Hackers found on US 9 and banned - [GM]Psyc420 and [GM] o7 | Spawning items

[howichrgelazer 69]

Hello everyone,

Per the new server rules, just posting that I banned two hackers on US 9 and here's the details:

23:30:48 : Player #16 [GM] o7 (24.23.147.110:44260) connected

23:30:48 : Player #16 [GM] o7 - GUID: f4e171569e6890bcb0ccf50743a7742d (unverified)

23:30:48 : Verified GUID (f4e171569e6890bcb0ccf50743a7742d) of player #16 [GM] o7

23:31:12 : Player #18 [GM]Psyc420 (99.106.230.67:2324) connected

23:31:13 : Player #18 [GM]Psyc420 - GUID: f51583d7057431d494c386a57c3908f8 (unverified)

23:31:13 : Verified GUID (f51583d7057431d494c386a57c3908f8) of player #18 [GM]Psyc420

Case 1: Item/Weapon Spawning

Login

23:31:33 "LOGIN ATTEMPT: "24255046" [GM]Psyc420"
23:31:34 "READ/WRITE: ['PASS',false,'25149080',[69,[38.8304,6103.79,0.00134277]],[["ItemFlashlight"],["ItemPainkiller","ItemBandage"]],["DZ_Patrol_Pack_EP1",[[],[]],[[],[]]],[66,79,79],"Survivor2_DZ",0.94]"
23:31:34 "LOGIN RESULT: ["PASS",false,"25149080",[69,[38.8304,6103.79,0.00134277]],[["ItemFlashlight"],["ItemPainkiller","ItemBandage"]],["DZ_Patrol_Pack_EP1",[[],[]],[[],[]]],[66,79,79],"Survivor2_DZ",0.94]"
23:31:34 "LOGIN LOADED: B 1-1-A:63 ([GM]Psyc420) REMOTE Type: Survivor1_DZ"
23:31:34 "SERVER RESULT: "X" 0.94"
23:31:34 Unit 104:107 not found, cannot update
23:31:35 "SETUP: attempted with ["25149080",B 1-2-L:1 ([GM]Psyc420) REMOTE,"24255046"]"
23:31:35 "READ/WRITE: ['PASS',[false,false,false,false,false,false,false,12000,[],[0,0],0,[0,0]],[0,0,0,0],["","aidlpercmstpsnonwnondnon_player_idlesteady03",36],[69,[38.8304,6103.79,0.00134277]],-207851]"
23:31:35 "SETUP: RESULT: Successful with ["PASS",[false,false,false,false,false,false,false,12000,[],[0,0],0,[0,0]],[0,0,0,0],["","aidlpercmstpsnonwnondnon_player_idlesteady03",36],[69,[38.8304,6103.79,0.00134277]],-207851]"
23:31:35 "WORLDSPACE: [69,[38.8304,6103.79,0.00134277]]"
23:31:35 "LOGIN: Location: [69,[38.8304,6103.79,0.00134277]] doRnd?: false"
23:31:35 "LOGIN PUBLISHING: B 1-2-L:1 ([GM]Psyc420) REMOTE Type: Survivor2_DZ"
23:31:35 "player24255046 = myObj"

