Server Owners Beware! 6 Griefers Caught Red Handed!

[Cleora]

Pretty much, on the 26th of June my Whitelisted lobby and Whitelisted faction server where greifed. By griefed, I mean a total of 6 users came onto the server, one gaining star perms.
Where able to use any command on the server to destroy it.

So, here's what they did.
[14:57:23] [Thread-10732/INFO]: UUID of player Numbist is 0bd4ecf0-8321-4ae6-8c51-9a7d37f1b02d
[14:57:23] [Server thread/INFO]: Numbist[Not showing you ips] logged in with entity id 765889 at ([world]-71.0, 31.0, 292.0)
[14:57:23] [pool-19-thread-1/INFO]: Creating empty config: /home/container/plugins/Essentials/userdata/0bd4ecf0-8321-4ae6-8c51-9a7d37f1b02d.yml
[14:57:27] [Server thread/INFO]: Numbist issued server command: /balance
[14:57:28] [Server thread/INFO]: Numbist issued server command: /balancetop
[14:57:35] [Server thread/INFO]: Numbist lost connection: Disconnected
[14:57:35] [Server thread/INFO]: Numbist left the game.
[14:57:42] [Thread-10735/INFO]: UUID of player Emcrypted is 9853087d-d15e-402a-9069-05475fb22575
[14:57:42] [Server thread/INFO]: Emcrypted[not showing you ips] logged in with entity id 773740 at ([world]-71.0, 31.0, 292.0)
[14:57:44] [Server thread/INFO]: Emcrypted issued server command: /gmc
[14:57:44] [Server thread/INFO]: §cEmcrypted §4was denied access to command.
[14:57:45] [Server thread/INFO]: Emcrypted lost connection: Disconnected
[14:57:45] [Server thread/INFO]: Emcrypted left the game.
[14:57:57] [Thread-10736/INFO]: UUID of player Emcrypted is 9853087d-d15e-402a-9069-05475fb22575
[14:57:57] [Server thread/INFO]: Emcrypted[not showing you ip] logged in with entity id 775442 at ([world]-71.0, 31.0, 292.0)
[14:57:58] [Server thread/INFO]: Emcrypted issued server command: /lp
[14:58:03] [Server thread/INFO]: Emcrypted issued server command: /balancetop
[14:58:09] [Server thread/INFO]: Emcrypted lost connection: Disconnected
[14:58:09] [Server thread/INFO]: Emcrypted left the game.
[14:58:19] [Thread-10739/INFO]: UUID of player Velazuse is a770052c-d264-423d-98e3-e72283ee35c5
[14:58:19] [Server thread/INFO]: Velazuse[not showing you ip] logged in with entity id 782257 at ([world]-71.0, 31.0, 292.0)
[14:58:21] [Server thread/INFO]: Velazuse lost connection: Disconnected
[14:58:21] [Server thread/INFO]: Velazuse left the game.
[14:58:26] [Thread-10740/INFO]: UUID of player Velazuse is a770052c-d264-423d-98e3-e72283ee35c5
[14:58:26] [Server thread/INFO]: Velazuse[not showing you ip] logged in with entity id 783254 at ([world]-71.0, 31.0, 292.0)
[14:58:29] [Server thread/INFO]: Velazuse issued server command: /warp
[14:58:29] [Server thread/INFO]: §cVelazuse §4was denied access to command.
[14:58:44] [Server thread/INFO]: Velazuse issued server command: /balancetop
