The hardest part of making something cool

There are few things that make me want to pull the plug on my projects more than trolls and wannabe hackers.

Think of the hours I put in every week keeping my projects online and offering free services, only to end up dealing with this. The small, independent internet has never paid my bills. It's my way of showing a little love to people who want to do things on their own terms. So why ruin something good we're building?

You, dear reader, probably have no idea what I'm talking about. So let me tell you about something that happened at Runv Club. Looking back, it's actually pretty funny.

Runv Club is a Brazilian pubnix I've been running for about a year. We have 11 members. We've never cared about being popular, and we've never asked for money to keep the place going. It's just a group of people who like technology and enjoy each other's company. That's it.

I set up Runv to be as self-sufficient as possible. In other words: very little maintenance, plenty of stability, and enough security to keep everyone safe.

Anyway, a membership request came in. The guy said he was new to pubnixes and had found us through a search. Nothing unusual there, so I approved him.

Not long after, a second email arrived. He wanted me to replace his SSH key with a new one. All of this had happened in less than two hours, and both keys had been generated on the same computer. That caught my attention.

But I changed it. Out of goodwill, I changed it.

Then came the third email, asking me to install an IRC bouncer. That's when I started getting suspicious. Someone who's only just discovered pubnixes already knows what to do with a bouncer? I can forgive a lost SSH key in under two hours. With a little help from ChatGPT, anyone can generate another one. But a bouncer?

I decided to take a closer look.

I started with the login records. The account hadn't been used at all before the key change. Its first login was at 2:21 a.m., Brasília time, from an IP address in Romania. Remember Romania. It'll come up again.

Next, I opened the command history, the file the shell keeps in each user's home directory. His first commands were id, uname -a, ip addr, and w. Who am I? What kernel is this? What's the machine's IP address? Who else is logged in? A quick look around. Then he typed znc, the very IRC bouncer he'd asked about in his third email. The system told him it wasn't installed. Hence the request.

No bouncer, so on to plan B. Using wget, he downloaded a file called samp.tgz from filebin.net, a site where anyone can upload files without an account and have them disappear after a while. He unpacked it, deleted a component that had been compiled for a different Python version, installed setuptools, compiled a C module, ran a test, and fired up ./start.

So I went to see what this samp thing was.

SA-MP stands for San Andreas Multiplayer, the mod that turned GTA: San Andreas into an online game. The package was a bot for it. It included a Python implementation of the game's network protocol, a web control panel, and a script that generates GPCI, the machine identifier SA-MP servers use to recognize and ban players. That way, each bot can pretend to be a different computer. In the configuration file, the accounts pointed to a Romanian roleplay server (there's Romania again), and one of the fields was called gold_history.

That's right, dear reader. He was farming GTA gold on my server.

The package even came with logs from the previous day. In other words, the bot had already been running somewhere else and was looking for a new home. A free one. Its web panel started listening on every interface, on port 31424. But Runv's firewall blocks anything that hasn't been explicitly allowed, so nobody outside the server could reach it. Maybe that's why the last commands in the history were ss -tuln to check open ports, kill -9 to stop the process, and another hostname -I to double-check the IP address. The bot's log ends at 2:42 a.m. The session stayed open until it timed out from inactivity about an hour later.

To be fair, he never used sudo, never touched anything outside his own home directory, and I found no sign that he'd tried to become root. Our little hacker was just a virtual gold farmer in a hurry.

Still, Runv isn't a bot-hosting service, and our community rules are pretty clear: use the system responsibly, and don't run unauthorized automation. I suspended the account, deleted the bot and its web pages, and sent him an email explaining why, along with a way to appeal if he thought I'd made a mistake.

And since there's no such thing as too much paranoia, I gave the entire server a thorough check: antivirus scans, rootkit checks, every login, and every use of sudo over the past 30 days. I found no sign of a break-in. I did, however, find a few bolts I'd left loose myself, so I tightened them.

My souvenir from the whole mess is a rootkit scanner that checks the server every Monday and only emails me if it finds anything unusual.

And I'll give him this: the bouncer idea was good. I'll be offering IRC bouncers.