Money hack

[Drakath]

Recently I noticed some people are hacking money in my Server. Has anyone encountered that? Is it possible that they can bypass MTA's AntiCheat? Or maybe there is some bug on my Server? I do not have any extra anti cheat scripts yet.

[Karuzo]

How are you saving your money ?

[Drakath]

Account data. SQLite3.

[Saml1er]

That's impossible if the script is server side. Check your server settings and make sure anti-cheat is enabled.

[Drakath]

This is the part about AntiCheat in my mtaserver.conf

    <!-- By default, the server will block the use of customized GTA:SA data files. --> 
    <!-- To allow specific client files, add one or more of the following: --> 
    <!-- <client_file name="data/carmods.dat" verify="0"/> --> 
  
    <!-- Comma separated list of disabled anti-cheats. 
         For details see [url=https://wiki.multitheftauto.com/wiki/Anti-cheat_guide]https://wiki.multitheftauto.com/wiki/Anti-cheat_guide[/url] 
         e.g. To disable anti-cheat #2 and #3, use: 2,3 --> 
    <disableac></disableac> 
  
    <!-- Comma separated list of enabled special detections. 
         A special detection is a type of anti-cheat for (usually) harmless game modifications. 
         Competitive servers may wish to enable special detections, but most servers should leave this setting blank. 
         For details see [url=https://wiki.multitheftauto.com/wiki/Anti-cheat_guide]https://wiki.multitheftauto.com/wiki/Anti-cheat_guide[/url] 
         e.g. To enable special detection #12 use: 12 --> 
    <enablesd></enablesd> 

[Drakath]

Should I enable some special detection?

[monumento]

That may be a bug somewhere in your scripts/script. That's all.

[arezu]

With custom d3d9 file, you can do this kind of hack (by triggering server events from clientside). You can prevent people with custom d3d9 from joining your server, or have a list with allowed d3d9 versions (look on wiki for the functions).

But there still are ways to inject hack into MTA even if you dont allow custom d3d9..

[.:HyPeX:.]

I havent noticed this myself, be sure to check your resources, and that runcode is off.

[Drakath]

Runcode is not running. I have enabled SD #12 so I hope that will fix it. Also if there is a bug in my scripts how can I know which script is it? I made sure you cannot enter negative values or strings anywhere.

[Mr_Moose]

It's most likely a bug in any of the scripts that allow the players to send money or some kind of bank system, if you have any of those check so nobody enter a negative amount and gain money to himself for example, looks like you have a pretty good amount of players in your server so another option could be to google "money cheat in (name of your server here)" and see if anything appears.

Usually when there are bugs in bank systems or money transfer scripts most people will basically set their money to maximum and think that they get away with it, if they just gain money really fast but in smaller amounts then you should check for people who reconnects very often, reconnecting will reset some values that isn't saved like for example cool down in a job, store robbery or something else where people gain a large amount of money in a short time.

Any compiled scripts from untrusted as well as trusted source may contain a hidden command to get money and finally known bugs in community resources. What money related community resources do you have that might be able to trigger the above scenarios.

[Drakath]

Most of my scripts are custom. I only use mabako services which are from community. Though I maybe have a secret command to set the money but only I know it. Is there a way that someone can get that command? It is not possible to guess it because there are like 40 characters in it.

[Mr_Moose]

Well I don't know any way to view all the available commands but you should probably add some kind of restriction to it that for example verify that it is your account that is used while calling that command or similar, some people might be able to guess it, you never know. mabako services is a pretty old resource btw and it might contain bugs. Is there any way to earn money in it by for example rubbing a store, any bank system built in or similar who's values you can reset by reconnect.

[Drakath]

Well, the only script I could imagine doing this is my trading system. I will review the code again. Thanks for helping everyone.

And be aware of a player with this Serial: 613CD47421D389DFE271CCA725EBBA94