OpenSimWorld is the directory of 3D Virtual Worlds based on OpenSimulator and connected through the HyperGrid. Learn More
So, someone hacked into the Resurgence server and completely wiped it. Resurgence is gone. To the lowlife who did this, hope you’re happy with yourself. This wasn’t just an attack on me and Mike, it was an attack on a whole community of people and seriously, I don’t think anyone deserves this. Everything is gone. All our backups, OARs, IARs… Knew what you were doing didn’t you.
I’m not sure where to from here, I’m not sure if we will start over, I’m too angry and upset now to make any clear decisions. For now, it’s goodbye from me and Mike… lowlife, you won, congrats.
Zoey
I’m not sure where to from here, I’m not sure if we will start over, I’m too angry and upset now to make any clear decisions. For now, it’s goodbye from me and Mike… lowlife, you won, congrats.
Zoey
Liked by: 
Comments
So sorry to hear that. Clearly alot of work went into creating your build. Please don't give up, then the bad guys win.
like(1)
This is not new script. Sacrarium create this before years to protect assets from using god mode for unlock and edit. Of course they lost control where is included this and.... We all including Sacrarium is threatened.
Many times i already say - Disable BUILD for all visitors, guests, friends..... ONLY OWNERS MUST BUILD!!!
Some "great" furniture greeter etc scripts ask to build .... NO!!! To add NPC script no need to build!!! Virus script use Build to access SQL..... ops.... enough!
Stop to disable execute scripts fron visitors - this only make Athena and man bits unusable:)
like(1)
Many times i already say - Disable BUILD for all visitors, guests, friends..... ONLY OWNERS MUST BUILD!!!
Some "great" furniture greeter etc scripts ask to build .... NO!!! To add NPC script no need to build!!! Virus script use Build to access SQL..... ops.... enough!
Stop to disable execute scripts fron visitors - this only make Athena and man bits unusable:)
Script download from Internet and rez/build invisible object under the terain. Next start long and very bad attack. All ends with total control of computer.....
All what you must know and do to protect is HERE:
https://opensimworld.com/post/95832
like(1)
All what you must know and do to protect is HERE:
https://opensimworld.com/post/95832
This just came to me in a msg:
https://soziarium.su/post/25354_dear-sacrarium-grid-users-...
Dear Sacrarium Grid users, we kindly ask you not to bring objects of unknown creators from other networks than our Hypergrid partners. A new virus script has been created for opensim that destroys the opensimulator server database, but the backup copy will not help, since it will also be infected. It does not activate immediately, but after a certain time, unfortunately at the moment I cannot give more open information; it is already distributed in Hypergrid test mode!
please take this seriously, we have one small family, we can’t lose it(((
like(1)
https://soziarium.su/post/25354_dear-sacrarium-grid-users-...
Dear Sacrarium Grid users, we kindly ask you not to bring objects of unknown creators from other networks than our Hypergrid partners. A new virus script has been created for opensim that destroys the opensimulator server database, but the backup copy will not help, since it will also be infected. It does not activate immediately, but after a certain time, unfortunately at the moment I cannot give more open information; it is already distributed in Hypergrid test mode!
please take this seriously, we have one small family, we can’t lose it(((
There is no way a script can cause your crash of the server. My tech confirmed this as well and he is really smart in this server stuff. it has to be someone who is a really good hacker or had the passwords to your server. so I dont see unless you had it directly on the server how the backup would get corrupted.
I do know of a script that when a hypergrid tries to god mode it, it will make the item useless but that's about it. seems kind of odd that so far only one grid is talking about these so claimed virus script.
I would consider about that time when you did a restart, look in between what happen. i still as I have said before look in event viewer under security to see who logged in.
like(1)
I do know of a script that when a hypergrid tries to god mode it, it will make the item useless but that's about it. seems kind of odd that so far only one grid is talking about these so claimed virus script.
I would consider about that time when you did a restart, look in between what happen. i still as I have said before look in event viewer under security to see who logged in.
ouch... it's not very pretty what jealousy breeds. It's a shame. Don't give up. Whoever did this must be happy. Don't give him the joy of seeing you give up.
Hang in there.
Thought of France.
like(2)
Hang in there.
Thought of France.
You mentioned losing IAR and OAR files, so I'm wondering if your entire disk was erased. Not just the database—how can a script wipe your entire disk, including the folders where your backups are stored?
I think you should investigate the issue of losing your data by focusing on other factors, such as human errors (unintentional data deletion), service provider errors (in which case, you may seek compensation if you were paying for a server), or other issues. It's really strange that a script would erase the entire contents of your disk.
