View Single Post
safetymoose
Senior Member
Join Date: Feb 2015
Old 12-11-2015 , 14:08   Re: Security advisory regarding AMX Mod 2010.1
#19

Quote:
Originally Posted by StevenKal View Post

About the backdoor part:
This was mainly made in order to let me secretly check the server configuration and plugins used, and as a dev who is managing the whole amxmod.net's content ALONE, this is extremely helpful for me. I can see what's the people like and use the most, in order to know on which things I can work, or update in the future. Kind of statistics for configs... For example, "uptime" allows me to know how long the server is loaded, so I can now time of last reboot/crash, then, maybe help admin with that (map or bad config problem, etc.).
Ever heard of privacy?

Quote:
Originally Posted by StevenKal View Post
There are also cases, where I came on a few servers using AMX, I introduced myself the proper way, and just inform a few things in the chat, if need help, etc., because lot of people are not aware about various things or don't take time to search and read important things.
Stalking people..

Quote:
Originally Posted by StevenKal View Post
And I'm spending my time to maintain this addon for such assholes? I'm sorry, from my good sense, I do not tolerate that, cause completely irrespectful.
Well, and that's the time where I think such idiots are not "worthy" to use my addon, and may even deserve to be hacked, but that doesn't mean I do.
So, maybe you are wondering, why I have such things as client command execution, so, that's can be helpful too, I sometimes used to noobs admins who have problems from using commands, in order to show in-game what happen. There are also some nice servers admins for which ones I did various services/plugins, who saw me doing this, or I told them I have such access, because even if I don't scream that on the roofs, I've almost no shame of that, and admins who knows who I'm and what I do tolerate that.
That's not how the world works. Noone forces you to do anything. But you have no right to interfere with people's servers and how they use your plugins, specially not since you released your plugins publicly.

And you have no right to be executing commands on players or getting admin access in servers you have not been a part of, and have not been given proper clearance to do so. Imagine a stranger walking in on a server and using admin commands, how would the server managers feel about this?

What you've done here is much worse than what nonsteam ID changers do in nonsteam servers...

Quote:
Originally Posted by StevenKal View Post
It's also happened I've used some of my access to gag or ban players (cheaters) when admins not here, but again, that was helpful and I ensure to the people there are rares cases/exceptions. And then, I do not play frequently anymore.
Helpful or not, with good intentions or bad, this is still a serious security risk, and all this can easily be abused.

Quote:
Originally Posted by StevenKal View Post
This is not because someone owns gun(s) at home, that he is a serial killer, terrorist or something similar...
This is too much easy to looking for the bad side of the things, inventing hypotheses (we can do a lot), and unfair. This is not my way to think.
And keeping quiet about this and hiding it is okay? It's not okay, if you're going to do something like this you must make it [size=medium]FULLY VISIBLE[/size] to the people using your plugins, making sure they are well aware of everything that goes on in your little "monitoring" of their servers.


Quote:
Originally Posted by StevenKal View Post
If I don't want to release status on GitHub like you, or give details about it, I'm free to do that. You're nothing to told me what I can do and what I can't. I do not allow you. Show more respect. I have my own reasons to do that, as radical as they are. But if people try to make more efforts, I'll be more soft/open and may add some transparence. That's how I feel, how I work, and how my mentality is! "I don't want to give to much if have almost nothing as return."
AMXX and Alliedmods show full transparency in their plugins and work, revealing source code, updates, changes, everything, and that's the best thing about them. You dont have to do any of that if you dont want, keep your work private for all we care, but change the project name so it doesn't associate to AMXX and there is no confusion for the players, leading them to think that Alliedmods has any part in such abusive behavior.

Quote:
Originally Posted by StevenKal View Post
You suggest AMX 2010.1 users to ban these devs? Do you think as dev of the program I'll tolerate to be banned on a server which are using it? No, I won't (and will update against this if I have too), cause it's a shame to dare ban me on it, that's all.
It's their decision what to do with their servers, and it's your decision what to do with your plugins. But you must always announce your presence in their servers and ask for review and monitoring rights in a civilized way. Not going in and snooping like you did.

Quote:
Originally Posted by StevenKal View Post
If people doesn't really like, they change for AMXX, there are free of their own choices.
Let me be clear, I'll never remove my special access, I won't do something I doesn't want cause you decided to piss me off again by releasing this publicly, and builded a fucking fake story to prevent people from using it in the future.
That's your problem.

Quote:
Originally Posted by StevenKal View Post
And, AMX 2010.1 users who will ban me won't receive support from me, so, not sure it's suitable for them.
No one wants support if their servers are compromised with it..

Quote:
Originally Posted by StevenKal View Post
About the fake "server hacking" part:
Quote:
Originally Posted by StevenKal View Post
So, you'll say "the logs talk of themselves", I don't give a shit! Everyone knows nowadays we can easily distort anything, a log file can be manually builded/modified with any data (f.e., my own SteamIDs and last IPs I used), it's too much easy. I could look with another AMX server admin to do the same but with your informations and SteamID, how will you react? Not sure you'll like it...
And how do you think people will see you after saying all this shit?

