Preventing Hackers ala the one last night

I wanted to start a post to discuss first off the method this hacker used and second figure out a way to prevent anyone from doing it again. I know this guys was a complete idiot as even with his hacked character which was virtually unkillable the player Demnec (sp?) got them locked in rooms and killed many of his characters. If anyone could respond with the facts they know about him I would appreciate it. I will start.

I got this info all second hand so correct me if I'm wrong. I believe all his characters were lvl 1 or what ever xp you get at start. They had hacked ac, damage, damage reduction, elemental resistance, and items including a greater ruin wand. They could not hack their skill nor their saves. Anyone else?

When he made a new character I invited him to the party i was in, and examined his character. His did not have any immunities, he quickly left the party -relogged and i reinvited him and he then had all the trimmings of his "buffs".

So basicly he logged in with a lvl 1 character and did something to apply all these bonuses, like give himself a greenglowing type sword and some sort of armor.

Also while he was in Axfell I think he tried attacking hullet and kept healing himself up or raising himself, etc.

As for boosting his skills, after he got locked away and mocked, he made and lvled a fighter/rogue mix... and did have skill improved on his character's bonuses.

He also didn't know the layout of the module very well... perhaps faking this lack of knowledge...? dunno..

So thats all I think that I know.

Looks like the first thing we can do is try with banning CD Key, IP ranges and the known acct names to this point. I don't mind putting some time into looking through the logs if Starbridge is willing to get them to me, and others don't have a problem with it.

CD key/IP bans aren't going to cut it. There've been griefers running about on all the populated RP servers. They have plenty of keys. This isn't anything new.

Genesis is chock full of little problems, and pretty easy to exploit. Removing players' starting gear would be a step in the right direction with regards to security, though, as it'd prevent players from altering 2das/bifs to import custom items on character creation.

KumoKumo wrote:CD key/IP bans aren't going to cut it. There've been griefers running about on all the populated RP servers. They have plenty of keys. This isn't anything new.

Absolutely right. I spent about an hour last night with the griefer. He was looking for Myra when I ran across him, but she had logged. Someone told that if I could get him to Ranz, I'd be safe there. Well, in the name of trying to find Dead Man's Pass (which is where he wanted to go), I led him to Ranz and logged off.

Firstly, I don't know what drew him into his course of action, but being civil to him went a long way. He didn't attack me not once. During our conversation I asked him "what beef do you have against these players". He replied, "Nwn griefers, heard of them?". I of course had, because I remembered reading this a while back.

http://coa.ender.com/viewtopic.php?t=130949&postdays=0&postorder=asc&start=0&sid=b489d1d60d31d8346b0738e3f34c3bc2

From what I gather, they aren't here, because of anything personal. It looks like they grew tired of the same NWN routine, and got bored. Now they do obnoxious things. My guess however, is that the bulk of what they do is out of boredom and a sense of superiority. Hacking local char vaults is not that challenging, but doing what they do on servers, is like watching the face of a 6-year old child light up when given a new toy. It makes them feel powerful. But, we might could find a way just to keep em busy while we figure out the next step. It obviously doesn't take much to impress some of these guys.

The only thing you don't wanna do, is give them negativity. That's what they want.

As for banning CD keys, thats a waste of time. NWN cd key generators are fully operable, and fully available (have been for many years now). Banning the IP address, could work, unless they know how to use a proxy. Having their IP banned via their own ISP is how to do it. However, deleting their chars, banning the accounts, banning the cd key, and banning the ip address via ISP all at the same time will send a clear message. It might take days to get around all of that, and by then maybe these guys would look for easier prey.

Just my two cents on it, but I'm sure you guys will figure out how to deal with this nonsense.

If any of you have connections on some of the large populated server that have been around a while could you please send the GMs there a msg on their forums asking them how they deal with this problem? I think that would be easiest way. I am sure they have looked into it and know a good solution.

Right well hi, I'm new to the server and mod in general and have been having a blast exploring alone. I am however not sure if I'll stay around long term, I'm not really the sort of player that likes "High Magic World", though I am liking the rather relaxed community so as it currently stands I'm not sure.

