Game being exploited heavily, not sure how to resolve

Help and Feedback Scripting Support
#81

@JamesBlossoms exactly, I think a staff member is lying.

#82

Clearly you do. It is impossible in the nature of Roblox to configure something on the server using an exploit. You need a server sided executor for that.

#83

There has to be a require or HTTP that connects a function or contains a lua script that inserts exploit. I recommend to play in studio then if nothing happens, its a player but if something happens; something bad is in your game.

#84

There are only 3 people who can access studio, and all 3 are trusted.

#85

I would help the problem if you could stop kicking me for no reason.

#86

I would be able to see their admin logs if that was the case.

#87

Good idea @HarrowedCrobix then you can see if people have things there not supposed to

#88

Maybe one of your stuff gived someone permission

1 Like
#89

Someone may have inserted a malicious free-model without realizing it.

#90

I am 100% sure you have a malicious script allowing this type of access. You should go though all code in the game including require(id) code.

From experience I would avoid admin modules in a game. I find that they can be easily abused (admin permissons passed onto other users) and for the most part trusted members have access to the dev console to run code.

If you really need an admin command script I would make my own. They are simple to create and you are only including commands you want for that game. There will be no undefined access or commands.

1 Like
#91

I agree @Daw588. I think a staff gave our perma

1 Like
#92

First of all, this doesn’t make sense. You would have tested it in studio. And second of all, how can a exploiter gain control to studio like access.

#93

This doesn’t mean anything.
I was developing a game and I was the only one in it, but a backdoor still slipped in.

#94

as you said this is “Impossible”

#95

I don’t think this is in the right category?

#96

I mean those are the only FE admin HACKING script s Th e exploiters use

#97

You can disable FilteringEnabled, just most developers don’t know where the option is.

The most likely way the exploiting was possible was either that it was all done client-side (which doesn’t depend on you accidentally embedding some malicious code in your game) or that something might’ve disabled FE.

Edit: The removal must’ve been recent or something, didn’t bother opening the API.

#98

This must be a backdoor, the backdoor sends everything important that is server sided, over to their discord server, there is no other way for the client to do stuff that the server registers, the only thing that could be is that FE (Filtering Enabled) is disabled, just look into your guys workspace service and look through the properties until you find:
image

if it’s true then it is not FE and another problem, but if it’s false you know problem

#100

I checked all admins and what levels they have of admin, and they all have the type of admin they are supposed to have. Nobody has given out higher permissions.

#101

@HarrowedCrobix I have played the game in studio, it does not happen in studio.

@Daw588 No one can give permission to access studio other than Zack.

@JamesBlossoms Our games only used trusted and original free models.

@kingdom5 I have reviewed all of the instances of require() and none of them are malicious.