Jump to content
DayZ Forums

Forums Announcement

Read-Only Mode for Announcements & Changelogs

Dear Survivors, we'd like to inform you that this forum will transition to read-only mode. From now on, it will serve exclusively as a platform for official announcements and changelogs.

For all community discussions, debates, and engagement, we encourage you to join us on our social media platforms: Discord, Twitter/X, Facebook.

Thank you for being a valued part of our community. We look forward to connecting with you on our other channels!

Stay safe out there,
Your DayZ Team

Sign in to follow this  
Followers 0
Wotuu

Hacker in WofjeM server

By Wotuu, in Mod Servers & Private Hives

Recommended Posts

Wotuu    11

Wotuu
Posted (edited)

Greetings,

To cut to the chase;

* Server this happened on.

94.242.227.182:2362 ; WofjeM | Vilayer.com

* Time that it happened including your timezone.

From 19:00~ till 19:20, timezone is GMT +2, server logs show it in GMT -7 or something. 15:00 in log time was 0:00 where I live.

* What happened during the incident

At 19:00 our time, a player called DISON logged in the server. Soon after, we heared reports of people getting killed with an M107 with infinite ammo (we did not know it was DISON at that point). This went on for a bit, as people started getting picked off one by one. At around 19:20 a player called DISON crashed a (stolen) helicopter on our vehicles (logs show proof that he was pilotting the heli when it crashed), while we were standing still trying to figure out who was hacking. Noone in their right minds would crash a chopper like that, but anyways. He couldn't have known where we were, and he probably wanted to get back at us for preparing to ban him.

Edit: While I didn't screenshot it, when we looked at the corpse of the player in the chopper that crashed on us, it had hacked items like Makarov SD, radio, etcetera. Since DISON had these kind of items (see logs below), it must've been him.

* Proof

While we don't have any screenshots, I've pulled all the relevant info from the logs. If the complete log is wanted, I can supply it.

/* server_console.log from the moment DISON joined */

9:58:51 DISON uses modified data file

9:58:51 Player DISON connecting.

9:58:52 Player DISON connected (id=77316358).

9:58:52 BattlEye Server: Player #17 DISON (<SNIP>) connected

9:58:53 BattlEye Server: Player #17 DISON - GUID: b4d65ed3bbd54b80193c7088c8db245e (unverified)

9:58:53 BattlEye Server: Verified GUID (b4d65ed3bbd54b80193c7088c8db245e) of player #17 DISON

9:59:05 HEMUL30 uses modified data file

9:59:05 Player HEMUL30 connecting.

9:59:06 Player HEMUL30 connected (id=18158022).

9:59:06 BattlEye Server: Player #18 HEMUL30 (<SNIP>) connected

9:59:07 BattlEye Server: Player #18 HEMUL30 - GUID: 96b2507143aaee027beebfb65987c2ed (unverified)

9:59:08 BattlEye Server: Verified GUID (96b2507143aaee027beebfb65987c2ed) of player #18 HEMUL30

10:00:32 Player Pox disconnected.

10:00:32 BattlEye Server: Player #15 Pox disconnected

10:00:53 Pox uses modified data file

10:00:53 Player Pox connecting.

10:00:54 Player Pox connected (id=25980678).

10:00:54 BattlEye Server: Player #15 Pox (<SNIP>) connected

10:00:55 BattlEye Server: Player #15 Pox - GUID: 4218e3020a9cefc86b28d45d64532f10 (unverified)

10:00:55 BattlEye Server: Verified GUID (4218e3020a9cefc86b28d45d64532f10) of player #15 Pox

10:02:33 BattlEye Server: Server admins are urged to start using the new public variable logging/blocking feature to protect against remote code execution exploits. More information: http://forums.bistud...gging-Blocking.

10:03:20 Sir Derpington uses modified data file

10:03:20 Player Sir Derpington connecting.

10:03:21 Player Sir Derpington connected (id=2969538).

10:03:21 BattlEye Server: Player #19 Sir Derpington (<SNIP>) connected

10:03:22 BattlEye Server: Player #19 Sir Derpington - GUID: 627dc4c31a39233df92812e5775d835b (unverified)

10:03:22 BattlEye Server: Verified GUID (627dc4c31a39233df92812e5775d835b) of player #19 Sir Derpington

10:05:15 Jonas uses modified data file

10:05:15 Player Jonas connecting.

10:05:19 Player Jonas connected (id=10566598).

10:05:19 BattlEye Server: Player #20 Jonas (<SNIP>) connected

10:05:20 BattlEye Server: Player #20 Jonas - GUID: cbcdfc61b1b9bc7321ecdb7e7c0c8455 (unverified)

10:05:20 BattlEye Server: Verified GUID (cbcdfc61b1b9bc7321ecdb7e7c0c8455) of player #20 Jonas

10:05:45 Player Müllaimer disconnected.

