Server Crash Exploit for Quake 3 Engine Games (including ET)

An exploit was found recently in Quake 3 engine games (like ET), which a remote user can send an invalid network message to a server and crash it instantly.

There are a couple of fixes available, and I will outline them here:

1) (recommended) bani has released a new ettv server binary that fixes the problem. I have added it to our file repository HERE. The ETTv binary can be used interchangeably with the normal etded.x86 or etded.exe file (depending on your platform), and you get the added bonus of having your server enabled to host an ETTv match (as the actual match server, not as a slave).

2) in the BugTraq listing, there is a patch to run on your original server binary.

If you are renting your server from a hosting company and you do not have shell access, I'd highly recommend you get in contact with them, and point them to this post, so that they can make the fix ASAP.

Finally, anyone caught intentionally crashing someone else's server, public or private, will receive a liberal beating with the ban stick. (crashing other peoples' network service is not only mean, its illegal)

Durinia
ET Competition Manager - ET Ladders & ET Fortress

D forgot to mention.
If you see or know anyone who does this. Do the right thing and rat them out.
(paraphrased from banis site)

Id like to add. This should be considered a serious offence just like cheating. Doing such on personal or private servers is a great way to get banned.

So is it just me or are all the zips on the bugtraq site just linking to the spanish site hosting them and not actually allowing me to download them?

[edit] on the contrary, I cannot read and just now realized the other option. Worked without a hitch, thanks for the headsup.
Post edited by ep1taph at 2/23/2005 4:40:30 PM

Apparently a player by the name of Assassinxx has been claiming he and his little 1337 nubs are responsible for this and i have seen him on Pink Taco bar, where i play a lot and their servers have been recently crashing randomly, they also think that he is the one doing it, i do not give a fuck to rat him out, people like him need to go imo, good luck fixing this all up.

Edit: i did a search randomly on xfire and found a guy named Tim Tsai with the name assassinxx, i also got his ip off of vent: 69.182.59.164. But i believe he has a rotating ip, i hope this will help in finding and stopping him

Post edited by Bill@Bong- at 2/23/2005 6:55:44 PM

I'll rat out


A person under the name (B.R)Dark in our server threatened to crash our server for spawn camping him and calling him a fag. So of course, thinking he was joking...we called him a fag again, which of course a minute or two later our server crashed with the string error in the server console.

Same shit happened for quite some time and we had to move our server to a different ip, and finally found this and fixed the problem

the name in server was (B.R)Dark, but there is a (B.R)Dark_x here on twl http://www.teamwarfare.com/viewplayer.asp?player=Dark%5FX

may or may not be the same guy

but either way, keep an eye on him

of course not much can be done, as one of our admins tried fixing some lag on our server by deleting the server log (which was 200 some meg at the time). But then again, w/o the server log I can't do anything about it but I sure as hell can post his name here
Post edited by <DS>Bill Nye at 2/23/2005 7:45:55 PM

I appreciate the help, although - to curb public flamewars and bitterness, please direct info you have to me or Skeeve via IRC or e-mail (durinia@teamwarfare.com)


Durinia
ET Competition Manager - ET Ladders & ET Fortress

redman sighting
__________________________________________________

#team-commies
http://irc.gamesurge.net

maybe if you would respond via irc lol durinia

Durina check your email plz =))

Originally posted by: ep1taph
So is it just me or are all the zips on the bugtraq site just linking to the spanish site hosting them and not actually allowing me to download them?

[edit] on the contrary, I cannot read and just now realized the other option. Worked without a hitch, thanks for the headsup.

the site doesn't seem to like direct linking. Copy/pasting the link into a new browser window, or going to http://aluigi.altervista.org/ and navigating to the mentioned files should do the trick. HOWEVER, I would STRONGLY recommend using the updated ettv instead. The binary patch may have unforseen side effects, while the ettv update corrects some other annoying bugs, and makes your server ettv ready.

A third option is to firewall the offending packets.

no, leave it on, that way, if we are losing, we can crash the server, and screw with our demos to make it look like we were winning!

