Any hope.....T1 server DoS...anyone...anyone???

Is there ANY hope for the current T1 server DoS hack to be
fixed? I sure hope I missed some good news and SOMEONE...ANYONE is looking into fixing this. I've read about the change of ownership and all that crap....but am I to believe that this is NOONE that was involved with the development of T1 that isn't TORN UP to see such a MAJOR f*ck up in the programming and just DYING to fix it?
Anyone here old enough to remember quakeworld....cant we learn from our past?
Should I just hang up the T1? You cant play on a server form more that 1/2 hour without some dipshit crashing it.
I dont seem to see anyone concernec about this.....maybe T2 got SOOO much better since the first time I installed (and soon afterwards UNINSTALLED) it.
BAHHHHHH!!!!!
ARENT THERE ANY PROGRAMERS OUT THERE THAT CAN HELP US???!?!?

p.s. I will NOT purchase any software from a company that hides behind the "sale" of the original company to TOTALLY wash thier hands of any responsibility for thier product....when most of the same programmers are still employed there.

Post edited by ShinRamYun at 7/20/2003 10:53:09 PM

Hey shin, have not heard of any fix but i don't think all servers are getting hit by this. I know USR crashes alot but im not sure if its just because of this.

Anyways, im hoping there is a fix too.

btw shin comming up to see us in sept. Got a lot of ppl wanting to meet you.


|cTa|Maniac Mark
Captain
Canadian Tribal Assassins
irc.dynamix.com #cta

HEY MARK!!!

i had to sign up on this again just to post this thread.
this DoS attack is BS man, someone needs to fix dis shizit!!
maybe this is a good time to find a different game? what do u suggest?

i replied to your mail msg. about sep. i'm affraid it'll prolly be a last minute thing if i can go. it would be cool to meet all u damn canuks. maybe get some real molson!!

Shin

change the ports... it will atleast slow them down

Set the server up with a firewall that can handle blocking DoS specific attacks to specific ports. Wait.. windows sucks for that kind of thing.. nvm

Can anyone give me specific details? Does it affect specific server admin mods? What ports? How is the attack generated? Etc.

I have, in the past, hardened BWAdmin so that it isn't as susceptable to hack attacks, so I may be able to come up with something to help here.

If they are talking about a true Deniel of Service attack, the problem needs to be addressed not on an admin mod but on the system itself. As a DoS is where an attacker floods the system bandwidth by pinging it with multiple machines, and multiple packets, there by making the connection really really shitty.

The technical definition of DoS is doing anything at a high enough frequency such that the server CPU is too busy answering those requests that it can't deal with the legitimate ones.

A DDoS is a distributed DoS, which is what you described.

Typically, a DoS (or DDoS) is not done using pings because those can be (and typically are) filtered at the firewall. Instead, they use malformed requests on the appropriate port which take time to parse and return a "invalid request" response.

But I digress. Why is the T1 server attack a DoS attack and not some other hack? Does anyone have the code?

Timalis you really have no idea what you're talking about. First...for all of you who want to understand this exploit i suggest you read the following Edit: This contains the script...I find it fitting that no one else should have it.

With this DoS attack the user can use a packet generator or creator and make a UDP packet with how ever many characters he wants in it and then sends it to the port 28001 or any other port that tribes would be running on. As of now I would suggest getting a firewall to set access so that tribes.exe can only use ports 28000-28009 or which ever ports your tribes server runs on, also don't forget the telnet port to ezconsole, etc. By looking through the code on this exploit I would also suggest changing the default port of 280001 to another port for this exploit seems to be built around that port. Good Luck to you all.
Post edited by pathogen at 7/22/2003 1:56:27 PM

Edit: changed "leak" to "link". Oy, it's been a long day.

Thanks for the link. This is something that will have to be fixed at either the Tribes source code level or "hacked" into the .EXE (like the CRC disabler was), and I don't have the skills to do the latter nor the source code to do the former.
Post edited by Questor at 7/22/2003 1:52:20 PM

I think that there are a few ways to fix this after seeing the code of this, however I don't know if I could change the Tribes source code in order to counter this. If anyone has any coding experience with the tribes server code I'd be interested in helping out to fix this.

I'm fairly (99.9%) positive that this isn't something that you can catch in the scripting language. The network traffic is handled first in the .EXE before it is dispatched to the appropriate place.

Yes it has to do with a single packet being sent, and until we get our hands on the code, there's nothing we can do to fix it.

But this dick doesn't hit our servers anymore. I had shithead setup a web interface that caught ANY kind of traffic to our server, specifically looking for the nofix attack. When we found the person doing it, we have a program that we run on the server that completely stops whoever (you can span whatever kind of IP address) from sending anything to your server. Since we installed this the fag hasn't been able to take our server down. If you want his IP's just ask, I have no problem posting them in public seeing as how this guy is a total queer.


Post edited by sLaM at 7/22/2003 6:11:48 PM

Slam,
Can you share more with us?
I know you can block certain IP's in unix but have never looked into doing this in winblows.
It would be cool if someone posted something like this on a web site and TWL linked to it.
Shin

Get a dedicated hardware-based FW (like the one built into the Linksys routers) and it's easy to do.

Admin

Can we get a sticky thread of all class C subnets that are known to be originators of the NoFix DoS attack so that those of us who run servers can block those subnets at the router level?

I will give you what I have. Also, FSB-AO (aka stud) is making a program that will run on the server and log whenever someone uses this exploit to attack the server.

