SRL Archive - The Bashing Club / BBQ Pit

So tonight the Skype channel for Simba/SRL has been flooded.

Myself and Kialok/Iamnoobot planned on making a AIO Karamja Fisher.
However When exchanging screen's via Teamviewer. He got a little greedy.

He went through my root folder, Which as everyone knows holds Simba/Scripts



Logs:

2012/05/06 23:35:08.693  7728  7904 G1   CMeetingControl[1]::Received_MeetingRegisterStream(): StreamID 4 (StreamType_Misc), Source[557951642,227470959]
2012/05/06 23:35:08.693  7728  7904 G1   CMeetingControl[1]::AddSubscriber(): StreamID 4, Participant[388858481,-2060474801], Source[0,0]
2012/05/06 23:35:08.694  7728  1208 G1   CStreamManager::StreamRegistered: streamID=4 type=1 source=[557951642,227470959]
2012/05/06 23:35:08.694  7728  1208 G1   CStreamManager::StreamSubscribed: ID=4 subscriber=[388858481,-2060474801] subscribed=1
2012/05/06 23:35:08.696  7728  7904 G1   CMeetingControl[1]::Received_MeetingRegisterStream(): StreamID 5 (StreamType_File), Source[557951642,227470959]
2012/05/06 23:35:08.696  7728  7904 G1   CMeetingControl[1]::AddSubscriber(): StreamID 5, Participant[388858481,-2060474801], Source[0,0]
2012/05/06 23:35:08.696  7728  1208 G1   CStreamManager::StreamRegistered: streamID=5 type=6 source=[557951642,227470959]
2012/05/06 23:35:08.697  7728  1208 G1   CStreamManager::StreamSubscribed: ID=5 subscriber=[388858481,-2060474801] subscribed=1
2012/05/06 23:35:08.806  7728  1208 G1   ServerThreadInfo connected to 557951642, client version is 7.0.11067, OS=4200
2012/05/06 23:35:08.808  7728  7028 G1   CFileTransferThreadServer started. 
2012/05/06 23:35:08.808  7728  1208 G1   CMeetingControl[1]::Received_MeetingRegisterStream(): StreamID 6 (StreamType_File), Source[388858481,-2060474801]
2012/05/06 23:35:08.809  7728  1208 G1   CMeetingControl[1]::AddSubscriber(): StreamID 6, Participant[557951642,227470959], Source[0,0]
2012/05/06 23:35:08.809  7728  1208 G1   CStreamManager::StreamRegistered: streamID=6 type=6 source=[388858481,-2060474801]
2012/05/06 23:35:08.809  7728  1208 G1   CStreamManager::StreamSubscribed: ID=6 subscriber=[557951642,227470959] subscribed=1
2012/05/06 23:35:08.813  7728  6708 G1   Server started successfully
2012/05/06 23:35:08.824  5140  6508 D1   ServerThread connected to 557951642, client version is 7.0.11067, OS=4200
2012/05/06 23:35:08.824  5140  6508 D1   ConnectionAccessSettings: RemoteControl: Denied FileTransfer: Allowed ControlRemoteTV: Denied SwitchSides: Allowed AllowDisableRemoteInput: Denied AllowVPN: Denied AllowPartnerViewDesktop: Denied ShareMyFiles: Denied ShareFilesWithMe: Denied 
2012/05/06 23:35:08.846  7728  6708 G1   File transfer request from Pauladmin (557 951 642) allowed
2012/05/06 23:35:09.115  7728  6708 G1   Views folder <root drives>
2012/05/06 23:35:09.379  7728  6708 G1   Views folder <root drives>
2012/05/06 23:35:14.034  7728  6708 G1   DragDropManager: Aborting 0 copy operations
2012/05/06 23:35:14.035  7728  6708 G1   Stopping file transfer session...
2012/05/06 23:35:14.814  7728  7688 G1   CT4 CT.Receive.CMD_ENDSESSION From=557951642 To=388858481 L=4
2012/05/06 23:35:14.814  7728  7688 G1   CConnectionThread::CmdEndSession(): Received CMD_ENDSESSION with reason: 1
2012/05/06 23:35:14.814  7728  7556 G1   CT4 CT.Send.CMD_DISCONNECT From=388858481 To=557951642 L=4
2012/05/06 23:35:14.814  7728  7688 G1   CT4 CT.Disconnect.WaitForLastAck
2012/05/06 23:35:14.869  7728  7904 G1   CT7  CT.Receive.CMD_DISCONNECT From=557951642 To=388858481 L=4
2012/05/06 23:35:14.880  7728  7688 G1   CT4 CT.Disconnect
2012/05/06 23:35:14.880  7728  7904 G1   CT7 CTU.Run.LoopEnd
2012/05/06 23:35:14.880  7728  7688 G1   Session to 557951642 ended. Estimated bandwidth=-1kBit/s, Latency=-1ms
2012/05/06 23:35:14.880  7728  7904 G1   CT7 CT.Disconnect
2012/05/06 23:35:14.881  7728  7688 G1