10:05:45 BattlEye Server: Player #11 Müllaimer disconnected

10:06:05 HerpDerp uses modified data file

10:06:06 Player HerpDerp connecting.

10:06:06 Player HerpDerp connected (id=2970114).

10:06:07 BattlEye Server: Player #11 HerpDerp (<SNIP>) connected

10:06:07 BattlEye Server: Player #11 HerpDerp - GUID: a569106ddc9e01ce3b830e1438525d31 (unverified)

10:06:07 BattlEye Server: Verified GUID (a569106ddc9e01ce3b830e1438525d31) of player #11 HerpDerp

10:08:03 Player Agony disconnected.

10:08:03 BattlEye Server: Player #2 Agony disconnected

10:08:05 BattlEye Server: (Side) Twister47: forced HACKER HERE !!

10:08:17 BattlEye Server: (Side) PaXx: FUCK YOU HACKER

10:08:19 BattlEye Server: (Side) WolfEater: admin here to ban him?

10:08:24 BattlEye Server: (Side) Twister47: porthack + m107 with unlimited ammo

10:08:30 BattlEye Server: (Side) PaXx: STOP DESTROYING GAMES FUCKING HACKING SHIT

10:08:30 BattlEye Server: (Side) Pox: Who?!

10:08:35 Player HerpDerp disconnected.

10:08:35 BattlEye Server: Player #11 HerpDerp disconnected

10:08:36 BattlEye Server: (Side) Twister47: dont know

10:08:36 BattlEye Server: (Side) Pox: Whos the hacker?!

10:08:44 Player Sir Derpington disconnected.

10:08:44 BattlEye Server: Player #19 Sir Derpington disconnected

10:08:51 BattlEye Server: (Side) Forced: where ?

10:08:54 BattlEye Server: (Side) Twister47: all ur stuff gone omg we had som much -.-

10:09:00 BattlEye Server: (Side) Twister47: near calamar

10:09:45 BattlEye Server: (Side) Twister47: were all down lost our gear from 3 heli crashes and our stuff man just fuck you -.-

10:09:54 BattlEye Server: (Side) Wotuu: Checking logs .. but a name would help

10:09:58 BattlEye Server: (Side) Pox: Fucking hacking pieces of shit

10:10:18 BattlEye Server: (Side) Goldfischentsafter: its not me..

10:10:18 BattlEye Server: (Side) WolfEater: just report him on forum that way the ban him from al lserver and cherno

10:10:42 BattlEye Server: (Side) Pox: Everybody report him on the forums as soon as we find out his IGN

10:11:17 Aleksei uses modified data file

10:11:17 Player Aleksei connecting.

10:11:17 BattlEye Server: (Side) Twister47: come the fuck on man we had so fucking mucgh

10:11:18 Player Aleksei connected (id=6111428).

10:11:19 BattlEye Server: Player #2 Aleksei (<SNIP>) connected

10:11:19 BattlEye Server: Player #2 Aleksei - GUID: 9a7108aacf3d6f4a07ef7e2dcf38a342 (unverified)

10:11:19 BattlEye Server: Verified GUID (9a7108aacf3d6f4a07ef7e2dcf38a342) of player #2 Aleksei

10:11:43 Player KniFeeH disconnected.

10:11:43 BattlEye Server: Player #9 KniFeeH disconnected

10:12:09 N.Zigaev uses modified data file

10:12:09 Player N.Zigaev connecting.

10:12:09 BattlEye Server: (Side) Goldfischentsafter: is it possible, z´that the guy is looted your stuff and join to another server?

10:12:10 Player N.Zigaev connected (id=30360902).

10:12:10 BattlEye Server: Player #9 N.Zigaev (<SNIP>) connected

10:12:11 BattlEye Server: Player #9 N.Zigaev - GUID: 199de59a7de56831bbb7a31956cb83ed (unverified)

10:12:11 BattlEye Server: Verified GUID (199de59a7de56831bbb7a31956cb83ed) of player #9 N.Zigaev

10:12:19 Player Enraged_Nerd kicked off by BattlEye: Client not responding

10:12:19 Player Enraged_Nerd disconnected.

10:12:24 Player Myzery kicked off by BattlEye: Client not responding

10:12:24 Player Krips kicked off by BattlEye: Client not responding

10:12:24 Player Krips disconnected.

10:12:24 Player Myzery disconnected.

10:12:51 BattlEye Server: (Side) Wotuu: Restarting server

10:12:57 BattlEye Server: (Side) Twister47: the is our stuff gone

10:13:00 BattlEye Server: (Side) Pox: new anti cheat on the way

10:13:01 BattlEye Server: (Side) Forced: pushing some updates

10:13:01 BattlEye Server: (Side) Twister47: our bodys

10:13:25 BattlEye Server: (Side) Pox: The hacker probaply hid them anyway

10:13:26 BattlEye Server: (Side) Goldfischentsafter: hi wotuu... the other vilayer Server have the ame prob with hacks?

