Deliberately Crashing Servers

[haunted]

you are definitely an ass hat, I agree.

[QwazyWabbit]

So I try to hop on the server to get my railz fix and BOOM D-E-N-I-E-D. Try the mutant port, BOOM D-E-N-I-E-D. Try the whale server, BOOM D-E-N-I-E-D. I thought the ban was just for coop but apparently not. I want to get this resolved. I'm an asshat  . The lessons have been learned, let's put this behind us and frag on 

So, you exploited a game vulnerability to fuck with your fellow players and you are surprised when you are banned from all the servers involved?
I think you need more time in the ban corner myself. You need to learn what denial of service really means.

[|iR|Focalor]

I think you need more time in the ban corner myself. You need to learn what denial of service really means.

Yeah. He still isn't convinced he was doing anything wrong at all. Last night on IRC he was feeding quadz a line of shit saying, "You know I'd never do anything to deliberately cause problems.", even though he was the one who connected to coop and then started being a dick by deliberately shooting other players. Before I even got there, he was hard at work at fragging the other coop players. When I turned on god mode and prevented him from having fun by being a dick, he resorted to being a dick by crashing the server.

[console]

The lessons have been learned, let's put this behind us and frag on 

[21:20:33] krenZ [WebETGUser@cpe-76-xxx-xxx-xxx.neo.res.rr.com] has joined #tastyspleen
[21:48:48] <krenZ> sup quadz
...
[22:33:14] <krenZ> I hope we're cool on that coop thing
[22:34:33] <krenZ> you know I don't intentionally go around causing problems
[22:39:53] <@quadz> that would depend on your willingness to abide by the no-deliberately-crashing-servers ruule
[22:41:17] <krenZ> of course. I'm not razor
...
[23:08:29] <@quadz> krenZ: it would speed things along if you were to summarize your current position vis-a-vis server crashing on the relevant forum thread
[23:09:45] <krenZ> It's simple. They enabled God mode so i crashed the server and fragged them on re-connect, thus my greek mythology rant
[23:10:28] <krenZ> they played dirty. I played dirty.
[23:10:52] <|iR|Focalor> wrong, you played dirty, I stopped you by using god mode
[23:10:54] <@quadz> then it seems your position is unchanged; thus the ban remains


You keep talking as though you feel it's OK to crash our servers.

[Sgt. Dick]

  really,
You shoot players when your not suppose to.
When someone stops you from doing what you are not suppose to do, you intentionally crash the server so you can go back to shooting other players.

And you feel justified in doing it. 

[ex]

Once again krenZ, what you did can be considered low-level hacking because it resulted in the server crashing directly from your efforts to do so.

If quadz was a stickler for the law, he could call your ISP and report you, and you'll deal with a ban from all ts servers on YOUR ISP's side, maybe even having your ISP account suspended depending on if the person at your ISP cares or not.  Let's not even get into the issue of if quadz decided to hire a DA prosecutor and went after you.  Trust me, you'd be in deep shit.  There are laws that can screw you over bad on these types of things.

You have a really nonchalant attitude for what you're doing.  I'd just apologize, actually mean it, and not try to fuck with the servers anymore.

You're actually not that bad to play against.  You should do more of that, instead of this childish BS.

[VaeVictis]

Once again krenZ, what you did can be considered low-level hacking because it resulted in the server crashing directly from your efforts to do so.

If quadz was a stickler for the law, he could call your ISP and report you, and you'll deal with a ban from all ts servers on YOUR ISP's side, maybe even having your ISP account suspended depending on if the person at your ISP cares or not.  Let's not even get into the issue of if quadz decided to hire a DA prosecutor and went after you.  Trust me, you'd be in deep shit.  There are laws that can screw you over bad on these types of things.

You have a really nonchalant attitude for what you're doing.  I'd just apologize, actually mean it, and not try to fuck with the servers anymore.

You're actually not that bad to play against.  You should do more of that, instead of this childish BS.

you are over playing it honestly...

technically there is a couple acts that can be called and he could possibly get a sizable fine or something... but any decent lawyer could get the case thrown out... or maybe just dropped to a small fine with a slap on the wrist... but you can get that from a ton of things

the thing with a lot of laws, is you can play the wording against itself quite well, and use their own definitions to dodge legality issues...

though legal issues aside, isp still might create a filter on his connection if a server admin called up with log files that a user under their services was intentionally causing a dos

sides that, i wouldnt call a dos or even a ddos "hacking" just because often times its either A. script kiddy who figured out the --flood switch in hping (which is fun btw) or B. unintentional due to a spike in the normal network usage...

dont get me wrong, krenz is still a dick who doesnt understand the situation, but screaming "HACKER!" and threatening legal action just sounds retarded... hes banned, problem solved

[ex]

Maybe the point was missed.  I said if quadz wanted to krenZ would have a problem in this.  As far as the legal side itself, you're spot on.  Most the time it's a small fine type of scenario when people actually follow up on this.

