Another Discord Bot Nuked People's Servers, Again...
ฝัง
- เผยแพร่เมื่อ 4 ก.ค. 2024
- I sometimes question if people ever learn. Thankfully the Reverb Discord bot, a music bot, answered that question for me. It's no!
When you set up a Discord bot, you give it permissions to do a wack ton of stuff, and if you aren't careful. You could be exposing yourself to the risk of having your whole Discord server get nuked. All those precious memories / nonsense messages flushed down the drain. So maybe do a bit of reading on what Discord permissions do and STOP ADDING OBSCURE DISCORD BOTS IF YOU DON'T HAVE TO. As you can tell, a bit upset all of this was caused by a silly music bot. Just use youtube or something.
SOCIALS
-----------------------------------------------------------------------------
Discord Server
/ discord
Twitter
/ notexttospeech
MUSIC
-----------------------------------------------------------------------------
chillhop.com
Tesk - makemesee
El Train, Marc Mathias - Snap Back
Aso - Sidewalks
Plusma, Ben Bada Boom - Cabriolet
TIMESTAMPS
-----------------------------------------------------------------------------
00:00 - The Hack
01:54 - Reverb Team's Awful Response
04:26 - Server Safety - บันเทิง
Yeah so I talked to the owner of the bot. They are pinning the blame on one of the devs. From what I can see, it seems like a huge lack of permissions management both from people adding the bot all the way to the bot management itself.
Like always, don't join the support server to harass the devs.
Finally, I would definitely steer clear from bots made by these fellas (unless you keep them trapped in a box with very little perms). Just like stick to the big and popular bots if you want stability and security OR selfhost your own!
First+ur gay+discord sucks+nerd
Thank you, NTTS
❤
Smash
69 likes, Nice
i'd rather have someone tell me a genuine "sorry for the loss" rather than an artificial 2000 word apology, full of fake promises and other lies
"I am sorry for being so naive and getting my bot hacked. I should have done better. I will be going to therapy from now on and try to become a better person" x)
tru
@@bakamedia8285 💀💀
True, but in this case the rest of the guy's messages definitely don't make it look genuine. Red flags all over
Yes, that's what NTTS said too; too sad the other red flags falsify it themselves in this case...
This is why it’s very important to only give bots the necessary permission instead of just giving every bot admin permissions
This. It’s infuriating to see every single bot ask for admin
@@kepler6873 ok not really infuriating but alr
@@CZghost "I don't want the bot to nuke servers in case the bot token somehow gets out" - this is NOT within your control! What is within your control is keeping the token secure.
I think they were trying to say they want to minimize what permissions the bot needs, so that if someone else runs hacked code through the token the scope of damage is limited, in contrast to music bots asking for admin and having unlimited scope.
Keeping the token secure is still the #1 solution, but failsafes never hurt
@@kepler6873 I believe they resort to that because Admin is more powerful than channel overrides; I suppose that sometimes people forget about overrides and then what is their first step after the bot doesn't work in a specific channel? Go cry to support, obviously, because they can't just check their own server's perms!!! Well, the staff get tired and whoops, the invite link now has the 0x8 bit flipped on...
Man, the sheer audacity to call those people "haters" knowing full well the bot has been compromised and has deleted years of work is just friggin amazing
Yeah, that developer was out of line
Just a theory: what if *they* were the one who hijacked the bot
“Years or work” lmfaooo what???
Work may have been an odd way of saying but not untrue
@@Cleenishere years of conversations with friends, some of which may not be around anymore, artwork thats inaccessible now, stories that can no longer be read (all things that i have on my friends server). years of work, deleted forever
Bro became a discord kitten at the end
He got Dream-ed
@@SkepCakes now replace D with C
@@叵 he got Cream-ec
@@DionDPR damn you were faster than me
@@DionDPR replace the first "D" with "c".
A naked man fears no pickpocket.
yes
You shove the phone and keys into the ass and when you need them you just shit them out, great solution.
yeah but they fear dropping the soap
But they'll fear me.
This is why reddit gold should be a thing for youtube comments.
