Warning of possible attempts to use admin access commands

[Pyewacket]

[20:06:11] [PM from Passion: Unknown command received from zoki: #withdraw]

[20:06:15] [PM from Passion: Unknown command received from zoki: #store]

[20:06:22] [PM from Passion: PM from zoki: #help]

[20:06:23] Anbumedic wants to trade with you. Use the trade icon then click on him/her in order to accept the trade.

[20:06:30] [PM from Passion: PM from zoki: #adminhelp]

[20:06:37] [PM from Passion: PM from zoki: #advhelp]

 

While the above may have a perfectly plausible and reasonable explanation, which I am happy to invite Zoki to bring to our attention here on the forums, I believe the quote contains sufficient evidence to warn Bot owners that Zoki appears to be attempting to use admin level commands for nefarious purposes. I am quite surprised if this is the case, but since there was also no subsequent pm to the bot enquiring INV or LOC then i am forced to assume the worst case scenario.

 

Labrat banned him from passion for me some 10+ minutes after the above took place from ingame, and also believes this was an attempt to find something to exploit in the bots commands/listings. I have warned several bot owners ingame to ensure that these attempts are not tried elsewhere and now post here to continue that effort to contain a possible scam attempt.

 

Posted this here, instead of Outlaws since it is more to do directly with bot owners that the community in general, however if no reasonable and plausible explanation is forthcoming, a post in Outlaws will follow, with a link to this post so the rest of the community can also be informed to keep a sharp eye out in future.

[zoki]

[21:06:08] [PM to Passion: withdraw ]

---

[21:06:12] [PM to Passion: store]

---

[21:06:19] [PM to Passion: help]

---

[21:06:28] [PM to Passion: adminhelp]

---

[21:06:35] [PM to Passion: advhelp]

---

[21:10:00] [PM to Passion: inv]

---

[21:10:19] [PM to FlameKeeper: inv ring of]

---

[21:11:35] [PM to Tina: inv ring of]

---

 

(--- is the response of the bot)

 

OK this matter is resolved but I like to have it in the open the fact that i tried that commands is true, but if i wanted to hack and/or make one of the bots give me stuff i would not use the obvious commands, but rather send a 4-32 bit coded sentence... I merely used these commands to see only if they work, I was not in a trade with that bot, nor was I near it (and yes I was on the same map), as you may or may not know that my guild (-KA-) is getting a bot, and this was lets just say, kind of a test. We have yet to choose whose bot service we will use, but most likely it will be Learner's because I was highly offended by LabRat.

 

Sincerely,

Zoki.

[LabRat]

I didn't want to post about this, but now I will.

 

You were looking for exploits, caught red handed and confronted about it.

 

Your response: Oh yeah lol.

 

My response: Tell Lyndy that I am not willing to host her bot purely because of your attitude, have fun spending real money.

 

I heartily recommend Learner's services and am glad business is heading his way.

 

You are now banned irrevocably from every bot I host now and any I host in the future.

 

To clarify - you are now on my list of bots so the bots will not even waste a PM telling you that you are banned.

 

And please refrain from talking out of your rectum, a 4-32 bit coded sentence means absolutely nothing.

Edited April 26, 2008 by LabRat

[zoki]

And please refrain from talking out of your rectum, a 4-32 bit coded sentence means absolutely nothing.

lol i didn't say that it meant something, it was just an example... and I'm serious you got a problem m8t...

Edited April 26, 2008 by zoki

[LabRat]

And please refrain from talking out of your rectum, a 4-32 bit coded sentence means absolutely nothing.

lol i didn't say that it meant something, it was just an example... and I'm serious you got a problem m8t...

Yup I do have a problem - people entrust many hundreds of dollars worth of bots to me, along with millions of gold coins.

 

I take that responsibility very seriously, and I react with a ban first, ask questions later approach if I detect even the slightest sign of an exploit attempt.

 

Maybe that is exactly why I am so trusted with regard to bots?

 

You're pissed off because you got caught in the act and outed about it, but notice that it was not I that told the world - it was actually the owner of the bot you attempted to exploit.

 

The last time a bot under my control got scammed I went out of my way to get the player banned and locked - including every one of his alts. The post is on these very forums somewhere.. go find the thread.

[zoki]

By the way... I was offended not by your word, but by your silence...

