BanToolsACE (ban player by ACE machine ID)

[UT99.org]

I cannot see any reason why a spectator should be subjected to checks. However, assuming hwardware ID hash can easily be spoofed I may be able to find middle ground if you agree that HWID should be optional for a serverowner and kept seperate from anti-cheats. I don't want to derail this thread at all but the majority of what you said is offtopic to start with

You can speak for yourself re: horrible players. But you definitely do not have perfect servers. I even left a gap for you when i departed, from having a top ranked 9 player server which was always full and a backup 7 player server. A fine job you've done, 4 players average. I could point out why, but if you can't see obvious things I'm not going to waste my time

Back on topic, the only reason I don't use nexgen is because the author is unknown to me. The best things about it is the language fix and the ability to code extensions, Hell it even has a built in ActorCLP serverstarter. The fact that you use nexgen bans or give admin to people too stupid to use webmin, normal adminlogin via command or even bind a key to the control panel instead of typing !Open should ring alarm bells but you continue to tirade about giving spectators an easily spoofed ID

I take that back they are not stupid. Bad student = bad teacher. You do realise running 2 low spec servers with zeroping still is bad for players who dont use hitscan weapons if you are running 2000 mods, 2 servers without seperating them virtually so one doesnt lag when the other switches maps, a windows firewall in the background. It's not pleasant for them at all and the amount of player slots given the above none of this is any surprise

[Sp0ngeb0b]

Re: Nexgen.. There is actually a security flaw realised by BillyBill right here in these forums where you can steal players NExGen ID's from their user.ini's when they play on an infected (hacked) server.. This honeypot server collects information from players and then can be used to gain access back to the server and have admin rights over the server. Therefore I find Nexgen to be insecure.

As you know B4M , I'm actually working on a solution which will require nexgen admins to fullfill additional checks (like IP-range, Hostname-range, and HWids). With the right setup by the server admin, the security hole will be fixed as far as possible.

[Wises]

Hey Hey

Yes indeed , you are the Developer I am refferring to here bro

One method which I have discussed with another developer is to incorporate into NexGen a Hostname/IP Check against a database of all any/privledged users.. Also perhaps with the ability to auto_update and change their NG ID's every xx_Days perhaps making it harder for these people from gaining access without Authorisation.

And Very much appreciated

@BB .. let me re-phrase the 'easy to spoof' part of HWID. It is not easy.. but is doable. But only a select few people can do this and I think only a real fkwit with serious issues would need to go down that path.. I mean TBH I can't do it.. and I doubt very much that you can either.

tl;dr: Regarding the above statement ... ^^^I was wrong.. perhaps you have been privy to the HWID spoof (bummer) such a fine upstanding individual like yourself .. tsktsk , see bottom of your computers details for evidence;

This is you for example;

Code: Select all

Log: ACE: DataLink initialization complete.
Log: ACE: Ident  : Player:[I'm-a-racist-loser!
ScriptLog: [ACEv08h]: [[I'm-a-racist-loser!]: [IP] 182.48.129.52
ScriptLog: [ACEv08h]: [[I'm-a-racist-loser!]: [OS] Microsoft Windows 7 x64 (Version: 6.2.9200)
ScriptLog: [ACEv08h]: [[I'm-a-racist-loser!]: [CPU] AMD FX(tm)-6100 Six-Core Processor             
ScriptLog: [ACEv08h]: [[I'm-a-racist-loser!]: [CPUSPEED] Measured: 3314.390555 Mhz - Reported: 3314.712822 Mhz
ScriptLog: [ACEv08h]: [[I'm-a-racist-loser!]: [NIC] Realtek PCIe GBE Family Controller
ScriptLog: [ACEv08h]: [[I'm-a-racist-loser!]: [MAC1] 4E7784ED8EAB190C877597543D0F68B2
ScriptLog: [ACEv08h]: [[I'm-a-racist-loser!]: [MAC2] 59DC197E8C556DC74D36A37D93B7EA34
ScriptLog: [ACEv08h]: [[I'm-a-racist-loser!]: [HWID] D91D3221B2EC22C13DDF8AAB744FE111
ScriptLog: [ACEv08h]: [[I'm-a-racist-loser!]: [UTVER] 436
ScriptLog: [ACEv08h]: [[I'm-a-racist-loser!]: [UTCMD] <none>
ScriptLog: [ACEv08h]: [[I'm-a-racist-loser!]: [RENDEV] D3D9Drv.D3D9RenderDevice
ScriptLog: [ACEv08h]: [[I'm-a-racist-loser!]: [SNDDEV] Galaxy.GalaxyAudioSubsystem
ScriptLog: [ACEv08h]: [[I'm-a-racist-loser!]: [TIME] 01-02-2013 / 18:49:53

Code: Select all

[ACEv08h]: [[I'm-a-racist-loser!]: [HWID] D91D3221B2EC22C13DDF8AAB744FE111
[ACEv08h]: [Kids.w/Candy]: [HWID] D91D3221B2EC22C13DDF8AAB744FE111
[ACEv08h]: [ArseSucker_DE]: [HWID] D91D3221B2EC22C13DDF8AAB744FE111

^good moral alias's there I see also.