Well hello there everything

23:36:46 "UPDATE: [B 1-3-A:1 ([GM]Psyc420) REMOTE,["5Rnd_127x99_as50","5Rnd_127x99_as50","5Rnd_127x99_as50","5Rnd_127x99_as50","5Rnd_127x99_as50","5Rnd_127x99_as50","5Rnd_127x99_as50","ItemPainkiller","ItemPainkiller","ItemMorphine","ItemMorphine","Skin_Survivor2_DZ","7Rnd_45ACP_1911","7Rnd_45ACP_1911","7Rnd_45ACP_1911","7Rnd_45ACP_1911","7Rnd_45ACP_1911","7Rnd_45ACP_1911","7Rnd_45ACP_1911"],false]"
23:36:46 "HIVE: WRITE: "CHILD:201:"25149080":[]:[["ItemFlashlight","BAF_AS50_scoped","Colt1911","Binocular_Vector","NVGoggles","ItemGPS","ItemCompass","ItemMap","ItemWatch","ItemHatchet","ItemKnife","ItemMatchbox","ItemEtool","ItemToolbox"],["5Rnd_127x99_as50","5Rnd_127x99_as50","5Rnd_127x99_as50","5Rnd_127x99_as50","5Rnd_127x99_as50","5Rnd_127x99_as50","5Rnd_127x99_as50","ItemPainkiller","ItemPainkiller","ItemMorphine","ItemMorphine","Skin_Survivor2_DZ","7Rnd_45ACP_1911","7Rnd_45ACP_1911","7Rnd_45ACP_1911","7Rnd_45ACP_1911","7Rnd_45ACP_1911","7Rnd_45ACP_1911","7Rnd_45ACP_1911"]]:["DZ_Patrol_Pack_EP1",[[],[]],[["30Rnd_556x45_StanagSD","ItemBloodbag"],[6,2]]]:[]:false:false:0:0:0:0:["BAF_AS50_scoped","amovpknlmstpsraswrfldnon",100]:0:0:"Sniper1_DZ":0:" / "25149080""
23:36:46 "WRITE: ['PASS']"

And again (also note the position, barely moved and in the middle of nowhere):

23:37:40 "UPDATE: [B 1-3-A:1 ([GM]Psyc420) REMOTE,["5Rnd_127x99_as50","5Rnd_127x99_as50","5Rnd_127x99_as50","5Rnd_127x99_as50","5Rnd_127x99_as50","5Rnd_127x99_as50","5Rnd_127x99_as50","ItemPainkiller","ItemPainkiller","ItemMorphine","ItemMorphine","Skin_Survivor2_DZ","7Rnd_45ACP_1911","7Rnd_45ACP_1911","7Rnd_45ACP_1911","7Rnd_45ACP_1911","7Rnd_45ACP_1911","7Rnd_45ACP_1911","7Rnd_45ACP_1911"],false]"
23:37:40 "HIVE: WRITE: "CHILD:201:"25149080":[161,[-18.0336,6109.19,0.00137329]]:[["ItemFlashlight","BAF_AS50_scoped","Colt1911","Binocular_Vector","NVGoggles","ItemGPS","ItemCompass","ItemMap","ItemWatch","ItemHatchet","ItemKnife","ItemMatchbox","ItemEtool","ItemToolbox"],["5Rnd_127x99_as50","5Rnd_127x99_as50","5Rnd_127x99_as50","5Rnd_127x99_as50","5Rnd_127x99_as50","5Rnd_127x99_as50","5Rnd_127x99_as50","ItemPainkiller","ItemPainkiller","ItemMorphine","ItemMorphine","Skin_Survivor2_DZ","7Rnd_45ACP_1911","7Rnd_45ACP_1911","7Rnd_45ACP_1911","7Rnd_45ACP_1911","7Rnd_45ACP_1911","7Rnd_45ACP_1911","7Rnd_45ACP_1911"]]:["DZ_Patrol_Pack_EP1",[[],[]],[["30Rnd_556x45_StanagSD","ItemBloodbag"],[6,2]]]:[]:false:false:0:0:0:0:["BAF_AS50_scoped","aidlpercmstpsraswrfldnon_idlesteady02",41]:0:0::0:" / "25149080""
23:37:40 "WRITE: ['PASS']"

[GM] o7 is banned by association due to this little gem:

23:36:19 "UPDATE: [B 1-2-K:1 ([GM] o7) REMOTE,[],false]"
23:36:19 "HIVE: WRITE: "CHILD:201:25144521:[312,[-13.1053,6106.45,0.00128174]]:[]:[]:[]:false:false:0:0:27:0:["M9SD","amovpknlmstpsraswpstdnon",42]:0:0::-185.141:" / 25144521"
23:36:19 "WRITE: ['PASS']"

EDIT: Extra evidence that I overlooked in regards to o7.

