Humanoid Name Hack?


This is a security issue more than a scripting problem - I am struggling to identify the cause.

(Spoiler contains bad language)

I have no server-side scripts which touch/modify the humanoid name, so I don’t think it is a remote event/function issue (unless you can pass a function through a remote? But then again, I don’t call anything passed through a remote…)

I want to be able to stop these offensive humnaoid character name changes from happening.
So far I have gone into studio as a test mode, and from the client-side, tried changing the name property of the character from the player object and character, however I am as expected blocked.

13:42:43.97 7 - The current identity (0) cannot set a Character’s name (lacking permission 4)
13:43:03.142 - The current identity (0) cannot set a Player’s display name (lacking permission 4)
13:43:08.540 - The current identity (0) cannot set a Player’s name (lacking permission 4)
13:43:21.708 - The current identity (0) cannot set a Player’s ID (lacking permission 4)

I’m hoping someone else might have experience with this and can advise what the root cause is, I’ve tried searching on the forums and google, but can’t find anything. Maybe I’m not using the right keywords. “Humanoid name hack” and variants is my main search basis but can’t find anything related :confused:

Any help is much appropriated!


Report it to ROBLOX.

The Name property of a humanoid doesn’t have the “notreplicated” tag. This means that you can listen for property changes for name on the server, and kick the player if they change the name of their humanoid.

Source: Humanoid

I don’t know what the hack is so do not have enough details to report. I’m kinda guessing it is something to do with client replication like with hat dropping/part spamming?

You’re gonna have to do some server sided stuff for this.

I think you can put a server script in StarterCharacterScripts, and detect when the name of the character was changed. When it’s changed, you can revert the name to the original one.

local name = script.Parent.Name

    if script.Parent.Name ~= name then
        script.Parent.Name = name
1 Like

to the OP: If you’re sure that you’re not changing the name of the humanoid yourself, then you can kick/ban the exploiter for changing the name of their humanoid.

Isn’t the name displayed by the humanoid based on the model name? I’m not sure why the name of the humanoid would effect this?

Sorry, I thought you meant the name of the Humanoid instance itself.

I recommend avoiding the punishment of kicking exploiters, because what if the anti exploit fails? You can simply protect things and the exploiter can do no harm. Only kick if your anti exploit is 100% working.

I know It’s going to have to be server-side :confused:
Hence in the question I was asking for the cause.

Is this a problem you have personally experienced and are you sure that it is as simple as just the character model name?

I agree, that’s why I included this portion. If the anticheat is for something like speed hacks, you can never be sure if they’re actually modifying their walkspeed so you shouldn’t kick them.

However, for things like this where there’s a definite way to detect it and you’re sure you didn’t change it yourself (meaning the exploiter did it) then it’s still safe to kick them before they do any more harm.

I haven’t experienced this issue before, but I’d imagine this would be a good way to solve this situation.

I also think you should do the same protection for the Humanoid’s DisplayName, and the player’s DisplayName.

I feel you are being a little patronising in that case. Why should I trust your advice if you haven’t experienced or at least dealt with it? I could just be adding unnecessary code into my game if it doesn’t resolve it (and I’d have my own way of implementing it hence I was specifically asking for the root cause of the issue…).

Just check if the players DisplayName is the same as the players Name on PlayerAdded. If not, kick them.

1 Like

Thank you, that’s really helpful :slight_smile:

I just know how exploiting works, I think this should work.