10:13:42 Player Forced disconnected.

10:13:42 BattlEye Server: Player #7 Forced disconnected

10:13:48 BattlEye Server: (Side) Twister47: may not..

10:13:49 BattlEye Server: (Side) Wotuu: Shouldnt be .. but the anti cheat was uninstalled for some reason

10:14:02 BattlEye Server: (Side) Twister47: can we check befor restart?

10:14:16 BattlEye Server: (Side) Goldfischentsafter: oh, the jail effect..

10:14:23 BattlEye Server: (Side) Wotuu: How long would that take you?

10:14:29 BattlEye Server: (Side) Twister47: 5 - 10 min

10:14:51 Forced uses modified data file

10:14:51 Player Forced connecting.

10:14:52 Player Forced connected (id=4362752).

10:14:52 BattlEye Server: Player #7 Forced (<SNIP>) connected

10:14:52 BattlEye Server: Player #7 Forced - GUID: aaf940c8b8a136aa3395ee32142892c3 (unverified)

10:14:52 BattlEye Server: Verified GUID (aaf940c8b8a136aa3395ee32142892c3) of player #7 Forced

10:14:54 BattlEye Server: (Side) Bloodred: ZOMG found mountain dew!

10:14:58 kubik pindik uses modified data file

10:14:58 Player kubik pindik connecting.

10:14:59 Player kubik pindik connected (id=37126).

10:14:59 BattlEye Server: Player #8 kubik pindik (<SNIP>) connected

10:14:59 BattlEye Server: Player #8 kubik pindik - GUID: 683832b212383c44a6c7c16d1939d8d5 (unverified)

10:14:59 BattlEye Server: (Side) Wotuu: Ok we'll wait for a sec then

10:14:59 BattlEye Server: Verified GUID (683832b212383c44a6c7c16d1939d8d5) of player #8 kubik pindik

10:15:09 BattlEye Server: (Side) Wotuu: Let us know asap

10:15:11 Agony uses modified data file

10:15:11 Player Agony connecting.

10:15:12 Player Agony connected (id=57311942).

10:15:12 BattlEye Server: Player #10 Agony (<SNIP>) connected

10:15:12 BattlEye Server: (Side) Twister47: kw

10:15:13 BattlEye Server: Player #10 Agony - GUID: d6fe98aafcf2b6efaef00b883a50dab9 (unverified)

10:15:13 BattlEye Server: Verified GUID (d6fe98aafcf2b6efaef00b883a50dab9) of player #10 Agony

10:15:32 Player kubik pindik kicked off by BattlEye: Client not responding

10:15:32 Player kubik pindik disconnected.

10:16:22 Player Goldfischentsafter disconnected.

10:16:22 BattlEye Server: Player #5 Goldfischentsafter disconnected

10:16:31 BattlEye Server: (Side) Schumacher.cat: hacker on the server

10:16:39 BattlEye Server: (Side) Forced: name ?

10:16:45 Player Jonas disconnected.

10:16:45 BattlEye Server: Player #20 Jonas disconnected

10:16:52 BattlEye Server: (Side) Schumacher.cat: I dont know

10:16:55 BattlEye Server: (Side) PaXx: WATCH IN THE SERVERLOGS !

10:17:00 Player Agony is losing connection

10:17:00 BattlEye Server: (Side) Pox: PaXx

10:17:04 BattlEye Server: (Side) Pox: We cant

10:17:05 BattlEye Server: (Side) PaXx: what ?

10:17:05 BattlEye Server: (Side) Schumacher.cat: we die with no shoots

10:17:10 BattlEye Server: (Side) PaXx: Why omg

10:17:19 BattlEye Server: (Side) Pox: The server logs dont show who killed who

10:17:25 Player Bloodred kicked off by BattlEye: Script Restriction #195

10:17:26 Player Bloodred disconnected.

10:17:26 BattlEye Server: (Side) Schumacher.cat: I park my helli and die

10:17:29 BattlEye Server: (Side) Pox: Schumacher, you got shot by an M107 or AS50

10:17:30 Player Agony kicked off by BattlEye: Client not responding

10:17:30 Player Agony disconnected.

10:17:46 BattlEye Server: (Side) Pox: The bullets travel faster than sound so you die before you hear the shot

10:17:46 BattlEye Server: (Side) Schumacher.cat: nop, thats not posible

10:18:05 BattlEye Server: (Direct) Baeza: no shoot

10:18:08 BattlEye Server: (Side) S10:29:23 BattlEye Server: Initialized (v1.163)

/* Server was restarted here */

10:29:23 Host identity created.

