Someone hacked to the console?!

[DoctorSLO]

Hi.

Today I woke up and I found my spawn griefed. Then I looked at the server log and I found this:

2012-08-11 07:38:04 [iNFO] CONSOLE: Opping Final_Architect

Here a little bit more:

2012-08-11 07:37:22 [iNFO] <Final_Architect> Thank you 

2012-08-11 07:37:24 [iNFO] There are 22 out of maximum 25 players online.

2012-08-11 07:37:24 [iNFO] Connected players: 97silverdragon, allsphinx, AsNeDomantas, bandnerd15, Chhay19, demosean, Draw11, Emo_Princess, Final_Architect, fwazar1337, GlossGhost, Guguc112, Jerwen, kevintoki, m4gn3t1z3d, Mr_pips, NitrxNR, solidzeller, THUNDERGROOVE, Vand1, xJerrymiahx, xThexCommanderx

2012-08-11 07:37:24 [iNFO] <bandnerd15> sphinx

2012-08-11 07:37:27 [iNFO] <THUNDERGROOVE> Mhm:D

2012-08-11 07:37:30 [iNFO] <bandnerd15> thanks

2012-08-11 07:37:35 [iNFO] /69.162.68.58:44469 lost connection

2012-08-11 07:37:37 [iNFO] [FD] GlossGhost found 4 iron ores

2012-08-11 07:37:41 [iNFO] <allsphinx> do i have the defalt skin?

2012-08-11 07:37:42 [iNFO] /72.253.204.208:50918 lost connection

2012-08-11 07:37:47 [iNFO] <bandnerd15> yes

2012-08-11 07:37:49 [iNFO] /50.23.30.168:52042 lost connection

2012-08-11 07:37:49 [iNFO] /72.253.204.208:50925 lost connection

2012-08-11 07:37:50 [iNFO] There are 22 out of maximum 25 players online.

2012-08-11 07:37:50 [iNFO] Connected players: 97silverdragon, allsphinx, AsNeDomantas, bandnerd15, Chhay19, demosean, Draw11, Emo_Princess, Final_Architect, fwazar1337, GlossGhost, Guguc112, Jerwen, kevintoki, m4gn3t1z3d, Mr_pips, NitrxNR, solidzeller, THUNDERGROOVE, Vand1, xJerrymiahx, xThexCommanderx

2012-08-11 07:37:53 [iNFO] [PLAYER_COMMAND] AsNeDomantas: /sell charcoal

2012-08-11 07:37:57 [iNFO] /50.23.30.168:52477 lost connection

2012-08-11 07:38:04 [iNFO] CONSOLE: Opping Final_Architect

hm ... any comments, suggestions? :S

[paulcall]

I highly doubt that someone "hacked" your console. Someone probably did it manually.

If you find who did it, make sure he gets hung.

[Expozay]

Which locations is there access to your console? Perhaps someone has access to your account with the host provider.. Or perhaps you allow cracked version to connection, which allows one to log in under your account?

[DoctorSLO]

The hack happened again after 20 hours. The guy is from USA ...

OK, I have changed the password of my account.

Yes I do run server in offline mode, but noone has op-ed using my account, even noone has logged in ... I checked the log (ofcourse I'm using auth plugin).

But I doubt that they have my password, because the hacker used command /who about 10 times before he got op status. So he was checking if he is already OP.

Is there anyway to disable OP command?

EDIT: I think he is using something like this:

http://www.youtube.com/watch?v=uG7vEf_tuqs

[Expozay]

He most likely has access to your console. Or the password to your actual in-game account. And yes, it is possible to mirror the console, without showing who opped who. Have you checked your ops.txt just to see if anyone else is in there? Also, I suggest you talk to your hosting company about providing IP logs of who's logging into your Control Panel at what time. If they can't, I suggest going to a different hosting company with better security. For me, I whitelist by IP who can access the CP.

And it's not the program from the video from what I can tell, since it doesn't show the console opping him.

[DoctorSLO]

I have changed the password for my hosting account but he was able to op him again.

In op file it's just me .. (and him when he op himself)

I already talked to my hosting company, but no appropriate answer yet.

The good thing is that he has the same IP address, so I banned the IP (I forgot for the first time lol ), so lets see what will happen now ...

[Expozay]

Let's hope of nothing bad : P