Author Topic: Backdoor room kill in RSWCS!! (Read 22291 times)

GhostShip · « **Reply #20 on:** February 03, 2009, 08:51:10 pm »

It seems you know less of this bug than I do Wench

I have seen the bug demonstrated and know what it does and also know of a further exploit based on the same code portion, I,m not interested in discussing the matter any further, there is no point in myself pointing code portions out to you when it seems you have no idea what their purpose is anyway.

Wheels are in motion to fix the problem in co-operation with those who maintain WCS and we shall await those efforts at this time.

Bluehaze · « **Reply #21 on:** February 03, 2009, 09:22:35 pm »

Thanks Nooks, Deux, Ghostship and all of you who have checked this thing out. This seems like a good time to give a hearty thank you to WMW, Zenar, Deux, Bide, EaglE, Emulator and all of the programmers who have worked so hard to provide the community with useful tools! Thank you! Your work is much appreciated!

gypsyroadhog · « **Reply #22 on:** February 03, 2009, 11:41:30 pm »

I agree if that was his intention ban him...BUT i dont believe it was
It is VERY possible he didnt realise what was there(until it was brought up), AND thats why ONLY today he rectified....accidents do happen folks
Read his post(on his site), he has appolagised(which is more than others can do...and i DONT mean any1 from here)
ALSO REMEMBER all he has done(programmes)
Personally i think it was a pure accident...BUT thats my view

GhostShip · « **Reply #23 on:** February 04, 2009, 12:14:00 am »

Actions speak louder than words unfortunately, in case anyone missed this its what ritchy placed in the rswcs 1.8.8 release

"## YOU HAVE BEEN OWNED ##\n\n"

There are quite a few commands such as delete the entire config, add a new password, kick all the room occupants and crash the room, real helpful things to want in a remote operation I,m sure, all this with no check of user level, that in itself is strange for wcs variants

If you truly believe that this is to help you remote control a chat server then you have my sympathies.

As for ritchies work in editing up KMs work and hiding his src from peer review, this only accents what can happen if open src is not the norm with such projects.

ñòóKýçrÕôK · « **Reply #24 on:** February 04, 2009, 01:33:36 am »

Quote from: Bluehaze on February 03, 2009, 09:22:35 pm

Thanks Nooks, Deux, Ghostship and all of you who have checked this thing out. This seems like a good time to give a hearty thank you to WMW, Zenar, Deux, Bide, EaglE, Emulator and all of the programmers who have worked so hard to provide the community with useful tools! Thank you! Your work is much appreciated!

You should know that the only real part I took in this was yesterday to attempt to talk Richy into helping resolve a bug issue in WCS which appapently by Richy's own admission in his update logs on his version of WCS which to my understanding had already been fixed in a later version by KM himself. To which Richy refused, even knowing a vulnerability and its location, he refused to help. With all due rights mind you, he didn't have to. He went on to insult WMW and myself in general because we were upset that a coder supposedly acting in the best interest of WinMX, and the community in general, refused to help fix a problem. I have seen the codes and yes sure he could use them to help remotely but the whole thing of being able to delete your config and replace the text with "you have been owned" is something I find very troubling. After this was all found out today I went room to room to RSWCS users along with other WMW members and /opmsged for users to come to this thread so they would know what's up.

Quote from: gypsyroadhog on February 03, 2009, 11:41:30 pm

I agree if that was his intention ban him...BUT i dont believe it was
It is VERY possible he didnt realise what was there(until it was brought up), AND thats why ONLY today he rectified....accidents do happen folks
Read his post(on his site), he has appolagised(which is more than others can do...and i DONT mean any1 from here)
ALSO REMEMBER all he has done(programmes)
Personally i think it was a pure accident...BUT thats my view

I honestly do not want you to believe I am being insulting and I agree you're right that some users can never apologise for the harm they brought to this network. The only thing in this case I believe makes them any worse than Richy is that they were smart enough to not get caught until after they did their deeds. Richy was not even capable of that. What if none of this were found out if he had been patient enough for 100s of WinMX hosts to be on his chat server and then had done something? His plan I believe is/was insulting and degrading to the users he either manipulated into using his server or talked into it freely. Either way done with manipulation and others with intimidation. Your opinion is valuable and god bless you for obviously having a very big heart but I believe your trust in him to be misplaced and that's all I'll say to you and ty for using WinMX.

