Punkbuster hacked?

[fffmmm]

I just found that: LINK REMOVED (Article contained command) -CaptainKirk

Hi there.

It's been said over and over again: Punkbuster is always right, defensive and will never cause false positives...
...nc once proved the opposite, and we will do it again.

We'll go straight to the point, we can ban anyone from any pb game's master banlist, as long as we have a server for that game.
Banning them is as easy as typing a command:
**COMMAND REMOVED** -CaptainKirk

After that command, any reputation of that player will be buried, his non-cheating friends probably will believe PunkBuster instead of him and hate him, his e-career will be destroyed, his clan will be kicked from any leagues they were doing at the moment, his game will be banned in most servers, etc, etc.
All that with just one command.
And this ban exploit is because of the stupidity of EvenBalance and the master ban lists.

We would like to add that making this "exploit" took us like 5 minutes after we discovered the gigantic security hole.

But, since you won't probably believe us, (after all, we're the "bad guys"), we've bothered ourselves to ban a lot of GUIDs, just to prove us right.

Grab some Doritos:



[media]http://www.youtube.com/watch?v=YaPB7shwJ3k[/media]

So what are you going to do? Are you going to continue trusting in such a pathetic system?
Just remember that if a server admin doesn't like you, he can wipe you out... with one command.

This was just a proof of concept. A mere "demonstration" to say. If this doesn't get fixed, the next time we get our hands in a server, we're going to ban players discreetly...
One by one, bans that are identical to genuine ones... but are forged by us.

Can you trust a banlist where the "evidence" is a mere log file that can be faked easily, like we just did? I don't think so.

We could bet 10 bucks, without losing them, that this exploit has already been reported... Countless times. It was far too easy to find, for another person to not notice.
But it wasn't in the eyes of the public, until now. So they didn't give a ****.

Would you trust a banlist staff whose conscience allows them to continue banning players, even through they know that some, might be innocent players, whose only crime was making a server admin angry?
I wouldn't.

Now, the reaction we expect is that all the bans caused by our server will get deleted with no trace. (EDIT: They already got deleted.) But, can you assure that no one knows how to do this? Can you assure that we wouldn't just distribute this exploit underground? You can't.
Your system bans innocent players, that is now, A FACT.

Credits:
PB lulz team.
Our friendly host.
All the donators who helped covering the server costs.
All serveradmins that were so nice sharing server logs.
PunkBuster Online Countermeasures.
PBBans


PD: Also a wink to the spanish community and their banned clanners, they served as good test subjects.

They hacked punkbuster (again?) and banned a ****load of peoples! I really loose my trust in PB!

FFFMMM

[Natt]

Re: Punkbuster hacked?

Look at the names of the players they 'banned', they are all random letters and numbers. Looks like bull to me.
And there are no players banned from NoS server in the last 2 months. http://www.pbbans.com/mbi-latest50-bf2142-lfb22.html

[Rugerdog]

Re: Punkbuster hacked?

There were a bunch of players banned from that server last night. I saw them coming in by the droves from the pbbans streaming on our server. They removed all of those bans not long after though, so they won't show up anymore.

[LaikaSB]

Re: Punkbuster hacked?

Haha yeah this hack is whack. The server also paused while "people" were getting kicked.

[SuperiorityC]

Re: Punkbuster hacked?

there was also a similar hack where they would to irc servers of people who played pb games and send strings of text that were the signature of hack programs that pb tried to detect in memories. This method works and pb has yet to patch it.

and for those of you who do not know what kind of damage this can do, just keep in mind almost all competitive players float in gamesurge irc looking for scrims while they are playing so a single text string being sent into irc is damaging to the reputations of hundreds if not thousands of good players.

so yeah, were pretty much ****ed.

Haha yeah this hack is whack. The server also paused while "people" were getting kicked.

the point is that they can fake whatever kick they want on anyone and it will stream to pbbans regardless of whether its real or not. unless they decided to login a bunch of players with different cd keys and ran detected hacks on all of them this is still proof that admins can send whatever ban information they want to pbbans.