Teamspeak Security Problem

[testycow]

Ok i dont know what is up but I have a teamspeak server and i host free teamspeaks for people. I have a company, and for some reason i have the following problems BIG problem:

1)SA on the default IP. Mine. SA and The Registeration keep getting taken away. I would log out and poof gone. i would have to log in anonymously and get SA from one of my co-workers. Then i thought of a possible leak in the company. Nope. i removed SA and SuperAdmin from all my co-workers. Still happeneing.

2)Well now i figure out there is this 10 year old kid. That SOMEHOW got SA and banned us all. There is no way he got SA from anybody. That is one of my biggets concerns is how is he getting SA. My Passwords are original and no one could guess it. Please help ASAP.

Thank you for your help and time in advance.

Kyle

[guldi]

there's a FAQ thread about hacked TS servers. Currentyl no hack is know but a "design hole" where you can get people SA rights by selecting them and pressing simply the "e" button (with no warning message => design hole)
having lot's of people with SA rights is a sec. hole as well. Can you really trust them all ???


I'm VERY sure, if there were a real sec. hole in TS, big servers would have been taken over long ago which didn't happend.


PS: If someone has access to the TS server PC, he can open the server.dbs and get the passwordsfrom there, they are plain text (maybe the second "design hole"). But in this case, I guess you would have bigger probs :D

[LOAM]

The best way to eliminate the worry of idiot people getting SA status is to remove the ability of SA's to grant or revoke SA status. You then have to do it manually server side as superadmin but you have complete control over who gets it.
LOAM

[-[BBD]-MotherFo]

The best way to eliminate the worry of idiot people getting SA status is to remove the ability of SA's to grant or revoke SA status. You then have to do it manually server side as superadmin but you have complete control over who gets it.
LOAM


yes sir I have done this and it is very smart to do :cool:

[3rdDegree]

It should come with this as the default!!!

[WalkaboutTigger]

No, people should read the manual and be clue-enabled before using server-side software that is potentially mission-critical.

TeamSpeak may not be the best documented application but it is certainly better documented than a lot of other applications.

Walkabout

[guldi]

It should come with this as the default!!!
may make sense on some servers. But the bigger problem is that there is currently no warning window when dealing with mighty rights. I'm sure this will be corrected in a next version.

And, much worse, most people are dealing with admin rights if they were nothing special. That's not a problem of TS, that's a problem that most people are lazy or simply not aware what they are playing with.