Skype Chatlog:

[5/6/2012 11:55:53 PM] Kyle: i will prove it's not an accident
[5/6/2012 11:56:46 PM] NKN: It's not like we can give punishment to him
[5/6/2012 11:56:50 PM] NKN: Why make this big of a deal?
[5/6/2012 11:57:06 PM] Kialok: what have i stolen?
[5/6/2012 11:57:09 PM] Kialok: which data?
[5/6/2012 11:57:11 PM] NKN: Attempted to steal.*
[5/6/2012 11:57:18 PM] Kialok: oke
[5/6/2012 11:57:19 PM] Kialok: but what?
[5/6/2012 11:57:25 PM] Olly: Kialok so your admiting to attempting to right now? (worry)
[5/6/2012 11:57:29 PM] NKN: Files in his C;/ Drive
[5/6/2012 11:57:42 PM] Kyle: http://puu.sh/tkVL
http://puu.sh/tkVZ
http://puu.sh/tkW8
http://puu.sh/tkWh

BEWARE

I can also "vouch" that from what it looks like with the proof provided there is no way this was an accident.

What an a**….

Thats low. Sad really. Good job catching him on it.

Here are the images:

http://puu.sh/tkVL
http://puu.sh/tkVZ
http://puu.sh/tkW8
http://puu.sh/tkWh

Should also note, that "Pauladmin" is the account on his computer. He said it was an accident, hence the images proving that it's not one.

No way this could be an accident, only took us like, an hour to figure out. xD

From: NKN
No way this could be an accident, only took us like, an hour to figure out. xD

Haha but I told you! :P

Wow that is truly disappointing

He's been lurking on the thread. No posts.

From: xtrapsp
So tonight the Skype channel for Simba/SRL has been flooded.

Myself and Kialok/Iamnoobot planned on making a AIO Karamja Fisher.
However When exchanging screen's via Teamviewer. He got a little greedy.

He went through my root folder, Which as everyone knows holds Simba/Scripts



Logs:

2012/05/06 23:35:08.693  7728  7904 G1   CMeetingControl[1]::Received_MeetingRegisterStream(): StreamID 4 (StreamType_Misc), Source[557951642,227470959]
2012/05/06 23:35:08.693  7728  7904 G1   CMeetingControl[1]::AddSubscriber(): StreamID 4, Participant[388858481,-2060474801], Source[0,0]
2012/05/06 23:35:08.694  7728  1208 G1   CStreamManager::StreamRegistered: streamID=4 type=1 source=[557951642,227470959]
2012/05/06 23:35:08.694  7728  1208 G1   CStreamManager::StreamSubscribed: ID=4 subscriber=[388858481,-2060474801] subscribed=1
2012/05/06 23:35:08.696  7728  7904 G1   CMeetingControl[1]::Received_MeetingRegisterStream(): StreamID 5 (StreamType_File), Source[557951642,227470959]
2012/05/06 23:35:08.696  7728  7904 G1   CMeetingControl[1]::AddSubscriber(): StreamID 5, Participant[388858481,-2060474801], Source[0,0]
2012/05/06 23:35:08.696  7728  1208 G1   CStreamManager::StreamRegistered: streamID=5 type=6 source=[557951642,227470959]
2012/05/06 23:35:08.697  7728  1208 G1   CStreamManager::StreamSubscribed: ID=5 subscriber=[388858481,-2060474801] subscribed=1
2012/05/06 23:35:08.806  7728  1208 G1   ServerThreadInfo connected to 557951642, client version is 7.0.11067, OS=4200
2012/05/06 23:35:08.808  7728  7028 G1   CFileTransferThreadServer started. 
2012/05/06 23:35:08.808  7728  1208 G1   CMeetingControl[1]::Received_MeetingRegisterStream(): StreamID 6 (StreamType_File), Source[388858481,-2060474801]
2012/05/06 23:35:08.809  7728  1208 G1   CMeetingControl[1]::AddSubscriber(): StreamID 6, Participant[557951642,227470959], Source[0,0]
2012/05/06 23:35:08.809  7728  1208 G1   CStreamManager::StreamRegistered: streamID=6 type=6 source=[388858481,-2060474801]
2012/05/06 23:35:08.809  7728  1208 G1   CStreamManager::StreamSubscribed: ID=6 subscriber=[557951642,227470959] subscribed=1
2012/05/06 23:35:08.813  7728  6708 G1   Server started successfully
2012/05/06 23:35:08.824  5140  6508 D1   ServerThread connected to 557951642, client version is 7.0.11067, OS=4200
2012/05/06 23:35:08.824  5140  6508 D1   ConnectionAccessSettings: RemoteControl: Denied FileTransfer: Allowed ControlRemoteTV: Denied SwitchSides: Allowed AllowDisableRemoteInput: Denied AllowVPN: Denied AllowPartnerViewDesktop: Denied ShareMyFiles: Denied ShareFilesWithMe: Denied 
2012/05/06 23:35:08.846  7728  6708 G1   File transfer request from Pauladmin (557 951 642) allowed
2012/05/06 23:35:09.115  7728  6708 G1   Views folder <root drives>
2012/05/06 23:35:09.379  7728  6708 G1   Views folder <root drives>
2012/05/06 23:35:14.034  7728  6708 G1   DragDropManager: Aborting 0 copy operations
2012/05/06 23:35:14.035  7728  6708 G1   Stopping file transfer session...
2012/05/06 23:35:14.814  7728  7688 G1   CT4 CT.Receive.CMD_ENDSESSION From=557951642 To=388858481 L=4
2012/05/06 23:35:14.814  7728  7688 G1   CConnectionThread::CmdEndSession(): Received CMD_ENDSESSION with reason: 1
2012/05/06 23:35:14.814  7728  7556 G1   CT4 CT.Send.CMD_DISCONNECT From=388858481 To=557951642 L=4
2012/05/06 23:35:14.814  7728  7688 G1   CT4 CT.Disconnect.WaitForLastAck
2012/05/06 23:35:14.869  7728  7904 G1   CT7  CT.Receive.CMD_DISCONNECT From=557951642 To=388858481 L=4
2012/05/06 23:35:14.880  7728  7688 G1   CT4 CT.Disconnect
2012/05/06 23:35:14.880  7728  7904 G1   CT7 CTU.Run.LoopEnd
2012/05/06 23:35:14.880  7728  7688 G1   Session to 557951642 ended. Estimated bandwidth=-1kBit/s, Latency=-1ms
2012/05/06 23:35:14.880  7728  7904 G1   CT7 CT.Disconnect
2012/05/06 23:35:14.881  7728  7688 G1

Skype Chatlog:

[5/6/2012 11:55:53 PM] Kyle: i will prove it's not an accident
[5/6/2012 11:56:46 PM] NKN: It's not like we can give punishment to him
[5/6/2012 11:56:50 PM] NKN: Why make this big of a deal?
[5/6/2012 11:57:06 PM] Kialok: what have i stolen?
[5/6/2012 11:57:09 PM] Kialok: which data?
[5/6/2012 11:57:11 PM] NKN: Attempted to steal.*
[5/6/2012 11:57:18 PM] Kialok: oke
[5/6/2012 11:57:19 PM] Kialok: but what?
[5/6/2012 11:57:25 PM] Olly: Kialok so your admiting to attempting to right now? (worry)
[5/6/2012 11:57:29 PM] NKN: Files in his C;/ Drive
[5/6/2012 11:57:42 PM] Kyle: http://puu.sh/tkVL
http://puu.sh/tkVZ
http://puu.sh/tkW8
http://puu.sh/tkWh

BEWARE

That's like saying, "Oh my bad I accidently walked out of the store with this 42" flat screen TV officer."