In my server, it luckily didn't delete any channels, but it did type "@everyone bitch" 1.5K times in 4 different channels for a total of 6K pings. That was fun to wake up to / clean up. Lesson learned about bot permissions.
oh god-
That's just the average discord server
@@Zant582 certified Discord moment
just use mee6 and /clear it, you can specify the user so it is better
@@ilikeobbies7442 promoting using mee6? In an ntts video? Heresy!
Software developer here.
Sounds like the dev did not take permissions seriously and did not bother to only request the ones the bot needs. Also users of the bot took permissions even less seriously. Hopefully this will be a good learning experience for them at least. They should be thankful they did not add this bot to their bank account.
OR he intentionally nuked all the channels himself.
“Software developer here”
Yeah and I’m Elon Musk.
@@aneima huh?
@@aneimaedgy
@@aneima what were you trying to do lol? Anyone can become a software dev, not everyone can exploit everyone and act like they did nothing wrong
@@aneima What are you trying to achive here?😢
Odd how the official Reverb discord support server wasn't messed with.
🤨
Prob doesn't have admin permissions, like it shouldn't
Any dev with a single IQ would not make a bot that is not self hosted admin to be able to nuke
bot
That’s what I was thinking too
Worth adding about the idea of a token leak at 1:55 that discord is pretty good at handling this stuff. One of the devs on the bot I’m working on accidentally pushed a commit to github with the live token. Discord detected it and actually automatically reset the token and I got a very scary pop up on my discord client.
"Don't get hacked bro EZ"
A wise lesson from a wise man
> gets hacked
> 👁️👄👁️
Someone sent the link to this vid in the support server and a dev said “that’s shit” 💀
That dev is a dick
gasp, how dare they 💀💀
@@Tired_Kye it was funny ash 😭
@@CheezyTopqz I want to join but I don't want my acc to 💀
@@Tired_Kye I recommend joining. Just a ton of kids arguing with kids. Make an alt if you’ve gotta. A good portion of the server members are in a damn vc 😂
Music bots are like having a public jukebox. It's fun sharing music with your friends
all without the obnoxious ads that you get with watch together too.
no it's not fun at all, all of my friends have trash taste, and I to them have trash taste so no one is ever having a good time
There really is no point using it though
@@UmiZoomR what do you mean? It's like having a speaker set up In a room with your friends.
Imagine you want to set the mood of a dnd campaign. That's a great reason to use it.
But me and my friends used it to make little playlists for our games nights. And anyone who didn't like it just shut it off.
What would the alternative be if you just wanted some background music?
You could listen to it on your own PC but then you can't share it. And on a public server that's annoying but on a server with a few friends it's qyite fun to have.
*its fun sharing the same music you guys like from your friends fixed it for you
If you're giving a *music* bot the ability to do this, that's a problem.
Like when people give the calculator the permission to make and manage phone calls ...
@@dk14929blah blah blah
”Just don’t get scammed” -No Text To Speech
Is it this hard to not give random bots admin privileges?
Fax
It's that easy 👍
A bot having all those permissions is ridiculous. Have these devs never heard of the Principle of Least Privilege? It is a common practice in the IT World to prevent stuff like this from happening.
Its honestly disgraceful how the owner cares more about their account than the thousands of Discord servers and channels the bot deleted
bros got main character syndrome
Bro its just discord servers who cares he probably had important dms
who gives a damn about the discord servers?
@@priitpiirisild2796 yeah but versus some people who had thousands of messages that were sent years ago and memories deleted? i think the owner is being disrespectful
@@chelseachang8155 thats why u backup everything and screenshot just in case lmfao
This is why permission control and self-hosting open source bots is very important
"I don't understand why people us discord music bots"
Also him: tutorial for making your own music bot
Doing what people want will bring in the ad revenue ¯\_(ツ)_/¯
Money
5:03 When you hold D&D sessions in discord, it's much easier to play the ambience through these music boxes, main reason I use it :(
Life would be better if Discord had a safe backup feature
They literally do. It's a template. If your talking about contents like images, messages, so on. Discord can't do that because it breaches users privacy and the privacy policy.