Anyhow now that I've introduced myself kind of, I'll add a few suggestions to help combat such issues and they're simply for new characters (So you can simply add the suggestions to the team joining portal for newly created characters)

* As someone already mentioned, stripping all characters of all gold and items in their possession including plot items (In this case you might want to add a secondary ooc room before entering the world as to allow players to buy up some robes/armour/other instead of walking around town naked)

* Add a script to your choosing a team that checks to see if XP is greater then 0 (You add xp after somebody's joined a team as such that shouldn't be an issue otherwise you can check players that have more XP then however much is given to new characters)

* Add script to check Ability points don't exceed a certain point (Should be Highest base been ages since I've done some scripting but IIRCly you can call up a players base stats rather then their modified ones as such you can skip the bonus's from subraces)

* Add a script to check skill's don't exeed a certain amount (max skill bonus for a lvl 1, can't remember if you can call up base skill bonus without feats/abilitymod etc (4+feat's+ability mod+racial mod) can't remember what I worked it out to be last time but should be easy enough to figure out.

* Add script to check for feats that couldn't possibly be obtained at lvl one, Dev Crit, DR feats, Immune to crits etc etc etc, you get the point I'm sure)

*Also if there's a way to check for a players status of immortality/invunability via script might be a good idea to add a check for that as well.

Basically if any of the above don't pass don't allow them access to the rest of the world and add the character, account name and public cdkey to a log somewhere if possible (Again been way to long since I've done scripting to recal.) You can also then check their characters manually to see what they were using via copying their character from their account name in your server vault to your own.

Anyhow that's my suggestion.... it will deal with the more common cheats, that being said there is no fool proof way to stop them short of having a DM online at the time to continuely smite them.

-Space Bunny

The hacker is on right now! Please DM Velvet or Star get on an beat him up.

Thanks a lot for the info space bunny. This is def not a low magic mod. Weapons and armor go up to +5 here.

In addition to the script above we should make the barracks and start areas that each fort has none PvP areas so that no afk killing can happen.

Well for right now we will see how my IP and CD KEY ban works. Like I said before, if he finds a way around these we will be going to player password for log in.

constrainer wrote:In addition to the script above we should make the barracks and start areas that each fort has none PvP areas so that no afk killing can happen.

I can make the barracks NO PvP.

Server Admin Starbridge wrote:Well for right now we will see how my IP and CD KEY ban works. Like I said before, if he finds a way around these we will be going to player password for log in.

This is pretty much guaranteed to kill off your player base. And keeping the password "hidden" while also letting legitimate players play sounds like a lot of overhead.

Why not start with some scripted preventative measures? Removing starting gear is pretty easy, and would be a good start.

KumoKumo wrote:

Server Admin Starbridge wrote:Well for right now we will see how my IP and CD KEY ban works. Like I said before, if he finds a way around these we will be going to player password for log in.

This is pretty much guaranteed to kill off your player base. And keeping the password "hidden" while also letting legitimate players play sounds like a lot of overhead.

Why not start with some scripted preventative measures? Removing starting gear is pretty easy, and would be a good start.

I'll see what I can do.

Apparently the hacker is back. Dens let me know that he killed Eva.

Darn you constrainer! xD faster typer... D: but yar.. what he said!

If a player password is placed by tomorrow, half our player base (the half that hasn't bothered signing up to the forums...) Is gone.


Should consider setting the fort's to no pvp zones for a while (temporary), so the hacker logs in charges out and realizes he can't attack players.
So any further damage he can do is stand around spaming nonsense while we sit about continueing our rp and ignoring him.

TheeVals wrote:Darn you constrainer! xD faster typer... D: but yar.. what he said!

If a player password is placed by tomorrow, half our player base (the half that hasn't bothered signing up to the forums...) Is gone.


Should consider setting the fort's to no pvp zones for a while (temporary), so the hacker logs in charges out and realizes he can't attack players.
So any further damage he can do is stand around spaming nonsense while we sit about continueing our rp and ignoring him.

Thats a good idea. I will put this into effect right now. For a while the forts will be no PvP.

