Teamspeak Spam

[Bohdan]

Our Teamspeak server has been discovered by the spammers. We need a password and a private forum in which to keep the password safe.

Boh

[Allison]

Keep it secret. Keep it safe!

[Noleader]

Hopefully it was Duke Nukem that spammed.

[Hulrig]

For those that where on TS last night when two of the spamers came on. Do a virus scan on your computer. I booted up my computer this morning only to be greeted by 500 rejected mail sent messages due to spam.

I found a virus called Bloodhound.SONAR.1 that was in my windows/system32/aspimgr.exe file. Does anyoone know what that file is attached to or can I delete using my regedit.

[spyder913]

um..you can't be infected by someone over TS. the rejected spam messages are probably backscatter, which you can't do anything about. I would post a link to info on backscatter but I'm posting from my phone so it's kind of a pain to do that.

[Hulrig]

Nim mentioned to me that one of the spammers logged on after we rebooted TS with our new password. I'm not sure how I was infected. This only happened this morning when I booted up my PC. I did not log in to any other programs last night other than our TS and AoC.

What is backscatter, never heard of it. I'm using Norton at this time.

[Morety]

I noticed a ton of "msg not delivered" emails last week and ran adaware, haven't seen them again since. I'm not sure if it was when I was on TS or not? I have no idea where that happened, but I was long overdue for an adaware run anyways.

[Morety]

backscatter:

http://spamlinks.net/prevent-secure-backscatter.htm

The term backscatter in spam refers to a spammer using your email address as the return address in the spam he is sending. All error messages and complaints will then be directed towards your email address. You will need to view the message headers to be able to show that the messages did not originate from your computer. There is not an easy solution for this problem other than digitally signing all valid mail correspondence. This however does not eliminate the problem, it only helps verify what is truly valid communication.

[Hulrig]

Thanks Mo, i will look in to this. I ran my norton scan. When It showed the virus I did a fix on it right away. So far the spam mail has stopped. Going to reboot my system when complete and see if it happens again.

[Cavan]

We have two options here.....

#1) Put a Hard Password on the Team Speak Server that is only visible in the Guild Log-On Message

#2) Transfer from a Team Speak Server to a Ventrilo Server (costs a bit more.. but not much) and start off with higher security

Let me know....

[Morety]

I'd have to think that having the pw on our guild motd is good enough. Only people in our guild would see it.

[Elvtin]

I'm good with the 1st option. :)

[Hraland]

I agree that putting it in the MOTD should be sufficient security, but when did you implement the TS password? I was able to connect last night at about 6pm Pacific with no password.

[Ivyrielle]

We have two options here.....

#1) Put a Hard Password on the Team Speak Server that is only visible in the Guild Log-On Message

#2) Transfer from a Team Speak Server to a Ventrilo Server (costs a bit more.. but not much) and start off with higher security

Let me know....

If it helps...

We've had our vent server info in a public area of the Fianna forums for 3+ years and I've never run into any random spammers, etc. I'm an admin there, so i'd hear about it, I'm sure. :)

My husband mentioned WOW TS servers have had a glut of spammers hijacking them. Didn't really click, let alone make sense WHY to me anyone would even bother, but there it is.

[faeldan]

just something i read over at MMO-champion website today.


Quote from: Drysc (Source (http://www.legionoflions.com/))
A recent vulnerability has been discovered in popular web-content delivery program Adobe Flash, and it could potentially be used to target World of Warcraft players and accounts. The newest available version of Adobe Flash, version 9.0.124.0, does not contain this vulnerability, and we recommend that everyone upgrade their Flash player as soon as possible by visiting the Adobe.com download page at the link below.

http://www.adobe.com/shockwave/download/download.cgi?P1_Prod_Version=ShockwaveFlash (http://www.adobe.com/shockwave/download/download.cgi?P1_Prod_Version=ShockwaveFlash)

In addition, to avoid exploitation of this vulnerability, we have temporarily disabled the ability to post hyperlinks in our forums. Any links will need to be copied and pasted into a browser. We’ll continue to evaluate any potential security threats and take any steps necessary to ensure a safe and fun environment.

For more information on this issue, you can read the announcements from the Adobe security team concerning the threat at the links below

[spyder913]

that 0-day vulnerability for flash is not good, since there doesn't look to be a patch yet. I would recommend disabling flash until it is fixed, since there appear to be live or very good proof of concept exploits for it already.

[Morety]

Thanks for the info Fael. I'll update asap. I wonder if someone will try to hijack my daughter's webkinz account?

[spyder913]

Thanks for the info Fael. I'll update asap. I wonder if someone will try to hijack my daughter's webkinz account?Already did:

un: canadarlz97
pw: mydadfartsalot

[Aarimus]

pw: mydadfartsalot

Would be my guess also.....