@@yellowtapes oh yeah i didnt think about that
Its called a template moron
this is why I want Discord permissions to be more specific, like you can manage if it can delete channels or not
like, currently, the permission "Manage Channel" lets the person control everything about the channel, i think i forgot
i want them to make most of the channels more specific, like "Delete Channel", "Manage Channel Name", "Manage Channel Permission" and more
i always wanted Discord to have this feature
God I love you dude, this is the second video I watched after the spotify godness you are a blessing subscribe well earned
this is exactly why i always give bots as little perms as possible
and why its especially annoying when other people give all bots they invite admin permissions lmao
Especially if you're a group of admins on a server, and you're the only sensible one who removes admin, and the other admins add admins back to bots.
@@Liggliluff yeah exactly
Well I moderate a server- I wont say the name. But someone got rid of Probot by accident and I remember the dev telling the admin to only give the bot the perms it needs and to remove the rest. And now I realise that was smart. It was a public server. personally, ive been more than happy to grant bots random permissions but ill be more careful in the future.
I honestly don't even watch the videos for the Discord content. I watch to hear No Text To Speech talk about Discord and make funny jokes along the way. Honestly any upload I see, I watch almost instantly.
I'm in the process of developing discord bot that I expect to be big and this makes me scared. The fact that even developers don't know how it happen, doesn't give me idea what I should do to protect against this
Just don't explicitly state sensitive data like token in code
“my wife left me” broke me tbh 😭 caught me so off guard bc it’s the beginning LMAO
Thanks for the heads up on checking bot perms. I have a bot that I trust BUT It had all sorts of permissions I wasn't willing to let it do like delete channels. I have now made this impossible to happen to me (P.S I see ProBot)
Good!
2:59 BRUH
No cost too great, no mind to think, no will to break, no voice to cry suffering. Born of God and Void, you shall seal the blinding light that plagues their dreams. You are the Vessel. You are the Hollow Knight.
i love hollow knight as much as the next guy, but what?
Nice
No but why💀
@@huaweiproX54 why not
Get this to top comment
Also if you're making a bot, if you're testing it on your own server, it should be fine to use admin privileges for testing, but if you're rolling out to other servers, only use permissions that are absolutely required by said bot in the event it ever becomes compromised.
Thank you for making these PSAs i went to both of my servers and check yagpdb and nero to make sure they didnt have the administrator privileges, i also double checked that yagpdb didnt need it either
Fun fact, if you remove all permissions that the bot asks for, when the bot joins the server, it isn't given a bot role.
Remember: when you give permissions to a bot, you're giving them to the owner and his friends. Don't give them to a random teenager who has no security and doesn't care
This is why when I make bots (for fun and to use by myself (on my own on a private server)) to only need the required permissions.
Something that could be done is give all bots minimum permissions to function. Music bot shouldn't be able to do anything outside the designated music bot channel.
That is also a good idea. On a server I got to manage, every bot had their own designated role as they get when you add them with permissions, and each being and admin ... because of course. So for the music bot, I removed it to get rid of the permission, re-added it without a single permission so it doesn't create that automatic role. Then I created a "music bot" role, and assigned the permissions specifically to the music channel only. Now this bot can't even spy on users outside this channel.
But after being an admin for a long time, I stepped down, and then it was back to the usual. The music bot was again an admin.
That "meow" at the end was so cute :3
no text to speech meowing was all I needed in life
This is exactly why I only give bots the channel specific perms they need to function and completely avoid giving them any role based perms, and especially not Administrator lol
imagine being staff on a discord server and actually doing your job, couldn't be the entirely of discord admins
It reminds me of when apps on Android asks for the permission to make and manage phone calls. Suspicious red flag. A weather app, calculator, or even that one game doesn't need permission to manage your phone calls.