(B.R)Dark and (B.R)Machine were on and crashed my server as well. But I have an alias tracker, and guid logger...if anyone wants thier info please let me know.

please give that info to durina


I am eager to see these assclowns get the boot

Yes this evening around 11:45 pm eastern time B.R machine and B.R. Dark were on our server and said to our player to stfu or they would "I'll shut the server down if you dont move out of my way". He disconnected and then our server went down. These pigs need shutdown and shutdown fast. Also banned from TWL in my opinion. This (as I have found out) is illegal,it is no different that breaking and entering.
Shadow >Post edited by Tussey at 2/27/2005 8:52:39 AM

Ya both the BR guys and Assissian are the ones behind it they have said as much on my server before. They play in CAL so maybe twl and cal can ban them all. They have crashed my private server while a twl match was in progress.

People like this have no place in the ET community

I really would suggest if you have not already, then please use the ettv fix or the other fix. I really think it should be up to splashdamage to correct this problem, but things don't always happen like they should. I have banned these people off our servers and am in the process of trying to get them added to the punksbusted mbl. I can promise you though if there are two out there doing this that are known about, there are even more that have not been caught yet. So keep an open eye, and try and keep people informed that way we can avoid this in the future.

i just saw this thread now and i know what bill@bong is talking about...i seen this guy at Pink Taco Bar also....i think hes on my xfire...not too sure, he has a rotating Cable IP though...do an IP range on http://www.arin.net/whois

Just a heads-up to all of you - we tracked down these guys, and, in conjunction with CAL, issued them penalties and a stern warning that what they're doing could get them in big trouble.

I hope they stop. If they don't, I would recommend that server admins keep logs of evidence against these guys, and contact their ISP.

Durinia
ET Competition Manager - ET Ladders & ET Fortress

\o/

Though I don't think going to their ISP immediately would have been out of the question.

well, telling their ISP that this person is doing something illegal and with malice... that should get their attention. I don't even know why TWL or CAL would tolerate anyone doing this. Im all for a perma-ban and kline.
Its just like a hack, once you have one or know how or where to get one, you WILL use it, and when you do, you are a cheater and cheaters get banned.

They are still at it. Knocked down both our servers last night.
Post edited by .Riff Raff. at 3/3/2005 12:02:20 AM

I have all ready reported one of them to thier ISP. I have yet to hear back from them at this time though.

I agree with johnny, a perma-ban should be implemented, crashing servers is at least as bad as using hax during a match, they're disrupting the ET community and looks like possibly disrupting matches too

on 2/19/05 we (|ABC|) recruited a guy who was from the ND80 clan named crash, this guy is also in a clan called BackRage or the B.R. clan. Thought it was strange that someone who was already in CAL and TWL would want to be in our "noob clan" as we are pretty new on the circuit. But he said he wanted to share info w/us to help us be able to compete in tournaments... reluctantly I agreed to let him join.
The next day about 5 min. after he showed up in Vent. Some guy connects to our vent server and he has in his Pheonetic Name ( /<>/<>/<>/<>/<>/<>/<>/<>/<>/<>/<>/<>/<> ) it seemed to go on forever and I imediately went to the lobby where this guy was ...his name was Dark....I asked him who he was and what he was doing in our private server he said he followed his freind Bones aka: ND80 Cr@sh through XFire. So I went to the other channel to question Bones about this Dark guy when all of a sudden multiple users started connecting with the same /<>/<> stuff in their pheonetic. The lobby filled up faster than we could kick/ban people out. One of the other names of users in our lobby of ventrilo was AssAsin.
So we as a clan (band of brothers) started our investigation into this matter. One thing I forgot to mention is this guy Bones asked us why we banned his cousin
a guy who plays by the name of n3on also in the B.R. clan
I told him because one the guy was an A-hole he came in and started all kinds of crap with our admins we thoroughly suspected him of hacking he had unbelievable amount of headshots and kills. The guy Dark's real name is Cody Campbell. As we read it on the Backrage website. They also had ... a section of people they hate and listed |ABC| saying we ban everyone that is better than us. and calling us names. on their website (real classy)
Well anyway after they crashed our Ventrilo server with this exploit of connecting multiple users. They proceded to crash our shrub server which was full at the time, they continued to crash the game server about every 5 min. for the rest of the night. The next day I found out one of my clannies had went to the B.R. vent server which accually was someone elses server they were using. These guys said they wanted my friend |ABC| DrFong to appoligize to n3on for banning him and for us to unban him from our server. get this Appoligize to him for accusing him of hacking ..... after he just hacked our game server and talk server...kinda funny I thought. Well we were'nt about to bow down to anybody. So we fixed the problem and put a password on our vent server. and We were prepared for their threat that if this appoligy was not met they would crash our server again in a week.