Well, I can just ban his logins, CD keys, and IPs. If it slows him down I hope that it will just be annoying to him and quits in a few weeks. Even if he is using proxy IP he sill needs to change settings when I ban it, so it should slow him down and deter him for a while.

We're still not stripping items, and this makes me sad.

I understand that working with a module the size of this one can be a bit daunting, though, unless you're already familiar with it. I've cobbled together a list of necessary changes (in three easy steps!) in order to strip stuff here. Feel free to use or ignore as you'd like.

1) Firstly, we'll need a new include file with a function for stripping items. Create a new script called "_inc_item", remove the default code, and then insert the following:

Code:

//::///////////////////////////////////////////////
//:: Item Functions
//:: _inc_item
//:://////////////////////////////////////////////
/*
    Contains function definitions for handling
    items.
*/
//:://////////////////////////////////////////////
//:: Created By: KumoKumo
//:: Created On: March 21, 2011
//:://////////////////////////////////////////////

//Removes all gold and objects from oPC (except for its hide).
void ClearInventory(object oPC);

//::///////////////////////////////////////////////
//:: ClearInventory
//:://////////////////////////////////////////////
/*
    Removes all gold and objects from oPC
    (except for its hide).
*/
//:://////////////////////////////////////////////
//:: Created By: KumoKumo
//:: Created On: March 21, 2011
//:://////////////////////////////////////////////
void ClearInventory(object oPC)
{
    int i;
    object oItem;

    TakeGoldFromCreature(GetGold(oPC), oPC, TRUE);
    oItem = GetFirstItemInInventory(oPC);
    while(GetIsObjectValid(oItem))
    {
        DestroyObject(oItem);
        oItem = GetNextItemInInventory(oPC);
    }
    for(i = 0; i < NUM_INVENTORY_SLOTS; i++)
    {
        if(i == INVENTORY_SLOT_CARMOUR)
        {
            continue;
        }
        DestroyObject(GetItemInSlot(i, oPC));
    }
}

2) Next we'll have to call the function to strip items. The best place is in the script anph_start_trigg, in the block of code that intercepts new characters and ports them to the faction selection portals. The modified code looks like this:

Code:

//KumoKumo, Mar 21 2011; new PCs now have their inventory cleaned.

#include "hc_inc"
#include "anph_persist_inc"
#include "anph_inc"
#include "_inc_item"

void main()
{
    object oPC = GetEnteringObject ();
    if (!GetIsPC(oPC)) return;
    object oTarget;
    object oMaster = GetMaster(oPC);
    if (GetIsObjectValid(oMaster))
      return;

    int nFaction = AnphGetPlayerTeamInt(oPC);

    //--------------------------------------------------------------------------
    // Delete stuff we dont want
    //--------------------------------------------------------------------------
    // delete player's rulebooks
    object oItem = GetItemPossessedBy(oPC,"Anp");
    if(GetIsObjectValid(oItem))
        DestroyObject(oItem);
    oItem = GetItemPossessedBy(oPC,"Anp");
    if(GetIsObjectValid(oItem))
        DestroyObject(oItem);
    //Destroy wands of AFK
    //oItem = GetItemPossessedBy(oPC, "Wan");
    //if(GetIsObjectValid(oItem))
    //  DestroyObject(oItem);

    //--------------------------------------------------------------------------
    // Update any missing items
    //--------------------------------------------------------------------------
    // Anphillia history.
    /*oItem = GetItemPossessedBy(oPC,"AnphilliaRuleBook");
    if(GetIsObjectValid(oItem)){
        DestroyObject(oItem);
        CreateItemOnObject("AnphilliaRuleBook_3FAC", oPC);
    }else{
        CreateItemOnObject("WandofAFK", oPC);
    }
    */
    // Give PC's an EmoteWand if using the DMHelper set.
    //oItem = GetItemPossessedBy(oPC,"EmoteWand");
    //if(!GetIsObjectValid(oItem))
        //CreateItemOnObject("emotewand", oPC);
    // Give PC's an EmoteWand if using the DMHelper set.
    //oItem = GetItemPossessedBy(oPC,"AnphilliaRuleBook");
    //if(!GetIsObjectValid(oItem))
    //  CreateItemOnObject("anphilliaruleboo", oPC);
        // Give PC's an EmoteWand if using the DMHelper set.
    //oItem = GetItemPossessedBy(oPC,"WandofAFK");
    //if(!GetIsObjectValid(oItem))
    //    CreateItemOnObject("wandofafk", oPC);

