New Cheat/Hack for Enemy Territory

(superdug) #1

Hello, I am an admin for one of the more popular et servers and recently we were experiencing a little bit of a problem with every user disconnecting with the server message of “Illegible Message 0”

I hate cheaters/wanna be hackers as much as the next guy, but I am almost 100% sure that what we were experiencing at our server.

The hack involves using a bufferoverflow in the sound system.

I believe after looking at the ET source code this may be the offending section.


===============
CG_SoundLoadSoundFiles
===============
*/
extern char bigTextBuffer[100000];    // we got it anyway, might as well use it

This is from \WET_Source\src\cgame\cg_sound.c

To be a little more indepth with how this stupid hack works.

A bind for a vsay is made, this vsay howerever seems to be larger than the buffer will allow and causing an immediate disconnect from all users connected to the server.

I’d like to not actually post the actual exploit here in the forums.

I have a few ideas on a fix …

1.) Have an error checking call in the code making sure that either the call is not too large for the buffer OR ensure that the vsay call is for a valid call.

2.) Censor out and Vsay’s that are part of the actual allowed vsays.

Anyone else experieincing this problem or have an idea to make it stop?

SuperDuG

(Deprave) #2

Hey mang thats pretty interesting i think we should investigate further mang for sure mang how bout a patch gimme a patch

(Deprave) #3

my balls itch

(bubba g) #4

Hi there,

I posted a topic earlier today ‘Server Exploit’ sometning or other, for this exact problem. And yes, it was ‘Rebel Train’ causing the problem. Look at his name closely, you will notice some very ‘odd’ things about it. I have emailed another server to try and get his IP, as I intend to contact his ISP and see what they think.

If you could provide his IP it would be most helpful!

P.S. Look out for this guy - full name ‘Rebel Train (FH’

And I think the other name is just an alias he uses…

(Abnix) #5

Bubba G, here’s the information you requested:

1254:44ConnectInfo: 39: 89274264721075E9360C6EC8307BF667: ^1Rebel ^2Train ^7^8(^5FH^9^8): 3: 0: 24.207.213.161:27960

(Abnix) #6

ack, hate smilies

(bubba g) #7

Thanks abnix!

(bubba g) #8

Question though - is that his IP at the end or the IP of your server???

(superdug) #9

Bubba - that’s HIS Ip not the IP of the server. Abnix is the owner of the server that I admin on, so that is definantelly valid information.

(Sauron|EFG) #10

ARIN whois search results

(bubba g) #11

Thanks guys, I will track down his ISP and see what they think of his activities

(Sambie) #12

Bubba, Have you found his ISP yet? please give us some updates.

(bubba g) #13

Charter Communications - an American ISP - I am having difficluty contacting them though as you need to enter a zip code to contact

(bubba g) #14

It’s done - reported - waiting for a reply

(bubba g) #15

Hmmm, just thought - wonder who Sambie is? I was telling the guy earlier (came on again and crashed the server) I was going to report him, he didn’t believe me, and I told him to look here…

(SCDS_reyalP) #16

abuse@whateverisp.com

is usually a good place to start. The complaint should come from the server operator / owner, with logs and ips.

Performing DOS attacks (such as causing the server to boot everyone) is a violation of almost all ISPs TOS. Also, if the server is hosted by a for-profit hosting company, the hosting company could reasonably claim that DOSing their computers causes them damage, thus subjecting the perpitrator to http://www4.law.cornell.edu/uscode/18/1030.html as well as various state laws. See also
http://www.cybercrime.gov/cclaws.html
and
http://www.ncsl.org/programs/lis/cip/computercrimes.htm

Returning to a server after you are banned is ‘unauthorized access’ which is all that is required under many ‘hacking’ laws.

While law enforcement isn’t likely to be interested in such a small issue, it should encourage the ISP to shut the trouble maker down.

FWIW, I seem to remember a bug like this being mentioned in the change list for the latest ETPro. If the server isn’t running etpro, it might be time to switch. If the exploit does work in etpro, I’m sure bani would want to hear about it.

(Sambie) #17

bubba g, Im not anybody special. Im just a player that plays on Abnix and Superdugs server. I was also experiencing the problem that has been found, as the newest hack/cheat that Superdug had mention about.

PS, if you visit Abnix website and join his server you can learn more about me, and how i play :slight_smile:

(turk2000) #18

yes, on Nexus server is happened that a lot of time.
Hackers always lie in wait… :suspicious:

(bubba g) #19

Hi Sambie,

Sorry about that, just seemed a coincedence.

SCDS_reyalP & Sauron|EFG thanks for the useful information - has helped greatly.

And turk2000, this is the guy causing the problem on at least one of the nexus severs - were I play most of the time.

(superdug) #20

Getting the guy is not anywhere near fixing the BIG problem. Would anyone from Splash care to comment on a fix for this bug or do we have to fix it ourselves?