POTENTIONAL FIX: etded.x86 getstatus exploit Options

[Guest_Dutchman_*]

Hi,

since a few months there is a exploit floating around abusing the getstatus requests to launch dos attacks against random targets and as a side effect creating massive lags on clients and the server.
Cause of this Yada from Staatsschutz.org made a patch for linux wich reduces the effectivity of this exploit.

etfix_getstatus 0.2 by yada / staatsschutz.org / jan. 2011
------

This patch will ratelimit etded.x86 2.60b getstatus requests to 1 per IP every
4 seconds. This approach is not ideal as the real fix would be to change the
protocol to require some kind of handshake but this would break compatibility
with existing clients so its not really practical. The worst part is that the
patch is (in theory) vulnerable to a dos where legitimate clients could be
denied access to the getstatus command but i feel this is less of a headache
than kiddies using the server to flood random targets and thereby lagging the
server and pushing bandwith usage through the roof (master server is excluded
from ratelimit so no need to worry about it being denied using spoofed
packets).

Download the file right here.

A readme.txt, the sourcecode and a small howto are included.

Your free to distribute this file.

This post has been edited by Dutchman: Jan 6 2011, 11:33 AM

[schnoog]

The getstatus exploit is more active than ever.

I talked to some admins and more than 10 000 incoming packets per seconds are not very rare.

OldMan posted a modified version of the q3_getstatus_ddos script here: http://wolffiles.de/index.php?forum-showposts-44-p5#

This one not only spoil plaintext getstatus attacks, it also handles zoneRef getstatus attacks.


That is like it looks after the script finnished his work:

CODE

rx: 6,1 Mbit/s 13862 p/s tx: 12 kbit/s 2 p/s

OldMan integrated some very nice features (delayed unban for example)

Unfortunality I`m not familar with the windows powershell, but there should also be a possibility to do such things.

[-sunkist-]

The getstatus exploit is more active than ever.

I talked to some admins and more than 10 000 incoming packets per seconds are not very rare.

Oh WOW! That's true! Holy shit!

I didn't see any attacks because I didn't list my ET servers in the Masterlist. Since I listed one of my ET servers again, the attacks are back - more then before!

Thank's for the hint!

Now I know where the attackers get the targets from: The Master Browser List!

When you use:

seta sv_master1 ""
seta sv_master2 ""
seta sv_master3 ""
seta sv_master4 ""
seta sv_master5 ""

in your server.cfg, your servers will not get listed in the Master Browser List and therefor they will not get attacked.

[Guest_Dutchman_*]

blabla

this has nothing to do with the topic about a patch for linux servers.
Is there a possibility you communicate in a normal way? thnx.

[-sunkist-]

blabla

this has nothing to do with the topic about a patch for linux servers.
Is there a possibility you communicate in a normal way? thnx.

Well, I regret to communicate in a higher level.

There will be no patch for linux servers from the vendor. But you may use one of the iptables scripts offered by me (http://www.vollspack.org/) or by others. These scripts will block these attacks. But you still will receive the traffic. There is nothing you can do against it.

This post has been edited by -sunkist-: Oct 17 2011, 11:05 PM

[Guest_Dutchman_*]

blabla

this has nothing to do with the topic about a patch for linux servers.
Is there a possibility you communicate in a normal way? thnx.

Well, I regret to communicate in a higher level.

There will be no patch for linux servers from the vendor. But you may use one of the iptables scripts offered by me (http://www.vollspack.org/) or by others. These scripts will block these attacks. But you still will receive the traffic. There is nothing you can do against it.

The fix i posted for linux servers as stated from yada in the readme file if fine.
Your post has nothing to do with solving it if you wan't to get your server(s) listed.