Security Flaw in Maps and Mods

[Webs961]

Community members have recently decompiled modifications and maps created by community scripter, mapper, and modder KiLL3r and discovered a number of security flaws including a backdoor allowing users with access the ability to retrieve the RCON password of any server using the map or mod. Staff at InfinityWard.com have removed links to the mod and passwords, citing the potential security flaws.

WARNING: K3 V1.11 AND POSSIBLY PREVIOUS VERSIONS HAVE BEEN CONFIRMED TO HAVE THE ABILITY TO STEAL YOUR RCON PASSWORD -- THIS MOD ALSO HAS A BUILT-IN AIMBOT

To further prevent abuse of the security flaw, the staff at PBBans have taken an unprecedented step in issuing a manual MBI ban for KiLL3R across all PBBans enabled servers.

Server owners and administrators are highly advised to remove all of KiLL3R's mods from their servers until each mod is checked for malicious code and scripting.

Mods:
-K3
-Ion Cannon Mod
-Freeze Tag mod
-iBAS Beta 1.1 Mod
-UO Zombie Mod

Maps:
-Q3CTF3
-WAWA
-Maze1
-Backlot Night
-Rat House

All of these files which were hosted on Total Gaming Files have since been removed, and all mirrors are highly encouraged to remove these files.

[Dan2k3k4]

Re: Security Flaw in Maps and Mods

It doesn't exactly 'steal' the rcon password, it just shows the password only to KiLL3r, but he could easily write down each rcon that runs his mod, and then possibly breach into other servers that are run by same community, since many people use similar rcons for all servers they use... and the 'aimbot' can only be run by the bots, however pb could pickup this 'aimbot' and think you have an installed aimbot and then ban you...

[Webs961]

Re: Security Flaw in Maps and Mods

Hence it allows him to retrieve your RCON password.

[CptainCrunch]

Re: Security Flaw in Maps and Mods

Yea, trojan horses dont steal anything either, they just email passwords to specific hosts.

The bot stuff doesnt concern me, its the password thing. You dont need something like that. RCON is the key to the kingdom and though he may not have planned on using it, its an exploit waiting for someone else to figure out and manipulate.

Good posting and good job spreading the word.

Crunch

[ExitChicago]

Re: Security Flaw in Maps and Mods

Makes me wonder what other kind of bad stuff is included in theses custom maps, or even worse - mods. Call me paranoid, but I'm no longer allowing downloads and not playing on any servers with mods.

[JoMaMaz]

Re: Security Flaw in Maps and Mods

Makes me wonder what other kind of bad stuff is included in theses custom maps, or even worse - mods. Call me paranoid, but I'm no longer allowing downloads and not playing on any servers with mods.

You're paranoid.

[imported_Will]

Re: Security Flaw in Maps and Mods

Oh god. So this dosent steal our CD key?!?!

And 2 thumbs down to Kill3r. Trying to steal RCON's? Pff. PB should ban him.

[TSlaw*]

Re: Security Flaw in Maps and Mods

PB should ban him.

UMMMM

To further prevent abuse of the security flaw, the staff at PBBans have taken an unprecedented step in issuing a manual MBI ban for KiLL3R across all PBBans enabled servers.

[imported_Will]

Re: Security Flaw in Maps and Mods

Ok ok I get it. What i meant to say is

Good job PB for banning him but it dosnet steal your cd key right?:

[[TPG]MoFo]

Re: Security Flaw in Maps and Mods

It doesn't exactly 'steal' the rcon password, it just shows the password only to KiLL3r, but he could easily write down each rcon that runs his mod, and then possibly breach into other servers that are run by same community, since many people use similar rcons for all servers they use... and the 'aimbot' can only be run by the bots, however pb could pickup this 'aimbot' and think you have an installed aimbot and then ban you...

I could be wrong, but from the posts I saw on other boards, the aimbot is not for the bots, but works for his GUID/username allowing him to use it on servers with his mod.

[^Garf*uk*]

Re: Security Flaw in Maps and Mods

what a chimp

[[MyIS]Dan]

Re: Security Flaw in Maps and Mods

PB should ban him.

UMMMM

To further prevent abuse of the security flaw, the staff at PBBans have taken an unprecedented step in issuing a manual MBI ban for KiLL3R across all PBBans enabled servers.

Thats only if the server streams to PBBans, if it's only Punkbuster then he can still play.

[TSlaw*]

Re: Security Flaw in Maps and Mods

Thats only if the server streams to PBBans, if it's only Punkbuster then he can still play.

I stand corrected.

[MrKLM]

Re: Security Flaw in Maps and Mods

well while it is a bad thing, that is a smart thing im surprised no one thought of that before really.

[=98=]

Re: Security Flaw in Maps and Mods

Good find. Thanks for alerting us.