He writes scripts .-. how can you say you accidently just stumbled upon his c:/simba/script folder.

It requires you to 'click' on each button!

Come up with a better excuse bro.

I just don't see how he thinks he could have got away..

guilty in my eyes. thank-you for the heads up and ill be sure to have no part with imanoobot in the future

lol greesy people these days. and best thing is your busted and your gonna try to lie about it. if he was inocent he would have given a better explination and would actually have something to say rather then lurking in the thread then leaving

I kind of feel bad, we pretty much ruined his stay on Villavu. xD

He shouldn't have done this. D:

From: NKN
I kind of feel bad, we pretty much ruined his stay on Villavu. xD

He shouldn't have done this. D:

He pretty much deserved it for trying to steal passwords. He's been lurking almost the entire time damn

I was helping imanoobbot with scripting… :(
EDIT: So does this mean that teamviewer should be closely monitored?

Just to clarify, nothing was stolen. The only thing that happened was Kialok/Imanoobbot attempted to open the file manager and trope around the root folder. AFAIK, xtrapsp was prompted to give him permission to transfer a file. Therefore, I don't think that TV has some exploit. Just be careful.

Nevertheless, another vouch right here. I was a bit skeptical at first (considering that Kialok is from Germany and there is a language barrier and all), but you have to make several clicks before you get to that point, and his TV is in German. It's quite obvious he knew what he was doing. After seeing the logs, I'm convinced that this was malicious.

From: JOEbot
I was helping imanoobbot with scripting… :(
EDIT: So does this mean that teamviewer should be closely monitored?

Smart Manager has a encrypted or something password. To be sure someone hasn't made it a password stealing script, I just put my password in that, not needing to put it in any scripts and stopping this sort of thing from happening.

People just need to be very careful, it's the internet, no one really wants to help anyone, they just want to get ahead themselves.

can someone please verify that that log actually means that he attempted to steal? It does say aborting '0' file transfers. Not positive what that means. It is still within the realm of possibility that xtra made this up because of a personal conflict

If this is true than I'm really disappointed in you, Iamnoobot. :(

From: m34tcode
can someone please verify that that log actually means that he attempted to steal? It does say aborting '0' file transfers. Not positive what that means. It is still within the realm of possibility that xtra made this up because of a personal conflict

We have no actual motive for him making this up.
Wouldnt you comment right away if someone accused you of such an act if it wasnt true?

Yes he was trying to open it, but to steal stuff, that I'm not sure I can say for sure was his motive. But yes definitely he was trying to open the root folder but someone caught on in time and aborted the file transfer request.

[PHP]2012/05/06 23:35:08.846 7728 6708 G1 File transfer request from Pauladmin (557 951 642) allowed
2012/05/06 23:35:09.115 7728 6708 G1 Views folder <root drives>
2012/05/06 23:35:09.379 7728 6708 G1 Views folder <root drives>
2012/05/06 23:35:14.034 7728 6708 G1 DragDropManager: Aborting 0 copy operations
2012/05/06 23:35:14.035 7728 6708 G1 Stopping file transfer session…
2012/05/06 23:35:14.814 7728 7688 G1 CT4 CT.Receive.CMD_ENDSESSION From=557951642 To=388858481 L=4
[/PHP]

Does this mean he'll be banned from the forums? Just wondering since this did occur off the forums and such, or I guess he'll just be shunned by the community

Not banned but prob will be banned from the market area of the forums if he had access to it before

Too bad. Viewing the thread, but not defending his "innocence".

Wow, he could steal mine too. Or maybe did that.

I've posted all the chatlogs on the skype chat. I've posted TV logs. I've posted picture proof on the skype logs. I have witnesses to him practically admitting it.
I highly doubt im making it up m34t. If he's pming you and your falling for his language barrier stunt then your truly mistaken

also it says no files transfered cause i denied it. but in that time he managed to go through 2 folders in my root. Kyle proved this

Him lurking the thread and not posting isn't helping his defense, I would like to hear what he has to say about it.

From: begginer
Wow, he could steal mine too. Or maybe did that.

Please stop the spam in every thread..

From: ShawnjohnSJ
Him lurking the thread and not posting isn't helping his defense, I would like to hear what he has to say about it.

