Author Topic: Server attacks?  (Read 3490 times)

SamOz

  • Posts: 143
  • Turrets: +2/-677
    • Samurai Tremulous
Server attacks?
« on: January 20, 2011, 03:02:27 pm »
I'm seeing a lot of servers with the same "name" in red lettering, basically an accusation about some guy I never heard of. There's at least ten servers, all with different IPs and maps. It's as if they'd been hacked. Anyone know about this, what's going on? Is this a security issue that I should be worried about for our server?

They're showing on the list of servers for protocol 69.

There were 19 of these a few minutes ago, now there are 20.
« Last Edit: January 20, 2011, 03:05:26 pm by SamOz »
Read about SamOz's MImod or download it here. Warning, It's BIG!!!
MImod is a new mod for Tremulous, with flashy script effects & High-Def textures in an Oriental-influenced theme.

NotYarou

  • Posts: 76
  • Turrets: +27/-2
    • Alcoholics Anonymous
Re: Server attacks?
« Reply #1 on: January 20, 2011, 05:57:55 pm »
It's an old exploit which was patched ages ago. (It basically allowed you to overwrite rcon)
Unfortunately, some pkg maintainers screwed up and automatically installed server w/o user confirmation.
This is why you see those "Tremulous 1.1.0 servers".

Now, when you combine said exploit with a perl script, you can write endearing messages to all your loved ones. I see in this particular instance, One.Floww has a fan.
You can safely ignore this.

SamOz

  • Posts: 143
  • Turrets: +2/-677
    • Samurai Tremulous
Re: Server attacks?
« Reply #2 on: January 21, 2011, 02:58:21 am »
Very confused ethics anyway; accuses someone of cheating, and does it by cheating using an exploit.
Read about SamOz's MImod or download it here. Warning, It's BIG!!!
MImod is a new mod for Tremulous, with flashy script effects & High-Def textures in an Oriental-influenced theme.

Kiwi

  • Posts: 859
  • Turrets: +29/-9
Re: Server attacks?
« Reply #3 on: January 22, 2011, 01:26:51 pm »
It's an old exploit which was patched ages ago. (It basically allowed you to overwrite rcon)
Unfortunately, some pkg maintainers screwed up and automatically installed server w/o user confirmation.
This is why you see those "Tremulous 1.1.0 servers".

Now, when you combine said exploit with a perl script, you can write endearing messages to all your loved ones. I see in this particular instance, One.Floww has a fan.
You can safely ignore this.

Would "ps -A | grep tremulous" ensure that you aren't hosting one of those "Tremulous 1.1.0 servers"?

Edit: I think you'd need to "grep tremded" instead.  I'm not hosting any 1.1 stuff, so I wouldn't be able to test this.
« Last Edit: January 22, 2011, 01:28:54 pm by Kiwi »