PSA: Cheaters now spoofing BIS_Effects

[(OCN)Vortech 65]

Busy weekend, another fun one here. Hats off to Dwarden for the preemptive changes to remoteexec (http://code.google.com/p/dayz-community-banlist/source/diff?spec=svn4f22f1a178cc5e90ac879703dcda5aa8f7a37275&r=4f22f1a178cc5e90ac879703dcda5aa8f7a37275&format=side&path=/filters/remoteexec.txt) A little after we implemented the controversial change I noticed this in one of our servers logs:

Old legitimate execution:

21.08.2012 06:58:55: USERNAME (IP) GUID - #38 "[this] spawn BIS_Effects_AirDestruction"
21.08.2012 06:58:56: USERNAME (IP) GUID - #38 "[this, 0, 10611.7]spawn BIS_Effects_AirDestructionStage2"
21.08.2012 06:58:56: USERNAME (IP) GUID - #38 "[this, 0, 10611.7,false,true]spawn BIS_Effects_Burn"

New spoofed execution:

24.08.2012 11:49:32: USERNAME (IP) GUID - #38 "[this] spawn BIS_Effects_AirDestruction"
24.08.2012 11:49:32: USERNAME (IP) GUID - #40 "[this] spawn BIS_Effects_AirDestruction"

24.08.2012 12:33:20: USERNAME (IP) GUID - #38 "[this] spawn BIS_Effects_AirDestruction"
24.08.2012 12:33:20: USERNAME (IP) GUID - #40 "[this] spawn BIS_Effects_AirDestruction"

So for anyone not utilizing Dwardens CBL commits for BE filters keep an eye out for this form of BIS_Effects execution.

[Vinyl (DayZ) 2]

Thanks for this PSA.

[(OCN)Vortech 65]

NP. I'm not banning for this alone but it looks like they may have changed it up in an attempt to mimmick the legit entry. I'm now seeing the following:

25.08.2012 12:42:49: USER (IP) GUID - #38 "[this] spawn BIS_Effects_AirDestruction"
25.08.2012 12:42:49: USER (IP) GUID - #40 "[this] spawn BIS_Effects_AirDestruction"
25.08.2012 12:42:49: USER (IP) GUID - #38 "[this, 7.09406, 2217.81]spawn BIS_Effects_AirDestructionStage2"
25.08.2012 12:42:49: USER (IP) GUID - #40 "[this, 7.09406, 2217.81]spawn BIS_Effects_AirDestructionStage2"
25.08.2012 12:42:49: USER (IP) GUID - #38 "[this, 7.09406, 2217.81,false,true]spawn BIS_Effects_Burn"
25.08.2012 12:42:49: USER (IP) GUID - #40 "[this, 7.09406, 2217.81,false,true]spawn BIS_Effects_Burn"

Tis user was banned for other known cheats however this entry has shown up from others recently on our other servers as well. To clarify there are possibly now 2x different ways they're spoofing.

[(OCN)Vortech 65]

As an update I was informed that the cheaters can now fully spoof the legit execution in its entirety.

[{sas}stalker 108]

They can but not all of them are

[corking 1]

choppers give that to

[(OCN)Vortech 65]

They can but not all of them are

Exactly, so admins need to use common sense.

choppers give that to

Exactly that's why it is a spoof, they're attempting to look legit. I'm hopeful this will help admins identify cheaters a little easier. However they must use common sense when researching. :)