Not to mention, being active in other threads and not this one.
Respect officially lost…

From: xtrapsp
I've posted all the chatlogs on the skype chat. I've posted TV logs. I've posted picture proof on the skype logs. I have witnesses to him practically admitting it.
I highly doubt im making it up m34t. If he's pming you and your falling for his language barrier stunt then your truly mistaken

also it says no files transferred cause i denied it. but in that time he managed to go through 2 folders in my root. Kyle proved this

I havent actually seen solid proof yet. I would really like to see a chatlog of my own, to see what aborting 0 file transfers means. he could have been curious of the file transfer button, clicked it then closed the window. That would explain why it said aborting 0 file transfers. It may also mean that you denied an attempt, so the file transfer was never more than a request.

To verify that, we really need to see another log, to see what the aborting 0 file transfers means.

His language doesn't get to me, but my lack of understanding where the proof is does.

From: Chig
Not banned but prob will be banned from the market area of the forums if he had access to it before

How can you be so sure? It'll be up to the mods/admins what happens.

I dont see him being banned, as this did not happen on villavu, and admins may share my view that we need to be 100% positive he intended to steal a script, or login credentials, before action is taken.

But, as you said, it is not my call, its up to the admins.

m34t

2012/05/06 23:35:09.115  7728  6708 G1   Views folder <root drives>
2012/05/06 23:35:09.379  7728  6708 G1   Views folder <root drives>

He went through 2 folders from my root drive, That isn't an accident..

From: Kyle Undefined
Here are the images:

http://puu.sh/tkVL
http://puu.sh/tkVZ
http://puu.sh/tkW8
http://puu.sh/tkWh

Should also note, that "Pauladmin" is the account on his computer. He said it was an accident, hence the images proving that it's not one.

oh ohhh someone is screwed.

Well, what a rectum all I can say.
Mat

Truly sad; Although the Skype channel is not officially SRL, correct?

From: P1nky
Truly sad; Although the Skype channel is not officially SRL, correct?

It's unofficial. NOTA says it.

Still, it's disgusting behaviour. Anyway, this is just a warning make your own judgement from the obvious proof

From: xtrapsp
m34t

2012/05/06 23:35:09.115  7728  6708 G1   Views folder <root drives>
2012/05/06 23:35:09.379  7728  6708 G1   Views folder <root drives>

He went through 2 folders from my root drive, That isn't an accident..

Until you have either generated logs of your own, or spoken with a tv dev, you dont know what that means. Root could very well be a default location. Someone needs to test it. Im not backing for kialok, but i do want that slight possibility of innocence addressed.

I cant generate a log myself, as i will not tv with anyone i dont know personally, and my bro is the only one with another pc i can use. he is gone for a while.

I personally know the TeamViewer devs, <root> is by default C:\ on Windows. The log doesn't show what files under root is viewed, but that just root is being accessed.

exactly. it also doesnt show whether it was just viewing root twice. also, now that i think of it, if he navigated to the scripts directory it would have showed 3 root views, because you need to go to simba, then scripts…

From: m34tcode
exactly. it also doesnt show whether it was just viewing root twice. also, now that i think of it, if he navigated to the scripts directory it would have showed 3 root views, because you need to go to simba, then scripts…

No it wouldn't have, two clicks is all you need to see the Scripts folder. He could of just copied everything inside of /Simba/ or just /Scripts/

Views root 3 times.

1: open file transfer whichllads root folder by default
2: click simba to load that folder
3: click scripts dir,to load that one

3views,so I suspectit was something else.

Not individual script, just the /Scripts/ folder.

- Clicks "File Transfer"
- Clicks on C:\ (That's one)
- Click on /Simba/ (That's two)

/Scripts/ folder is able to be copied.

Whenyouclick file transfer it shows a list of files and folders. In order to see those files, a function musthave been called to read what files andfolders existed under the directory so everytime it has tolist files, the client has 'viewed' a foldes under the root drive

Hasn't this thread died down yet.. We get it dnt trust him -_-

This is a very disappointing especially since imanoobot helped make a shantay bonfire script

kyle, you can transfer folders? He said it was a file request he aborted, not a folder transfer. I would assume it say whats being transfered on the request…

It doesn't matter if it's a file or a folder, it's still considered a "file transfer".