I think these guys should be banned permenantly from being able to play this game or any punkbuster games. Is'nt hacking a federal offence. I mean we pay over 100.00 a month for our server and spend lots of time creating a likable invironment for our public. And these guys can just come in and totally (F) it all up . Don't you all agree they should'nt have the right to even play this game anymore?
|ABC| -D- ...|ABC| Clan Founder

Well I didnt know how involved crash was in this but he is a former clan member of mine and although we never had a problem I do have screen shots of him admitting to crashing my server and I also have a post in my forums where he says quote "i know how to crash them now lol let me know if u dont like someone !!!!!!"

http://www.darkrangers.com/phpbb/viewtopic.php?t=1508

Broken Bones and Crash are the same person crash is a match player for ND80 in TWL.

Originally posted by: NeO*Mario
I agree with johnny, a perma-ban should be implemented, crashing servers is at least as bad as using hax during a match, they're disrupting the ET community and looks like possibly disrupting matches too

Because they obviously ignored the warnings they got, they've been banned permanantly. It was my hope to convince them to stop their rampant ass-hattery, but I guess in this case its just inbred too deep.

I don't have any servers for them to crash, but with all the input I've received, I contacted their ISPs myself with collected community information. This should not stop you from making your own complaints, though.


Post edited by Durinia at 3/4/2005 10:26:50 AM


Durinia
ET Competition Manager - ET Ladders & ET Fortress

will you be releasing home addresses and phone numbers?

ive got personal information on a few of the people that were crashing servers, but im sure it would be illegal in some form or fasion for me to give that personal information out... *tear*

but yes perma ban them all... stupid "leet hax0rs" as a few of them were calling themselves... lolz0rz

oh and bones goes by cr4sh playing for nd80's roster, im suprised hes still on there considering nd80 seems to be always for the et community and cr4sh is somewhat the opposite

Crash is still in ND80 and on the rooster

his name with ND80 look like this cr4sh

kinda like metal from minus addition now in etf excel? ya still havent seen anything done about that one either... gg

what does it matter et is a free download .they will get a new guid and ip addy and be rite back on as some other a$$hat name doing the same crap.it never ends . and as far as what there doing the program there using is found on the hax site so if there using it you can be quite sure they dl'd a hax or 2 while there . ..............................remember for every haxer caught there is 3 laughing that they didnt. wish someone would make a fake hax that broadcast there name and ip on every pb server instead of being a multi hack like they think they got.that would be halariouse .just an idea to all you programers/haxers jk maybe :/

Originally posted by: -Killswitch-
what does it matter et is a free download .they will get a new guid and ip addy and be rite back

That's why you make an abuse report to their ISP. Most likely mommy and daddy won't be too pleased when their internet is shut down for TOS violations.

Is it possible that someone could compile the Linux version of the patcher and post a link in here?

