server getting hacked or something - Page 2

YamiKaitou · 07-20-2010 , 10:15 Re: server getting hacked or something

Firewall TCP 27015 (or your server port) off or to only allow specifc IPs to connect.

endeffects · 07-20-2010 , 10:17 Re: server getting hacked or something

Quote:

And how does that stop the server from crashing?

well it doesn't, i was referering to the rcon hacking attempts.
anyways, valve released a hlds beta to fix one of the currently
available crash exploits. but there are some others that still work.

drekes · 07-20-2010 , 13:24 Re: server getting hacked or something

Quote:

Originally Posted by 8088

And how does that stop the server from crashing?

Drekes, did you actually check the link that I posted?

yeah, i read it, but i don't know what i should do now, i'm not planning to install dproto or something.
And i don't have access to the command line, so i can't use that beta thing

8088 · 07-20-2010 , 13:26 Re: server getting hacked or something

If you don't have proper access, the most logical thing to do is to contact the person that does.

drekes · 07-21-2010 , 03:01 Re: server getting hacked or something

Okay, i'll do that. Thanks guys

yokomo · 07-24-2010 , 08:22 Re: server getting hacked or something

Quote:

Originally Posted by drekes

Hey,

a server of us is getting hacked or something. It crashed alot lately and now that i monitor it i get this, and then it crashed.
What can i do to prevent this?

Code:

00:52:04 L 07/19/2010 - 18:48:51: "Hitler<5><BOT><CT>" killed "Apple_Sauce got.Juked?[BB]<9><STEAM_0:0:1445284><TERRORIST>" with "ump45"
00:52:05 L 07/19/2010 - 18:48:52: Bad Rcon: "rcon 1019646846 "1993"  sv_contact "HLBrute 1.09"" from "89.207.75.107:1396"
00:52:10 L 07/19/2010 - 18:48:57: "=P<12><STEAM_0:0:13857048><>" connected, address "70.22.210.77:50434"

Owh same problem as me, i also got this log

Code:

Bad Rcon: "rcon 1019646846 "1993"  sv_contact "HLBrute 1.09"" from "89.207.75.107:1396"

i tried to check the ip and the owner is from Russian. My server always freeze for 3-5secs. That so weird.

drekes · 07-24-2010 , 08:58 Re: server getting hacked or something

same with me, russian too.
But it stopped for a while now.

bluechester · *Last edited by bluechester; 07-24-2010 at 11:53.*

Believe it or not, I'm having this problem as well. It appears that it requires the people to connect to your server before it actually crashes it so what you could do is ban them from your server. But that only solves half the problem.

It appears that we have another exploit on our hands. D:

@ drekes: How were you able to trace the Steam ID and IP? It appears that for me, the server crashes before they even connect so I can't even get their info. The way I know that it's them connecting is because on server crash, I see a randomly generated username in spectator.

Also, I don't seem to be getting any logs. It might be because I have log off.

Also, my servers are NOT non-Steam!

Either way, I tried adding "-beta hlbeta" to my command line and hopefully that fixes it.

drekes · 07-24-2010 , 11:46 Re: server getting hacked or something

I updated a plugin, and the server started crashing. And because i didn't get any error logs, i monitored the server with HLSW for 2 hours, that where i saw the IP, and i used that to track him down to russia with some website.

bluechester · *Last edited by bluechester; 07-24-2010 at 11:53.*

Quote:

Originally Posted by drekes

I updated a plugin, and the server started crashing. And because i didn't get any error logs, i monitored the server with HLSW for 2 hours, that where i saw the IP, and i used that to track him down to russia with some website.

"-beta hlbeta" doing any good for you?