I have a Scripts folder on C:/ for private scripts and Scripts inside Simba folder just saying.

ah, then that makes sense. two loads will open your scripts folder…

also, i would be more inclined to generate a log of my own, if he had attempted to defend himself. He has not by now, so I am no longer worried about it.

Xtrapsp wouldn't possibly make this up because of a personal conflict, imanoob was working on the script with him.
I really hope something get's done about this tbh, its like if a person hires someone on sythe or something to get a fire cape for their account n the person cleans the acc and the person had proof do you think they would be not getting banned?
Also two trusted SRL Members witnessed this and xtra has a log lol…

I was questioning the proof. the proof isn't solid, since we don't know what aborting 0 transfers means. The only thing that makes this really seem like he did try to steal, is his lack of response.

Aborting 0 file transfers means he opened file transfer but did not try to transfer anything before he was denied the transfer.

I'm with meat on this one.. The log doesn't show any threats to me.
I don't think anyone cared enough to read this line:

ConnectionAccessSettings: RemoteControl: Denied FileTransfer: Allowed ControlRemoteTV: Denied SwitchSides: Allowed AllowDisableRemoteInput: Denied AllowVPN: Denied AllowPartnerViewDesktop: Denied ShareMyFiles: Denied ShareFilesWithMe: Denied

Everyone saw root and freaked out.. 1 thing wrong here though. Without remote control, he cannot access the C:/ Drive except through a file transfer which has to be allowed. Secondly FileSharing is turned off. The guy can't even view his desktop because that is off as well. He can't transfer files to you either since it's denied as well. Why the hell would FileTransfer be allowed when everything else is NOT allowed.. Doesn't make sense from a security point of view. I just don't understand OP has two of the biggest threats open port. By that I mean he has switch sides AND file transfer from but not to. Not only that but every thing else is off? Nah something is wrong here.


Also he just happens to come in time to deny the guy access? You kidding me? He could have easily ratted him and fork bombed him on the spot but I guess since file transferring is set to off then he can't. Even though, that log really makes no sense to me so I'm not going to judge him based on the evidence on the first post. I would take caution but I will absolutely not judge the guy.

From: Brandon
I'm with meat on this one.. The log doesn't show any threats to me.
I don't think anyone cared enough to read this line:
Everyone saw root and freaked out.. 1 thing wrong here though. Without remote control, he cannot access the C:/ Drive except through a file transfer which has to be allowed. Secondly FileSharing is turned off. The guy can't even view his desktop because that is off as well. He can't transfer files to you either since it's denied as well. Why the hell would FileTransfer be allowed when everything else if NOT allowed.. Doesn't make sense from a security point of view.


Also he just happens to come in time to deny the guy access? You kidding me? He could have easily ratted him and fork bombed him on the spot. That really makes no sense to me so I'm not going to judge him based on the evidence on the first post. I would take caution but I will absolutely not judge the guy.

I agree. I don't think anything happened.

From: Brandon
I'm with meat on this one.. The log doesn't show any threats to me.
I don't think anyone cared enough to read this line:
Everyone saw root and freaked out.. 1 thing wrong here though. Without remote control, he cannot access the C:/ Drive except through a file transfer which has to be allowed. Secondly FileSharing is turned off. The guy can't even view his desktop because that is off as well. He can't transfer files to you either since it's denied as well. Why the hell would FileTransfer be allowed when everything else is NOT allowed.. Doesn't make sense from a security point of view. I just don't understand OP has two of the biggest threats open port. By that I mean he has switch sides AND file transfer from but not to. Not only that but every thing else is off? Nah something is wrong here.


Also he just happens to come in time to deny the guy access? You kidding me? He could have easily ratted him and fork bombed him on the spot but I guess since file transferring is set to off then he can't. Even though, that log really makes no sense to me so I'm not going to judge him based on the evidence on the first post. I would take caution but I will absolutely not judge the guy.

You don't need remote control to file transfer, and file transfer was enabled. He used file transfer, not file box. File box is file sharing.

He tried to to transfer files, but a popup appears and the person can deny it. Which xtrap did. File Transfer is almost always allowed by default, it's the way TV is built.

iirc, he was showing iamnoobot the script running, or something like that when this happened. That's how he was able to deny the file transfer.