[14:58:46] [Server thread/INFO]: Velazuse lost connection: Disconnected
[14:58:47] [Server thread/INFO]: Velazuse left the game.
[14:58:56] [Thread-10745/INFO]: UUID of player muud is 5d73c536-ca47-49ba-8333-e622c9b2c6be
[14:58:56] [Server thread/INFO]: muud[not showing you ip] logged in with entity id 795846 at ([world]-71.0, 31.0, 292.0)
[14:58:59] [Server thread/INFO]: muud issued server command: /gmc
[14:58:59] [Server thread/INFO]: §cmuud §4was denied access to command.
[14:58:59] [Server thread/INFO]: muud lost connection: Disconnected
[14:58:59] [Server thread/INFO]: muud left the game.
[14:59:04] [Thread-10746/INFO]: UUID of player LordOfThisServer is 77ae6081-6495-420e-94e3-042918c11746
[14:59:04] [Server thread/INFO]: LordOfThisServer[not showing you ip] logged in with entity id 798281 at ([world]-71.0, 31.0, 292.0)
[14:59:06] [Server thread/INFO]: LordOfThisServer issued server command: /fly
[14:59:06] [Server thread/INFO]: §cLordOfThisServer §4was denied access to command.
[14:59:09] [Server thread/INFO]: LordOfThisServer issued server command: /balancetop
[14:59:12] [Server thread/INFO]: LordOfThisServer lost connection: Disconnected
[14:59:12] [Server thread/INFO]: LordOfThisServer left the game.
[14:59:18] [Thread-10747/INFO]: UUID of player Hosstile is 5b02bb34-fc8e-4bfd-a3da-6c1410388faf
[14:59:18] [Server thread/INFO]: Hosstile[not showing you ip] logged in with entity id 802716 at ([world]-71.0, 31.0, 292.0)
[15:01:05] [Server thread/INFO]: Hosstile lost connection: Disconnected
[15:01:05] [Server thread/INFO]: Hosstile left the game.
[15:01:14] [Thread-10758/INFO]: UUID of player SkippTekk is 766c4d3e-05f8-4338-9512-d7f2412d11f6
[15:01:14] [Server thread/INFO]: SkippTekk[not showing you ip] logged in with entity id 866458 at ([world]-71.0, 31.0, 292.0)
[15:01:16] [Server thread/INFO]: SkippTekk issued server command: /gmc
[15:01:23] [Server thread/INFO]: SkippTekk issued server command: /lp user Numbist parent set owner
[15:01:23] [luckperms-worker-18/INFO]: [LuckPerms] [Messaging] Sending log with id: 30e64646-c0fb-492b-a502-0e63e1794a12
[15:01:23] [pool-9-thread-1/INFO]: [0;37;22m[21m[[0;36;1m[21mL[0;36;22m[21mP[0;37;22m[21m] [0;36;22mLOG [0;36;22m[21m> [0;30;1m([0;33;1mSkippTekk@lobby[0;30;1m) [[0;32;1mU[0;30;1m] ([0;36;1mnumbist[0;30;1m)[m
[15:01:23] [pool-9-thread-1/INFO]: [0;37;22m[21m[[0;36;1m[21mL[0;36;22m[21mP[0;37;22m[21m] [0;36;22mLOG [0;36;22m[21m> [0;37;1mparent set owner[m
[15:01:23] [luckperms-worker-19/INFO]: [LuckPerms] [Messaging] Sending user ping for 'numbist' with id: 4fb1abcd-8a5f-4e61-b1d3-0da587c23e04
[15:01:27] [Server thread/INFO]: SkippTekk issued server command: /lp user Numbist permission set *
[15:01:27] [luckperms-worker-14/INFO]: [LuckPerms] [Messaging] Sending log with id: b205823d-2d3c-4aa6-baa5-0e335d9345a0