HOSTMOON · « **Reply #25 on:** February 05, 2009, 10:23:57 pm »

why you all picking on a mistake they do happen nobody is perfect ,this RWCS IS THE BEST SERVER OUT THERE SO GIVE RICHY A BREAK IT WAS A MISTAKE.LOOK AT THE PRIME MINISTER DONT HE MAKE MITAKES AND THATS KILLING US ALL SO GIVE RICHY A BREAK AND HE IS WORKING ON THE SERVER, I AINT BOTHERED I WILL ALLWAYS USE RWCS SERVER IT CANT BE BEAT YOU USE YOUR FX SERVER ITS HOPLESS I AINT HAD NO PROBLEMS WITH RWCS SERVER BUT FX SERVER CRASHES EVERY 3 HOURS IS THAT WHAT WE WAT ??????
THANKYOU AND ALL THE BEST RICHY HOST MOO .

cord73 · « **Reply #26 on:** February 05, 2009, 10:30:59 pm »

i for one thinks richy didnt do this on purpose anyone could have done this by mistake ive been using rcwcs for many months its the only server i can hold for days unlike all other servers out there. He has made other programs thats awesome and none of u can say u have never used them cause i know better so plz give him a chance to fix this i will stand behide him on this sorry guys thats how it is

HOST MOON · « **Reply #27 on:** February 05, 2009, 10:36:25 pm »

ITS ABOUT TIME PEOPLE LEARNED THAT MISTAKES DO HAPPEN, DO YOU THINK RICHY DID THAT ON PURPOSE COS IF YOU DO THERES SOMETHING UP WITH YOU HE,S A GREAT BLOKE DOING A GREAT JOB 1 MISTAKE AND YOUR ALL ON HIS BACK RSWCS IS THE BEST SERVER I HAVE EVER USED AND NOBODY WILL STOP ME USING IT,WHATS UP WITH FX SERVER CRASHING EVERY 3 TO 4 HOURS DO WE WANT THAT COS I DONT GET ON THERE BACKS AND SORT THE CRASHING OUT,BUT YOU HAVE TO JUMP ON A GREAT BLOKES BACK AFTER 1 ISTAKE JEESSSSSSSSSSSSSSSSSS GIVE HIM A BREAK ALL THE BESTRICHY AND KEEP UP THE GOOD WORK THANKYOU.....

tig · « **Reply #28 on:** February 05, 2009, 10:52:44 pm »

To All

This isn't just about this problem we have found on RSWCS this goes deeper. As we have written evidence of what has happened in rooms. I am sorry to all that believe Richy is some nice guy. I will stand behind the others and say that he is banned from this forum until he can prove otherwise.

To someone that has brought up FX server every 3-4 hours dropping is not right however, we do have some hosts still using it with no dropping and they are happy.

GhostShip · « **Reply #29 on:** February 05, 2009, 11:10:34 pm »

Very nice of you to come to speak up for Ritchy Host Moon, however I must be clear on this, we will not and cannot endorse anything ritchy has a hand in, on top of that he is rude and unhelpful to other community members, we should not have to clean up his mess and worse for ritchy is in doing so we have gathered logs from many rooms where ritchy spoke of room crashing in an attempt to intimidate hosts into using the rswcs edited WCS variant, this is not the action of any of programmer I know or want anything to do with, the clock cannot be turned back on his backdoor activity, there is no mistake in telling a room host his room "has been owned"

If you wish to use whatever ritchy provides thats your choice but we will not direct anyone to use something we cannot trust or recommend.

