How to stop this CHEAT - HACKED DEDI SERVER

[Yammo]

The Virtual Red Arrows Server is going on a week up-time atm.

 

I'm basically blocking everything, then white-listing people on

request. Yesterday I added an IP and was taken down within

minutes. ...re-blocked the IP again and everything was stable

again.

 

While this method has several benefits, such as knowing that

everyone on the server will know the rules, etc. the downside

of not having your server advertised is quite sad. Also, finding

the correct ranges for people with Dynamic IPs is a b*.

 

Question:

Has anyone managed figured out a way to have the server

running without using a per user white-list?

 

RED4 | Yammo

http://www.virtualredarrows.com

[Nick DvB]

A firewall whitelist seems to be the only public solution at the moment, unless Hellboy wants to share his findings? But it is perfectly understandable that he wants to keep it private. I have one idea, maybe run the server over a VPN like Hamachi or Tunngle. This might make life difficult for the attackers current scripted attack (proxy configuration etc) and Tunngle has a very powerful API, Wireshark debugging might be able to capture the "packet of death" before it hits the server, there is also a large community who might be willing to help:

 

http://www.tunngle.net/wiki/Wireshark_Capture

 

 

http://www.tunngle.net/community/

 

It's just an idea but it might be worth a shot...

 

:)

Edited February 8, 2012 by Nick [D]vB

[GGTharos]

If you could stick iptables in the way you could do a lot better than white-listing. Unfortunately it isn't a viable solution for everyone.

[Rhinox]

I'd rather recommend starting with blacklist. If you block TOR (it is enough to block only exit nodes, and you can get list of them on tor's web) and known open proxies (some DNSBLs have quite good lists), I'd say you repel 90% of attacks. Of course it is not bullet-proof, especially when you consider number of free wifi hotspots...

[Speed]

I'd rather recommend starting with blacklist. If you block TOR (it is enough to block only exit nodes, and you can get list of them on tor's web) and known open proxies (some DNSBLs have quite good lists), I'd say you repel 90% of attacks. Of course it is not bullet-proof, especially when you consider number of free wifi hotspots...

On the bright side, if he DID have to use WiFi, you might get the douche bag doing this out of his mother's basement. He might actually run into another human being. The psychological trauma of that might cause him permanent harm :thumbup:

Edited February 8, 2012 by Speed

[FLANKERATOR]

vB;1395319']A firewall whitelist seems to be the only public solution at the moment' date=' unless Hellboy wants to share his findings?[/quote']

 

Hellboy has been temporary banned !? :D

 

White-listing is the only viable option at the moment, a bit more work for servers' admins and little hassle for users, at least it brings peace of mind to all.

[Rhinox]

Hellboy has been temporary banned !?

What a coincidence: exactly the one who claims he has working solution to this problem gets banned before he could disclose it to the community. Whom is this gonna help? Only the one who does not want fix for this problem to be known...

[FLANKERATOR]

exactly the one who claims he has working solution

 

Sometimes gap between claims and truth is huge. I personally trust ED on this one.

[Boberro]

Hmmm weird, but he's not dead. If you want to, you will find him on other forums, surely on squadron page.

[Nick DvB]

Sometimes gap between claims and truth is huge. I personally trust ED on this one.

But you can see how the conspiracy theories get started. Yes the memory hacks will take a major overhaul to fix but patching the server crash should be a few hours work for them, leaving it un-patched would be a convenient way to force the upgrade to FC3...

 

;)

[159th_Viper]

vB;1396073'].....but patching the server crash should be a few hours work for them....

 

And why would you deem it fit to comment on some thing you obviously know little about, further compounding the conspiracy theories? That's the question ;)

 

Let's do us all a favour and stop the conspiracy theories once and for all and keep the content to this thread relevant to the topic.

 

Ta

[Rhinox]

vB;1396073']But you can see how the conspiracy theories get started. Yes the memory hacks will take a major overhaul to fix but patching the server crash should be a few hours work for them' date=' leaving it un-patched would be a convenient way to force the upgrade to FC3...;)[/quote']

Long time I resisted saying something like this, but more and more I think that is exactly what's going to happen: FC2 will never get fixed, and if you want to play, go and buy FC3. Looking from ED's perspective, this is the best what could have happened...

