Spammer around Excessive Plus

29 replies [Last post]

23. February 2005 - 23:26

Developer

Offline

Joined: Sep 2003

Posts:

Well guys, it seems we have some idiots using an exploit to crash our servers. If your server keeps crashing with the error message

ERROR: Info_SetValueForKey: oversize infostring

then your server is being attacked as well.

IP of that idiot: 84.149.231.52 (p5495E734.dip.t-dialin.net)

What can you do?

Wait until id software releases a new point release or download and apply this fix.

http://aluigi.altervista.org/patches/q3infofix.zip

Or block them with a firewall:
iptables -I INPUT 1 -p udp -m mport --dports 27960 -m string --string "\xff\xff\xff\xffgetstatus" -m length --length 50:inf -j DROP
iptables -I INPUT 1 -p udp -m mport --dports 27960 -m string --string "\xff\xff\xff\xffgetinfo" -m length --length 50:inf -j DROP

24. February 2005 - 0:20

Offline

Joined: Aug 2004

Posts:

Spammer around Excessive Plus

Thanks easy I added the ip to the ban list how exaclty is he crashing the servers without rcon?

CLEMSON TIGERS ARE #1
**RETIRED**1st E+ forum whore Muhahaha :mrgreen:
*2nd highest NON-CHEATED post count***RETIRED**

24. February 2005 - 0:24

Spammer around Excessive Plus

Exploit slip, dont need rcon just a crafty codeman : /

24. February 2005 - 0:34

Offline

Joined: Aug 2004

Posts:

Spammer around Excessive Plus

He can crash servers with an old school packet dump...similiar to crashing/booting yahoo, msn, & other chat clients but on a larger scale.

Send enough packets and you can crash a network or even restart the victims' computer.

Purest evil... :twisted:

I used neotrace of this IP, located in Nürnberg.

"Samo sloga Srbina spasava"

24. February 2005 - 10:42

Offline

Joined: Mar 2004

Posts:

Spammer around Excessive Plus

man what a dick head

24. February 2005 - 13:00

Offline

Joined: Aug 2004

Posts:

Spammer around Excessive Plus

INFO

Quote:

84.149.231.52 (p5495E734.dip.t-dialin.net)

hmmm.... this IP is a Germyn IP from T-Online.

i think its a Dynamic IP.

24. February 2005 - 14:02

Offline

Joined: Sep 2004

Posts:

Spammer around Excessive Plus

wrote:

Send enough packets and you can crash a network or even restart the victims' computer.

So this is basically a DOS attack?

parasight://infesting.your.senses

24. February 2005 - 15:01

Offline

Joined: Aug 2004

Posts:

Spammer around Excessive Plus

oh so he is just changing his packets to a higher amount which crashes the server? oh i got it now if thats what it is.

CLEMSON TIGERS ARE #1
**RETIRED**1st E+ forum whore Muhahaha :mrgreen:
*2nd highest NON-CHEATED post count***RETIRED**

24. February 2005 - 16:36

Offline

Joined: Aug 2004

Posts:

Spammer around Excessive Plus

wrote:

So this is basically a DOS attack?

Not sure if that is what he is doing, but this is one possibility.

:-k

"Samo sloga Srbina spasava"

24. February 2005 - 21:28

Offline

Joined: Dec 2004

Posts:

Spammer around Excessive Plus

i dont understand punks that think its ok, nice, and funny to hack servers, IMHO i wouldnt even call u a hacker arshole, ur are a scriptkidde who had a hard childhood