A guy named Tachikoma (>) was kicked off of GSET Clan Server (204.157.0.105:27960) for some unknown reason, a couple of minutes later the round ended and his buds (Sylver (>), and Zerg (>) said that they shouldn't have kicked him and the server is gonna crash and seconds later it did
just lettin ya know
Dave

Originally posted by: s0dap0p
ive got personal information on a few of the people that were crashing servers, but im sure it would be illegal in some form or fasion for me to give that personal information out... *tear*

but yes perma ban them all... stupid "leet hax0rs" as a few of them were calling themselves... lolz0rz

There is nothing wrong with posting people's information online, as long as you got it legitimatly and what you are posting is public information (ie. Name, address, phone number). Websites that track down pedophiles post their chat logs online all the time, and their forums are dedicated to finding and posting personal information.

Now, if someone on here decides to do something stupid with that information, that is all up to the individual. Just don't do anything stupid, infer that anyone should do anything stupid, or support people doing stupid shit and you will be fine.

Oh and I would be damn sure positive that the info I was giving out was correct, and was indeed the people that have caused this havoc...
Post edited by {Dev}BigTruck at 3/10/2005 2:14:48 AM

Hi.
About the crashed, I was really involved in it.
I was hosting DR on our vent because they got banned out of their original vent by oD, because they crashed their servers. I was temporally hosting them while fixing all this stuff. While they were on our server, they (Assassin and some other guys) were talking about crashing servers. People gave Assassin (aka Vanity, aka Spaz, founder of Team Acceleration and now member of DR) the IP to crash, so they could know if that was true. Just to make sure he didn't look like a liar, he crashed the servers. I then told him I would ban him out of vent if he kept doing that, and I would avertise ND80 and TWL Staff so you guys could ban him out. He started threatening me about crashing ND80 servers.
I personally don't care about what he thinks he is able to do, but he's just being stupid by crashing those servers due to an exploit. Now that people know it's him, and now that he saw the post on Bani forums, he started crashing servers of people he didn't like. I set up a scrim between Team Silence and DR, and Assassin was talking shit in the server. Team Silence then kicked him out of the server... the others DR members said: AH, you guys are screw, he will crash your server. 2 minutes later the server was down.
I told him to leave ventrilo, him and the clan he played for (DR). I shouldve banned him, cuz he came back flooding the vent on and on with multiple clients (probably winsock connection made with Visual Basic, if we take a look at his desktop screenshot). I then banned them out when I caugh them at time. Judging by the IP someone gave in this thread, he's using a DSL connection so YES, he doesnt have the same IP everytime he reconnects to his ISP.

I was there while they were talking about crashing servers and stuff like that, and he's just acting like a kid who's dreaming of being the best because he has a kind of "power" in his hand. I can tell.

I don't know about Crash, I know he played for them in CAL and he plays in ND80 for TWL. I never heard of him involved in crashing servers.
I will give him a word on that, if any of you caugh him involved in crashing servers, let me know he will get kicked out of the clan, and will be banned of ND80 servers.

If you need any other informations, contact me.
You can find me on IRC Gamesurge: #nd80et as BG`

Hope this can help. I also posted on Bani Forums.

ive never heard of crash bein involved in it. (alos its BR=backrage) =P

I personally dont know how to crash the servers but i do have the program. Some of my buddies from br did have it and sent it to me. They were tryin to teach me how to do a little programming but im not computer ilitterate.lol and if anyone gets my personally info and wants to come see me so be it cause i guarantee i can defend my self. i live in the country and some would consider me a red neck so i have my shot gun hanging on my gun rack in the back of my truck.

to the abc clan... i was still goin to help your clan but i felt unwanted because this all happened. I figured sense i was friends with them u all would blame me when i did nothing wrong. n3on aka. b.woods is my cousin. he is one of the best trick jumpers for et too. i hate how some people just jump to conclusion because someone is good at a game. it is totally bs that people have to suffer because a few cheat. do u think it could ever cross your mind someone might accually be better at a game then u. its ok if u dont like experienced players on your server and if so just tell them to leave. its not our fault you want to be sucluded from the rest of the et community. in my oppion if u dont like good players then u can go and have your noob community to yourself. also i hate how some people pose as your friends cough cough "dr" and talk crap about u behind your back.i have been nothin but a friend to all of u and look how i get treated. guess everyone want to stab everyone in the back to look good for twl. this is y i hate compatition.