After constant and successful DDoS attacks, a stranger broke into our server this morning. As I have now discovered after thorough tests and logic, the attack was not local, perhaps not even from a human and did not know our server. Let's call him the Seeker. The search engine tries to get to the accounts through the web account administration. I have seen these attacks in the past. However, we have several layers of protection against these attacks on the old site. Unfortunately, this can not be said about the upcoming website. The new site still has bugs and is not fully secure and is available only to people who know the address and, as we have seen, our Searcher knew it. The new website is intended to serve as a base for all player and GM activities. A new editorial complex consisting of all the add-ons we have so far, but under one login name and password. On the web, I tested these features with a GM account, and so I put the server at risk, which was used by our Seeker. My GM account, which is as yet the only one synchronized for all components of the new site system, served the attacker as a gateway to our server, because it is not yet fully secure. This has happened 28.2.2012 in the early morning hours. The attacker got into my GM account and executed commands (often invalid), some senseless notifications about hacking the server to harm the currently playing players (Total 13: Akywasha, Arry, Dzousefns, Inde, Rawera, Rovena, Spendlik, Tonyus, Werb, Winny, Gaschamber, Valka, Smoulakill). These characters were completely restored from the last backup, which took place on 20.2.2012. These were all players playing at this time + their guilds and accounts, so it was not a targeted attack on a faction or a specific person, as we initially thought, in short, those who were online at 3:15 in the morning. It wasn't even our server player.
The Seeker managed to execute the commands strictly forbidden even by the Game Masters themselves (it is not possible to perform them in the game even by me). These commands have been modified to abbreviated form. They could have been done this way. These are dangerous commands to reset all spells, flying, modifying states and many other commands. I completely removed these commands from the core today. It will no longer be possible to carry them out. Resets are performed only after the relog of the player and therefore it only affected someone (About 200 players, which were returned spells, professions, mounts and other data associated with the reset of spells from the last backup period, all other data remained at the old, unlike the mentioned thirteen characters, see above, where the whole character was restored, for other players everything remains at the old).
However, the server has extreme protection, I dare say that really exaggerated and as soon as after a few minutes found out that someone other than the person with IP addresses is on the account, the server shuts down all by itself, as it also happened over the morning. The attacker cannot access the server's database, its crate or anywhere else, it is too secure for that, it was only a GM account and its activities. The server behaved extremely well and all the measures worked and it was another mistake of mine that I quickly turned it on without verification at the request of the players and thus reset the newly logged-in players, while the damage could have been less. However, I believe that the damage is minimal after my diligent recovery all day and players can easily learn the missing spells in a few moments, nothing else was affected. I have secured the server, separated the new site, changed the passwords and I will only use normal accounts for tests on the new site system. No one is infallible, neither am I, although I am doing my best to ensure that such a situation never happens, and I will continue to do so. Thanks to the complete logo on our server, I managed to put almost everything in its original state, which has not been restored (level for skills, some individuals, etc.) the players have to polish themselves, we do not replace these things anymore.
As for the identity of the Seeker, he used a proxy address and thus is not normally traceable without a court order to issue his identity. Why do people do that? We have recently deployed a very successful and self-banning system on the server, which will immediately ban players using hacks (only these individuals). Even this could provoke some of them to refer the Seeker to our server, because he can no longer play out of his own stupidity and non-compliance with the rules, so after all, no one will play or at least we will fail.
I apologize for the server, I caused this situation partly by underestimating the danger of an unfinished website and one of my GM accounts, and then for the hasty start of the server, where instead of 13 people lost a few data more individuals. It will not happen again, I have taken all the steps for it. You can sleep safely now. What doesn't kill us makes us stronger. I also thank GM Tarenas, the player Smrada for help and user Chaotic, who quickly informed about the situation from my quick exit to the chat in a nice and clear topic on the forum for information to others when I was just busy. Thank you and I wish you a pleasant and trouble-free playing and enough talking, we are waiting for more repairs soon.
Repairs
29.2.2012 – 13:15
1) Another test of Anubarak's jam repair sometimes in the third phase
2) Fixed countdown to The Aspirant's Challenge quest
3) Fixed grid unload system for disappearance of some phased mobs - these mobs could in some cases disappear or fall under the texture - fixes quest for DK where it might seem that the necessary mob is missing
4) Fixed damage from glyph to Water Elementala
5) Fixed Glyph of Shadowflame (Distance of Action)
6) Fixed kicking players in Dalaran Sewers arena - now discards players if they are in the middle and the waterfall starts full or in the starting pipe
7) Fixed autocast for abilities for pets
8) Fixed focus regeneration on some pets
9) Removed dangerous commands directly from the kernel of the erver
10) Added Mind Control immunities to Bladestorm and Bestial Wrath