    // Give druids Ear of the Druid
  /* if(GetLevelByClass(CLASS_TYPE_DRUID, oPC) > 0 && !GetIsObjectValid(GetItemPossessedBy(oPC, "DruidEar")))
        CreateItemOnObject("DruidEar", oPC);

    // Give players the Wand of AFK
    //if(!GetIsObjectValid(GetItemPossessedBy(oPC,"AnphilliaRuleBook")))
    //    CreateItemOnObject("AnphilliaRuleBook_3FAC", oPC);
    // Give players the Wand of AFK
    //if(!GetIsObjectValid(GetItemPossessedBy(oPC,"WandofAFK")))
    //  CreateItemOnObject("wandofafk", oPC);

    //Ranger tracking tool
    if(GetLevelByClass(CLASS_TYPE_RANGER,oPC) && GetIsObjectValid(GetItemPossessedBy(oPC,"TrackerTool"))==FALSE)
        CreateItemOnObject("trackertool", oPC);  */

    /* Give Paladins their tools that simulate missing abilities
    if(GetLevelByClass(CLASS_TYPE_PALADIN,oPC)>1 && GetIsObjectValid(GetItemPossessedBy(oPC,"hc_palbadgecour"))==FALSE)
        CreateItemOnObject("paladinsbadgeofc", oPC);
    if(GetLevelByClass(CLASS_TYPE_PALADIN,oPC) && GetIsObjectValid(GetItemPossessedBy(oPC,"hc_paladinsymb"))==FALSE)
        CreateItemOnObject("paladinsholysymb", oPC);  */

    // Give PC's a Trap Tool in inventory
//    if(GetLocalInt(oMod,"HCRTRAPS") && GetIsObjectValid(GetItemPossessedBy
//        (oPC,"searchtool"))==FALSE)
//          CreateItemOnObject("searchtool", oPC);

    // Give PC's the ball of saving.
//    if(!GetIsObjectValid(GetItemPossessedBy(oPC,"ballofsaving")))
//        CreateItemOnObject("ballofsaving", oPC);

    // Check for tensers sword.
    oItem = GetItemPossessedBy (oPC, "NW_WSWMLS013");
    if (GetIsObjectValid (oItem)){
        SendMessageToPC (oPC, "Tensors sword crumbles to dust..");
        DestroyObject (oItem);
    }

    //--------------------------------------------------------------------------
    // This part converts old players to the new configurable anph system
    //--------------------------------------------------------------------------
    if (GetIsObjectValid(GetItemPossessedBy(oPC, "CleavenMilitiaRing")))
    {
      RecreateFactionItems(oPC, 1);
      nFaction = 1;
    }
    else if (GetIsObjectValid(GetItemPossessedBy(oPC, "AxfellWarriorRing")))
    {
      RecreateFactionItems(oPC, 2);
      nFaction = 2;
    }
    else if (GetIsObjectValid(GetItemPossessedBy(oPC, "RanzingtonCitizenRing")))
    {
      RecreateFactionItems(oPC, 3);
      nFaction = 3;
    }
    else if (GetIsObjectValid(GetItemPossessedBy(oPC, "DrowRing")))
    {
      RecreateFactionItems(oPC, 4);
      nFaction = 4;
    }
    /* All Items should be set now */

    if (GetXP (oPC) <= 1)
    {
        if (nFaction == 0)
        {
            oTarget = GetObjectByTag("ChooseSideLocation");
            AssignCommand(oPC, JumpToObject(oTarget));
            ClearInventory(oPC);
            return;
        }
    }

    if (nFaction != 2)
    {
      oTarget = GetObjectByTag (GetLocalString(GetModule(), "FACTION_0" + IntToString(nFaction) + "_DREAMSTART"));
      AssignCommand (oPC, JumpToObject (oTarget));
    }
}

3) Now all is well and good, except new PCs will enter their forts naked! This isn't quite ideal, so we'll modify the faction join scripts in order to give them a starter outfit and 500 extra gold (to compensate item loss).