23:32:56 "UPDATE: [B 1-2-K:1 ([GM] o7) REMOTE,[["ItemPainkiller",9],["20Rnd_762x51_FNFAL",16],"20Rnd_762x51_FNFAL","20Rnd_762x51_FNFAL","20Rnd_762x51_FNFAL","20Rnd_762x51_FNFAL","20Rnd_762x51_FNFAL","20Rnd_762x51_FNFAL","20Rnd_762x51_FNFAL","20Rnd_762x51_FNFAL","20Rnd_762x51_FNFAL","20Rnd_762x51_FNFAL","ItemBandage","15Rnd_9x19_M9SD","15Rnd_9x19_M9SD","15Rnd_9x19_M9SD","ItemBandage","ItemBandage","ItemBandage"],false]"
23:32:56 "HIVE: WRITE: "CHILD:201:25144521:[]:[["ItemFlashlight","ItemWatch","ItemToolbox","Binocular_Vector","NVGoggles","ItemEtool","ItemMatchbox","ItemCompass","ItemGPS","ItemHatchet","ItemKnife","M9SD","FN_FAL"],[["ItemPainkiller",9],["20Rnd_762x51_FNFAL",16],"20Rnd_762x51_FNFAL","20Rnd_762x51_FNFAL","20Rnd_762x51_FNFAL","20Rnd_762x51_FNFAL","20Rnd_762x51_FNFAL","20Rnd_762x51_FNFAL","20Rnd_762x51_FNFAL","20Rnd_762x51_FNFAL","20Rnd_762x51_FNFAL","20Rnd_762x51_FNFAL","ItemBandage","15Rnd_9x19_M9SD","15Rnd_9x19_M9SD","15Rnd_9x19_M9SD","ItemBandage","ItemBandage","ItemBandage"]]:["DZ_Patrol_Pack_EP1",[[],[]],[["FoodSteakCooked","ItemPainkiller"],[3,2]]]:[]:false:false:0:0:0:1:["FN_FAL","aidlpercmstpsraswrfldnon_idlesteady04",42]:0:0:"Sniper1_DZ":0:" / 25144521"
23:32:56 "WRITE: ['PASS']"

They were right next to each other during this event. Both of them had access to the spawned items and neither one reported the incident. Therefore they were working together (they also have the same clan tag).

Edited August 11, 2012 by HowIChrgeLazer

[A Metal Viking 18]

Kill them all!

[BlackHat (DayZ) 3]

Last I checked, you cannot ban for "association"; the hacker however, more power to you for banning him.

Edited August 11, 2012 by Skutch

[howichrgelazer 69]

If this helps ease your mind Skutch:

23:32:56 "UPDATE: [B 1-2-K:1 ([GM] o7) REMOTE,[["ItemPainkiller",9],["20Rnd_762x51_FNFAL",16],"20Rnd_762x51_FNFAL","20Rnd_762x51_FNFAL","20Rnd_762x51_FNFAL","20Rnd_762x51_FNFAL","20Rnd_762x51_FNFAL","20Rnd_762x51_FNFAL","20Rnd_762x51_FNFAL","20Rnd_762x51_FNFAL","20Rnd_762x51_FNFAL","20Rnd_762x51_FNFAL","ItemBandage","15Rnd_9x19_M9SD","15Rnd_9x19_M9SD","15Rnd_9x19_M9SD","ItemBandage","ItemBandage","ItemBandage"],false]"
23:32:56 "HIVE: WRITE: "CHILD:201:25144521:[]:[["ItemFlashlight","ItemWatch","ItemToolbox","Binocular_Vector","NVGoggles","ItemEtool","ItemMatchbox","ItemCompass","ItemGPS","ItemHatchet","ItemKnife","M9SD","FN_FAL"],[["ItemPainkiller",9],["20Rnd_762x51_FNFAL",16],"20Rnd_762x51_FNFAL","20Rnd_762x51_FNFAL","20Rnd_762x51_FNFAL","20Rnd_762x51_FNFAL","20Rnd_762x51_FNFAL","20Rnd_762x51_FNFAL","20Rnd_762x51_FNFAL","20Rnd_762x51_FNFAL","20Rnd_762x51_FNFAL","20Rnd_762x51_FNFAL","ItemBandage","15Rnd_9x19_M9SD","15Rnd_9x19_M9SD","15Rnd_9x19_M9SD","ItemBandage","ItemBandage","ItemBandage"]]:["DZ_Patrol_Pack_EP1",[[],[]],[["FoodSteakCooked","ItemPainkiller"],[3,2]]]:[]:false:false:0:0:0:1:["FN_FAL","aidlpercmstpsraswrfldnon_idlesteady04",42]:0:0:"Sniper1_DZ":0:" / 25144521"
23:32:56 "WRITE: ['PASS']"

