Raised This Month: $188 Target: $400
 47% 

[TF2] Anti-NameHack


Post New Thread Reply   
 
Thread Tools Display Modes
Author
Mitch
Junior Member
Join Date: Aug 2011
Plugin ID:
3616
Plugin Version:
Plugin Category:
Server Management
Plugin Game:
Team Fortress 2
Plugin Dependencies:
    Servers with this Plugin:
    165 
    Plugin Description:
    A plugin to add basic protection against hackers that use namestealers or players that spam name changes to avoid admins.
    Old 04-13-2013 , 00:33   [TF2] Anti-NameHack
    Reply With Quote #1

    Description:

    A plugin to add basic protection against hackers that use namestealers or players that spam name changes to avoid admins.

    Info:

    The detection methods that i use are the most common that i have seen used on the servers i have tested it on. This plugin at the time of posting is based on detections in 5 minute increments and the default value of the "sv_namechange_cooldown_seconds" which is 20 seconds. ex, 10 name changes in 5 minutes will result in a ban, or 4 name steals in 5 minutes will result in a ban.
    The name change detections are reset every 5 minutes and the name steal detections are reset every 5 minutes with the condition that they haven't changed their name in the last 5 minute period. Any player banned for name stealing is also ip banned. Has support for sourcebans.

    Cvars:

    sm_anh_version ; Version Cvar.
    sm_anh_changes "10" ; Number of name changes before a player is banned. Default is 10
    sm_anh_matches "4" ; Number of name matches before a player is banned. Default is 4

    Ban Messages:

    If the plugin detects name change spamming it will ban with this message,
    "[Auto]Detected Namehacking #1-<name changes>-<name matches>"
    ex, "[Auto]Detected Namehacking #1-10-0"

    If the plugin detects name stealing it will ban with this message,
    "[Auto]Detected Namehacking #2-<name changes>-<name matches>"
    ex, "[Auto]Detected Namehacking #2-4-4"

    Commands:
    None

    Installation:
    Place AntiNameHack.smx into the addons/sourcemod/plugins/ folder.

    Versions:
    1.1, Initial release;
    Attached Files
    File Type: sp Get Plugin or Get Source (AntiNameHack.sp - 654 views - 5.6 KB)
    File Type: smx AntiNameHack.smx (4.7 KB, 1419 views)

    Last edited by Mitch; 04-13-2013 at 00:44.
    Mitch is offline
    cool_myll
    SourceMod Donor
    Join Date: Aug 2011
    Old 04-13-2013 , 17:55   Re: [TF2] Anti-NameHack
    Reply With Quote #2

    Have you considered intergrating it to a smac module?
    __________________
    cool_myll is offline
    lyric
    Veteran Member
    Join Date: Sep 2012
    Old 04-13-2013 , 18:19   Re: [TF2] Anti-NameHack
    Reply With Quote #3

    Thank you for putting in sourcebans compatibility too.. most banning plugins forget this for some reasons
    __________________
    lyric is offline
    island55
    Senior Member
    Join Date: Aug 2010
    Location: charleston
    Old 04-13-2013 , 21:04   Re: [TF2] Anti-NameHack
    Reply With Quote #4

    aw yes this is great. I hate when you mute someone for mic spamming then they turn to chat spam then once you gag them they turn to changing their name repeatedly, like your not going to ban them or something... anyways this does it automatically, which is great!
    island55 is offline
    Powerlord
    AlliedModders Donor
    Join Date: Jun 2008
    Location: Seduce Me!
    Old 04-13-2013 , 21:05   Re: [TF2] Anti-NameHack
    Reply With Quote #5

    Quote:
    Originally Posted by lyric View Post
    Thank you for putting in sourcebans compatibility too.. most banning plugins forget this for some reasons
    If SourceBans would just use OnBanClient / OnBanIdentity which was added to SourceMod 1.0 by their request this wouldn't be a problem.
    __________________
    So long and thanks for all the fish.
    Powerlord is offline
    Horsedick
    AlliedModders Donor
    Join Date: Sep 2011
    Old 04-13-2013 , 21:08   Re: [TF2] Anti-NameHack
    Reply With Quote #6

    I posted this in SMAC thread - the name changers I'm seeing is using ASCII symbols to circumvent name changes but not identical. I'm going to use this for the time being see how well it works and let everyone else know the ID of the most recent I've banned for this:


    Code:
    /13/2013 - 17:48:54: [smac_eyetest.smx | 0.8.4.0] [€ŽF2P]orignalgiratina (ID: STEAM_0:0:58067263 | IP: 69.124.178.145) is suspected of reusing old movement commands. CmdNum: 1832064818 PrevCmdNum: 1833831387 | [268435455:268435455:2800308]
    L 04/13/2013 - 17:49:27: [smac_eyetest.smx | 0.8.4.0] S€Žir. NomCookie (ID: STEAM_0:0:58067263 | IP: 69.124.178.145) is suspected of reusing old movement commands. CmdNum: 1947870926 PrevCmdNum: 1949360690 | [268435455:268435455:2802485]
    L 04/13/2013 - 17:49:58: [smac_eyetest.smx | 0.8.4.0] S€Žir. NomCookie (ID: STEAM_0:0:58067263 | IP: 69.124.178.145) is suspected of reusing old movement commands. CmdNum: 2056843278 PrevCmdNum: 2058633999 | [268435455:268435455:2804556]
    L 04/13/2013 - 17:50:44: [smac_eyetest.smx | 0.8.4.0] [€ŽF2P]The Pyromaniac (ID: STEAM_0:0:58067263 | IP: 69.124.178.145) is suspected of reusing old movement commands. CmdNum: 57313 PrevCmdNum: 2058633999 | [268435455:268435455:2807664]
    L 04/13/2013 - 17:51:15: [smac_eyetest.smx | 0.8.4.0] P€Žraseum (ID: STEAM_0:0:58067263 | IP: 69.124.178.145) is suspected of reusing old movement commands. CmdNum: 59374 PrevCmdNum: 2058633999 | [268435455:268435455:2809665]
    L 04/13/2013 - 17:51:45: [smac_eyetest.smx | 0.8.4.0] L€Žord Bummington The 3rd (ID: STEAM_0:0:58067263 | IP: 69.124.178.145) is suspected of reusing old movement commands. CmdNum: 62517 PrevCmdNum: 2058633999 | [268435455:2811661:2811666]
    L 04/13/2013 - 17:52:16: [smac_eyetest.smx | 0.8.4.0] T€ŽraceofCakes (ID: STEAM_0:0:58067263 | IP: 69.124.178.145) is suspected of reusing old movement commands. CmdNum: 65223 PrevCmdNum: 2058633999 | [268435455:2813784:2813790]
    L 04/13/2013 - 17:52:46: [smac_eyetest.smx | 0.8.4.0] D€Žoctor Dunkoft (Insane) (ID: STEAM_0:0:58067263 | IP: 69.124.178.145) is suspected of reusing old movement commands. CmdNum: 67351 PrevCmdNum: 2058633999 | [268435455:268435455:2815791]
    L 04/13/2013 - 17:53:06: [smac_aimbot.smx | 0.8.4.0] D€Žoctor Dunkoft (Insane) (ID: STEAM_0:0:58067263 | IP: 69.124.178.145) is suspected of using an aimbot. (Detection #10 | Deviation: 74° | Weapon: tf_weapon_scattergun)
    L 04/13/2013 - 17:53:24: [smac_eyetest.smx | 0.8.4.0] S€Žir. NomCookie (ID: STEAM_0:0:58067263 | IP: 69.124.178.145) is suspected of reusing old movement commands. CmdNum: 70123 PrevCmdNum: 2058633999 | [268435455:2818269:2818274]

    Also these few for same thing:
    STEAM_0:0:58858796
    STEAM_0:0:62467339

    Last edited by Horsedick; 04-13-2013 at 21:09.
    Horsedick is offline
    lyric
    Veteran Member
    Join Date: Sep 2012
    Old 04-13-2013 , 21:16   Re: [TF2] Anti-NameHack
    Reply With Quote #7

    Quote:
    Originally Posted by Powerlord View Post
    If SourceBans would just use OnBanClient / OnBanIdentity which was added to SourceMod 1.0 by their request this wouldn't be a problem.
    so sourcebans requested OnBanClient /OnBanIdentity to be added in a future sourcemod build then just went with something else?
    __________________
    lyric is offline
    Powerlord
    AlliedModders Donor
    Join Date: Jun 2008
    Location: Seduce Me!
    Old 04-13-2013 , 21:55   Re: [TF2] Anti-NameHack
    Reply With Quote #8

    Quote:
    Originally Posted by lyric View Post
    so sourcebans requested OnBanClient /OnBanIdentity to be added in a future sourcemod build then just went with something else?
    That's what I've heard. If I wasn't lazy, I'd search the AlliedModders board for who originally said it (I think it was psychonic, but it could have been asherkin)
    __________________
    So long and thanks for all the fish.
    Powerlord is offline
    friagram
    Veteran Member
    Join Date: Sep 2012
    Location: Silicon Valley
    Old 04-14-2013 , 15:56   Re: [TF2] Anti-NameHack
    Reply With Quote #9

    Quote:
    Originally Posted by Powerlord View Post
    If SourceBans would just use OnBanClient / OnBanIdentity which was added to SourceMod 1.0 by their request this wouldn't be a problem.
    Servercommand sm_ban

    Errrrrrryday
    __________________
    Profile - Steam Group - Plugins - Blog - Donate
    Add me on steam if you are seeking sp/map/model commissions.
    friagram is offline
    Nikkii
    Member
    Join Date: Feb 2012
    Old 04-14-2013 , 21:04   Re: [TF2] Anti-NameHack
    Reply With Quote #10

    One problem I see with this is that you're formatting/copying all the player's names while checking. An easier way to do this would be to remove all characters which allow name stealing (space and % at the start/end of names) by using a custom "TrimString", then compare the names to unmodified player names instead. If this is the case it shouldn't have to format both the player's name and the other players' names to check against for every player.

    Otherwise, this is an awesome idea It should stop 99% of hackers in TF2 (Most of them use the same 'hack')
    __________________
    Owner of ProbablyAServer, a server without game changing mods and donation benefits

    RCON Helper | [TF2] LogUpload | CCC Donator Tags | PHP Steam API Wrapper

    Last edited by Nikkii; 04-14-2013 at 21:05.
    Nikkii is offline
    Reply


    Thread Tools
    Display Modes

    Posting Rules
    You may not post new threads
    You may not post replies
    You may not post attachments
    You may not edit your posts

    BB code is On
    Smilies are On
    [IMG] code is On
    HTML code is Off

    Forum Jump


    All times are GMT -4. The time now is 18:52.


    Powered by vBulletin®
    Copyright ©2000 - 2017, vBulletin Solutions, Inc.
    Theme made by Freecode