I know someone years back who hired their local DA to prosecute someone who was DoS'ing them offline.  I believe it was a similar small fine ($500 area) but the issue of it being criminal is valid.  Just not usually actively pursued.

[QwazyWabbit]

Just for the hell of it krenZ, and this may help you redeem yourself, I'd like you to try DOS'ing the Loxophilia server for me in the same way you did coop.

74.86.171.202:27910

The LOX code uses a different G_Spawn / G_FreeEdict scheme and I'd like to see if your exploit works against it. This, and the maxentities is 2048.
I'll be watching the logs, so let's see what you can do to it.
If you can't succeed in crashing the server perhaps the LOX method can be used in the other mods and this vuln can be eliminated from them since this code is in the game module and not the engine.

I can't promise what quadz might do ban-wise, but it would satisfy my curiosity about this vuln.

If anyone knows the exploit being used, please PM me so I can investigate it on test servers.

[VaeVictis]

Just for the hell of it krenZ, and this may help you redeem yourself, I'd like you to try DOS'ing the Loxophilia server for me in the same way you did coop.

74.86.171.202:27910

The LOX code uses a different G_Spawn / G_FreeEdict scheme and I'd like to see if your exploit works against it. This, and the maxentities is 2048.
I'll be watching the logs, so let's see what you can do to it.
If you can't succeed in crashing the server perhaps the LOX method can be used in the other mods and this vuln can be eliminated from them since this code is in the game module and not the engine.

I can't promise what quadz might do ban-wise, but it would satisfy my curiosity about this vuln.

If anyone knows the exploit being used, please PM me so I can investigate it on test servers.

the most obvious is just get an ia map up, and keep dropping ammo, not that difficult to test yourself

[|iR|Focalor]

Unless he took the time to create a bind that would drop 1000+ ammo packs all at once, that's not the method he was using. Cajmere said he never saw any ammo packs dropped before it crashed.

It's pretty stupid that anyone should HAVE to make changes to the server to prevent this from happening again when it would be a hell of a lot quicker and simpler to keep the assholes doing it off the server with a ban until they agree to stop doing obnoxious shit. Play by the rules or play somewhere else.

[fdrjk]

Keep that retard banned.

[peewee_RotA]

Keep that retard band.

That's a terrible thing to say. They're disabled, and they play better than you ever will.

[Zeppelin]

yesterday, the server crashed again when i went back to the previous map.

[2012-03-19 03:28] RecyCled: it happens when one person is going to next level
[2012-03-19 03:28] Cajmere: ?
[2012-03-19 03:28] RecyCled: and one person is spawning on previous level
[2012-03-19 03:28] RecyCled: its timing

[QwazyWabbit]

Unless he took the time to create a bind that would drop 1000+ ammo packs all at once, that's not the method he was using. Cajmere said he never saw any ammo packs dropped before it crashed.

It's pretty stupid that anyone should HAVE to make changes to the server to prevent this from happening again when it would be a hell of a lot quicker and simpler to keep the assholes doing it off the server with a ban until they agree to stop doing obnoxious shit. Play by the rules or play somewhere else.

I don't think making server code resistant to attack is stupid at all. You have to remember that Q2 was designed as a single player game first, multiplayer second and the philosophy of the net at the time was "everybody plays by the rules". Then the Morris worm came out and all hell broke loose. Original Q2 was riddled with vulnerabilities, hence all the admin tricks and add-ons to plug the holes.

One of the most annoying shortcuts taken by the Q2 developers IMHO, is the good old crash-the-app-because-something-bad-happened. This is exactly what you saw with the coop server. This is fine if you're developing but it sucks when you're an admin. Fortunately, quadz has Wallfly and server monitor/reset automation in place but from the degree of upset caused by all the complainers in this thread I'd say making the servers resistant to the exploit would be a better solution.

The patch would appear to be minimal and it's already written so why not take advantage of it if it exists. We only need to prove it works.