HLDS Exploit Released

[-:Nighthawk:-]

Helkite wrote..

Nighthawk... who are you speaking about, Dassbaba or the Security Focus people?

My first line was disapproval of posting links to the actual program. It's one thing to mention that an exploit was discovered, and link to a patch. It's another to link to the "here's how to start crashing servers!" page.



Primarily, though, I was referring to Luigi. Yes it's good to get problems taken care of, but forcing the issue in this manner is really stupid in my opinion. I'd see it roughly comparable (in concept, not in scope or end effect) to something like the Rodney King riots. Sure, you're upset about racial inequality, but going out and looting, beating people up, wreaking havok, and such... that is not an acceptable way of getting yourself heard. The end result makes people aware, sure. But in the meantime you've caused a lot of damage and screwed over a lot of people.



Releasing exact information on how to crash servers will result in servers going down, and a lot of people getting screwed over in Security Focus' little agenda to get a stupid buffer overflow check added. The ends, in my opinion, don't justify the means in this case.

Foo2rama wrote..

Nice explaination, thanks for clearing that up without me having to. :) I've seen "an historical document" simply because some people don't pronounce the H on that, though I personally do. But yeah, nicely done. :)

[gobd]

WOW. This is a huge exploit, i'm glad the person finally released the program now valve will get off their asses and fix the problem maybe. Someone that knew what they were doing could easily crash every single HL server that is vulerable to the exploit and nearly kill the game for a few hours. I tried it myself on my own server, it is amazingly easy to use.

[Ghengis]

Edited by [user="54146"] @ [time="1059585371"]

Yeh the an case tends to be more needed for people who fail to pronounce their H's properly, its 'haich' not 'aich'.



This exploit is within a few multishackx im sure...



Also on the CD and cheats debate, just started using cd recently and was horrified that people kinda wear the cheats as a badge of honour, like im leeter than ya average hacker cos I dled something for CD!



Yeh not smart posting link to the crashing thing... Agree with ya Nighty, Dunno if anyone went through dasbabba the general kinds of themes and sensibilities of posting news or not... Poor guy has posted a couple of 'reaction provoking' topics already receiving imho, a checkered reception ;P



It almost feels like he didnt visit the site much before.....



But keep em coming A change is as good as a rest.

[Thinge]

Thanks guys, now hundreds of servers are going down. All 4 of the servers I admin were hit. Why the hell did you have to post this? We don't need to know about it! All we need is for Valve to know about it and fix it.

[digglerdude]

Aye, all three of our servers have been hit continuosly throughout the day. I have to say, maybe a more subtle report of the exploit may have been in order :/

[kureosity]

From the "researcher" that posted this exploit:



Disclosure:

Full and responsible disclosure can lead to a quick fix, and prevent a problem before it gets into the wrong hands.

We've been down most of the day today - thanks for the irresponsible disclosure It's clear that your hands are the wrong hands...

[Pharlap]

maybe csn should remove the link to that site?

dasbabsbsbab, youre really the new king of good posts :) keep it up.

[thats supposed to be sarcastic]

[Thinge]

The damage is already done, removing the post or the link would do nothing. Now Valve have to hurry with this patch and get it out tomorrow or today.

Lots of companies have taken all of their HL servers down until the patch is out.

Thanks dassbaba, you've affected the whole HL community by posting this.

The only good to come from this is the patch will be out quicker but even if you hadn't posted this it still would have been patched, so it's not really good at all.

[Parallax-UK]

As I write this, over two-thirds of UK CS servers are down thanks to the publication of this security exploit. There's no point in taking it down now - the damage is pretty much done, and only Valve can fix it. It does have to be said though - linking to it in the first place was hugely, hugely irresponsible. Learn from this mess.

[muff99]

we host a 3rd party patch for linux, vmaster coded a small patch that adds an extra check to the overflowing function and terminates it if its too big. And since the exploit already spread, you can check for yourself if your server is safe again or not.



http://cd.redclaw-network.de/index.php?...k&newsid=2133



its in german, but its easy:

- download teh additional .so pack

- copy the right one (amd, 386, 486, 686) into your hl server dir

- add a line into hlds run, e.g. export LD_PRELOAD=boffix_amd.so (if you are using the amd file)

[FAF]

Three of my servers are back up now, one still down, and our ping/lag is shocking; due to the amount of DoS attacks on our provider's other servers?



I hate to say it, but I had never heard of this security site until I read this news post, and I'm sure most DoS attackers hadn't either. But they had heard of CSNation. Please in future, so that I don't end up cancelling matches due to hacking, wait until a fix is available before releasing links to HLDS problems :/

[ukHazard]

Disclosure:

Full and responsible disclosure can lead to a quick fix, and prevent a

problem before it gets into the wrong hands.

Reminds me of people who post links to cheats, citing the same.

[Pharlap]

i think a full formal appology is in order from dasbabasbabsbasb.

[Buddah]

Ghengis wrote..

Also on the CD and cheats debate, just started using cd recently and was horrified that people kinda wear the cheats as a badge of honour, like im leeter than ya average hacker cos I dled something for CD!

The average run of the mill cheat user isn't going to wait around for the cheat that gets by CD. They'll just get the VAC proof and off they go. Generally CD required servers I've seen the cheat usage is limited to ghosting and the occasional OGC user.



Is anyone actually shocked that so many servers crashed after this thread was posted with that link. It's like reverse psychology.

[Pharlap]

lol i just tried the server crashing program and it works!!! yes!

i did it on a server which has immature teen admins which slayed me for camping and for using a "stop reload script".



cya suckers!

PS, shame uk2.net servers have patched up, they are the worst servers on the planet and every1 deserves to ddos them!