On another note, Cord I for one would like to know of a single program ritchy has created as I,m not aware of any so please enlighten me and the rest of the winmx community.

wonderer · « **Reply #30 on:** February 05, 2009, 11:18:31 pm »

I second tig in her statement about fx server, It runs past 45 days without dropping or crashing.
The reason I swapped to ZCS server is among many other things the better handling of exiling to another room. I had ZCS online over 65 days and only a poweroutage made an end on it.
Both are easy to setup.

The fact alone WCS was written by KM and sources now in hand of, in my opinion less skilled "programmers" should be enough to stay far from any WCS-clone.

ñòóKýçrÕôK · « **Reply #31 on:** February 06, 2009, 01:15:22 am »

Quote from: HOST MOON on February 05, 2009, 10:36:25 pm

ITS ABOUT TIME PEOPLE LEARNED THAT MISTAKES DO HAPPEN, DO YOU THINK RICHY DID THAT ON PURPOSE COS IF YOU DO THERES SOMETHING UP WITH YOU HE,S A GREAT BLOKE DOING A GREAT JOB 1 MISTAKE AND YOUR ALL ON HIS BACK RSWCS IS THE BEST SERVER I HAVE EVER USED AND NOBODY WILL STOP ME USING IT,WHATS UP WITH FX SERVER CRASHING EVERY 3 TO 4 HOURS DO WE WANT THAT COS I DONT GET ON THERE BACKS AND SORT THE CRASHING OUT,BUT YOU HAVE TO JUMP ON A GREAT BLOKES BACK AFTER 1 ISTAKE JEESSSSSSSSSSSSSSSSSS GIVE HIM A BREAK ALL THE BESTRICHY AND KEEP UP THE GOOD WORK THANKYOU..

You are entitled to your opinion but i have seen him in action and attitude enough in the WMW help room alone to know I don't trust him. I can only speak for me and this thread is only to educate and inform users of his program's malicious ability. Take this how you want or even don't take it at all. It's your prerogative but at least the truth is here and if you should need a stronger dose of it later that's fine too. Use his program if you want to. That is also your choice. If it bites you in the behind I'd rather not know about it later so keep it to yourself if it does so I won't have to say told you so. That's all I ask.

edit by me:

Quote from: wonderer on February 05, 2009, 11:18:31 pm

The fact alone WCS was written by KM and sources now in hand of, in my opinion less skilled "programmers" should be enough to stay far from any WCS-clone.

I would like to respond to this statement by saying that nothing in the wcs code states malicious ability. The fact that KM was the coder is irrelevant. The bug is the result of a "mistake". Mistakes happen to coders all the time and that's where bugs come from. Bugs are unintentional mistakes that can cause moderate or severe harm, but are i no way intentionally malicious. That's not to say KM's hands weren't dirty, but to my understanding, next to his patch, WCS was one of KM's best creations. And anyone who wishes to correct me on that may.

Now let's say Richy's hidden commands were for the intention of remote helping with a config. Which in theory is a hell of a great idea. My first question is why would you have a command to remotely delete the config and rewrite it to say "YOU HAVE BEEN OWNED"? Now how long does it take to edit a config to be a really good config? I would appreciate it if someone would answer that as I seriously do not know the answer myself. Now let's take a room like MOON'S JOY AND FUN ROOM that is run on RSWCS server. A very nice config. Beautiful layout. Now I'm almost positive it took a long time to edit that config and get that room exactly how it is and as nice as it is. The question I should ask IS, if Richy's hidden commands were for remote assistance, and you have to have a command that would delete that config file, where was the command to restore the config to it's original state instead of the host of MOON's room having to go through all the time and trouble it must've taken to get that config as good as it was?