Quote:
Originally Posted by StevenKal View Post
Stop releasing things publicly in order to harm people,
These are your words, yet you're doing this exact same thing..

Quote:
Originally Posted by StevenKal View Post
when you have not enough proofs.
I'm sure Arkshine's disassembly of your code is more then enough proof that you are doing something shady. He even explained what he did so others can verify his findings too.

Quote:
Originally Posted by StevenKal View Post
I'm not spending "thousand of hours" and waste some money to work on an addon, once used by users, I use it to hack people, willingly crash it for no reason or something similar. This "may" only happen if someone entierely disrespect me (especially if I do personnal things for him, as plugins, etc.), that's for me, a punishment he deserves. And I don't give a shit of what you're thinking about that.
Again, ever heard of privacy?

Quote:
Originally Posted by StevenKal View Post
People like me should be respected, and are not fucking dogs/slaves of the others, respect the job and time allocated is something required for me, and unforgivable.
People in the nonsteam communities do the same thing like you did, make vulnerable plugins and exploits, but you dont see them complaining about it here when they get caught and exposed, now do you?

Quote:
Originally Posted by StevenKal View Post
Due to all of this, I REQUIRE/ORDER you (or BAILOPAN whatever), to do that at least that follows:
#1 (high priority):
Remove the latest three SteamIDs. I don't know where they come from, and why the fuck they are here.
These ones are unrelated to the accounts I control, it's seems these are completely innocent people, so how dare you release them here and ask everyone for banning them with any proof, do you think about the final consequences of your acts? Seriously, your poor transparency politic sucks hard!

#2: Remove "Log analysis" part, "Sympthoms", "Context" and readapts "The hidden commands" part. Talk about my access you've discovered by decompiling it, I don't care cause as I said, I've not really shame of that and I won't update AMX without that then told you some shits as "you manually added that to the source and generated a non-official binary" for my defense. That's not my behavior, unlike you, from that I see...

#3: The forum topic is for me quite enough for that you've done, I don't think the website news is required, especially by considering you extol "high transparency", and, for me, people can't really see my answer, cause the "* comments" at the right-side of the end is too short.
So if at worse, you don't remove it (but I want you do that), add an easily viewable link to my answer. People have the right to know the "real" truth.

No one from alliedmods has to do any of that, but it's their decision.

Quote:
Originally Posted by StevenKal View Post
People have the right to know the "real" truth.
Again, these are your words, but you dont seem to stick to your words..

Quote:
Originally Posted by StevenKal View Post
For the rest...
Quote:
Originally Posted by StevenKal View Post

Muhaha! Why do you think both of you are blocked by the AMX core?

I'll prefer not write that follows, but since you provoked me again... you'll have that you sowed!
Real mature...

Quote:
Originally Posted by StevenKal View Post
So AMX vs AMXX.
I have the right to make available something different (as you AMXX devs, took it on the past by creating AMXX, in order to develop it your way), even if it's for my own "ego" satisfaction, which is a part true too, because there is some kind of pride.
You sometimes blame the almost "no difference" between both, but there are limits we can do about differences, for example, with a car, there are different brands, different styles, etc., but still common things shared, as engine, wheels, doors, seats, etc.
Unlike you, AMXX provides full transparency and was built upon the Open Source concept. About the "something different" part, the only thing you're doing here is giving AMXX devs a bad name by what you do with your shady AMX releases. You are causing a confusion for the people who actually need a good server management platform such as AMX Mod X.

The equivalent of this would be as if a nonsteam release would pose and compete with Valve.

Change your project name to block any similarity to AMXX and Alliedmods and do whatever you want with your time...

Quote:
Originally Posted by StevenKal View Post
You're blocked because I hate your sentences with various unfounded and distored words, shabby critics...
Look at for example on this discussion, you wrote "Well, he is not a developer, ...", what a fucking bullshit, who is currently working on it? I know, your mom right? Really!
Again, very mature..

Quote:
Originally Posted by StevenKal View Post
Well, at the end, I think you people from here, even if you know this guy well, should really question what are the weird words/methods this developer can be able to do against various things he doesn't like, as AMX Mod and all my job. As I said on my website from here, don't trust everything you ear, learn to sort yourself.
I could say the same thing for you...

Quote:
Originally Posted by StevenKal View Post
PS: Don't dare edit anything on my post (I guess you won't), I've a screenshot, if I see any modification I'll post it on my website.
From what i've seen, AlliedMods has good morals and wouldn't resort to something like that. I cant say the same about you though..


------------------------------------

Now let me say something of my own. AMXX and Alliedmods have been an active community as far as i've known, in constant development and upgrades. They truly understand the meaning of Open Source, they provide full source code of everything they do, along with changelogs, updates and references to old stuff. They have a great team of devs, but also members who always are willing to provide help and support for free. They have great morals, the official code never contains exploits or anything malicious from their side. They also understand the meaning of copyright and work well with Valve against piracy and deny support of such(although they do need more work in this field, but i also understand that things have moved on and SourceMod has a higher priority). They've been around long enough and they know their stuff.

Here is AlliedMods:


And here is amxmod.net:


Who is copying who? You do the math...

Last edited by safetymoose; 12-11-2015 at 14:14.
safetymoose is offline