Anyway, I'm reiterating my previous response:
Honestly, I have never read from any scripter, or even from those who create modules for scripts in Opensimulator, that a script can call a function to delete the entire database. There is a script, for example, that allows setting up a partnership between accounts, but it should make a call to a web-type function by connecting to a PHP page, thus making a call to something created and set up by the grid owner on their server.
Furthermore, there is an integrated security system for making HTML calls in Opensimulator (there is a specific section in opensim.ini and opensimdefaults.ini), so I don't think that was the issue. I don't believe the deletion of your entire database could be related to a script. :)
like(1)
I think you should investigate the issue of losing your data by focusing on other factors, such as human errors (unintentional data deletion), service provider errors (in which case, you may seek compensation if you were paying for a server), or other issues. It's really strange that a script would erase the entire contents of your disk.
Anyway, I'm reiterating my previous response:
Honestly, I have never read from any scripter, or even from those who create modules for scripts in Opensimulator, that a script can call a function to delete the entire database. There is a script, for example, that allows setting up a partnership between accounts, but it should make a call to a web-type function by connecting to a PHP page, thus making a call to something created and set up by the grid owner on their server.
Furthermore, there is an integrated security system for making HTML calls in Opensimulator (there is a specific section in opensim.ini and opensimdefaults.ini), so I don't think that was the issue. I don't believe the deletion of your entire database could be related to a script. :)
This is getting scarier by the time :( Could this happen to other Outworldz sims? To other sims using DreamGrid? Or Windows based?
Not sure which one the grid where I have my shop is using (apart from OS 0.9.2.) and I know they are doing offsite backups but..ugh :(
like(1)
Not sure which one the grid where I have my shop is using (apart from OS 0.9.2.) and I know they are doing offsite backups but..ugh :(
Well, at the time all this happened I was in bed and Mike was at work. So I know no one was 'legally' logged into our server. There were 3 of our members on the grid watching the assets disappear and reporting to Mike in our Discord group. There was nothing he could do about it. By the time he got home the grid was gone. IAR, OAR, backups all those files were gone. The ini files were gone. So if it wasn't a script then someone had managed to find their way into the server. In terms of the hosting company, they don't maintain our server, that is up to us. It just seems weird that files were selectively deleted. I don't have any answers and only one I have from a 3rd party is these scripts made to take advantage of the bugs in the sql database. I'm no scripter and certainly not a hacker. All I know it that it happened and people were there watching it happen. I have no difinitive answers just speculation. I wish I had answers so we can work out how to prevent this happening again.
like(1)
If Resurgence was professionally hosted on an actual server, and it was still possible for amateurs to breach into the data centre and the machine and acquire full admin rights on Windows, then something is wrong with the hosting company.
I'm on the edge of saying that something is fundamentally wrong with Windows as an operating system for Internet servers. But I think only one out of maybe 15 grids is not running on Windows, and I refuse to believe that an operating system is so inherently unsafe and still regularly exposed to the Internet by professionals.
I still have to shudder thinking about those thousands of DreamGrids running on personal Windows computers behind provider-issued, customer-grade routers. Either they're even more unsafe, or if not, that'd say a lot about the hosting company.
Still, the backups are a key issue. DreamGrid is mainly intended for computers at home where you can stick a USB pen drive into the machine and copy the backups automatically created by DreamGrid onto that drive. I think if I said that securing DreamGrid backups on an external drive at home when the grid runs in a data centre is a bit more difficult, that'd be an understatement.
Nonetheless, if you start over, this will have to be done. It won't save your grid from being wiped, but you can always restore it, for it'll save your backups from being wiped.
like(1)
I'm on the edge of saying that something is fundamentally wrong with Windows as an operating system for Internet servers. But I think only one out of maybe 15 grids is not running on Windows, and I refuse to believe that an operating system is so inherently unsafe and still regularly exposed to the Internet by professionals.
I still have to shudder thinking about those thousands of DreamGrids running on personal Windows computers behind provider-issued, customer-grade routers. Either they're even more unsafe, or if not, that'd say a lot about the hosting company.
Still, the backups are a key issue. DreamGrid is mainly intended for computers at home where you can stick a USB pen drive into the machine and copy the backups automatically created by DreamGrid onto that drive. I think if I said that securing DreamGrid backups on an external drive at home when the grid runs in a data centre is a bit more difficult, that'd be an understatement.
Nonetheless, if you start over, this will have to be done. It won't save your grid from being wiped, but you can always restore it, for it'll save your backups from being wiped.