I asked a couple of questions, and I didn't get the answer for, and I was wondering why Lyndy said that you had willingness to host our bot, and many other stuff concerning the matter (I don't remember at the moment) after your conversation with her, while I didn't get anymore PM's from you...

And I'm sure that you are a capable bot servicer and I have no doubt in your abilities, but I really care about my friend Lyndy, and I'm going to support any of her decisions and help her bot have a safe stay in EL, and I would never cheat... I don't believe in unhonorable stuff and actions, I always return death bags even if its just a bunch of flowers or potions, an for your information, I didn't write this to change your mind, I really do not care if I'm banned at your or any one's bots, I am not pissed off because I got caught in the act, because I did nothing wrong, despite your opinion of me.

 

Sincerely,

Zoki

[Theladin]

Didn't do anything wrong??? Are you kidding?? Consider yourself banned from my bot!

[Mar(c)]

Only thing I see is a way blown out of proportion reaction.

Seriously, whatever Zoki's intentions were, if trying out a few possible admin level commands on a trade bot is taken this hugely, what does that say about the security of admin level commands??

I really can't imagine that these commands in PM ever can be a threat to a well-written bot!

Should we all now doubt if it's safe to use your bot service, LabRat?

[Jezebelle]

Only thing I see is a way blown out of proportion reaction.

Seriously, whatever Zoki's intentions were, if trying out a few possible admin level commands on a trade bot is taken this hugely, what does that say about the security of admin level commands??

I really can't imagine that these commands in PM ever can be a threat to a well-written bot!

Should we all now doubt if it's safe to use your bot service, LabRat?

 

 

It was never said that what Zoki did was a threat to the bots. But, it seems Zoki made an attempt to break in, succesfull or not, thats still a BIG NO-No, in my eyes at least!

 

What if some held you at gunpoint, even tho the gun wasnt loaded, but you dont know that? Would you feel threatned, or would you say ' oh, that gun may not even be loaded, so why worry? '

 

Or, simpler said; someone locks himself into a big store,, but never comes around of stealing anything, coz the shopkeeper wakes up..does the shopkeeper has the right to call the police, even tho nothing was stolen?

 

Jez

[Mar(c)]

It was never said that what Zoki did was a threat to the bots. But, it seems Zoki made an attempt to break in, succesfull or not, thats still a BIG NO-No, in my eyes at least!

 

What if some held you at gunpoint, even tho the gun wasnt loaded, but you dont know that? Would you feel threatned, or would you say ' oh, that gun may not even be loaded, so why worry? '

 

Or, simpler said; someone locks himself into a big store,, but never comes around of stealing anything, coz the shopkeeper wakes up..does the shopkeeper has the right to call the police, even tho nothing was stolen?

 

Jez

That doesn't make any sense.

 

To the gun analogy: Zoki doesn't have a gun.

The only gun I *may* see here is the one LabRat is holding, pointed at himself. But I won't stretch it that far.

 

To the store analogy: the store is closed, and Zoki is just looking through the window checking out the alarm system.

His intentions may be good or bad, but it's definitely not even a reason to bother the police with!

[LabRat]

His intentions may be good or bad, but it's definitely not even a reason to bother the police with!

I never started this thread, PyeWacket did.

 

And yes, informing bot owners of a potential scam attempt is one of the main reasons the bot forum was set up in the first place.

 

I already stated that I deal with attempts like this in a heavy-handed manner (ban first ask questions later).

 

Ask anyone who has a bot I host just how much time I spend coding stuff or bughunting.

 

Directly as a result of this thread I have been approached by more than a few people to ask if I would consider hosting their bots purely because of the way I have dealt with this situation.

 

I fail to see how a loaded gun is aimed at my own head, if anything I feel exonerated by my actions.

------------

As an aside - notice that Lyndy is the one getting the bot not him, he had absolutely no business doing what he tried. If Lyndy wanted to see a bot in action I could have made a live one on the test server for her to play with.

 

Even the order he tried the commands shows deliberate intent:

[20:06:11] [PM from Passion: Unknown command received from zoki: #withdraw]

[20:06:15] [PM from Passion: Unknown command received from zoki: #store]

[20:06:22] [PM from Passion: PM from zoki: #help]

 

If he had tried help first to see the available commands I would be more inclined to believe his incredibly flimsy excuse but he went straight to withdraw (which btw does not exist on my bot code).

