Hacker Plugin Edit
What are Hacker Plugins? Edit
Hacker Plugins are Plugins that look peacefully (like a little, peaceful MotdManager or AntiCheat Plugin) but can give Players op when they write e.g. #opme or such stuff in the chat. These messages are getting blocked by this Plugin then and this Plugin gives the Player then Operator Mode.
How can I detect such Plugins? Edit
These Plugins often are pretty oversized because they have many classes with code that doesn't even get runned. Plugins that are uploaded at Bukkit Dev or Spigot usually are getting checked for such code. So if you download it there you don't really don't need to worry about such thing. If the Moderators or Admins made a mistake and approved a Hacker Plugin make sure to report that Plugin so it gets removed ASAP and no other Owners are getting trapped into it.
How can I protect myself against such Plugins? Edit
So if a Developer that is not long in your Server Team or you don't really know sends you a Plugin, decompile with e.g. JD-GUI (http://jd.benow.ca/) and check it for such code. Also make sure you make daily backups of your server. Most of the Server Hosters are doing that automatically but ask your hoster, if you have one, about that or how you can make backups. Because if you have daily backups Hacker cannot do a shit to your server.
How can I find such Plugin if I've installed one? Edit
If you installed such plugin, your server got hacked and you don't know what Plugin it was, make sure to put your server in maintance mode as long as that isn't fixed so no other players can hack it again. If you have any Logger Plugin installed which logs everything, try to find proof in there. Then search about every Plugin you've installed on your server and if there any other hack / grief cases known. If you cannot find any result about that, use JD-GUI or any other Java Decompiler and decompile all Plugins you've installed. Try to start with the biggest Plugins because as I said earlier Hacker Plugins usually contain unused code which makes them bigger. If you finally found the hacker plugin make sure to report the Plugin on Bukkit Dev or Spigot or if it got coded by a Developer ban him from your server.
Closing Remark: Edit
I hope I could help you out with this article and you are going to think twice about choosing a Developer or a Plugin.
~TASSIA710 / DeCraiz