Query creates channels, send messages or pokes users

[Hembi]

Hi,

with PHP scripts can connecting to the server without a ServerQuery login and this client can write to the other users, can create channels, etc.
I cann't ban the client, with ServerAdmin.

The script can more than one client and flooding/spamming the chat and create some temporary channel.

Channel creating:


Ban:

[dante696]

That's no exploit or bug.
Your server just does allow the Guest query to do these things.

http://forum.teamspeak.com/threads/9...011#post394011

[Davlik]

Hello , iam hosting teamspeak 3 server for some time and now from nowhere everyone on server got spam poke from some unknown user

<00:24:21> "admin" pokes you: new ip teamspeak3 : 185.***.***.***:9992

However , from logs and everthing user was never on server(no indentity no connect on server, nothing....cant do nothing about it) so iam not sure how could he do it.
My friends told me they happened same for them on theirs servers with different IPs and after few minutes after that they got all DDOS attack on their server but i got strong bandwith from France so its holding up so far but iam not sure if is this some security hole in server or client or my query pw was compromised or something idk.

Does anyone have any idea whats going on? thank you iam kinda confused

[shawnstyle]

A few days ago I received a poke from "Admin" with the message "NEW IP, CLICK HERE!" Everyone else connected to the server at that time also received the message and they alerted me about it, when I tried banning the user it said "missing required parameter" but when I checked the banlist the ban was registered as "uid=ServerQuery (Unknown from 37.187.252.194:48319)" ... I tried connecting to the ip that was sent through the poke as a message and it connected me to a European server, today the same thing happened, I stepped out for a bit, when I came back I received 3 pokes from the same ip "uid=ServerQuery (Unknown from 37.187.252.194:48319)" but when I tried connecting through the poke message It connected me to a different server not the one like before, I'm not connected to any Query programs and I have no Idea what is going on it is really affecting me and my clients.

[sunpeace]

I think that if you have a server group that you think anyone could have and it has enough poke power, someone could do it with the help of javascripts. I believe TS3MassMover also has mass poke feature, as long as you have enough poke power to poke most of the people, its easy to manipulate new ip. like change your nickname to admin /masspoke

[u rl= ts3srv://123.123.123.12 3]Click here for new ip[url]

Or he might have done it with yatqa or similar things, that could be the reason you couldn't ban

[shawnstyle]

I don't know, When I try to ban it says "invalid perimeter" but when I check the banlist it shows a ban is registered as "uid=ServerQuery (game-state.com" or "gametracker" in those brackets with the ip as shown in my first reply when the ban is fresh, when i close the banlist the ip next to it disappears..

Edit: when i edit the ban window the unique id shows the ban registered as "ServerQuery"

[numma_cway]

Solution is somewhere in the server changelogs. Read them.

[shawnstyle]

Solution is somewhere in the server changelogs. Read them.

I went over the changelog, I see what you're referring to. But I do not know how to go about "fixing" the problem.

[sunpeace]

It's probably as I thought but you need to check it yourself to be sure. Join your teamspeak with new identity, give yourself a server group which has enough permission to poke. When you have the server group on you, go to tools, serverquery login. Write serverquery1, since we consider serverquery is taken by "hacker" guy. Connect to yatqa with your server ip+port and username serverquery1 and password that it gives you after you write serverquery1. Change your nickname with yatqa, in misc part if I'm not mistaken. Then poke a yourself(but old yourself, not new id, disconnect from the server with new identity. Connect with your original one.) When you poke original yourself click on red name that shows who poked you and ban it. Check the ban list to see what it says about uid. If you see serverquery1 or the nickname you changed, bingo!

Then copy your sqlitedb into your pc and open it with a sql browser. I'm %100 sure in somewhere there are list of created serverquery login accounts. And possibly information about who created them. I saw with my own eyes that there is a list about it in database but I'm not sure about if it includes information. I'm on mobile so can't exactly tell you were it is but it's easy to find.

[shawnstyle]

Server groups are protected I'm the only one who can assign/remove groups and only my group is allowed to access SQ login/acc creation. I did follow the rest of the steps you mentioned, I couldn't find SQ accounts in the sqlitedb I could be looking the wrong place maybe?

I did make one change to my permissions for guess, I revoked the permission to poke.

[ANR Daemon]

Shield your query port from external connections.

[shawnstyle]

Shield your query port from external connections.

How do I go about doing this?

[ANR Daemon]

F.e. bind query console to 127.0.0.1

[Chris]

I went over the changelog, I see what you're referring to. But I do not know how to go about "fixing" the problem.

That was explained in the announcement for that server version as well as in post 33 of this thread.

[Saelyth]

This explains pretty much the issue:


Some guys got a ServerQuery bot that is creating DDoS attacks and redirecting people to a new external IP.

The address they're linking with those pokes is: ts3server://xxxxx

So... questions:

1. How could we block access to our server without blocking access to all serverquery bots? We got our own bot just for management.
2. Can those guys be punished? Remove their license or anything. It's very frustrating and seems like they're attacking more servers. This is really problematic for paid servers.