~~birdman~~ · « **Reply #32 on:** February 06, 2009, 07:29:23 am »

Ive used FX server for years and in no way does it crash after 3 to 4 hours !!! infact look down the rooms list 80 % of rooms use FX server so if it was not stable or any good we must all be wrong lol .... and it seems some people choose to ignore the advice given from this site over this bug found in RSWCS well this site has never given out bad advice since i have been on winmx so don`t listen to what they say here at your peril ! i mean no matter what this guy says about it was a mistake since when do you use the phrase " YOU HAVE BEEN OWNED" other than in a malicious act even if it is now fixed the intent was there....... wake up RSWCS users

reef · « **Reply #33 on:** February 06, 2009, 08:13:57 am »

Coupla days ago i came back to my room to find richy sitting in there and heard he was talkin about a wcs bug...sent him a pm and asked him what it was all about, he said he knew 1.8.3 had this bug which was caused by text replacements but he wasnt sure of 1.8.5 ... i told em to go ahead and try to crash it , at least i would know if it was present in bides 1.8.5... he told me i should open a temp room so i didnt lose my guests from the main room, i told em to go ahead not many in right now anyways...it did crash. the next day i went and downloaded his latest RSWCS and was busy doin the config... decided to take a break and check out the latest posts here on winmxworld and seen this 1....glad i did b4 starting up RSWCS!!!

Quote from: GhostShip on February 04, 2009, 12:14:00 am

There are quite a few commands such as delete the entire config, add a new password, kick all the room occupants and crash the room, real helpful things to want in a remote operation I,m sure, all this with no check of user level, that in itself is strange for wcs variants

1.) delete entire config? interesting....2.) kick all the room? why would anybody wanna do that?

Then seeing he's been exposed he runs onto the rebelion posting about these commands claiming them to be a mistake

C'mon Richy people aint that stupid You almost had me suckered in tho

Lagerlout666 · « **Reply #34 on:** February 06, 2009, 10:27:44 am »

Well im currently hosting a room on Eserve, and i can say ive never known a server like it for stability. Ive watched my internet connection resync on the damn thing and not loose a single person. Wcs is a good server, but their are better out thier.

reef · « **Reply #35 on:** February 07, 2009, 08:41:16 am »

Eserve is a nice server, used it awhile back... only thing that keeps me on wcs is the custom commands. If ZCS had custom commands i'd switch in a blink of an eye *hints @ Zenar* any plans for custom commands in the future???

wonderer · « **Reply #36 on:** February 07, 2009, 12:14:49 pm »

Quote from: ñòóKýçrÕôK on February 06, 2009, 01:15:22 am

...nothing in the wcs code states malicious ability. The fact that KM was the coder is irrelevant. The bug is the result of a "mistake". Mistakes happen to coders all the time and that's where bugs come from. Bugs are unintentional mistakes that can cause moderate or severe harm, but are i no way intentionally malicious. That's not to say KM's hands weren't dirty, but to my understanding, next to his patch, WCS was one of KM's best creations. And anyone who wishes to correct me on that may.

Right, unintentional "mistakes" can be called bugs. Hidden features like the commands above are definitely no bugs and not made by mistake and intended to be there. No excuses for that.

Max™ · « **Reply #37 on:** February 09, 2009, 10:48:52 am »

well i used rswcs untill it suddenly crashed on me, twice in 2 days,
i also see the below screen shot and it makes it more suspicious
it was the "keep it that way" sounded like a "shut up" from how i see it, but ppl can take it how they see it.

Max™ · « **Reply #38 on:** February 17, 2009, 07:03:24 pm »

well the good news,
Richy has apologised to the lady concerned in her room, he also spoke to me regarding the matter,
he has also released an updated version of RSWCS without the room kill commands, im testing this and hasnt crashed like the previous version.

GhostShip · « **Reply #39 on:** February 18, 2009, 09:36:22 am »

I dont remember Ritchy apologising here when he had the chance. The simple fact is he is untrustworthy, I for one will not ask anyone to use something he has had a hand in, the fact he was rude and tried to bluff his way out of being caught installing a backdoor in folks chatrooms speaks for itself.

Author Topic: Backdoor room kill in RSWCS!! (Read 22291 times)

HOSTMOON

HOST MOON