Possible solutions to reduce ban bypasses

TeamSpeak 3 Server
1

I have no clue if this problem is going to be solved, but most people that I know are aware and have been spreading a bug where you can bypass a TeamSpeak server ban. I don’t wanna specify too much, but simply changing where TeamSpeak retrieves your product ID, your public ip address and identity is enough to bypass a ban. Will this problem be solved for TeamSpeak 5?

I’ve noticed that you can now connect to servers with the option of sending your myTeamSpeak ID. Even if that is enforced and their myTS ID is banned from the server, can’t they just create a new account? I was wondering if you were gonna enforce a different type of ban like an HWID server ban instead of what the current system is now!

1 Like
2

I don’t think that this problem will be solved. U can create anty-vpn bot that will block all traffic via vpn. U can also setup ur server to let the people join only while using myTeamSpeak account. Maybe TeamSpeak team will do something special, but that’s not confirmed.

3

I don’t think an Anti-VPN bot would solve that too because some people have a dynamic IP address where they simply shut off their router and turn it back on. Sometimes peoples IP reset over night and they can just come back the next day. I’d like to say most people are dynamic and have their IP reset over night but I’m not too sure what the stats are.

Also, I’ve never heard of this where you can set it where people can only join using a myTeamSpeak account. Where is this option?

4

In the TeamSpeak server, you can create a special ban entry which bans all users with an empty myTeamSpeak ID.

This is rather a side affect of the myTeamSpeak ID ban feature than an actual well-designed feature and the TeamSpeak 3 client ban dialog doesn’t even support it. You have to do this via the server’s query interface, if I remember correctly.

That’s probably why you never heard of it.

Regarding evading IP bans: IP addresses have never been a particularly good property to base blocking mechanisms on since they are way too easy to change, unless you go for region or ISP blocking by blocking entire subnets. But with more and more affordable and easy to use VPN services being available, you basically have to block out anyone who cares about privacy and uses VPN for legitimate reasons.

In the end, it’s all about patience. At some point, the attacker will eventually give up.

2 Likes
5

Alright, I just wondered if any further advancements would happen to their current system. You can always set server passwords, modify permissions, etc.

2 Likes
6

Hi,

So we got a user that we definetely don’t want on our TeamSpeak so we banned him. Currently our TeamSpeak Bot removes the IP Bans because IP bans are not necissary in our opinion, because users can just change their ip.
I have heard at some point that TeamSpeak bans the hardwareid aswell but it does not seem like this because the banned user can just create a new identity and join again.
Now here is my question: Is the HardwareID ban saved in the ip ban? Or is there another reason that he can rejoin all the time? Or do you have other hepfull things about it?

Have a nice day
Mattzi

1 Like
8

Well, then TeamSpeak should definitely add something to prevent users from just rejoining because IP Range bans not just ban that specific user but all users that get those ips.

10

You can ban their myTeamSpeak ID, that way another IP or VPN doesn’t help. But they can connect without sending their myTS ID! To prevent that you can force clients to send their myTS ID to your server which means everyone using your server needs a TeamSpeak account.

11

Well this user is clever enough to use things like vpns to even bypass a ip range ban but I don’t think he would get why he cant join if his hwid is banned.

17

You could increase the needed security level. Temporarily at least, until the user gives up.

4 Likes
18

This is the answer, ontop of that you could create a timed system (PHP + Cron, or whatever you prefer) where new users cannot move from the lobby immediately until they’ve been connected for 2-5 mins unless someone drags them. If they wait the 5 mins they get allocated a server group that allows them to proceed.

Wasting the person’s time is the best bet as they usually end up giving up because in reality they’re wasting more of their own time than yours.

1 Like
19

Yes, TS did, and likely still does, ban on 4 things (UID, IP, myTS & a hardware hash) when you ban a user, but all but the myTS are super easy to work around. And myTS is also not too hard. Best is higher security level, yes, this can impact your trusted users one time, but explain it to them it is to deter the trolls and most will be OK with it as long as you don’t set it to 40 or something so high it takes months to reach.

I will add that it would not be a bad idea to force having a [my]TS account, but I would put a notice on the server about that change in advance to give user time to create one if they to not have one already. Or, mention you are considering and discuss with them the pros/cons as they see it. One big pro is how integrated the new TS client is with the [my]TS account for global messaging and such.

1 Like
21

Use Sinusbot and add this script to it: https://forum.sinusbot.com/resources/antiproxy-block-proxies-vpns-say-goodbye-to-ban-evading.265/

That should eliminate 90% of your problems… this script has a huge database on a remote server of almost every vpn exisiting and checks on your server if a user is joining with a ip from a vpn.. you can then choose what the bot needs to do(ban,kick) instantly.

2 Likes
22

If thats the case. Is he able to rejoin because we remove the ip ban or is he able to bypass the hardware hash ban

2 Likes
24

I think @FakE is right, been years since I looked at how that part worked. But, as I stated the hardware hash is super easy to change, any script kiddie can do it.

1 Like
25

I said it before and will repeat it here.

There is no perfect ban system and there will not be any.

Users will always find a way to avoid a ban. That’s a fact.

You have following options to solve that problem:

  • Use a high security level on your server.

  • Put a password on your server and give it to the people.

  • Put a password on your server and assign the permission to ignore it to your member groups. But don’t tell anyone else the password.

  • Remove the possibility for Guests to move out from default channel, to write in there etc. and to subscribe any channel.

  • Add a myTS ID ban and put in the word empty. From now on your users must use a valid myTS ID to join the server.

  • You can require users to use a minimum required Client version. Meaning that all users for example need to use a TS6 client which currently comes at the advantage of not having any bot scripts etc.

    Use the Query command:
    serveredit virtualserver_min_client_version and set it to the desired build version (Unix timestamp) which can be found in the client settings.

8 Likes
26

Hello,

I am running a TeamSpeak 3 server using the latest version 3.13.8 on Linux.

For many years, I have been facing a security issue that I have not been able to solve:

Whenever I ban a user from my TeamSpeak server, they can easily bypass the ban by simply changing their IP address and reconnecting to the server.

Is there any recommended solution or a better security mechanism to prevent banned users from returning, even after changing their IP address?

Please note that increasing the Security Level is not an effective solution in this case.

The default Security Level for all users is 8. If I increase it by only one level (for example, requiring Level 9), the user can simply increase their identity security level to 9 within a few seconds and reconnect to the server.

If I increase the required Security Level much higher, it creates problems for normal users. Many new users do not know what Security Level is, where to change it, or how to upgrade their identity, which creates unnecessary difficulties and prevents legitimate users from joining the server.

Therefore, I am looking for a more practical and reliable solution.

Is there any built-in TeamSpeak feature, recommended configuration, plugin, or security method that can prevent banned users from bypassing bans through IP changes?

For example, is there a recommended way to combine identity-based banning, hardware/device identification, or any other mechanism to make bans more effective?

I would appreciate your guidance on the best practice for handling this situation on a public TeamSpeak server.

Thank you.

1 Like
27

You’ll find all possible methods to prevent ban bypasses in the reply above.

2 Likes