 

Will he stay banned? absolutely. Will I lose sleep over turning down Lyndy's bot because of his attitude after the matter was resolved originally and access to the bots by him was restored (oh didn't he mention that part? strange..) no.

Edited April 27, 2008 by LabRat

[Theladin]

It's not just his actions but his reaction to that as well. Trying to gain illegal access to a service is hacking. That's what he did and it's pretty serious. However, his reaponse to that wasn't "I'm sorry, I shouldn't have done that, it was a stupid thing and I won't do it again.", it was "Oh yeah lol" and an attempt to defend his actions.

[LabRat]

My chatlog regarding the entire event - almost a day before this thread was created. this is the accurate and unadulterated chatlog from my side:

[20:10:23] [PM from PYEwacket: hey?]
[20:10:27] [PM to PYEwacket: hiya]
[20:10:54] [PM from PYEwacket: zoki seems to be sending odd pm's to passion atm..possibly looking for weak spots?]
[20:11:24] [PM from PYEwacket: [PM from Passion: Unknown command received from zoki: #withdraw][PM from Passion: Unknown command received from zoki: #store]]]
[20:11:34] [PM to PYEwacket: ban him]
[20:11:37] [PM from PYEwacket: [PM from Passion: PM from zoki: #adminhelp][PM from Passion: PM from zoki: #advhelp]]]
[20:11:46] [PM from PYEwacket: he defo looking for exploit then?]
[20:11:49] [PM to PYEwacket: yup]
[20:12:00] [PM from PYEwacket: kk ty, thought i had best check with u]
[20:12:08] [PM to PYEwacket: I will ban him on all of them]
[20:12:18] [PM from PYEwacket: can i do it from ingam...oh okies tyvm]
[20:12:19] [PM to PYEwacket: I will add his name to the bots list :D]
[20:12:23] [PM from PYEwacket: woot :D]
[20:13:38] [PM to PYEwacket: he is now silently ignored by all bots]
[20:14:02] [PM from PYEwacket: much obliged :)]
[20:14:11] [PM to PYEwacket: no - I am]
[20:14:17] [PM from PYEwacket: :)]
[20:14:46] [PM to zoki: you are blocked from all the bots I host for reports of searching for exploits. Have a nice day.]
[20:15:24] [PM from zoki: excuse me?]
[20:15:41] [PM from zoki: what do you mean exploits?]
[20:15:54] [PM to zoki: trying to find commands like withdraw on bots I host]
[20:15:58] [PM from zoki: ah :D]
[20:16:01] [PM from zoki: lol :D]
[20:16:13] [PM to zoki: the command is give]
[20:16:21] [PM from zoki: yea whatever]
[20:16:33] [PM from zoki: just looked at forums and wanted to test it :D]
[20:16:55] [PM to zoki: I am also putting you in the bot owners private forum for the same reason.]
[20:17:39] [PM from zoki: my guild is going to get a bot (i presume you have talked to lyndy) so i just wanted to test it, and was bored atm too]
[20:17:59] [PM from zoki: looking for a triss ring actually...]
[20:20:20] [PM from zoki: really m8t im not looking for an exploit... id rather work hard for something, and deserve it, and im pretty sure you do your job well]
[20:20:26] [PM from zoki: keeping the bots up and all]
[20:21:41] [PM from zoki: :D oh sry m8t... i mixed you with Learner...]
[20:21:47] [PM from zoki: omg:P]
[20:21:59] [PM to zoki: I host a large number of bots too]
[20:22:27] [PM from zoki: i know :D just i didnt even pay attention to the name :D the L is confusing at times]
[20:22:35] [PM from zoki: is flamekeeper your bot?]
[20:23:13] [PM to zoki: nope agneum titanta Dragon_of_Ice]
[20:23:38] [PM from zoki: kk]
[20:23:50] [PM from Dragon_of_Ice: PM from Qin: #wanted]
[20:24:59] [PM from zoki: oh and is there an amount of time that i will be banned from your bots or just forever?]
[20:25:24] [PM to zoki: I have set you as a bot, the bots will not even respond to you]
[20:27:54] [PM from zoki: but you didnt awnser me... am i going to be marked as a bot for a some time or just plain forever?]
--------------------------------------------------
[22:25:36] [PM from lyndy: i am -KA- guild ... are you satisfied with zoki's explanation?]
[22:26:41] [PM to lyndy: I am never satisfied with anyone messing with my bots.]
[22:27:23] [PM from lyndy: has he made sufficient apology? he tells me it was curiosity (should kill the cat)]
[22:28:13] [PM to lyndy: as far as he is concerned it has indeed killed the cat. Why should he be attempting to find commands like withdraw on a bot that has nothing to do with]
[22:28:16] [PM to lyndy: him?]
[22:28:34] [PM to lyndy: especially as withdraw is not one of the commands that bot knows]
[22:28:53] [PM to lyndy: it is nothing but a flagrant exploit attempt]
[22:30:56] [PM to lyndy: I am in a position of responsibility with the bots I host and I respond with immediate and decisive action when I see something that could risk the bots]
[22:30:57] [PM from lyndy: since i am currently interested in starting a bot for my guild i hope his behaviour will not jeapardise this?]
[22:32:05] [PM to lyndy: not at all, in fact if I were you I would consider it an extremely good sign that I put the good of the bots in front of any future possible bot hosting]
[22:34:14] [PM from lyndy: i am a grandmother labrat... my own grandchildren are also mischievous, and i truly believe zoki at 14 and a male (sad but true males are difficult)]
[22:34:48] [PM from lyndy: was just nosy and silly...]
[22:34:51] [PM to lyndy: I spend 3-4 hours a day reviewing my bot code and trying to find weaknesses and holes. I take bot security very seriously (between them I have over 8m]
[22:35:09] [PM to lyndy: 8 million gc on the bots I am responsible for)]
[22:35:16] [PM from lyndy: and i have done my best to shout at him]
[22:36:44] [PM to lyndy: I will remove him from the global bans list this time, tell him you (meh you're a grandmother you know how guilt trips work :p)]
[22:37:31] [PM from lyndy: thank you very much... :)]