Code: Select all

*:Inside timer.Player ip is 182.48.129.52
*:IpData found 182.48.129.52:52.host-182-48-129.compassnet.co.nz:NEW ZEALAND:NZL:nz

^No Surprises there...

Appended:

Code: Select all

[ACEv08h]: +---------------------------------------------------------------+
[ACEv08h]: |                       Player Screenshot                       |
[ACEv08h]: +---------------------------------------------------------------+
[ACEv08h]: PlayerName...: waaaaaaaaah the maps
[ACEv08h]: PlayerIP.....: 182.48.128.113
-----------------------------------Emphasis from here------------------------------------->
[ACEv08h]: OS...........: Microsoft Windows 7/2008 R2 x64 (Version: 6.1.7600)
[ACEv08h]: CPU..........: AMD FX(tm)-6100 Six-Core Processor             
[ACEv08h]: CPUSpeed.....: 3309.072681 Mhz Measured - 3314.745758 Mhz Reported
[ACEv08h]: MACHash1.....: 59DC197E8C556DC74D36A37D93B7EA34
[ACEv08h]: MACHash2.....: 59DC197E8C556DC74D36A37D93B7EA34
[ACEv08h]: HWID.........: 990869BBB99BE4D60547A71453BCF289
-----------------------------------To here----------------------------------------------------->
[ACEv08h]: UTVersion....: 436
[ACEv08h]: Renderer.....: OpenGLDrv.OpenGLRenderDevice
[ACEv08h]: SoundDevice..: Galaxy.GalaxyAudioSubsystem
[ACEv08h]: CommandLine..: <none>
[ACEv08h]: RequestedBy..: DM-Tempest.bbTNali0 (TOKEN)
[ACEv08h]: TimeStamp....: 19-01-2013 / 01:21:39
[ACEv08h]: +---------------------------------------------------------------+
[ACEv08h]: | Screenshot Status                                             |
[ACEv08h]: +---------------------------------------------------------------+
[ACEv08h]: Success......: TRUE
[ACEv08h]: FileName.....: xxDoctoredxx __.._2013.01.19.01.21.39_DM-Tempest_waaaaaaaaah_the_maps.jpg
[ACEv08h]: +---------------------------------------------------------------+
[ACEv08h]: +---------------------------------------------------------------+
[ACEv08h]: |                       Player Screenshot                       |
[ACEv08h]: +---------------------------------------------------------------+
[ACEv08h]: PlayerName...: waaaaaaaaah the maps
[ACEv08h]: PlayerIP.....: 182.48.128.113
[ACEv08h]: OS...........: Microsoft Windows 7/2008 R2 x64 (Version: 6.1.7600)
[ACEv08h]: CPU..........: AMD FX(tm)-6100 Six-Core Processor             
[ACEv08h]: CPUSpeed.....: 3309.072681 Mhz Measured - 3314.745758 Mhz Reported
[ACEv08h]: MACHash1.....: 59DC197E8C556DC74D36A37D93B7EA34
[ACEv08h]: MACHash2.....: 59DC197E8C556DC74D36A37D93B7EA34
[ACEv08h]: HWID.........: 990869BBB99BE4D60547A71453BCF289
[ACEv08h]: UTVersion....: 436
[ACEv08h]: Renderer.....: OpenGLDrv.OpenGLRenderDevice
[ACEv08h]: SoundDevice..: Galaxy.GalaxyAudioSubsystem
[ACEv08h]: CommandLine..: <none>
[ACEv08h]: RequestedBy..: DM-Tempest.bbTNali0 (TOKEN)
[ACEv08h]: TimeStamp....: 19-01-2013 / 01:23:35
[ACEv08h]: +---------------------------------------------------------------+
[ACEv08h]: | Screenshot Status                                             |
[ACEv08h]: +---------------------------------------------------------------+
[ACEv08h]: Success......: TRUE
[ACEv08h]: FileName.....:xxDoctoredxx.._2013.01.19.01.23.35_DM-Tempest_waaaaaaaaah_the_maps.jpg
[ACEv08h]: +---------------------------------------------------------------+

I think you enjoy this kind of thing there Ed_Dynamite ,

*Should have no problem evading every reputable server admin's bans in the Future.. as you can indeed spoof that computers ID?
^HYP?...