[15:01:27] [pool-9-thread-1/INFO]: [0;37;22m[21m[[0;36;1m[21mL[0;36;22m[21mP[0;37;22m[21m] [0;36;22mLOG [0;36;22m[21m> [0;30;1m([0;33;1mSkippTekk@lobby[0;30;1m) [[0;32;1mU[0;30;1m] ([0;36;1mnumbist[0;30;1m)[m
[15:01:27] [pool-9-thread-1/INFO]: [0;37;22m[21m[[0;36;1m[21mL[0;36;22m[21mP[0;37;22m[21m] [0;36;22mLOG [0;36;22m[21m> [0;37;1mpermission set * true[m
[15:01:27] [luckperms-worker-19/INFO]: [LuckPerms] [Messaging] Sending user ping for 'numbist' with id: a8efc2e1-297d-489f-af3d-c677a3cea4f3
[15:01:28] [Server thread/INFO]: SkippTekk lost connection: Disconnected
[15:01:28] [Server thread/INFO]: SkippTekk left the game.
[15:01:58] [Thread-10763/INFO]: UUID of player Numbist is 0bd4ecf0-8321-4ae6-8c51-9a7d37f1b02d
[15:01:58] [Server thread/INFO]: Numbist[not showing you ip] logged in with entity id 874314 at ([world]-71.0, 31.0, 292.0)
[15:02:01] [Server thread/INFO]: Numbist issued server command: /gmc
[15:02:02] [Server thread/INFO]: Numbist issued server command: /gms
[15:02:06] [Server thread/INFO]: Numbist lost connection: Disconnected
[15:02:06] [Server thread/INFO]: Numbist left the game.
[15:02:22] [Thread-10766/INFO]: UUID of player Numbist is 0bd4ecf0-8321-4ae6-8c51-9a7d37f1b02d
[15:02:22] [Server thread/INFO]: Numbist[not showing you ip] logged in with entity id 878919 at ([world]-71.0, 31.0, 292.0)
[15:02:27] [Server thread/INFO]: Numbist issued server command: /gmc
[15:03:09] [Server thread/INFO]: Numbist lost connection: Disconnected
[15:03:10] [Server thread/INFO]: Numbist left the game.
[15:03:44] [Thread-10773/INFO]: UUID of player Numbist is 0bd4ecf0-8321-4ae6-8c51-9a7d37f1b02d
[15:03:44] [Server thread/INFO]: Numbist[not showing you ip] logged in with entity id 907345 at ([world]-71.0, 31.0, 292.0)
[15:03:52] [Server thread/INFO]: Numbist lost connection: Disconnected
[15:03:52] [Server thread/INFO]: Numbist left the game.
[15:06:35] [Thread-10783/INFO]: UUID of player Numbist is 0bd4ecf0-8321-4ae6-8c51-9a7d37f1b02d
[15:06:35] [Server thread/INFO]: Numbist[not showing you ip] logged in with entity id 912482 at ([world]-71.0, 31.0, 292.0)
[15:06:37] [Server thread/INFO]: Numbist issued server command: /gmc
[15:06:41] [Server thread/INFO]: Numbist issued server command: /sp area 5
[15:07:33] [Server thread/INFO]: Numbist issued server command: /gmc
[15:07:52] [Server thread/INFO]: Numbist issued server command: /warp
[15:09:39] [Server thread/INFO]: Numbist issued server command: /pt /sphere 0 15
[15:09:40] [Server thread/INFO]: [PT] Numbist issued server command: //sphere 0 15
[15:09:40] [Server thread/INFO]: [PT] Numbist issued server command: //sphere 0 15
[15:09:40] [Server thread/INFO]: [PT] Numbist issued server command: //sphere 0 15

