[leong124]

Today my server faced a bot attack that I've never seen. The attacker only connects once, that is only one "Incoming connection: ....." is displayed. Then there will be a lot of connections using the same ID and IP address. The names are random just like the other bot attacker program.

I think it can be easily blocked by checking if that ID is connected/reserved before the coming connection, and then banning the incoming player if it is, but I still hope that the dev team can get noticed and maybe try to fix the vulnerabilities.

Код:

[2013-01-30 14:14:27] Incoming connection: hidden:56364
[2013-01-30 14:14:28] [join] ys_so.lag has joined the server (35:hidden) //This is server log.
[2013-01-30 14:14:28] [14:14:28] ys_so.lag has joined the server.(IP:hidden) //This is gamemode log.
[2013-01-30 14:14:28] [join] 369369963_Dwvx has joined the server (35:hidden) 
[2013-01-30 14:14:28] [14:14:28] 369369963_Dwvx has joined the server.(IP:hidden)
[2013-01-30 14:14:28] [join] 369369963_D94x has joined the server (35:hidden)
[2013-01-30 14:14:28] [14:14:28] 369369963_D94x has joined the server.(IP:hidden)
[2013-01-30 14:14:28] [join] 369369963_DhO8 has joined the server (35:hidden)
[2013-01-30 14:14:28] [14:14:28] 369369963_DhO8 has joined the server.(IP:hidden)
[2013-01-30 14:14:28] [join] 369369963_DLm8 has joined the server (35:hidden)
[2013-01-30 14:14:28] [14:14:28] 369369963_DLm8 has joined the server.(IP:hidden)
[2013-01-30 14:14:28] [join] 369369963_DXbX has joined the server (35:hidden)
[2013-01-30 14:14:28] [14:14:28] 369369963_DXbX has joined the server.(IP:hidden)
[2013-01-30 14:14:28] [join] 369369963_DrAN has joined the server (35:hidden)
[2013-01-30 14:14:28] [14:14:28] 369369963_DrAN has joined the server.(IP:hidden)
[2013-01-30 14:14:28] [join] 369369963_D4uy has joined the server (35:hidden)
[2013-01-30 14:14:28] [14:14:28] 369369963_D4uy has joined the server.(IP:hidden)
[2013-01-30 14:14:28] [join] 369369963_DGlZ has joined the server (35:hidden)
[2013-01-30 14:14:28] [14:14:28] 369369963_DGlZ has joined the server.(IP:hidden)
[2013-01-30 14:14:28] [join] 369369963_DY5T has joined the server (35:hidden)
[2013-01-30 14:14:28] [14:14:28] 369369963_DY5T has joined the server.(IP:hidden)
[2013-01-30 14:14:28] [join] 369369963_Dqem has joined the server (35:hidden)
[2013-01-30 14:14:28] [14:14:28] 369369963_Dqem has joined the server.(IP:hidden)
[2013-01-30 14:14:28] [join] 369369963_DXaI has joined the server (35:hidden)
[2013-01-30 14:14:28] [14:14:28] 369369963_DXaI has joined the server.(IP:hidden)
[2013-01-30 14:14:28] [join] 369369963_DQh1 has joined the server (35:hidden)
[2013-01-30 14:14:28] [14:14:28] 369369963_DQh1 has joined the server.(IP:hidden)
[2013-01-30 14:14:28] [join] 369369963_D1hi has joined the server (35:hidden)
[2013-01-30 14:14:28] [14:14:28] 369369963_D1hi has joined the server.(IP:hidden)
[2013-01-30 14:14:28] [join] 369369963_DRAJ has joined the server (35:hidden)
[2013-01-30 14:14:28] [14:14:28] 369369963_DRAJ has joined the server.(IP:hidden)
[2013-01-30 14:14:28] [join] 369369963_DrMt has joined the server (35:hidden)
[2013-01-30 14:14:28] [14:14:28] 369369963_DrMt has joined the server.(IP:hidden)
[2013-01-30 14:14:28] [join] 369369963_DWd4 has joined the server (35:hidden)
[2013-01-30 14:14:28] [14:14:28] 369369963_DWd4 has joined the server.(IP:hidden)
[2013-01-30 14:14:28] [join] 369369963_DQ0u has joined the server (35:hidden)
[2013-01-30 14:14:28] [14:14:28] 369369963_DQ0u has joined the server.(IP:hidden)
[2013-01-30 14:14:28] [14:14:28] (hidden)(28) entered command :(hidden) //This is gamemode log.
[2013-01-30 14:14:28] [join] 369369963_DTHe has joined the server (35:hidden)
[2013-01-30 14:14:28] [14:14:28] 369369963_DTHe has joined the server.(IP:hidden)
[2013-01-30 14:14:28] [join] 369369963_D7Il has joined the server (35:hidden)
[2013-01-30 14:14:28] [14:14:28] 369369963_D7Il has joined the server.(IP:hidden)
[2013-01-30 14:14:28] [join] 369369963_DIUs has joined the server (35:hidden)
[2013-01-30 14:14:28] [14:14:28] 369369963_DIUs has joined the server.(IP:hidden)
[2013-01-30 14:14:28] [join] 369369963_DlKt has joined the server (35:hidden)
[2013-01-30 14:14:28] [14:14:28] 369369963_DlKt has joined the server.(IP:hidden)
[2013-01-30 14:14:28] [join] 369369963_DCe0 has joined the server (35:hidden)
[2013-01-30 14:14:28] [14:14:28] 369369963_DCe0 has joined the server.(IP:hidden)
[2013-01-30 14:14:28] [join] 369369963_DRVz has joined the server (35:hidden)
[2013-01-30 14:14:28] [14:14:28] 369369963_DRVz has joined the server.(IP:hidden)
[2013-01-30 14:14:28] [join] 369369963_DI0F has joined the server (35:hidden)
[2013-01-30 14:14:28] [14:14:28] 369369963_DI0F has joined the server.(IP:hidden)
[2013-01-30 14:14:28] [join] 369369963_DLot has joined the server (35:hidden)
[2013-01-30 14:14:28] [14:14:28] 369369963_DLot has joined the server.(IP:hidden)
[2013-01-30 14:14:28] [join] 369369963_Dbce has joined the server (35:hidden)
[2013-01-30 14:14:28] [14:14:28] 369369963_Dbce has joined the server.(IP:hidden)
[2013-01-30 14:14:28] [join] 369369963_D9PN has joined the server (35:hidden)
[2013-01-30 14:14:28] [14:14:28] 369369963_D9PN has joined the server.(IP:hidden)
[2013-01-30 14:14:28] [join] 369369963_DNrE has joined the server (35:hidden)