 

It was *after* he had been allowed access again that this thread was posted and he chose to attack me in his posts. As far as I was concerned he had learned his lesson and that was an end to the matter.

 

I would have posted this yesterday but I was at my mother-in-laws (check the IP logs to confirm marc) so did not have ready access to the relevant chatlog parts.

 

All times are UK (BST?)

[Mar(c)]

(check the IP logs to confirm marc)

Oh FYI, I'm not in a position to check IP logs, not now and not when I were a mod.

(And I'm not interested in them either.)

 

Directly as a result of this thread I have been approached by more than a few people to ask if I would consider hosting their bots purely because of the way I have dealt with this situation.

Well, gratz.

But if I were even looking for such a service, you would've lost me as a potential client with this.

If trying out a few simple potential admin level commands lead to such reactions, I lose my trust in the safety of it.

Someone tried a locked door, that's all.

I completely understand a "lol" reaction if I were treated as such (and if I were looking for a reliable service I may want to test some life bots too, see if admin level commands were "visible" this way).

[Pyewacket]

It was never said that what Zoki did was a threat to the bots. But, it seems Zoki made an attempt to break in, succesfull or not, thats still a BIG NO-No, in my eyes at least!

 

What if some held you at gunpoint, even tho the gun wasnt loaded, but you dont know that? Would you feel threatned, or would you say ' oh, that gun may not even be loaded, so why worry? '

 

Or, simpler said; someone locks himself into a big store,, but never comes around of stealing anything, coz the shopkeeper wakes up..does the shopkeeper has the right to call the police, even tho nothing was stolen?

 

Jez

That doesn't make any sense.

 

To the gun analogy: Zoki doesn't have a gun.

The only gun I *may* see here is the one LabRat is holding, pointed at himself. But I won't stretch it that far.

 

To the store analogy: the store is closed, and Zoki is just looking through the window checking out the alarm system.

His intentions may be good or bad, but it's definitely not even a reason to bother the police with!

 

 

If I may place my own analogy to the thread then?

 

Supposing someone had attempted to use admin access commands over the internet to "test" if they worked or not on..say..a bank? Or a countries defense system? Merely using the excuse that they were going to be writing their own coding and wanted to see the one they were attempting access commands on in action would not, I believe, cut the mustard when the authorities rang the doorbell.

