Hey guys, I kinda need help here to explain what this means (its a console output) A hacker hacked my server and now im here trying to find out who it was. This person did not have access and did indeed hack the colsole Spoiler (Move your mouse to the spoiler area to reveal the content) Show Spoiler Hide Spoiler [12:06:13] [pool-34-thread-12/INFO]: [0;32;1mConsole[m [0;37;1mbanned [0;32;1m_SicKic_ [0;37;1mfor '[0;32;1mYou should have stopped ~[0;37;1m'[m [12:06:13] [Server thread/INFO]: _SicKic_ lost connection: ?cYou are banned from this server!?f Banned on: 2016-10-14 Banned by: Console?r Reason: You should have stopped ~ You are permanently banned! [12:06:13] [Server thread/INFO]: _SicKic_ Has Left Snowraces [12:06:13] [Server thread/WARN]: handleDisconnection() called twice [12:06:13] [Async Chat Thread - #38/INFO]: [m<[0;36;1m[21m[[0;31;1m[21mHeadAdmin[0;36;1m[21m][0;37;1m[0;36;1m[5mL[0;31;1m[21mGl[0;36;1m[21mor[0;31;1m[21my[0;36;1m[21m[5ml[m> Yes or no[m [12:06:13] [Async Chat Thread - #38/INFO]: [m[0;32;1m[m[0;37;1m [0;37;22m[[0;30;1mDefault[0;37;22m][0;37;1m [mWarpStore_OnSb[m [0;32;1m> [0;37;22mScreenshare?[m [12:06:14] [pool-34-thread-13/INFO]: [0;32;1mConsole[m [0;37;1mbanned [0;32;1mF1S [0;37;1mfor '[0;32;1mYou should have stopped ~[0;37;1m'[m [12:06:14] [Server thread/INFO]: F1S lost connection: ?cYou are banned from this server!?f Banned on: 2016-10-14 Banned by: Console?r Reason: You should have stopped ~ Please help me and if you can, tell me how I can prevent this from happening again.
@zr120cat Well all we can tell you from console is that someone was baned, and some people where chating :? nothing perticularily helpfull. Please be more specific on what you mean 'hacked'. 1. You mean that your minecraft account was comprimised and they used the privilages to mess with your server? 2. You mean that somehow someone gained unauthorised access to your server's console (or admin privilages) and used them to mess about? 3. You mean that the machine on which the server runs on was accessed by someone who then used it with bad intentions? After we identify the posible method(S) we will look into how it was done.
@zr120cat Right since it is case #2, we need some more information that will help us identify how they did it. 1. What plugins do you have installed? (Namely) 2. Have you installed any plugin or have you veen requiested to install a plugin from a player? 3. What version are you running on? 4. Did they get OP rights or just permissions?