 

btw I'm working for a company which inter alia sells software, but if in case of problems we acted the way ED does, we'd soon be forced to close our business...

[Nick DvB]

Truth be told I don't even play FC, or any flight sims, I'm an FPS man myself. A friend told me about your predicament, I only registered to suggest the Tunngle / Wireshark idea because they helped me solve a similar problem in the past. I'm not making any allegations, I'm just saying that for an outsider looking in something doesn't seem right. Good luck with your problem guys, I hope you find a solution soon.

 

:thumbup:

Edited February 9, 2012 by Nick [D]vB

[FLANKERATOR]

Solution has already been found, there are servers out there running smoothly, of course you wont find them anymore in the lobby because they are protecting themselves, but yes they aren't out of reach all you need to do is to contact the server admin and ask for IP clearance.

 

There is no conspiracy from ED whatsoever. You guys just need to read previous pages of this topic, you'll notice ED representatives, along with other servers' admins asking Hellboy to give more details about his so called solution . they obviousely want the issue to be solved as almost everyone else here.

This guy is banned for a good reason, and for the good of the MP community and there is no need to go into details.

Patched FC2 or FC3, pretty much the same, people who really want to fly still bother ask for IP clearance and are able to enjoy their time as before, not to say better than before.

[RIPTIDE]

hehe... Evil Dynamics hacking FC2.0 servers to make everyone buy FC3.0. I love it. :D

 

As for hellboy... it's Bedlam in the Russian forums, everyone gets stuck in, developers and all. He'll be back. They do things differently there ;)

[FLANKERATOR]

This guy is banned for a good reason, and for the good of the MP community and there is no need to go into details.

 

Correction :

This guy 'might' have been banned for a good reason, but I don't know.

 

I sincerely apologize to Hellboy. Assumptions are not good. Either you are sure 100% either silence.

[Heli Shed]

Correction :

This guy 'might' have been banned for a good reason, but I don't know.

 

I sincerely apologize to Hellboy. Assumptions are not good. Either you are sure 100% either silence.

 

:thumbup:

[Dimebag]

When it comes down to it, I am not going to buy FC3 if it's another rehash of FC 1. However, I will buy FC3 if it adds new content, such as new 3d cockpits, updating graphics to atleast a-10c quality, improved mission editor capabilities, use with a-10c and blackshark in multiplayer.

 

IMO, if ED really do make FC3 worth it, there is no need for them to intentionally screw with fc2, as the switch will happen naturally, as happened with fc1-2. People abandoned the original over a series of months, upgraded their hardware in order to play it, and the switch went fairly smoothly. if fc3 can't draw us to it on its own, there is no need for ED to make it.

 

Idle speculation aside, I personally don't think ED would ever do such a thing.

[Mustang]

updating graphics to atleast a-10c quality, improved mission editor capabilities, use with a-10c and blackshark in multiplayer.

 

FC3 will use the same graphics engine as the current DCS titles, and will feature cross-compatibility with A-10 and Ka-50.

[Postal2]

FC3 will use the same graphics engine as the current DCS titles, and will feature cross-compatibility with A-10 and Ka-50.

 

 

Cool, finally some good news.

 

And the network did you one information on the progress? ...

[Jona33]

FC3 will use the same graphics engine as the current DCS titles, and will feature cross-compatibility with A-10 and Ka-50.

 

And even better... The Mission Editor from DCS.

[Postal2]

All problém rejoins , freeze and co are out ? .

 

Its ok we can play any problem"s ? .:smilewink::pilotfly:

[c0ff]

The cheat in 1st post looks like an attack from a specially crafted fake client.

Some determined guy took time to analyze network protocol.

 

Patch for DCS (as well as future FC3) will have a protection against this and many other kinds of network attacks.

[Krebs20]

And that's his 666 post! This hacker better be scared from that alone!

[Speed]

And that's his 666 post! This hacker better be scared from that alone!

 

No, as far as c0ff is concerned, that would be his 29a post... he still needs 3cc to reach 666 :smartass:

 

It's good to see the ED team tackling this before it hits the current version of the TFCSE... but that is of little comfort right now to the FC2 crowd. I wonder if the lack of attacks on current TFCSE versions is from the difference in the network code between FC2 and current TFCSE, or something else I can't even begin to guess.

Edited February 15, 2012 by Speed