Author Topic: Mentius (Read 5170 times)

|iR|Focalor · « **on:** July 03, 2009, 11:31:56 AM »

Caught a botter on vanilla a minute ago. The first time I ran into him, I knew some shit was going on. He had a machinegun on me and didn't miss with one single bullet even though I was strafing all over the place. He thinks he's being smart by mainly using grenades and shotguns, but it's still pretty obvious with a few shots using those weapons. He's got the FOV low enough to where the bot won't target unless he's aiming close enough. The second demo is much more obvious when he finally uses the machinegun again.

In demo 2, pay especially close attention to frags 9, 13, 20, and 21.

ReCycled · « **Reply #1 on:** July 03, 2009, 11:33:14 AM »

Named Mentius. Recorded around 2:15 PM EST today on Vanilla. He had been there for a while before I connected so people were already pointing him out. His general movement was a bit choppy too, kind of like packet loss, but he pinged 50. Some of his shots were funny. He's climbing up the ladder and then shoots a rocket at the wall halfway up, taking damage.

ReCycled · « **Reply #2 on:** July 03, 2009, 11:34:26 AM »

Christ you're fast. I was posting at the same time about him.

|iR|Focalor · « **Reply #3 on:** July 03, 2009, 11:42:58 AM »

I'm using forum speedhax.

console · « **Reply #4 on:** July 03, 2009, 05:28:50 PM »

Thanks for the demos! I merged the two topics...

His IP is annoyingly dynamic:

Code: [Select]

|playername| server|           ip|                           hostname|         first_seen|   last_seen|times_seen
|   Mentius|  whale|  68.32.5.158|  c-68-32-5-158.hsd1.nj.comcast.net|2008-05-11 14:54:41|418 days ago|         1
|   Mentius|  wod-x|  68.32.5.158|  c-68-32-5-158.hsd1.nj.comcast.net|2008-05-11 14:55:37|418 days ago|         1
|   Mentius|  whale|  68.45.79.16|  c-68-45-79-16.hsd1.nj.comcast.net|2009-06-16 01:18:38| 17 days ago|         7
|   Mentius|vanilla|68.37.212.221|c-68-37-212-221.hsd1.nj.comcast.net|2009-07-03 16:59:41| 4 hours ago|         8

Kinda hard to encapsulate that in a subnet......

Well, it looks like.... in hex, they are all constant in the top 12 bits:

44200000
442d0000
44250000

Alright, I'll force AC with a 12-bit netmask.

Thanks,

ReCycled · « **Reply #5 on:** July 03, 2009, 05:51:44 PM »

Was bot-protection off and he snuck in?

console · « **Reply #6 on:** July 03, 2009, 06:11:25 PM »

Quote from: ReCycled on July 03, 2009, 05:51:44 PM

Was bot-protection off and he snuck in?

Uh... i hate to be the bearer of unpleasant news, but there's no such thing as bot-protection.

There is auto-detection of some very ancient hax. But any "scans" can be coded around.

Regards,

|iR|Focalor · « **Reply #7 on:** July 03, 2009, 11:28:14 PM »

From what I can tell, any time a client connects (using an older bot or one that's set up poorly), the server runs a script to each connection that would cause the client to reconnect if it were using some type of extra config for the proxy bot, effectively causing the person to disconnect and reconnect until they got fed up and quit. There are newer "reconnect-proof" bots out there, but the minute an admin runs the ratbot kick, it would list the bot program (MZ EXEC ratbot.exe). Perhaps they could keep the bot program in an alternate location so that a scan wouldn't find it (not sure), but the scan would still probably locate the bots config file. Even if THAT doesn't work, the ratbot kick would still cause the client to disconnect and reconnect at least once, effectively giving them away. I'd assume this guy was probably using that particular type of modified ratbot.

Most would-be cheaters are too stupid to figure out how to work around things. Even if they are smart enough to get away with it, there's still quite a few of us who are smart enough to spot them a mile away.

The moral of the story: only a fool thinks there is a fool-proof way to cheat without being caught, so play legit and quit wasting your time.

console · « **Reply #8 on:** July 03, 2009, 11:53:34 PM »

Quote from: |iR|Focalor on July 03, 2009, 11:28:14 PM

From what I can tell, any time a client connects (using an older bot or one that's set up poorly), the server runs a script to each connection that would cause the client to reconnect if it were using some type of extra config for the proxy bot, effectively causing the person to disconnect and reconnect until they got fed up and quit. There are newer "reconnect-proof" bots out there, but the minute an admin runs the ratbot kick, it would disconnect and reconnect again, effectively giving them away. I'd assume this guy was probably using that particular type of modified ratbot.

Honestly this is a surprisingly accurate assessment--to a point--and probably about as accurate as could be imagined without an understanding of how the Q2 protocol works.

To back up a bit, we frequently get accusations of things that are basically impossible given the Q2 protocol. For example, "i shot this guy and he didn't die, he must have armor hax!"

Knowing how the Q2 protocol works, divides the spectrum of potential hax into a couple categories: those possible on client side (aimbot, wallhack) , and those impossible on server-side--excepting a bug-which-could-be-fixed--like armor hax, jump hax, health hax, etc.

To clarify, between client and server there is a small conduit of information. Servers aren't magic, so they essentially 'believe' what the client is telling them. So a good game protocol will strive to limit the bandwidth of information from the client that has an effect on server-side decisions about the game state. To that end, in Quake II, the protocol basically says, (from the client) ... "i was facing this direction, and i had these buttons pressed".

The server says, ok, you say you were facing this direction and you had these buttons pressed at this time, so... I will incorporate that into the game state and... I (the server) will decide whether your buttons caused a weapon to fire, and btw, I will decide whether someone else's weapon impacted at your location.

....

er..

brb

|iR|Focalor · « **Reply #9 on:** July 04, 2009, 03:13:07 AM »

Quote from: console on July 03, 2009, 11:53:34 PM

brb

I miss "regards" already.

Do continue though.

console · « **Reply #10 on:** July 04, 2009, 02:45:41 PM »

Hmm... I guess what I was trying to illustrate is that ultimately, server-side bot scans are fundamentally limited, because all the server can really do is ask the client some questions, and observe its answers. But a hacked client is free to lie when answering any questions asked by the server, and there is no way for the server to tell if the client is lying.

So... our scans can catch some old versions of ratbot or frkq2, for instance, because those old hax were not yet smart enough to lie convincingly and cover their tracks.

r1ch's anticheat is a step up, since it actually runs on the client, and as such raises the bar in that it increases the difficulty level of making a hacked client be able to cover its tracks and hide itself. (It's more challenging to lie to anticheat than it is to lie to the server.)

Hmm... anyway....

In conclusion, cheaters are

Regards,

quadz

splisskin · « **Reply #11 on:** July 06, 2009, 02:45:28 PM »

This guy must be close to me! I have to use anticheat now in railz server.
No big deal but it feels like a rubberband is attached to me when I run? wierd

Whirlingdervish · « **Reply #12 on:** July 06, 2009, 02:51:47 PM »

splis, what client?

you might need to set cl_async 0 to get it to feel like stock q2, if it's r1q2..

splisskin · « **Reply #13 on:** July 06, 2009, 08:11:15 PM »

r1q2 with r1gl but no anticheat for awhile because of that wierd rubberband thing! no big deal asynch is off anticheat is on now
if the rubberband thing is the only thing I have to worry about its all good!

Author Topic: Mentius (Read 5170 times)

El Box de Shoutamente