Here's the new anph_join_cleave script:

Code:

//KumoKumo, Mar 21 2011; since new PCs now have their inventory cleaned,
//we'll grant them a starter outfit and an additional 500 gold (total of 1000)
//to compensate.

#include "hc_inc"
#include "anph_inc"

void main()
{
    object oPC = GetLastUsedBy();
    object oMaster = GetMaster(oPC);
    object oTarget = GetObjectByTag(GetLocalString(oMod, "FACTION_01_STARTLOCATION"));
    object oItem;
    if (GetIsObjectValid(oMaster))
      return;
    if (GetAlignmentGoodEvil(oPC) == ALIGNMENT_GOOD)
      {
        GiveFactionItems (oPC, 1);
        oItem = CreateItemOnObject("nw_cloth027", oPC);
        AssignCommand(oPC, ActionDoCommand(ActionEquipItem(oItem, INVENTORY_SLOT_CHEST)));
        GiveXPToCreature(oPC, 6000);
        GiveGoldToCreature(oPC, 1000);
        CheckPlayerTeam (oPC);
        AssignCommand(oPC,JumpToObject(oTarget));
        DeleteLocalString(oPC,"MothSetFactionInt");
        SetLocalString(oPC,"MothSetFactionInt","MothCleavenMember");
        if(GetIsObjectValid(GetItemPossessedBy(oPC,"MothBattleHorn"))==FALSE)
            CreateItemOnObject("mothbattlehorn", oPC);
        }
    else
        {
        SendMessageToPC (oPC, "Only Good Alignment characters are allowed in Cleaven!");
        }
}

And here's the new anph_join_axfell script:

Code:

//KumoKumo, Mar 21 2011; since new PCs now have their inventory cleaned,
//we'll grant them a starter outfit and an additional 500 gold (total of 1000)
//to compensate.

#include "hc_inc"
#include "anph_inc"

void main()
{
    object oPC = GetLastUsedBy();
    object oMaster = GetMaster(oPC);
    object oTarget = GetObjectByTag(GetLocalString(oMod, "FACTION_02_STARTLOCATION"));
    object oItem;
    if (GetIsObjectValid(oMaster))
      return;
    if (GetAlignmentGoodEvil(oPC) == ALIGNMENT_EVIL)
      {
        GiveFactionItems (oPC, 2);
        oItem = CreateItemOnObject("nw_cloth027", oPC);
        AssignCommand(oPC, ActionDoCommand(ActionEquipItem(oItem, INVENTORY_SLOT_CHEST)));
        GiveXPToCreature(oPC, 6000);
        GiveGoldToCreature(oPC, 1000);
        CheckPlayerTeam (oPC);
        AssignCommand(oPC,JumpToObject(oTarget));
        DeleteLocalString(oPC,"MothSetFactionInt");
        SetLocalString(oPC,"MothSetFactionInt","MothAxfellMember");
        if(GetIsObjectValid(GetItemPossessedBy(oPC,"MothBattleHorn"))==FALSE)
            CreateItemOnObject("mothbattlehorn", oPC);
        }
    else
        {
        SendMessageToPC (oPC, "Only Evil Alignment characters are allowed in Axfell!");
        }

}

Note that the outfits we're giving to new PCs are adept's tunics. I didn't choose them for any particular reason; they just happened to be the first default outfit in the item palette. Feel free to replace the resrefs (nw_cloth027) with whatever you wish.

2 last scripts tested and proven? If so, I will get them put in yesterday.

Yep. I just made some small alterations here, adding the ClearInventory() call to the anph_start_trigg script, and handing out an adept's tunic and a bit of extra gold in the faction join scripts. But I went ahead and tested them anyway. They all work.

I heart Kumo