Hey. I had a really strange situation on my Minecraft server network. I’m using a Velocity proxy with two Paper servers. I'm using the "modern" mode on Velocity.
Description of the issue: Suddenly, I noticed that a member of my staff gave the default rank (LuckPerms) * permissions, which was completely impossible because that person was physically sitting next to me with their computer, and I could see what they were doing. Moreover, in the Paper server logs, they were executing a completely different command at the same time. There’s absolutely no trace of them setting * for the default group.
A little while later, another similar situation occurred. Suddenly, the same person set the whole server to creative mode. Again, there’s no trace in the logs of such a command being executed, and I could still physically see their screen, and they were doing something completely different. I’m sure this is some kind of attack, although I don’t know exactly how it was carried out. Of course, I have blocked the ports of my game modes (you can only connect locally), and all the servers in Velocity are also on localhost.
Do you have any idea what this might be? How can I block it?
Description of the issue: Suddenly, I noticed that a member of my staff gave the default rank (LuckPerms) * permissions, which was completely impossible because that person was physically sitting next to me with their computer, and I could see what they were doing. Moreover, in the Paper server logs, they were executing a completely different command at the same time. There’s absolutely no trace of them setting * for the default group.
A little while later, another similar situation occurred. Suddenly, the same person set the whole server to creative mode. Again, there’s no trace in the logs of such a command being executed, and I could still physically see their screen, and they were doing something completely different. I’m sure this is some kind of attack, although I don’t know exactly how it was carried out. Of course, I have blocked the ports of my game modes (you can only connect locally), and all the servers in Velocity are also on localhost.
Do you have any idea what this might be? How can I block it?