Security Problem or a Fake?

[Chronarch]

Hello everyone, I hope someone can maybe clarify what exactly happened to me tonight.

I was in our squad's TeamSpeak server when someone by the name of Bob came into the server. He had a strong accent and started calling for me, the server admin. I alt-tabbed out to see who it was and noticed that his name appeared as : Bob (R, SA) He started babbling on about me not being able to stop him no matter how hard I try or something. I really could not understand him because of the accent.

I promptly kicked and banned him once he told one of my squad mates to shut up. He never kicked or banned any of us in the server for the short time he was there and did not come back......

There is no way that he was willingly granted those priveledges by me or the other admin, so either he was fake or I have a security problem that needs fixing. I'm hoping you all might be able to help me determine if this guy truly had those priveledges or was a fake.

Also, I accidentally closed my client before I could verify this, but I am relatively certain that when I banned him in the bottom portion of the window it said Bob (R SA) was kicked from server by MyName() I'm wondering if the "R" and "SA" would show up after his name if he truly had those priveledges since they did not even show up after my name. Since we leave our server open for all users I'm wondering if he just joined with the nick Bob (R SA) after reading some of the other posts in these forums.

I appreciate all of your help and ask you to forgive me if this post is terribly redundant.

Thanks,

Chronarch

[Brain]

This sounds like someone tried to pull off the oldest trick in the book, see here.
It's basically attaching (R SA) to your nick, hoping other people don't notice the additional (U) Teamspeak appends as real status info.
You can see it very well here:

Bob (R SA) was kicked

Teamspeak doesn't quote user privileges when kicking, joining, leaving or changing channel etc.

[SatanClaus]

which server-version do you use???
some information on this could be in your server.log if it was set to log logins and stuff...
(dude, read the forum-rules before enraging me)

cu
SatanClaus

[Chronarch]

Thanks Brain. I figured that was probably the case when I noticed that (R SA) information followed his name but not mine. I'll pay attention to see if there is a "U" as well if it happens again. Also, in thinking back, when he joined it merely said "New Player" unlike "New Member" when registered users join. Anyway, thanks again.

SatanClaus, the version we are running is 2.0.19.40. It's run remotely on a computer that I do not know all of the specs for, and that is why I did not post them. Forgive me for being stupid, but I was having a hard time finding the version as well until I found it in the log file. The log file did not have any information relating to last night. We will look into updating the server ASAP as I see a new version is available.

When something runs as flawlessly as TeamSpeak has run for us you get lax in checking for updates.

As far as I'm concerned the guy was just a fake as Brain pointed out and this problem has been resolved.

Thanks for you help.

Chronarch

[Scruge]

Any Idea How the *** this dude got SA Rights ?
This is like the forth time today this has happened each time logging in the web access to give myself back my rights

Theres no extra users but me and one other person with that ability
and
Furthermore
Ive Made it so u can revoke or grant via TeamSPeak Client
YEt they still are somehow any ideas ?

[04:40:14] bibbelklaus (R SA) joined channel
[04:40:40] bibbelklaus (R SA) revoked your server admin rights
[04:41:04] bibbelklaus (R SA) quit
[04:42:08] bibbelklaus (R SA) joined channel
[04:42:39] bibbelklaus (R SA) quit


11-06-04 09:14:46,ALL,Info,server, Server version: 2.0.19.40 Win32

[debug]
MessageTypes=LMTALL
MessageDepths=LMDALL
[Main Config]
ExternalIPDectection=1
HTTPServer Port=14534
HTTPServer Enabled=1
DateTimeFormat=dd-mm-yyyy hh:nn:ss
TCPQueryPort=51234
BoundToIp=
[WebPost]
AdminEmail=admin@whc-gamers.com
ISPLinkURL=www.whc-gamers.com
ISPName=WHCGamers
ISPCountryNumber=5112
Enabled=1
PostURL=http:www.whc-gamers.com
ListPublic=1
[log]
access=0

[Brain]

Three recommendations for you:
- Upgrade Server to 2.0.20.1
- Enable all logging options
- Post the appropriate portion from the log file here next time the guy logs in and does his stuff.