 

Theres no authorities here to knock on Zoki's door. I posted this thread to give him a chance to explain his actions, he has done so. I do not personally believe that explanation but...BUT...I do DO insist that each bot owner that reads this thread makes up their OWN mind as to his guilt or innocence and acts accordingly with their own judgement.

 

My only concern on this occasion was to ensure two things:-

 

1. Zoki's attempts, good bad or indifferent, were reported for others to be made aware of. I am an owner not a programmer and as such my judgment on this matter is irrelevant since I couldn't code a bot to save my life, I therefore see my responsibility to hand judgment to other owner/programmers of bots as to whether they need to take action or not as they see fit. That is entirely in their hands.

 

2. Zoki has a place in which to openly defend his actions, by whatever explanation, reasoning or proofs he has to his credit.

This is only fair, under the circumstances, since I have made considerable efforts in bringing this matter to the attention of a lot of people AND risk harming someones hard earned reputation in the EL community, when it might have been reasonably argued that his actions were not "outlaw behaviour" towards my tradebot.

 

I believe I have achieved both of these things in this thread now. I do not see a need to debate with third parties as to whether the creation of this thread is an over reaction/rallying cry for a witchhunt, or simply the right thing to do. That is purely for others to decide, on an individual basis; with no reason to post on the subject unless they are specifically involved in the matter and wish to contribute to either the questioning of the validity of Zokis defence, or the improvement on said defense (I welcome both those types of posts here).

 

Edit:spelling

Edited April 27, 2008 by Pyewacket

[Mar(c)]

Reporting to the bot owner/programmer is definitely the right thing to do, Pyewacket.

I'm just astounded about how it got handled.

And the logs only confirm my feelings, starting here:

[PM from PYEwacket: he defo looking for exploit then?]
[20:11:49] [PM to PYEwacket: yup]

 

Anyway, I didn't intend to turn this into a fight, I just wanted to express my concerns.

[Pyewacket]

If I may put your concerns to rest then? As I stated previously, I have no knowledge of bot programming whatsoever. I receive the PM's from passion purely so I can monitor stock movement whilst playing and keep her topped up. Yet even so, when the PM's came through from her regarding Zoki, even my untrained eye saw them as a possible attempt to use the admin functions to gain access without permission. The fact that there was more than one further strengthened my concern, but still I also lacked the prior experience at having seen someones "possible" bot scam attempts in action to start shouting it out that "here is a bot scammer grab the flaming torches". Hence I pmed Labrat to get confirmation because I believed in his vastly superior (to my own, before some twunt takes offense) knowledge on the subject.

 

The fact is, I asked that above pm with a predetermined opinion that Labrat confirmed. I also saw the possibility prior to posting this thread that Zoki might still have a valid explanation, therefore I took the personal responsibility to forum pm him(Zoki) the link to it as soon as the original post was made, to ensure he had a fair crack at his defence.

 

I trust this satisfies your concerns and the topic can get back on track.

 

Edit: Added zokis name in the 2nd bracketted comment above to ensure no misunderstanding of my post.

Edited April 27, 2008 by Pyewacket

[Mar(c)]

My concerns are about how LabRat handled this, not about your reporting it to him, Pyewacket.

LabRat's confirmation that it is "definitely looking for an exploit", and his following actions, is what my concerns are about.

 

A few simple potential admin level commands were tried.

LabRat treating even that already as "definitely" a hacking attempt, is what surprizes me.

To make a better analogy: a guy is jiggling the locked door of an obviously locked door of a shop -- I see no crime here.

 

And to be clear, I definitely don't doubt LabRat's programming skills.

Maybe that's why I'm so shocked; it's either a really blown-out-of-proportion reaction of LabRat, or he doesn't trust his own code to be able to handle that simple "exploit attempt".

 

 

 

Gee, I feel like I'm being the devil's advocate here, while it's (imo) not even the little red guy on your shoulder poking you in your cheek with his pitchfork.

[Pyewacket]

...

To make a better analogy: a guy is jiggling the locked door of an obviously locked door of a shop -- I see no crime here.

...

 

Must be a different law system, over this end that would earn you an arrest for loitering with intent.