[2013-01-30 14:14:28] [14:14:28] 369369963_DNrE has joined the server.(IP:hidden)
[2013-01-30 14:14:28] [join] 369369963_DQH5 has joined the server (35:hidden)
[2013-01-30 14:14:28] [14:14:28] 369369963_DQH5 has joined the server.(IP:hidden)
[2013-01-30 14:14:28] [join] 369369963_DkqE has joined the server (35:hidden)
[2013-01-30 14:14:28] [14:14:28] 369369963_DkqE has joined the server.(IP:hidden)
[2013-01-30 14:14:28] [join] 369369963_DPNS has joined the server (35:hidden)
[2013-01-30 14:14:28] [14:14:28] 369369963_DPNS has joined the server.(IP:hidden)
[2013-01-30 14:14:28] [join] 369369963_DLwm has joined the server (35:hidden)
[2013-01-30 14:14:28] [14:14:28] 369369963_DLwm has joined the server.(IP:hidden)
[2013-01-30 14:14:28] [join] 369369963_DidR has joined the server (35:hidden)
[2013-01-30 14:14:28] [14:14:28] 369369963_DidR has joined the server.(IP:hidden)
[2013-01-30 14:14:28] [join] 369369963_D6gF has joined the server (35:hidden)
[2013-01-30 14:14:28] [14:14:28] 369369963_D6gF has joined the server.(IP:hidden)
[2013-01-30 14:14:28] [join] 369369963_DZdz has joined the server (35:hidden)
[2013-01-30 14:14:28] [14:14:28] 369369963_DZdz has joined the server.(IP:hidden)
[2013-01-30 14:14:29] [join] 369369963_D2UB has joined the server (35:hidden)
[2013-01-30 14:14:29] [14:14:29] 369369963_D2UB has joined the server.(IP:hidden)
[2013-01-30 14:14:29] [join] 369369963_DIKi has joined the server (35:hidden)
[2013-01-30 14:14:29] [14:14:29] 369369963_DIKi has joined the server.(IP:hidden)
[2013-01-30 14:14:29] [join] 369369963_DXbz has joined the server (35:hidden)
[2013-01-30 14:14:29] [14:14:29] 369369963_DXbz has joined the server.(IP:hidden)
[2013-01-30 14:14:29] [join] 369369963_DWW1 has joined the server (35:hidden)
[2013-01-30 14:14:29] [14:14:29] 369369963_DWW1 has joined the server.(IP:hidden)
[2013-01-30 14:14:29] [join] 369369963_Dt4B has joined the server (35:hidden)
[2013-01-30 14:14:29] [14:14:29] 369369963_Dt4B has joined the server.(IP:hidden)
[2013-01-30 14:14:29] [join] 369369963_D8NT has joined the server (35:hidden)
[2013-01-30 14:14:29] [14:14:29] 369369963_D8NT has joined the server.(IP:hidden)
[2013-01-30 14:14:29] [join] 369369963_DmTZ has joined the server (35:hidden)
[2013-01-30 14:14:29] [14:14:29] 369369963_DmTZ has joined the server.(IP:hidden)
[2013-01-30 14:14:29] [join] 369369963_DejM has joined the server (35:hidden)
[2013-01-30 14:14:29] [14:14:29] 369369963_DejM has joined the server.(IP:hidden)
[2013-01-30 14:14:29] [join] 369369963_DMhw has joined the server (35:hidden)
[2013-01-30 14:14:29] [14:14:29] 369369963_DMhw has joined the server.(IP:hidden)
[2013-01-30 14:14:29] [join] 369369963_DAzp has joined the server (35:hidden)
[2013-01-30 14:14:29] [14:14:29] 369369963_DAzp has joined the server.(IP:hidden)
[2013-01-30 14:14:29] [join] 369369963_Dl3D has joined the server (35:hidden)
[2013-01-30 14:14:29] [14:14:29] 369369963_Dl3D has joined the server.(IP:hidden)
[2013-01-30 14:14:29] [join] 369369963_DTAR has joined the server (35:hidden)
[2013-01-30 14:14:29] [14:14:29] 369369963_DTAR has joined the server.(IP:hidden)
[2013-01-30 14:14:30] [join] 369369963_DDTd has joined the server (35:hidden)
[2013-01-30 14:14:30] [14:14:30] 369369963_DDTd has joined the server.(IP:hidden)
[2013-01-30 14:14:30] [join] 369369963_DIRj has joined the server (35:hidden)
[2013-01-30 14:14:30] [14:14:30] 369369963_DIRj has joined the server.(IP:hidden)
[2013-01-30 14:14:30] [join] 369369963_Ds62 has joined the server (35:hidden)
[2013-01-30 14:14:30] [14:14:30] 369369963_Ds62 has joined the server.(IP:hidden)
[2013-01-30 14:14:30] [join] 369369963_D4nD has joined the server (35:hidden)
[2013-01-30 14:14:30] [14:14:30] 369369963_D4nD has joined the server.(IP:hidden)
[2013-01-30 14:14:30] [join] 369369963_DldF has joined the server (35:hidden)
[2013-01-30 14:14:30] [14:14:30] 369369963_DldF has joined the server.(IP:hidden)
[2013-01-30 14:14:30] [join] 369369963_D2as has joined the server (35:hidden)
[2013-01-30 14:14:30] [14:14:30] 369369963_D2as has joined the server.(IP:hidden)
[2013-01-30 14:14:30] [join] 369369963_DRaI has joined the server (35:hidden)
[2013-01-30 14:14:30] [14:14:30] 369369963_DRaI has joined the server.(IP:hidden)
[2013-01-30 14:14:30] [join] 369369963_DOyP has joined the server (35:hidden)
[2013-01-30 14:14:30] [14:14:30] 369369963_DOyP has joined the server.(IP:hidden)
[2013-01-30 14:14:30] [join] 369369963_DiIs has joined the server (35:hidden)
[2013-01-30 14:14:30] [14:14:30] 369369963_DiIs has joined the server.(IP:hidden)
[2013-01-30 14:14:30] [join] 369369963_D9gV has joined the server (35:hidden)
[2013-01-30 14:14:30] [14:14:30] 369369963_D9gV has joined the server.(IP:hidden)
[2013-01-30 14:14:30] [join] 369369963_DIPH has joined the server (35:hidden)
[2013-01-30 14:14:30] [14:14:30] 369369963_DIPH has joined the server.(IP:hidden)
[2013-01-30 14:14:30] [join] 369369963_D8Gi has joined the server (35:hidden)
[2013-01-30 14:14:30] [14:14:30] 369369963_D8Gi has joined the server.(IP:hidden)
[2013-01-30 14:14:30] [14:14:30] 369369963_D8Gi has left the server himself. //This is gamemode log.
[2013-01-30 14:14:30] [part] 369369963_D8Gi has left the server (35:1) //Name seems to be changed.