People try to make excuses such as: _"but it needs to let a phone call through if you get one when the app is running",_ no, that is done by the system and not the app. Apps without this permission won't prevent phone calls to go through. Or: _"but it needs to save your progress when you get a phone call and it's put in the background",_ no again. Regardless if you change app, go to the home screen, get a call on Facebook Messenger (which isn't a phone call) or an actual phone call, the app is placed in the background. It doesn't know why, but it does know it was put in the background, and it will handle that regardless. It doesn't need a specific permission just for phone calls. Phone calls aren't different. Don't get scammed.
Most apps don't have this permission and work perfectly fine regardless.
That’s why I create my own bots and when I can’t I only give minimum channel permissions. Never role permissions. Some bots refuse to work without admin perms and what I do in that case is:
- kick the bot
- find another one
Another baller goodbye kiss from NTTS. Thank you
Not the owner presenting main character syndrome instead of giving a damn about the mass amount of channels and messages permanently gone from their ignorance 💀
Me after reading all that ignorance you just wrote 💀
I suspect they just ask for Administrator permissions because it's easier to code knowing your bot should be capable of joining every channel
But this is a terrible way of doing things for security reasons as you just saw
It was either the owner of the bot, one of the dev team (if they have access to the machine/host) or a vulnerability within the code. It is surprising how dumb some people are when it comes to eval functions.
Already know it's a red flag when a Lead Developer starts every word in his sentence with a capital.
I like how most people don't pay a single cent for their discord server, but want the most professional software
Yeah, they dont get payed a cent for this. If you want a professional quality bot, pay or make it yourself
ending scared the shit out of me i almost chocked to death
This is like the random mobile game wanting to have permission to make and manage phone calls
You are just epic TH-camr, also you should see the secret UI on mobile discord by holding the ✨ emoji for a few seconds when you are on the emojis information screen
What a awesome channel subbed
Discord should just store deleted channels and servers for a week before they're _actually_ deleted so you can restore it
But noo that would be a good feature and we can't have an actually good update, can we?
0:16 bro i thought that was mickey mouse for a sec 💀
I developed a discord bot 4 years ago for my friend's server on discord and the token got leaked and kicked everyone from the server it was a small server 300-400 members i apologized to the owner and he forgives me but I still feel bad till this day.
Imagine giving a music bot Administrator permissions 🤡
The “bye-bye love yooooouuuu” at the end is so uncanny
Bro really meowed for us. What a lad.
We need more of those meows.
you have no time to go change the token in time it happened to me too, the second your token is in production, there are thousands of bots that lurk Git Hub, Replit, and other public places, it basically finds your token in 0.01 seconds the moment you push it, and instantly logs in to nuke everything
even discord scans these places and github copilot too, they usually automatically change the token when you push it to production but during that split second the bots already connect and keep the session
also for the people complaining that an entire movie scene is required for an apology they just have to go outside at that point and touch some grass
they deliberately choose to use someone else services and bots for free knowing all about the risks and token stealing that is happening and yet gets mad when they are surprised that their dream has finally ended
Something even better to protect the bots, don't link them to your main account, have an secret secondary accounts only people you trust know it exists
it is tragic that so many servers are deleted but this is just passage of time. you eventually lose stuff and thats just how life is. if you really wanted you could have archived it. even with human memories you forget stuff and if youve got a 4 year old server you wont be looking closely enough at anything to remember things youve forgotten.
They're just not thinking that way yet. They're not at the end of their development arc
Its just a discord server bro
I had a bot in a few hundred servers when my account got hacked, first thing I did was run my failsafe function that makes my bot leave every server its in. Always nice to have a function like that. Your account got compromised? Slam open the bots code and run the command before they change the token. And by run I mean execute the function in the discords 'ready' listener
I own a semi popular sever with around ~500 members and active chat channels and I use a containment channel where every user that gets let in must be verified by a mod to access the whole sever. It has stopped 100% of scams bots and raids so far but I don’t think this would be a great choice for larger servers though
i'm a helper in one with nearly 10k users that also has that kind of containment channel. just needs to have a team of decent people with specific above-normal-user permissions to run one command.
the new users are a step below normal users, which makes it possible for the team to run the command, and once that role is removed, they are equal and the command no longer works.
