Author Topic: Coders Please Read... (Read 6289 times)

Arm0r · « **on:** January 03, 2009, 03:19:36 PM »

Well I play Wolfenstein : Enemy Territory and am an admin on my clan server....we have some pretty knowledgable people there, but today we came across a hacker we don't know how to combat--he has over 2000 ips to choose from supposedly all on different subnets. I banned this prick 208 times today, he writes hacks+viruses so he says....my question is, how do I combat this type of hacker? He is obviously more advanced than I can handle, so I figured id ask the people here with a history of coding. ANY HELP is much appriciated. thanks guys.

console · « **Reply #1 on:** January 03, 2009, 03:41:30 PM »

Quote from: Arm0r on January 03, 2009, 03:19:36 PM

today we came across a hacker we don't know how to combat--he has over 2000 ips to choose from supposedly all on different subnets. I banned this prick 208 times today.

Can you list these 208 IPs so we can learn more about how they relate? (If you don't want to post them here, you could PM me.)

Regards,

Arm0r · « **Reply #2 on:** January 03, 2009, 03:45:18 PM »

Quote from: console on January 03, 2009, 03:41:30 PM

Quote from: Arm0r on January 03, 2009, 03:19:36 PM
today we came across a hacker we don't know how to combat--he has over 2000 ips to choose from supposedly all on different subnets. I banned this prick 208 times today.

Can you list these 208 IPs so we can learn more about how they relate? (If you don't want to post them here, you could PM me.)

Regards,

im sure I can get you all the info you need, just need to go pull up the ban logs n such and check em out--let me go look into that.

Arm0r · « **Reply #3 on:** January 03, 2009, 04:29:42 PM »

well wtf....all his locations were from sweden to from downtown cleveland...and all the IP's just registered as all 0's..who the hell is this guy

console · « **Reply #4 on:** January 03, 2009, 04:36:17 PM »

Quote from: Arm0r on January 03, 2009, 04:29:42 PM

all his locations were from sweden to from downtown cleveland...and all the IP's just registered as all 0's

Uh... How were these locations determined without the IPs ?

And to clarify - this person is connecting to your game server? Or to your clan website?

Regards,

Arm0r · « **Reply #5 on:** January 03, 2009, 05:02:43 PM »

Quote from: console on January 03, 2009, 04:36:17 PM

Quote from: Arm0r on January 03, 2009, 04:29:42 PM
all his locations were from sweden to from downtown cleveland...and all the IP's just registered as all 0's

Uh... How were these locations determined without the IPs ?

And to clarify - this person is connecting to your game server? Or to your clan website?

Regards,

game server, it's weird because it says a different location--but next to the location it just shows 00.000.000.000 as the IP used....on the server we don't ban IP's by typing them, you just do !ban and the user ID of the player.

console · « **Reply #6 on:** January 03, 2009, 05:10:15 PM »

Quote from: Arm0r on January 03, 2009, 05:02:43 PM

game server, it's weird because it says a different location--but next to the location it just shows 00.000.000.000 as the IP used....on the server we don't ban IP's by typing them, you just do !ban and the user ID of the player.

Hmm. Well do you have the raw logfiles that might show the connect IP for this player?

Arm0r · « **Reply #7 on:** January 03, 2009, 05:12:37 PM »

im waiting on the full raw log file, im not a top admin so I don't have access to em just yet--but webmaster/server provider told me he would send the full unedited logs to me in my inbox--ill def post them when I get em. Just never knew people could do stuff like this really, I dunno what it is but I was told he is "mac spoofing" whatever that means.

console · « **Reply #8 on:** January 03, 2009, 05:32:56 PM »

Quote from: Arm0r on January 03, 2009, 05:12:37 PM

I was told he is "mac spoofing" whatever that means.

Some ISP's have extremely dynamic IP ranges. (comcast for example.)

Many consumer routers allow a MAC address override option in their menus.

Changing the MAC address and renewing your DHCP lease can cause you to be issued a new IP.

But if that is all he is doing, all his IPs will still be on the same host. (Which is why we use hostmask-based banning at tastyspleen.)

Regards,

console · « **Reply #9 on:** January 04, 2009, 12:11:55 AM »

BTW, the

was directed at the "mac spoofer", not at you.

I'm still curious as to how or why you were seeing locations like "sweden to downtown cleveland" ... as that doesn't fit the profile of a simple "mac spoofer".

Regards,

R1CH · « **Reply #10 on:** January 05, 2009, 07:48:37 AM »

If they aren't all on one ISP it's likely there is a bug in the admin mod or engine that allows a fake IP to be sent to the server. Q2 and Q3 had the same problems.

reaper · « **Reply #11 on:** January 05, 2009, 10:36:43 AM »

yeah I highly doubt he's really coming from that many ip's!

Arm0r · « **Reply #12 on:** January 05, 2009, 11:50:24 AM »

Ya, im having alot of trouble still....im trying to get Rel!c (my clan leader) to be more co-operative with me but him being who pays for the server and forums, he is sketchy on all this stuff...like giving me info, or anyone for that reason--would you guys mind if I had him come on the forums and make a account? Possibly even get him interested in Quake 2 while im at it, but I did my reading up on mac spoofing......and like you said, no way it's a mac spoof--this guy would get banned and it would be treated as if he were kicked...just reloads right back up.

He made all these claims last night as well, DDoS threat being within those claims.

fanny · « **Reply #13 on:** January 05, 2009, 05:20:11 PM »

Doesnt W:ET have Punkbuster, if so you could ban on the GUID his client generates or his CD key. Hackable? probably, but much more work the IP changes / spoofing.

Just a thought???

X'tyfe · « **Reply #14 on:** January 05, 2009, 05:43:39 PM »

What an interesting situation, this guy is obviously skilled. That or there is a major security hole in W:ET :p
If he's going through all this trouble, whats he getting out of it.

Author Topic: Coders Please Read... (Read 6289 times)

fanny

El Box de Shoutamente