So if your server starts getting hit, you pop out, check the log and then block that IP at the router level. This isn't the best solution obviously, but there really aren't that many people who attack the servers this way. I will make sure I link the program here after FSB-AO gets done coding it. Down below are the IP's of the people who I've blocked from our servers:

12.219.161.73
65.184.132.41
66.83.177.228
67.80.152.10
67.80.188.0
63.205.129.160
63.231.89.103

Some of these are old, so I'm not sure if their IP is still the same. The last 2 IP's are VERY recent (within the last week). But I can say we haven't had a problem with this attack on our server since we banned these IP's, and with this logging program FSB-AO is making, it should really destroy the problem. FYI - I put all of these as 3 octet bans just to make sure (aka -63.205.129.xxx-)


Post edited by sLaM at 7/24/2003 3:13:10 AM

Currently our fix for this problem will be stopping any kind of UDP packetts with 255 characters. The packets will only be stopped if they're between the port range of 28001 and 28010 and of the IP of the server. However unless you have a highly configurable firewall in front of your server I highly doubt you willl be able to do this without completely screwing over your tribes server.

Just FYI, we did this on a Juniper router, with a programmable firewall type interface which gave us the ability to do this, will be testing it today.
Post edited by pathogen at 7/24/2003 6:40:04 AM

sLaM: with all due respect, I don't think you're logging will work.

What's to stop anyone from simply sending an invalid UDP packet to the server without launching Tribes? How can you log that if there isn't a valid connection established with the server so that you get the onClientConnect event fired?

Or am I all wet?

What happens if you send this to a specific client? Does it crash them only or does it cause a domino effect, causing the entire server to go down?

With no due respect, I don't think you know what you're talking about.

No offense taken, but my question is valid. If I write a C program that opens a socket, connects to a specific IP address/port, then sends a malformed UDP packet along that connection, isn't that enough to crash the server?

Or, to ask this another way: when is the onClientConnect script event fired? Is it after the TCP/IP connect() call is made? Or after any initial handshaking is done? If the latter and my first paragraph holds true, then no amount of logging will show you who crashed the server if they use that method.

Questor all you need to do is set up a simple packet sniffer on the port you're running tribes..you get it to sniff UDP packets with 255 characters and bingo you get everyones IP address who tried to DoS you.

We are not using tribes scripts, for obvious reasons. At the moment, we have 2 options.

One of them is to just sniff packets, and log those that meet certain criteria. The other is something Justin was telling me about, and thats trapping the winsock calls to receive.

And don't listen to pathogen. He is an idiot. We have purposely misdirected him, as a joke.

Thats why everything I have said magically works perfectly gee what a concidence...The packet sniffer actually shows us the nofix attack and the firewall really does actually block the nofix...damn i was really misdirected especially since I hadn't used anything you said.
Post edited by pathogen at 7/24/2003 8:28:25 PM

I appreciate all the discussion from this thread.
Can someone post simple instructions on how to do anything suggested here or is it just not simple to do?
Shin

hey shin is that you from -RaGe- cuz if so wuzzup lonmg time no see! and do u even play anymore lol?

BUSH!!!
how ya doing bra?
ya, its me...long tme no talk.
things are ok here....what r u up to?

He's into Dos Hackin'

who's 'he'?

you know something we don't?

I don't get this 255 character stuff. I can crash a server with a very small packet (2 characters of data). I talked to the homelan guys about this, but they didnt have a fix. And no I won't give it out.

Can someone talk to CeilingFan about Heaven/Hell? All he needs to do is block the class C subnets at the router.

Last night, some idiot took down Heaven over 15 times in 30 minutes. It got so damned annoying that I went to bed...




...what? Did you really think I was going to USR?
Post edited by Questor at 8/4/2003 8:53:19 AM

[quote="Questor]
...what? Did you really think I was going to USR?
USR gets taken down more than heaven/hell.. that and on USR you lag every 10 mins no matter what. :/

No, that's TTS.

Anyone else completly lost?
Post edited by DieonySuS at 8/4/2003 8:13:37 PM


Mav- yea ill take being a fat friendless geek over that, anyday

USR = United States Rangers
TTS = Tennessee Tribes Server

Both are sucky Tribes servers that masquerade as good ones.

Gee.. makes me proud of running TTS

Yeah, when you guys figure out the solution, let me know

Nm wit me eeither lots of work and stuff to keep me busy but im okay.... u still eating that shinyanrum soup lol... i hope u can get ur server running better...if u ask me just host ur server from ur comp and alt+tab down to leaeve it running then ur always on and always in lol... hope things are good for u...we need to go duel or something or ill just go find u in ur sever so take care and ill search for u in tribes or just bs wit u in the forums... cool im oput........ Ambush or u can just call me Bush!

Originally posted by: SuckyJason
Sup quest of qed fame.

Hi. And hardly fame. I have to be the longest playing person who's never played in a competing clan for more than 2 months. [Sigh]

Anyone want a better than average all-around player for 5v?

Originally posted by: BoguS
Gee.. makes me proud of running TTS

Yeah, when you guys figure out the solution, let me know

OMG! TTS has an owner!

I'll almost guarantee you that I'll find the problem if you can get me RDS access to the server (assuming it's on Windoze and not Linux). But I'm not expecting you to (even if you could) nor do I blame you.

If you're interested in finding out whether or not I'm a trustworthy individual, let me know. (BTW, I've run up to 5 dedicated Tribes servers simultaneously before so I'm not a total n00b regarding this. However, I seriously doubt that the issue is with Tribes.)

any luck yet?