/* createvehicle.log, the moment someone crashed a helicopter on our vehicles */

21.09.2012 10:20:37: DISON (<SNIP>) b4d65ed3bbd54b80193c7088c8db245e - #0 "HelicopterExploSmall" 32:141 0:0 [6577,5745,12] [0,0,0]

21.09.2012 10:20:37: DISON (<SNIP>) b4d65ed3bbd54b80193c7088c8db245e - #0 "HelicopterExploBig" 32:142 0:0 [6577,5745,13] [0,0,0]

21.09.2012 10:20:38: DISON (<SNIP>) b4d65ed3bbd54b80193c7088c8db245e - #0 "HelicopterExploSmall" 32:143 0:0 [6578,5747,14] [0,0,0]

21.09.2012 10:20:38: DISON (<SNIP>) b4d65ed3bbd54b80193c7088c8db245e - #0 "HelicopterExploBig" 32:144 0:0 [6578,5747,15] [0,0,0]

21.09.2012 10:20:44: DISON (<SNIP>) b4d65ed3bbd54b80193c7088c8db245e - #0 "SmallSecondary" 32:145 0:0 [6591,5757,13] [0,0,0]

/* blisshive.log, where DISON logged in, and more importantly, his loadout

This log is somehow 7 hours ahead of the previous logs, but do trust me it's at the same time */

09/21/12 16:59:51 INFO [main] dayz_3110.lingor command Q: call proc_loginSurvivor('77316358', 'DISON')

/* From this point on we can safely assume (I think?) that DISON is equal to 241288 */

09/21/12 16:59:53 INFO [main] dayz_3110.lingor command Q: call proc_getSurvivorStats(241288)

09/21/12 17:02:07 INFO [main] dayz_3110.lingor command E: call proc_updateSurvivor(241288, '[6,[3058.08,1396.76,0.000900269]]', '[]', '[]', '[]', 1, 1, 1, '"Survivor3_DZ"', 0, 0, 0, 0, 0, '["","aidlpknlmstpsraswpstdnon_player_idlesteady03",42]')

09/21/12 17:02:58 INFO [main] dayz_3110.lingor command E: call proc_updateSurvivor(241288, '[201,[3139.23,1391.32,-0.000202179]]', '[]', '[]', '[]', 1, 1, 1, 'any', 0, 0, 0, 0, 0, '["","amovpknlmrunsraswpstdfl",42]')

09/21/12 17:03:49 INFO [main] dayz_3110.lingor command E: call proc_updateSurvivor(241288, '[97,[3342.62,1403.25,0.00110245]]', '[]', '[]', '[]', 1, 1, 1, 'any', 0, 0, 0, 0, 0, '["","amovpercmrunsraswpstdf",42]')

09/21/12 17:04:43 INFO [main] dayz_3110.lingor command E: call proc_updateSurvivor(241288, '[96,[3407.5,1464.33,0.0015564]]', '[]', '[]', '[]', 0, 0, 0, 'any', 0, 0, 0, 0, 0, '["M107_DZ","amovpknlmrunsraswrfldfr",42]')

09/21/12 17:05:36 INFO [main] dayz_3110.lingor command E: call proc_updateSurvivor(241288, '[19,[3396.42,1466.18,0.00289536]]', '[]', '[]', '[]', 1, 1, 1, 'any', -3187.29, 0, 0, 1, 0, '["M107_DZ","amovpknlmrunsraswrfldl",42]')

/* The above logs go on for a few more after this, no point stating them I guess */

/* The log below shows that the person with id = 241288 (MOST probably DISON), either spawned or logged in with

a) ItemRadio

B) LaserDesignator

c) MakarovSD

d) the list goes on

*/

09/21/12 17:14:32 INFO [main] dayz_3110.lingor command E: call proc_updateSurvivor(241288, '[]', '[["ItemFlashlight","ItemMap","ItemWatch","ItemToolbox","ItemRadio","Laserdesignator","ItemKnife","ItemGPS","ItemHatchet","ItemFlashlightRed","ItemEtool","ItemCompass","ItemMatchbox","MakarovSD","M107_DZ","M9SD"],["HandGrenade_West","PipeBomb","SmokeShellRed","10Rnd_127x99_m107","2100Rnd_20mm_M168","PipeBomb","2100Rnd_20mm_M168","FlareWhite_GP25","8Rnd_9x18_Makarov","ItemBandage","ItemBandage","15Rnd_9x19_M9SD"]]', '["DZ_Backpack_EP1",[[],[]],[["ItemTankTrap"],[14]]]', '[]', 1, 1, 1, 'any', 0, 0, 0, 0, 0, '["M107_DZ","amovpknlmstpsraswrfldnon_diary",42]')

Edited by Wotuu
  • Like 1

Share this post

Link to post
Share on other sites
Sign in to follow this  
Followers 0
Go To Topic Listing Mod Servers & Private Hives
×