Also, the reason it said aborting 0 file transfers is because nothing had been transferred before aborting it, according to the TV devs.

All the evidence is there, you just have to understand the logs. Which I do, and I've asked one of the TV devs to review cause I was curious. He confirmed exactly what happened.

From: Kyle Undefined
You don't need remote control to file transfer, and file transfer was enabled. He used file transfer, not file box. File box is file sharing.

He tried to to transfer files, but a popup appears and the person can deny it. Which xtrap did. File Transfer is almost always allowed by default, it's the way TV is built.

iirc, he was showing iamnoobot the script running, or something like that when this happened. That's how he was able to deny the file transfer.

Also, the reason it said aborting 0 file transfers is because nothing had been transferred before aborting it, according to the TV devs.

All the evidence is there, you just have to understand the logs. Which I do, and I've asked one of the TV devs to review cause I was curious. He confirmed exactly what happened.

Point: All the others are Denied except file transfer and switch sides. That means he disabled the default settings and overridden them with custom settings. Why bother leaving the other ones enabled then. Also FileTransfer vs. FileBox.. Filetransfer counts as sharing just so you know. I have it disabled on Teamviewer 7. It doesn't make any sense at all to disable all the defaults and leave the two biggest security breaches there. It's like saying you don't wanna get caught in a storm but yet standing on the beach. Secondly if he indeed was showing him a script, why in the world is screensharing set to denied? This makes no sense at all.. He can't show him anything. There is no need to teamviewer with anyone if you disabled screensharing and the features needed to show or receive help from that user.

And I said in my previous comment that filesharing can be done without remote control. Think about what you just said. What malicious user do you know would try to jack someone's password folders WHILE the person is there showing them a script? That person would sure be an idiot if they tried to jack the guy while he's watching.. Does not make any sense.

Oh and just before I go I want to let you know that when a user initializes file transfer remotely, there is NO PROMPT that comes up. The only prompt that comes up is the stop prompt. It stops an already started file transfer before it is complete. It does not give the user any prompt to deny and allow.

I'm basing everything from the logs, what the TV devs confirmed, and the flow of events. As to why some settings were allowed and some weren't? I don't know, only xtrap knows. The log itself confirms the events, and that's what I'm going by.

File sharing != file transfer. That's why the log says one is allowed and one isn't.

Maybe he didn't know it was going to prompt xtrap?

From: Kyle Undefined
I'm basing everything from the logs, what the TV devs confirmed, and the flow of events. As to why some settings were allowed and some weren't? I don't know, only xtrap knows. The log itself confirms the events, and that's what I'm going by.

File sharing != file transfer. That's why the log says one is allowed and one isn't.

Maybe he didn't know it was going to prompt xtrap?

Either way if they are not equal then teamviewer has a clear statement of the rules here:

[BANANA]Transfer files

Governs whether file transfer is generally &#8722; Allowed
&#8722; After confirmation
allowed.
&#8722; Denied[/BANANA]

See there is allowed, after confirmation and denied.. If allowed is there, there is NO CONFIRMATION.
Allowed = True = No Confirmation. So how can he possibly deny what's not there? No prompt :S All he can do is stop the transfer and the logs don't say stopped. It says denied which is incorrect because when a transfer is stopped, it says stopped or aborted. When it is denied, it says denied in the logs and this is only when confirmation is enabled which in this case it is not.

Your right on the file box:
[BANANA]
File transfer using the
file box

Governs whether files may be shared via
the File box widget.

&#8722; Allowed
&#8722; Denied
[/BANANA]

If all of this is true then I'm still not going to judge the guy on the evidence here. Reasons being for all of the above. No one teamviewers someone with screensharing denied, all control denied, and only filesharing enabled. Does not make sense to me and I'm sure many others so based on the evidence I will not judge. Just pointing out some flaws. Iunno for me it just doesn't seem right to call him out on this. Maybe a little more would change my mind. Not as in Xtra getting hacked but rather better logs I guess. Just need something that seems more legit :S

I'm not judging him either, I'm just trying to help explain what the log is saying. I have the full TV log that xtrap sent me.

It's a lot of stuff, and can get confusing :p

I don't mind him being here, since he didn't "technically" hack anyone. The post is more of a warning.