 

I fully support Labrats actions in this matter, to be frankly honest there was no way of knowing that the attempts would simply stop at jiggling the locked door, to use your analogy. Regardless of whether they did stop there or not, why risk it? Labrat does indeed hold a LOT of responsibility for the bots he hosts on other peoples behalf. Who, given that level of trust, would take a step back and wait until AFTER the bots HAD been exploited before they took action and issued bans? Doesnt matter HOW good the coding is, or how secure the system, if someone is attempting to find access, then at some point they may discover a way to do so unless their ability to "test" such accessibility is removed. Even the most secure and advanced security suites on PC's are constantly updated to ensure that new Hacks are rendered harmless. I am sure even Radu has encountered attempts to access the EL server outside of normal and/or acceptable access methods, would he not be in his rights to act accordingly and block the IP of the attempts? Or should he wait until the Server gets crashed out first?

 

I like the fact that you are playing the role of Devils Advocate, I am happy someone chooses to do so, however I believe there is more than sufficient evidence to support Labrats actions in this matter and find his professionalism has been a source for continued trust in his abilities.

[Jezebelle]

When a door is locked, doesnt it mean you are not alowed in?

 

If you jiggle that same locked door, isnt there a big chance the alarm will go off?

 

Doesnt alarm bells-going-of mean Possible Danger Ahead?

 

Isnt that what Pye did..ring the alarmbells?

 

 

Now, we can argue about whetter Zoki was ' bored' and didnt had faul play in mind, thing is he rattled the chains of a lock..and had NO buisness in doing that. His reactions when caught were at the least immature and not serious..but then again, he is 14..!

 

A 14 year old doesnt seem the harm in rattling a lock, or jump on a car so the alarm goes off..

A 14 year old doesnt see the harm in making something look like a crime..he cannot see the consequences of his actions..EVEN if he has no harm in mind.

 

Question is..what do we do about such behaviour?

Let him get away with it? No, I dont think so..even if no harm was done, he has to be taught that you cannot do certain things in life..RL OR VL!

 

 

This has nothing to do with Labrat being worried his security fails (I would personaly trust my life with him).

 

Was Zoki wrong? I think yes, altho he did apologies to many ppl, including to me, I think punishment is in order, and allready sentenced, I believe (the bot ban)

 

Jez

[Placid]

You are all taking this WAY too seriously...

[LabRat]

I personally am glad people are taking the attempt seriously.

 

The point of this thread is that someone was looking for weaknesses and was banned due to his own actions. It could have been you, marc or anyone else doing the likewise and my reaction would have been the same - an immediate block followed by "what are you doing?"

 

I would have posted his actions in the bot owner's area where he could not try to defend himself, he was already guilty by his own actions. PyeWacket chose to give him a chance to explain his actions in a completely public forum.

 

You may note that as soon as I received the PM stating the commands attempted I immediately said ban him before I received the rest showing his continued PMs.

 

Anyway, by now hopefully all of EL knows my policy with regards to my bot security so maybe this "pointless" thread may deter others from trying the same.

 

I'm going back to silver mining now.

Edited April 27, 2008 by LabRat

[Jaxbot]

Actually, when I get a bot, I will set Zoki on the friendly price list.

 

Why? Because I think it's stupid that you banned someone who didn't manage nothing.

 

It's like someone calling the police to surround someone with a gun that has a plastic orange cap (...um, later )

 

We should all keep this as a lesson.

I think the only commands that should be simple and guessable is the fail-safe shutdown, to turn the bot off, and probably the ban function.

 

Otherwise, you could have admin help as like, _admin.#help, and no one would guess it, let alone get by it.

 

 

My 1 cent.

 

EDIT:

Maybe he was just curious, wondering if the bot would cuss him out or something when using one of those commands. (like my bot says "meh" to all non-admin attempts)

Edited April 27, 2008 by Jaxbot

[Drakos7]

Otherwise, you could have admin help as like, _admin.#help, and no one would guess it, let alone get by it.

This called "security by obscurity" and is highly looked down upon in the security community. A white list of who can issue admin commands and even forcing those people to login to the bot first are a much better way to go. (And yes, I know quite a bit about security)

[Jaxbot]

I see your point. However, I meant the whitelist in addition to the obscurity, and it's problaby a bad idea anyways, most of my guildies can't remember how to use my bot >.<

Edited April 27, 2008 by Jaxbot