The location of these two are no-where near loot spawns during their short stint on the server. I doubt that FN gear was lying on the ground in the middle of nowhere. ;)

Edited August 11, 2012 by HowIChrgeLazer

[BlackHat (DayZ) 3]

You do not understand the rules placed on the server admins, do you?

Did o7 spawn the loot or did he see some random box sitting on the ground and decide to loot it?

---One is ban-able by rocket's set standards the other is not.

How did those two get to a remote location next to each other? Do you have logs that they teleported there on YOUR server?

---You are not allowed to assume when banning someone.

[howichrgelazer 69]

Skutch, I am not under any assumption. They both had items updates from a position on the map that has no loot spawns. I don't understand how that's unfairly banning somebody when it's obvious they were working in tandem. Their positions put them on the very side of the map, far, FAR, away from anything that's lootable.

No other person died in that location during that run of the server.

They connected at the same time and they also disconnected at the same time. Everything that I have on them shows the intent of both persons to illegally obtain items.

I understand there are admins out there that unfairly ban people. I go out of my way, spending the little free time I have in my day digging through logs and collecting enough evidence to put these people away. As far as I can tell, I have everything I need in order to make these bans.

EDIT: I am more than happy to reverse these bans if I'm in the wrong (however, with the evidence I do have, it's very clear these guys knew what they were doing). I publicly post them, along with my evidence as required by the new server rules. I understand that you're trying to play devil's advocate and I take no offense to it.

Edited August 11, 2012 by HowIChrgeLazer

[Loque 13]

I have to ask, how could you tell they spawned close to each other? We recently started renting a server and I am checking the logs to familiarise myself with them - I have strained my eyes on the text but cannot see the location that they entered at.

If you have any reading/information on the server logs I would really appreciate it.

Many thanks!

[arithor (DayZ) 7]

I second Loque, I am a new DayZ admin and would love either a link that details how to identify portions of the log or a lesson in Arma 2 logs. I have hosted COD1 and COD2 servers in the past but never Arma. Unlike COD we cannot simply spectate and decipher who to ban due to script use by observing them in-game or expect anti-cheat systems to do our work for us.

TYIA Apex

[OriginAtrocity 4]

I have to ask, how could you tell they spawned close to each other?

I may be wrong on this - as I don't pretend for one second to be an admin of any kind that's knowledgeable on this kind of stuff - but from what I can gather from these log extracts...

[161,[-18.0336,6109.19,0.00137329]]

...the section in the second set of squared brackets - starting with -18 deals with a player's location, set out (usually, anyway) in X/Y/Z co-ordinates in relation to the Chernarus map. Going from the second player's co-ordinates...

[312,[-13.1053,6106,45,0.00128174]]

...you can very reliably determine that the two players were very close to one another. You can even prove that Player #2 was slightly downhill from his "companion" (the lower value on the Z-axis). Hope that clarified it for you.

[howichrgelazer 69]

OriginAtrocity, you hit it right on the nose.

As for learning how to read .RPT files, it just takes practice. Study legit people, study people you think are sketchy. Watch their progress. It takes time and effort. With the new logs however, this data doesn't show any longer.

Edited August 14, 2012 by HowIChrgeLazer