Oh it will be backed up off the server now. There is no trust left.
I don't think hacking our server could be difficult though, especially when you think about global companies and governments getting hacked. Had a few really big hacks recently here in Australia where peoples data was downloaded to the dark web. We really are just small fish in the grand scheme of things.
like(1)
I don't think hacking our server could be difficult though, especially when you think about global companies and governments getting hacked. Had a few really big hacks recently here in Australia where peoples data was downloaded to the dark web. We really are just small fish in the grand scheme of things.
This clearly wasn't an attack through OpenSim, using a script. This rather reads like someone having gained access to the underlying Windows system with full admin rights. (Resurgence was a DreamGrid, and DreamGrid is Windows-only.)
They could easily have deleted the whole DreamGrid. Then they might have snooped around on the machine, looking for backups outside the DreamGrid install, but still on the same machine, and deleted them as well.
Or they could simply have quick-formatted all drives in the machine, one by one, not only wiping out the grid but absolutely everything on the computer.
like(3)
They could easily have deleted the whole DreamGrid. Then they might have snooped around on the machine, looking for backups outside the DreamGrid install, but still on the same machine, and deleted them as well.
Or they could simply have quick-formatted all drives in the machine, one by one, not only wiping out the grid but absolutely everything on the computer.
It looks like there are some scripts around designed to take advantage of some bugs in the script engine or something to break SQL databases and this has been identified as the likely cause of whats happened to us. Not sure how it is uploaded right now but working on that. If anyone has heard anything about this can you please let us know?
like(1)
From my current understanding, which may not be 100% because I'm not that tech savy, it could have been a script inside an object that was on the grid. When I understand a bit more I'll post more.
like(2)
as i have mentioned before check event viewer for the logs, my tech guy says the viewer couldn't cause that. if it was a script that would have caused the whole world to poof. he doesn't think its a script. anyways good luck
like(1)
What can one say except "I'm so sorry"?
Maybe it's too soon but... DON'T GIVE UP, Zoey! kissiz from my heart.
♥
like(2)
Maybe it's too soon but... DON'T GIVE UP, Zoey! kissiz from my heart.
♥
Hey.. fear not! Don`t be the cat running away from the dog... Be the dog, an american bull terrier.. and build again and again.. and more beautiful. its how u win lowlives.. Anyway, needing any material for building, u know my sims, and anything else (my inventory is huge), IM me. :)
like(3)
I am so sorry this has happened to you Zoey & Mike. You're SO right! No one deserves this! I'm not sure why people do this but to only cause chaos & havok. I've heard really good things about Resurgence. Yesh & Please don't let this define you. Don't give in to those bully's. Take a step back and breath a little bit. Than make your decisions from there. Hoping you decide to bring resurgence back. But if not, you have my support. I do remember your name. So I believe we have met somewhere before.
like(2)
Dear Zoey and Mike, I got very upset to hear about what happened at your grid. This is not how we want our world to be. We all do our best to serve people and you have been very successful. I have always been impressed by the work you have done in your regions and grids, and it hurts me to see how it is coldly destroyed. We have been friends since many years and often discussed future dreams and prospects with Mike. I am deeply saddened by what has happened. I have suffered myself, and lost much. If there is anything that we can do to help, as Caribougrid or me as Jeanne, then please know that we are there for you. So do let me know how we could help. Sending you a warm hug, Jeanne.
like(2)
I am sorry this happened to you folks. I don't understand why people do stuff like this. Loving kindness to you both and your community.
like(2)
I'm really sorry to read this.
There is an ssh fail which is causing harm you should all update your servers to ssh levels it is really very important.
https://en.wikipedia.org/wiki/Terrapin_attack
I wish you lots of courage to rebuild. we must not give up!
like(3)
There is an ssh fail which is causing harm you should all update your servers to ssh levels it is really very important.
https://en.wikipedia.org/wiki/Terrapin_attack
I wish you lots of courage to rebuild. we must not give up!
Thank you for the link Paela, will have a read of it later. If we do another grid, hopefully we will make it more solid this time.
like(2)
Again sad news:( Haters group kill next sweet heart.
Not know how to help.
All please read and use this short HowTo:
https://opensimworld.com/post/95832
like(3)
Not know how to help.
All please read and use this short HowTo:
https://opensimworld.com/post/95832
Thank you for posting this link Pagane, appreciate it. I had a brief read and there is a lot there so will go through it if we set up a new grid.
like(2)
I would be curious to understand how they could have breached a paid server so easily, assuming you had a paid server, but even if it was a server within your "computer," how this could have happened.
