[Freezo Begin]

Originally Posted by DeNeDe well, if you set your server properly, then your gameserver properly you are protected, but many kids want a gameserver and don't know anything about linux/windows settings. jajajaa

Okey, now just give him the server that you set properly ... why you keep ignoring him i'm 100% sure that you didn't understand the aim of this topic.

+
"I can block you directly from the firewall using iptables. ;)"
what the hell are you talking about?

[Depresie]

You cannot block him with any kind of firewall... you may block his IP but he can change his IP freely...

[DeNeDe]

Ok.. one second and i will give ip address for some only steam server and see if it crashes
62.210.146.216:27015

OK, go.. at least if it doesn't work i will read the logs.


edit:
I see a lot of

L 12/27/2016 - 137:52: World triggered "Round_Start" L 12/27/2016 - 138:49: "uT4mMcrX07<3><STEAM_0:1:24174909><>" connected, address "196.65.23.187:64803" Dropped uT4mMcrX07 from server Reason: Client sent 'drop' L 12/27/2016 - 13:40:03: "Cjimm2HIpG<4><STEAM_0:1:24174909><>" connected, address "196.65.23.187:62182" Dropped Cjimm2HIpG from server Reason: Client sent 'drop' L 12/27/2016 - 13:40:14: "W8quR0flxz<5><STEAM_0:1:24174909><>" connected, address "196.65.23.187:62193" Dropped W8quR0flxz from server Reason: Client sent 'drop'

Nothing happens. Server will remain online..if anyone wants to give it a shot..do it..but post video/logs so i could debug it later.
cheers.

uT4mMcrX07 dropped Cjimm2HIpG dropped W8quR0flxz dropped MpRMCJYoZv dropped Y9dGQxer7u dropped R7mxbByeVt dropped Welcome to No Name Counter-Strike 1.6 Server Scoring will not start until both teams have players Welcome to No Name Counter-Strike 1.6 Server KXSihVQuak dropped Welcome to No Name Counter-Strike 1.6 Server 95NJ7Rki06 timed out

more logs, nothing happens

Dropped chM6mPGhFD from server Reason: Client sent 'drop' L 12/27/2016 - 13:48:57: "NrUvpp2XaG<30><STEAM_0:1:24174909><>" connected, address "196.65.23.187:58216" Dropped NrUvpp2XaG from server Reason: Client sent 'drop' L 12/27/2016 - 13:49:22: "034Upua1jI<33><STEAM_0:1:24174909><>" connected, address "196.65.23.187:53779" Dropped 034Upua1jI from server Reason: Client sent 'drop' L 12/27/2016 - 13:492: "QJmy2KOTJ0<35><STEAM_0:1:24174909><>" connected, address "196.65.23.187:53788" Dropped QJmy2KOTJ0 from server Reason: Client sent 'drop' L 12/27/2016 - 13:49:48: "hV7L548d3x<36><STEAM_0:1:24174909><>" connected, address "196.65.23.187:53800" Dropped hV7L548d3x from server Reason: Client sent 'drop' L 12/27/2016 - 13:50:07: "2uFTiAV70h<38><STEAM_0:1:24174909><>" connected, address "196.65.23.187:53475" Dropped 2uFTiAV70h from server Reason: Client sent 'drop' L 12/27/2016 - 13:50:29: "HPLg3R0K54<39><STEAM_0:1:24174909><>" connected, address "196.65.23.187:53487" Dropped HPLg3R0K54 from server Reason: Client sent 'drop'

btw.. its bad to use the same ip.. i could ban it, its class, or entire range.

edit3: it seems the HLTV attack did the trick.. hehehe, autobuy hack ?

[Seikk.]

Originally Posted by DeNeDe hehehe, autobuy hack ?

No, this is "FVU xD" vulnerability.

I do not understand why you think the Steam servers is safe. It's all in the authorization of bot: any non-Steam exploit can be sent via HLTV (easy way) and any unprotected license server will be crash.

[DeNeDe]

try again
if you say that you can send via HLTV then sv_proxies 0 will kinda fix this

[Seikk.]

Originally Posted by DeNeDe try again

Meant Steam clean server, without DPRoto and Reunion plugins. Do not deviate from the topic.

So what about security? Continue to block addresses through a firewall? Or should somehow fix vulnerabilities that can benefit anyone?

Originally Posted by DeNeDe try again if you say that you can send via HLTV then sv_proxies 0 will kinda fix this

And if you send the exploit via native Steam Player? What to do then? Do not give them to connect to the server?

[DeNeDe]

Try again..sv is online.

[Freezo Begin]

thank's for the logs ... this confirm that we can send a fake player to a steam server with a valid steam id yay
And no it's not FVU and it's not HLTV lol ... if it's HLTV give us a proof of that ...

Here you go, your server goes offline ...
http://img11.hostingpics.net/pics/725340tata.png

[PRoSToTeM@]

Originally Posted by Seikk. So what about security?

Use ReHLDS.

[DeNeDe]

well that means we need to put some security modules from russian forums hehe..
you think reHLDS will handle this better? i could replace hlds with it and give it a try again
hmm.. FileDeath ? interesting.. allowdownload and allowupload are enabled by default maybe disableing them