The Other Computer's one is to follow if you like? But then doing a quick 'Search in Files' for your IP Address using Notepad++ will allow any other admin to find that one as well quite easily I would think.

Presumably you are very concerned about 'Being Authenticated as Spec' (obviously) as well lets be honest here.. You have Trolled , Tormented , Harassed probably every Other Server Admin over the Last Decade for no apparent legitimate reason "What-So-Ever".. Iam not the only one and can off the top of my head count 5 Others (Also Members of this board as well as others who can attest to this very Fact.. (No Doctoring needed).

Yer.

off-topic: Iam sure that you are kean to get this thread closed.. by the looks of it.Why?..

I cannot see any reason why a spectator should be subjected to checks. However, assuming hwardware ID hash can easily be spoofed I may be able to find middle ground if you agree that HWID should be optional for a serverowner and kept seperate from anti-cheats. I don't want to derail this thread at all but the majority of what you said is offtopic to start with

^Agree with Nothing what-so-ever in this paragraph. however

*looks around for Scissors & a nice cold Lemonade*

I don't think that any Admin would want any banned person from being on their servers?... playing/specing or otherwise..

^ Already Clarified in this post I believe

As for the rest of it .. instead of rip holes in it and.. BLAH BLAH as such.. pointless../

I am however wondering if you would like to disclose to the community how you exploited the little hole in NEXGEN to Steal player ID's few years ago. And would urge other admins to check their ban lists as what this lil GEM done was got every-other player that visited his 'Honey-Pot' SERVERS 'Banned' along-side 'himself' from our servers by connecting to our servers with his banned IP address using their NEXGEN ID's.. quite ingenius .. I must admit.. Opel.

[Feralidragon]

What I can conclude from this whole thing is that whoever made NexGen had clearly no idea of the basic security rules, such as: not relying on the client at all.
In platforms such as UT, things like these should be either native (to not be accessed through UScript) or request some kind of authentication like a login. From there, if the admin decided to have shortcuts in his ini, it would be his problem, and not a problem with the module itself as it seems to be the case here.

[Higor]

See? Browsing UT servers is like browsing the internet, choose safe places mates!!

NexGen ID issues? I got 10 different sets of Exes/inis to roll online, COME AT ME BRO!!!.

[UT99.org]

I don't know what the answer to it is. I do like your manual input suggestion and having them type the password.

I've been all for identifying by hardware IDs in the past but as compulsory there will be "holes" like mentioned. I was promoting the usefullness of HWID before it was implemented into nexgen, for score saving and stats keeping when multiple computers are connected using the same ip address and installation...

If many people are going to have access to the config files of the server and client then plaintext may not be the answer

If people really had the choice whether to give their computer details over so easily, it would make them think about where they play. I won't name any names. But trying to get information about the computers of people you don't like and them volunteerily giving it over, that is a laugh. Maybe they should get into UScript themselves instead of tirading people to make changes. I'm sure they would come up with some better ideas once they learn a little

Please do implement the nexgen ID changer it sounds like a move people will appreciate

[Wises]

What I can conclude from this whole thing is that whoever made NexGen had clearly no idea of the basic security rules, such as: not relying on the client at all.
In platforms such as UT, things like these should be either native (to not be accessed through UScript) or request some kind of authentication like a login. From there, if the admin decided to have shortcuts in his ini, it would be his problem, and not a problem with the module itself as it seems to be the case here.

DeFrost I believe the Legends Name was.. Also Developed SLV? and many other good Mods/Additions. What I enjoy about DeFrosts Work is that he actually takes the time to make as much of his stuff customizable by the user which is not something that many developers for UT do these days... (you are also one such developer I believe)

and yes that would be great! you up for the challenge Ferali ? Lets do it bro.. when do we start (lolz)


@Higor;

[1a] See? Browsing UT servers is like browsing the internet, choose safe places mates!!

[1b] NexGen ID issues? I got 10 different sets of Exes/inis to roll online, COME AT ME BRO!!!.

[1a] Indeed you are correct bro.. this chap for example has about 10 Servers Globally ... However you can't just tell players don't go "here" or "there" and don't etc.. Mainly because they are GHOST Servers.
Invisible to the naked eye.. until you manage to find yourself already on it.. playing a few rounds .. and smashing Bots with 400ms pings from Kazakhstan.. few seconds later Borat will join in the fun.. and Ban you for killing his 'Sisters,Cousins & Grandmother' .. Thats when you'll notice Sticky Feet!.

[1b] What kinda goodies you got hiding over there mate .. I'd be kean to beta-test something if you're looking for someone like myself..to do so?

[youtube]bv9uFxYhp3c[/youtube]

On a Note about Proxy Blockers and such .. Doesn't ACE Come with a semi-functional Tunnel detection function?
if so.. then wouldn't it be easier for a bAllowTunnels=False?

Man..

