Abuse of ToS

[GreyGeek]

To whom it may concern at Comcast ...
Yesterday a Minecraft Tekkit server I setup several weeks ago for the enjoyment of myself and my two grandsons, ages 5 and 11, was broken into by a person whose IP address, my logs show, was 69.244.158.123. He used the pseudonym of Charismajacker. I have never heard of this individual prior to his appearance in my logs. His break-in was unexpected and uninvited. He was on my Minecraft server less than 10 minutes, but totally destroyed three separate areas of the simulation, proving that his entry was only for malicious purposes.


He may have hacked into my 11 year old grandson's Windows computer to gain the access password, or he used a "dearjohn" type password cracker, or perhaps a java exploit on the server itself. Regardless of his method of entry, he was not authorized to enter and I have no doubt that his act violated your Terms Of Service, AND the Computer Fraud and Abuse Act, which forbids unlawful entry into computer systems.


Using his IP address I tracked him to your service in Waterford Charter Township, Michigan, somewhere in the vicinity of 527 North Cass Lake Road, and I located his YouTube account under that pseudonym as well, where he posts videos of Minecraft activity and how to circumvent DRM on the use of Minecraft, which is probably a violation of YouTube's ToS as well.


Please do what you feel is necessary to prevent this irresponsible person from doing further damage to the computers and/or servers of other people.


Attached is a jpg of my server's admin system showing his entry and time, and the system logs showing the same.


Thank you,
etc...

[Xplorer4x4]

Good luck GreyGeek, seriously best of luck. Sadly I suspect it will go no where. Reminds me of when I was a kid using AOL(in it's heyday). My account was compromised, and I kept loosing my connection(this was the good ol days of 28K and 56K dial up). My father called AOL, who reset the password. I would log back in but to no avail my account was soon hijacked again. This went on for a few hours. After several phone calls, and my father being quite angry at the time, told the rep that I was pretty much unable to access the service because I kept being hijacked with in minuets of regaining access. The rep actually told him "well sir, your son doesn't have to be in front of the computer." Yeah the rep got an ear full after that lol. We didn't remain an AOL customer for to long after that. The cracker also managed to gain access to my ebay account and make some fraudulent purchases.

I was able to track his IP through email communications he sent me, but for some reason I doubt AOL or ebay ever perused the matter. Of course such things are taken a bit more serious these days and we have more laws that actually make it easier to pursue these individuals. Best of luck to ya GreyGeek.

[GreyGeek]

Good luck GreyGeek, seriously best of luck. Sadly I suspect it will go no where. ...

I doubt it will either.

One reason I chose the vendor I did was because they offered Linux servers. However, they present a limited admin of it through their GUI apps. After this incident I took over admin duties and opened a console on the server and made some security settings, removing the "public" setting, so now it doesn't broadcast and advertise for Minecraft that I have a Minecraft server running. I also added Whitelistings and give everyone else but me and my two grandsons the boot the instant they attempt to log in. I should have done this when I first set up the account, but ... I was too trusting.

I was up until 2:30 AM last night in an all-day, half the night marathon rebuilding so that we could continue our adventure where we left off. We had a blast this evening until his mother told him it was time to go to bed.

[NickStone]

Using his IP address can't you get in to his computer (I expect its Windows OS) and re-arrange his filing system of something? LOL

[james147]

In light of this I thought I might share my backup script for minecraft. I use clicraft to run my minecraft server and it is a plugin for this but you should beable to use it as a base for your own, or switch to clicraft and use it directly
It is run by a cron job hourly and uses rdiff-backup so the backups take up very little space if nothing changes making it very efficient. It also sync to a remote server just in case This way I will at most only lose an hour of work if something like this happens to me, hope someone finds it useful.

#!bash
#
# Usage: clicraft backup
#
#    Backs up the world folder to backups/<world>-<date>-<time>.zip
#


BACKUP_DIR="$SERVER_DIR/backups"
WORLD=$(serverprop 'level-name')
DATE=$(date +%Y%m%d-%H%M%S)
REMOTE_BACKUP="user@host::backup/minecraft"


cd "$SERVER_DIR"
mkdir -p "$BACKUP_DIR"


if status; then
        save-off
        save-all
fi


#zip -r "$BACKUP_DIR/$WORLD-$DATE.zip" "$WORLD"
rdiff-backup "$WORLD" "$BACKUP_DIR/$WORLD"


if status; then
        save-on
fi


# backup to external server
rsync -az --password-file=$HOME/backup.secret "$BACKUP_DIR/" "$REMOTE_BACKUP"

Note: clicraft is a nice way to run a minecraft server on linux using tmux or screen, is coded in bash and is easly extensible with scripts like this one.

[GreyGeek]

Thanks, james147, but I setup a backup program when I took over admin duties.

[oshunluvr]

Gerry, have you forwarded your info to the local police there? They might be interested to know they have a known felonous hacker in their midst.

[GreyGeek]

Gerry, have you forwarded your info to the local police there? They might be interested to know they have a known felonous hacker in their midst.

It's not a local crime. Minocity hides its server locations behind anonymous registers and the bad guy is a 16 year old living in Waterford Charter, MI. I'm in Lincoln, NE. I doubt that the FBI wants to put a man on this case, so I reported the grief incident to his ISP, ComCast, in his home town. It was no skin of their hide and I suspect that they'd rather keep his monthly service fee than cut him off, unless he does some serious hacking. I doubt that they will do anything because to do so would require expending some manhours and that would cut into their profit.

[Xplorer4x4]

It's not a local crime. Minocity hides its server locations behind anonymous registers and the bad guy is a 16 year old living in Waterford Charter, MI. I'm in Lincoln, NE. I doubt that the FBI wants to put a man on this case, so I reported the grief incident to his ISP, ComCast, in his home town. It was no skin of their hide and I suspect that they'd rather keep his monthly service fee than cut him off, unless he does some serious hacking. I doubt that they will do anything because to do so would require expending some manhours and that would cut into their profit.

For what is worth, some 10 years ago or so I admined a forum. I dealt with a child who got banned for the typical kind of reasons. I dont recall specifics but it was just forum behavior reasons, not hacking related. Anyways, he continued to register multiple accounts over and over and I finally contacted the abuse department for his isp. I did not hear from him for some time. Once he resurfaced, he more or less admitted his isp contacted mommy and daddy. So maybe the same will hold true. Of course the net landscape was rather different but perhaps the isp will at least due that much.


Sent from my DROID2 Global