Rocket's login files it's safe to say anyone involved is now just going to blame him rather than get the truth out. :/

I don't know about the password stealer client very much. I know someone on Swagger has it, and some passwords it can't steal for some reason. That's all I know. I can't answer your questions on that. But it does exist.