[Feralidragon]

DeFrost I believe the Legends Name was.. Also Developed SLV? and many other good Mods/Additions. What I enjoy about DeFrosts Work is that he actually takes the time to make as much of his stuff customizable by the user which is not something that many developers for UT do these days... (you are also one such developer I believe)

and yes that would be great! you up for the challenge Ferali ? Lets do it bro.. when do we start (lolz)

If it was him, it's somewhat explained why the thing is insecure. Just like Cratos (the guy that made ZP), he relies too much on client security rather than server security through validations.
For instance, as for his SLV, he made a wonderful job at it (all the servers using it simply do not crash and perform well), but then he relied on obfuscation to protect his code (not sure why he did it for SLV though), and fact is it's extremely easy to get the code back. I mean, I can get the whole code back in a matter of seconds.
Cratos also relied on obfuscation rather than serious server validation, and the result were hacks like "mass murderer" from Helios (this is why I dare to say my ZP is way more secure, as I don't trust the client a single bit and I make a ton of server-side validations to be sure the client is sending reliable info).

The best security is server-side, together with the concept that even if the "hackers" know how it works, they can't do anything about it (for instance, everyone knows how MD5 and SHA are calculated, how HMAC works and other similar concepts, and how passwords are stored in several platforms, but even so no one is able to do jack in getting around them directly, that is the kind of security that must be enforced).

However, Wises, I am not up to contribute for it since I already have a lot on my plate right now, and UT is so limited and so forcefully open for exploits that making something like this is actually hard if you don't go native.

[Wises]

mate , we should swap names .. actually I'll just change mine altogether lol

I don't understand why Defrost would Obfuscate SLV and not Nexgen..

I don't understand why Cr@tos would Obfuscate MapvoteLA13 .. When it is just an adaptation of BDBMapvote (or borrowed code)

Don't make sense to me either.

and yes I see where you are coming from .. in respect to ZP and such .. which is why I have been pushing for you to release normal weapons ZP for how long now? hehe

that single feat right there would make you more famous then Cr@tos/Defrost/B4M (had to add that in there) in UT land, If it performed better then all other ZP Releases I mean zp103 has issues outside of
all of this .. misfiring weapons .. things not working , broken Translocators .. The List goes on.

infact zp103 was just stolen (burrowed) code from ZP-Pure wasn't it?

starting to think that Cr@tos hid his code because maybe.. it wasn't his code to start with.

anyway regarding ZP.. although NewNet (Global Unreal) is pretty bloody awesome.. I don't think , that PACO / Tim-_- plan on releasing it publicly any time soon.
there vision I assume is to get all existing players onto their own servers and henceforth.. we are left with the old/broken toys and rattles to play with :\

it would be good if someone were to build such a thing to help keep UT alive , but I understand that you .. have a lot on your plate and alot of other awesome projects to work on.

therefore I shall stop pushing for it and see if one day something just eventuates.. who knows.

Btw: I dropped your Suggestion on coding for the forums off to Shade earlier today .. be interesting to see what he sez in regards to some slight forum improvements for your board.

[Feralidragon]

Well, the thing is, obfuscation is utterly useless security-wise, and always has been, specially in UEngine. All obfuscation does is to make harder for someone to read code, but in the end, if the engine runs it and understands it, as long as you know the kind of structure the byte code must obey, you can also decompile and retrieve the code yourself, specially since UT byte code is one of the most simple ones out there (since it has a very limited set of instructions and is very restrictive), to the point that even I may be able to make a program to do the same thing with a bit of time.

Anyone wanting to get the code back, can do it at will, and replace all obfuscated references by things which make sense and replace things like "goto" by their original "for" and "while" loops (actually, if you want to know if someone took the source from someone else, look for gotos with Jxxx labels, if they're there, then the code was decompiled from something else), and from there reading the code is like reading a manual in how it works. Any "hacker" worth of that name in the Unreal universe laughs at the very concept of trying to make something secure with obfuscation, it's like "hoping" the hackers do not find out what's in there, when that's the easiest task of all (if even I can do it, why not them?).

As for the ZP, and not wanting to derail much, I will probably do a normal weapons general version with all the features later on. The best thing of it is that it supports server-side security plugins (meaning you can update the server with plugins and the clients won't even know about it, since they don't receive the packages at all), since despite the amount of security I added to it, there may be one or another way to exploit it that I didn't think about, but which can be covered by server-side plugins later on without a new version of ZP being needed (actually, this makes possible for the code to be server-side alone and never ever be seen by others, which is a huge plus imho).
I don't know if Cratos took his ZP from somewhere else, so I can't say anything about that, but he at least tried to do something with it and that's of value and the reason ZP is still used even, but I can say mine is done 100% from scratch in my own way, and it works so far (needs far more testing though).