|
Threads
View context
Very well said, I honestly couldn't have said this any better, thanks for taking the time Safine.
like(6)
View context
Right now we focus on Athena, you can try on other Bodys if it works, neckfix is included ... we see what the future brings :)
liked(1)
View context
Thanks for posting this. We are setting up the new grid now and I will check these things before we go public. I feel like I'm going crazy trying to make sure everything is secured lol
like(1)
View context
This just came to me in a msg:
https://soziarium.su/post/25354_dear-sacrarium-grid-users-...
Dear Sacrarium Grid users, we kindly ask you not to bring objects of unknown creators from other networks than our Hypergrid partners. A new virus script has been created for opensim that destroys the opensimulator server database, but the backup copy will not help, since it will also be infected. It does not activate immediately, but after a certain time, unfortunately at the moment I cannot give more open information; it is already distributed in Hypergrid test mode!
please take this seriously, we have one small family, we can’t lose it(((
like(1)
https://soziarium.su/post/25354_dear-sacrarium-grid-users-...
Dear Sacrarium Grid users, we kindly ask you not to bring objects of unknown creators from other networks than our Hypergrid partners. A new virus script has been created for opensim that destroys the opensimulator server database, but the backup copy will not help, since it will also be infected. It does not activate immediately, but after a certain time, unfortunately at the moment I cannot give more open information; it is already distributed in Hypergrid test mode!
please take this seriously, we have one small family, we can’t lose it(((
There is no way a script can cause your crash of the server. My tech confirmed this as well and he is really smart in this server stuff. it has to be someone who is a really good hacker or had the passwords to your server. so I dont see unless you had it directly on the server how the backup would get corrupted.
I do know of a script that when a hypergrid tries to god mode it, it will make the item useless but that's about it. seems kind of odd that so far only one grid is talking about these so claimed virus script.
I would consider about that time when you did a restart, look in between what happen. i still as I have said before look in event viewer under security to see who logged in.
liked(1)
I do know of a script that when a hypergrid tries to god mode it, it will make the item useless but that's about it. seems kind of odd that so far only one grid is talking about these so claimed virus script.
I would consider about that time when you did a restart, look in between what happen. i still as I have said before look in event viewer under security to see who logged in.
View context
Well, at the time all this happened I was in bed and Mike was at work. So I know no one was 'legally' logged into our server. There were 3 of our members on the grid watching the assets disappear and reporting to Mike in our Discord group. There was nothing he could do about it. By the time he got home the grid was gone. IAR, OAR, backups all those files were gone. The ini files were gone. So if it wasn't a script then someone had managed to find their way into the server. In terms of the hosting company, they don't maintain our server, that is up to us. It just seems weird that files were selectively deleted. I don't have any answers and only one I have from a 3rd party is these scripts made to take advantage of the bugs in the sql database. I'm no scripter and certainly not a hacker. All I know it that it happened and people were there watching it happen. I have no difinitive answers just speculation. I wish I had answers so we can work out how to prevent this happening again.
like(1)
If Resurgence was professionally hosted on an actual server, and it was still possible for amateurs to breach into the data centre and the machine and acquire full admin rights on Windows, then something is wrong with the hosting company.
I'm on the edge of saying that something is fundamentally wrong with Windows as an operating system for Internet servers. But I think only one out of maybe 15 grids is not running on Windows, and I refuse to believe that an operating system is so inherently unsafe and still regularly exposed to the Internet by professionals.
I still have to shudder thinking about those thousands of DreamGrids running on personal Windows computers behind provider-issued, customer-grade routers. Either they're even more unsafe, or if not, that'd say a lot about the hosting company.
Still, the backups are a key issue. DreamGrid is mainly intended for computers at home where you can stick a USB pen drive into the machine and copy the backups automatically created by DreamGrid onto that drive. I think if I said that securing DreamGrid backups on an external drive at home when the grid runs in a data centre is a bit more difficult, that'd be an understatement.