Usually some people are just lazy to set up permissions so the bot can join private vcs so they give it administrator instead.
ntts you need to stop rizzing us at the end of your videos im so flustered
Discord should add a feature for server owners to be able to undo changes from the audit log
That one guy saying "stop saying don't use bot" is clearly unaware of the situation
this just happened to a server i mod, the bot was nebula and another mod on purpose added another nuke bot 💀
3:42 In Dutch there is the saying "een kip zonder kop" (some sort of alliteration), and it means a chicken without a head
At the end of the day Discord desperately needs a way to backup deleted channels. Also a way to instantly ban any bot that suddenly does shit like this.
The best part of the video (not that all of it wasn't great and informative) is the ~meow~ at the end. You can't change my mind.
Thank you for this video, I realized a bot we had in a personal server had admin rights when it shouldn't be :x Was able to fix that easily.
This really seems like the dev just added all the permissions so he wouldn't get any permission errors when developing the bot. Truly a professional.
I never understood why so many bots ask for administrator, ESPECIALLY music bots. Aaaages ago, maybe 2018 or before, I tried to add one, saw it asked for admin, and just... didn't.
that meow sounded like real life bored cat looll
This is why you only give a bot just enough to do what you want it to do
Music bots don’t need to make their own VCs (if they did you can still revoke that permission yourself if you don’t need it)
There's also another bot named "Nebula" it generally deletes all the channels (except rules) then adds multiple channels by the name of "join-trident" and megapings everyone 1k times
amazing video!❤️❤️
Sadly lot of popular discord bot are make by not so experimented develloper. And many user doesn't know how that's work behind and add so many bot with too many permissions they need.
Thanks ntts you saved my server that was going to destroy because I think that many music bots can be hacked so I removed them
Thats why i use the backup bot (i forgot the name) but if anything bad happens to your server, then just use /backup load and done your server is back
Messages are not back
@@zeda1568 if you buy the premium version they are, but I would rather lose all the messages in the server rather than all the messages and channels
Backing up server is easy, backing up all the memories is a different story.
protip: you can add the bot application to a "team" and keep access to it from another account
This got me to check the bots on my two (Currently (And possibly permanently) completely private) servers, and turned off administrator permissions to any that had them on. Two of three were music bots (Granted, both dead ones due to C&D's that I just never removed). *Why?*
The bot is also braking TH-cam's ToS, using youtube libary to bypass advertizement from music videos to stream to discord.
they responded JUST NOW they said they were gonna "learn from their mistakes" after watching your video im not gonna add their bots ever but im willing to give trusting them a chance
this is chaos, THIS IS FUCKING CHAOS
now i know why my server that ive put my blood and sweat just gone right around today... thanks dad😔😔
Thanks for the tips bby
yeah I was gonna say if you are a person on the dev team saying "it's not a big deal, just use the bot anyways", then that seems like one of the devs is purposely doing this.
Honestly, I side with the owner here. I know it's annoying but it *is* just a server at the end of the day. You can rebuild it, recreate it, hell - do whatever. I know it's annoying but so what?
Sure, it's preventable, but if I were the owner of Reverb, I'd probably care more about the account than the servers too. Just reset the token or delete the bot entirely as soon as the first report comes in.
As a server owner, you should check permissions that your bots have access to, and if you give a music bot access to admin or edit/remove channels - maybe check with the bot developers on their server first: "Hey, is this needed or is it an oversight?"
You meowed!! (Why the hell did you decide to give in due to popular demand?? We still love you though!)
Incompetent Developers, a classic.
I don’t understand why people give all the bots all permissions. Like each and every bot literally has its own separate role that you can use to give each bot what permissions they need, and then you can just have an overall bot role with no permissions. Makes perfect sense.
pretty sure the only point of the administrator perm so the bot can still join even if the channels full
No bot ever NEEDS admin power... I literally NEVER give them that
Some people give the music bot admin permissions so that it can join private offices or channels that are restricted to the everyone roles.
good rule to help avoid scams are if you dont know them dont accept the message and if it seems too good to be true assume it is
and yet its still down to day rip bot