[DeNeDe]

In about 6-7 hrs i will open the test server again and feel free to use the exploit, or any other exploit.
Debugging is always good.

[metal_upa]

Originally Posted by DeNeDe In about 6-7 hrs i will open the test server again and feel free to use the exploit, or any other exploit. Debugging is always good.

Post your server info. If using metamod then copy the meta list output.

[DeNeDe]

62.210.146.216:27015
Go at it, i'm not at home so post logs/info
cheers.
edit: just got home.. saw someone trying some exploits, none succeed.

[Freezo Begin]

Originally Posted by DeNeDe 62.210.146.216:27015 Go at it, i'm not at home so post logs/info cheers. edit: just got home.. saw someone trying some exploits, none succeed.

I was just curious about reHLDS, the trick goes for it too )

DeNeDe timed out
DeNeDe has left the game
Scoring will not start until both teams have players
Spawner timed out
Timed out

Edit: you can join and check that out .
Edit2: And no it's not caused by a restart because i have tested the exploit on a vps and i was connected to the server and i got timed out everytime i send the exploit ... End point.

[DeNeDe]

timedout because i restarted the server to change some setting. i'm not anymore.
sv works. i'm not even on the sv.
i see all your bots are timing out
yep, server crashed.. mneeh..go and sell the exploit for 1 quadrilion zeni

[joropito]

Originally Posted by Skettis27 I actually have a steam-only server, updated via steamcmd. A kid who has this xploit on his hands really made my server crash few times. Stop saying "steam servers don't have this problem" when this guy posted a youtube video demonstrating how he actually simulated a legit STEAMID player.

I didn't meant to say steam servers doesn't have the problem. What I say is they have a security layer on steamclient (yes, servers uses steamclient). Then when a fake player try to join, it gets rejected and throttled.

If the guy can simulate a real steamid, the server will only get affected if the steamid has the game in it's library, so it's an account with the game. Who in the world will use his real steamid to ddos a server?

If it's a real steamid, just ban him and it would be filtered at steamclient layer, not affecting the server.


If you really have proof about any exploit that works on steam servers that override this behaviour, please post more info.

[Freezo Begin]

Originally Posted by joropito If it's a real steamid, just ban him and it would be filtered at steamclient layer, not affecting the server.

Do you know what are you talking about? we can collect more data, for exemple from you and we will have your steamid validation ( you ban him = you ban yourself ) this could be more dangerous than you think ... search for xFakeplayers created by zeal ( it's an intelligent bots that it's sent using a program and they can play ... execute cmds they can cheat[ speedhack + aim .. ] etc ) they are working only on no-steam servers ) but if he really find this method of emulating steam ... lol this will be catastrophic ...

Edit: It's not just about crashing servers ...

[aron9forever]

Can confirm this exploit works on clean servers with only metamod & amxmodx installed.
Can't say anything about bypassing steamauth, I don't have access to the exploit, have only noticed it happen on a client's machines.


Even if this only works with steam running in the background, it's still a serious issue. You didn't ignore bugs such as #label, autobuy, u@%s and so on because you could ban by steamid, because it's still a pain in the ass to monitor and do this manually, and you're vulnerable to it at least until you ban the address.

You banned both people who not only had access to this exploit but also provided clues about how it works for the sake of protecting the IP of Valve of which even they don't care anymore. Please stop doing this, our community is very quickly decaying and you're only speeding it up. Now more than ever we need to discuss these issues on a proper platform and not some shitty russian forum where not any mentioning of "dproto" is directly translated to "please don't buy counter strike, come play on my server for free and enjoy all the perks of a game with no auth system whatsoever where no true banning exists. I also treat game clients from 2001 the same as ones from 2013 so except the same security standards, forget about the SILK codec, use any hack EVER developed since this game was launched"

[gabuch2]

Originally Posted by aron9forever You banned both people who not only had access to this exploit but also provided clues about how it works for the sake of protecting the IP of Valve of which even they don't care anymore. Please stop doing this, our community is very quickly decaying and you're only speeding it up. Now more than ever we need to discuss these issues on a proper platform and not some shitty russian forum where not any mentioning of "dproto" is directly translated to "please don't buy counter strike, come play on my server for free and enjoy all the perks of a game with no auth system whatsoever where no true banning exists. I also treat game clients from 2001 the same as ones from 2013 so except the same security standards, forget about the SILK codec, use any hack EVER developed since this game was launched"

Are you crazy? How else I'm going to tell people to uninstall dproto. /s

[fakkk]

So what is the solution for this new exploit?