Generally, servers from providers like Contabo or OVH are highly secure against these types of hacks. However, understanding how they managed it would be very helpful for the community.
I also think about those instances where grids accidentally delete the folder with all the assets. Obviously, if you delete the folder with assets on file, even if you reload an OAR, the textures and data of some types won't load, and you'll see almost everything in white and, in some cases, deformed. Then they claim someone hacked them, but instead, they deleted that folder, confusing it with the cache folder.
Of course, it may not be your case, but it has often happened to others.
Do you have more important information to share with the community to understand how you were hacked?
like(3)
Generally, servers from providers like Contabo or OVH are highly secure against these types of hacks. However, understanding how they managed it would be very helpful for the community.
I also think about those instances where grids accidentally delete the folder with all the assets. Obviously, if you delete the folder with assets on file, even if you reload an OAR, the textures and data of some types won't load, and you'll see almost everything in white and, in some cases, deformed. Then they claim someone hacked them, but instead, they deleted that folder, confusing it with the cache folder.
Of course, it may not be your case, but it has often happened to others.
Do you have more important information to share with the community to understand how you were hacked?
It looks like there are some scripts around designed to take advantage of some bugs in the script engine or something to break SQL databases. Not sure how it is uploaded right now but working on that. I think Pagane's post above (the link) has some good advice in it so we will try to lock down any future grid we set up with some extra safe guards.
like(1)
Honestly, I have never read from any scripter, or even from those who create modules for scripts in Opensimulator, that a script can call a function to delete the entire database. There is a script, for example, that allows setting up a partnership between accounts, but it should make a call to a web-type function by connecting to a PHP page, thus making a call to something created and set up by the grid owner on their server.
Furthermore, there is an integrated security system for making HTML calls in Opensimulator (there is a specific section in opensim.ini and opensimdefaults.ini), so I don't think that was the issue. I don't believe the deletion of your entire database could be related to a script. :)
like(1)
Furthermore, there is an integrated security system for making HTML calls in Opensimulator (there is a specific section in opensim.ini and opensimdefaults.ini), so I don't think that was the issue. I don't believe the deletion of your entire database could be related to a script. :)
Oh yes. @ZoeyRavenheart would you be willing to share more details about what they used? It would be helpful for all grids to close those gaps too.
like(4)
This type people, are nothing but BULLY"S. Anyone who enjoys ruining peoples creations, is nothing but low life. Sorry for your loss. Was just there, and received many cool items. Thanks for sharing!
like(2)
The critical mandatory need for an offline clone and backup prevents this kind of disaster. This is unfortunate 😭😭. But lessons must be learned. Back it up offline monthly. Sorry for your loss.
like(4)
omg! i was just about to go online and get more amazing stuff until i saw this. I am so sorry this happened to you! I visited last night and the owners were wonderful as well as the place. if there is anything i can do let me know.
like(2)
I am so sorry, thats horrible!!
What a terrible thing to have happen. Why do people do these things ?????
like(2)
What a terrible thing to have happen. Why do people do these things ?????
If you approve, I'd be happy to put a front page post inviting people to send you copies of what they got from your shops.
like(2)
Its ok, we should be able to salvage a lot of it as we still have the dae files. Thank you for your kind offer though.
like(1)
Sorry that happen. If you do decide to start over, here is a resource for you. I know it can be hard to remember where you got stuff. Our "What Are You Looking For" OSW has 53 helpful people. List want you need and can't find, they will help if they can. https://opensimworld.com/groups/1060.
Visit my region and let me know if you'd like a copy of anything you find there.
Also, I'm pretty good at terraforming. I can do a basic terraform of a region in 10 minutes, or show you how. Then you can fine tune the landscape to better fit your purposes.
A grid tech person has said that people should do a make backup of all the stuff you lost, and put a copy on a different computer.
Hope this is helpful.
like(4)
Visit my region and let me know if you'd like a copy of anything you find there.
Also, I'm pretty good at terraforming. I can do a basic terraform of a region in 10 minutes, or show you how. Then you can fine tune the landscape to better fit your purposes.
A grid tech person has said that people should do a make backup of all the stuff you lost, and put a copy on a different computer.
Hope this is helpful.
I have a dedicated Google Drive I use for OAR storage, and also back up to DVD as well as having an HDD clone of my working disk. Using a USB stick is also an option, but remember to plug the USB stick into your PC/laptop every few months to keep data rot at bay.
like(1)
