Re: Security Exploit in UAIO Binary
 

BAD: You have an exploited copy of UAIO. Download new copies of all UAIO .amxx files. You should post in the forum news thread that you encountered this incident.

I got this message :( I posted here because it told me to :wink:

Re: Security Exploit in UAIO Binary
 

Hey DSi!!! Its Robert.

Well, I can't really believe someone would do this! Good job guys for finding this! Its also a good thing I took UAIO off my server.

Re: Security Exploit in UAIO Binary
 

Well this actually explains ALOT.
I got my server hacked before...had UAIO on it too...I didn't keep it though...

But seriously....THANKS ALOT lol :mrgreen:

Re: Security Exploit in UAIO Binary
 

What about his other plugins?

Re: Security Exploit in UAIO Binary
 

His other plugins are clean. The only reason he was able to do it in UAIO was by pre-compiling the plugin with the exploit. And since none of his other plugins are pre-compiled, meaning only the .sma is uploaded, they are perfectly fine.

This report isn't meant to bash UAIO, it in its self is a good plugin and has no exploit. Just that the creator went a little far when he scripted a secret back door.

Re: Security Exploit in UAIO Binary
 

Wow, didn't see this coming...

Re: Security Exploit in UAIO Binary
 

Oh I see, he put a differnent AMXX file than the sma's AMXX file. :gyar:

Re: Security Exploit in UAIO Binary
 

What steps should we take besides replacing our UAIO. I will say I had someone appear to change maps on my server and I know I am the only admin. When I looked at my logs there was nothing about the map change till time ran out and all of a sudden something besides the only map on my rotation was there.

Re: Security Exploit in UAIO Binary
 

Make sure your users.ini (or SQL tables, if applicable) only contains entries you know about.

Re: Security Exploit in UAIO Binary
 

Also, if there is no amxmodx log about the map change it sounds like they had your rcon password. Could check hl logs to see if anyone else was on rcon at the time or just change your rcon password to be safe either way.