Nonetheless, if you start over, this will have to be done. It won't save your grid from being wiped, but you can always restore it, for it'll save your backups from being wiped.
liked(1)
I'm on the edge of saying that something is fundamentally wrong with Windows as an operating system for Internet servers. But I think only one out of maybe 15 grids is not running on Windows, and I refuse to believe that an operating system is so inherently unsafe and still regularly exposed to the Internet by professionals.
I still have to shudder thinking about those thousands of DreamGrids running on personal Windows computers behind provider-issued, customer-grade routers. Either they're even more unsafe, or if not, that'd say a lot about the hosting company.
Still, the backups are a key issue. DreamGrid is mainly intended for computers at home where you can stick a USB pen drive into the machine and copy the backups automatically created by DreamGrid onto that drive. I think if I said that securing DreamGrid backups on an external drive at home when the grid runs in a data centre is a bit more difficult, that'd be an understatement.
Nonetheless, if you start over, this will have to be done. It won't save your grid from being wiped, but you can always restore it, for it'll save your backups from being wiped.
Oh it will be backed up off the server now. There is no trust left.
I don't think hacking our server could be difficult though, especially when you think about global companies and governments getting hacked. Had a few really big hacks recently here in Australia where peoples data was downloaded to the dark web. We really are just small fish in the grand scheme of things.
liked(1)
I don't think hacking our server could be difficult though, especially when you think about global companies and governments getting hacked. Had a few really big hacks recently here in Australia where peoples data was downloaded to the dark web. We really are just small fish in the grand scheme of things.
View context
It looks like there are some scripts around designed to take advantage of some bugs in the script engine or something to break SQL databases and this has been identified as the likely cause of whats happened to us. Not sure how it is uploaded right now but working on that. If anyone has heard anything about this can you please let us know?
like(1)
From my current understanding, which may not be 100% because I'm not that tech savy, it could have been a script inside an object that was on the grid. When I understand a bit more I'll post more.
liked(2)
as i have mentioned before check event viewer for the logs, my tech guy says the viewer couldn't cause that. if it was a script that would have caused the whole world to poof. he doesn't think its a script. anyways good luck
liked(1)
View context
It looks like there are some scripts around designed to take advantage of some bugs in the script engine or something to break SQL databases. Not sure how it is uploaded right now but working on that. I think Pagane's post above (the link) has some good advice in it so we will try to lock down any future grid we set up with some extra safe guards.
like(1)
Honestly, I have never read from any scripter, or even from those who create modules for scripts in Opensimulator, that a script can call a function to delete the entire database. There is a script, for example, that allows setting up a partnership between accounts, but it should make a call to a web-type function by connecting to a PHP page, thus making a call to something created and set up by the grid owner on their server.
Furthermore, there is an integrated security system for making HTML calls in Opensimulator (there is a specific section in opensim.ini and opensimdefaults.ini), so I don't think that was the issue. I don't believe the deletion of your entire database could be related to a script. :)
liked(1)
Furthermore, there is an integrated security system for making HTML calls in Opensimulator (there is a specific section in opensim.ini and opensimdefaults.ini), so I don't think that was the issue. I don't believe the deletion of your entire database could be related to a script. :)
View context
Thank you for the link Paela, will have a read of it later. If we do another grid, hopefully we will make it more solid this time.
like(2)
View context
Thank you for posting this link Pagane, appreciate it. I had a brief read and there is a lot there so will go through it if we set up a new grid.
like(2)
View context
Thank you. We are not sure what we are doing next, we are all feeling devasted because we built a place we loved. Once we know our direction I'll let you know. Right now, we are just taking some out. *big hugs*
like(2)
I know how you feel, my grid once lost everything due to error, so please take as long as you need. hugs
liked(1)
View context
Its ok, we should be able to salvage a lot of it as we still have the dae files. Thank you for your kind offer though.
like(1)
View context
Yes, that doesn't normally happen. We will be doing a server restart shortly so I'll let you know when we are done. It should be fixed after the restart. Apologies.
like(0)
View context
DJ The Rock Sid will be finishing his set at 7pm and then we welcome DJ Mike to the airwaves! This party is not over yet xD
like(1)