With help, we where able to come to the conclusion that they used a cracked minecraft account to access my developers account, to then give himself (Numbist) star perms. (Admin/owner perms pretty much) and you can see what they did to grief:
[15:09:40] [Server thread/INFO]: [PT] Numbist issued server command: //sphere 0 15

Now here are some photos took only a couple hours after the accident:
Lobby: https://i.badlion.net/a4YiZXHSdaWkjaj8pSuGkE.png
Spawn: https://i.badlion.net/pCuXtYW2GrQuP36ogmHUS9.png

It wasn't a big deal because the server is still heavily work in progress and we where able to remove users for good, following a easy roll back to a couple hours before this happened.
Also, issued. All places where ip's have been replaced with [Not showing you ip] is for a good reason. And the other information is nothing no other server owner would know when running commands, console, etc.

Here are the user's namemcs, freshly picked out by me just to show you:
https://namemc.com/profile/LordOfThisServer.1
https://namemc.com/profile/Velazuse.2
https://namemc.com/profile/muud.5
https://namemc.com/profile/Hosstile.2
https://namemc.com/profile/Numbist.1 - What seems to be the leader. (star perm dude)
https://namemc.com/profile/Emcrypted.1 - Emcrypted1 (the only user who seems to have a mcm profile account)

Now, what seems a little ironic to me is the username in game is spilled Emcrypted, but on minecraft market there is a user called nether1, who I asked if he had anything to do with this. His responses:
https://gyazo.com/d9cb50f6a583a78d19e7d9b96bcba657
https://gyazo.com/be92240da030a237a82bfa20e9e6aad6
There was more to the above conversation but it's nothing that should go public.
And what makes me also think that this user did do it, is take a good look at his profile picture. https://gyazo.com/8d79754cb899b023cf6ea6a447d25c35 now take a good look at his minecraft skin on namemc. https://gyazo.com/13dd98d65f6d29a4f863ca2c8cfe4bbf
To me this looks like a case of a purposefully misspelled username when signing up for MCM, because the proper one was already taken. Don't get me wrong, I could be mistaken, but logs never lie from the last time I checked, but people do.

1. What do you think? Did encryted really have anything to do with this?
2. Do you think the true griefers would be stupid enough to use their actual username?

To help you decide, I and my developer also found a youtube channel linking to the griefers user names when looked up. (At least for numbist)
https://www.youtube.com/channel/UCL1QYJtjHA-VhGOI9FvEzlQ

 

[Remnicore]

The developer's account doesn't need to be cracked if it's whitelisted. If they have the IP to direct connect, they can simply use an alt manager and since it's technically "cracked" Minecraft, they just need his username without the password. If your developer's account was actually breached, I sincerely recommend getting a new developer.

 

[Cleora]

The developer's account doesn't need to be cracked if it's whitelisted. If they have the IP to direct connect, they can simply use an alt manager and since it's technically "cracked" Minecraft, they just need his username without the password. If your developer's account was actually breached, I sincerely recommend getting a new developer.

He has changed his information and we will be taking further actions to stop this from furthering happening.
Thank you for the feedback.

 

[YosemiteOG]

Simple bungee-exploit shit lol.

 

[nether1]

First and foremost, why do I grief your server? What are my benefits on griefing your server? I already explained to you how the numbist guy exploited the uuids of the users in your server. If you don't believe me then try it yourself by downloading the client, you'll see how it works. Lastly, it clearly shows that you're not knowledgable enough about the flaws of running an outdated minecraft version and you're not ready to run a server.[DOUBLEPOST=1562710228][/DOUBLEPOST]

The developer's account doesn't need to be cracked if it's whitelisted. If they have the IP to direct connect, they can simply use an alt manager and since it's technically "cracked" Minecraft, they just need his username without the password. If your developer's account was actually breached, I sincerely recommend getting a new developer.

Her server is in online mode. It was an UUID Spoofing Exploit that ruined her server.

 

[Addman]

This is interesting, but if you had set up your bungee correctly there should be no way for an "Cracked" account to join the server.

I will vouch for nether1 as he is currently working for me.

 

[KA]

Use IPWhitelist if you have a bungee server

 

[Addman]

Use IPWhitelist if you have a bungee server

I agree there is a few different ones out there.

 

[Sloth]

This feels like we’re back in 2011/2012 and you have a team of greifers trying to blow up your server.

Team Avolition was pretty neat.

 

[Zirak]

Thats.... rough buddy

(Tell me if anyone gets the reference )

 

[nether1]

Cleora, I want to end this blaming of yours and I want to clear my name too. If you take a good look in your log, the numbist guy was checking for each uuid that he takes and see if they have perms or not (He checks this by using /lp command as shown in your log, which I believe that it will return either "You don't have permission" or "Shows the help page of LuckPerms"), and after many times of attempt, he managed to get's SkipTekk's UUID and eventually, he knew that he has perms so he gave himself (The hacker) the perms he needed to destroy your server.

I'll keep on repeating this until you realize that me and the other guys (Except for numbist) are innocent. I hope that you will be able to understand at this time and have a good night.