[Madeline]

I have already faced that type of attacks before, I always use my method of blocking him from a server.

[Lorenc_]

I have about four times the spam you are getting LOL. Exact crap, just "369369963" is replaced with another name and their IP constantly changes like shit.

[leong124]

Currently those who attack my server still uses the same IP, but this time they also uses the same ID so as to fake the gamemode to have a lot of players, while there is still one bot only.

[Killa[DGZ]]

Looks like the same old attacks to me.. just new names and as I've found they all consume one player slot, joining around 450+ names per second and OnPlayerDisconnect doesn't seem to get called for any of them.. ever!

I've reported this before and it can actually crash your server if it continues for a long period of time as seen here..
https://sampforum.blast.hk/showthread.php?tid=399786


You can stop these idiots by using RyDeR's Flood control > https://sampforum.blast.hk/showthread.php?tid=320649

[kaisersouse]

Seriously, like Killa just stated...this is easily blockable. Jernej_L makes an antiflood as well

[leong124]

Ok thanks. Actaully I already have some blocking for the attack which comes from the same IP. I only haven't thought of the possibility for hackers to "share" the same ID.
And yes, in the first post I found the simple way to effectively block this kind of attack in scripts. I just report it and see if it's a new one. Now I know that it isn't new, so let's just leave it here and the others will find the solution for this problem.

[Maklister]

When you download the SA: MP server, folder filterscript now comes a fs anti bot

[leong124]

You mean maxips? It wouldn't work in this case, because that script search for all the players by player ID and see if there are any matching IP addresses, while the hack actually only uses one ID for a lot of players. You may say it is a real player with a long of fake connections.

[Guest9328472398472]

Block the IPs, simple as that!