Re: [hlds_linux] Garry's Mod server admins: be alert to a Lua rcon exploit currently making the rounds
So was this used to obtain rcon passwords in other games such as TF2? On Sat, Apr 19, 2014 at 9:45 PM, Tyrone wrote: > The exploit works on all source based games according to Garry. > > > On Fri, Apr 18, 2014 at 11:11 PM, wickedplayer494 > wrote: > >> http://facepunch.com/showthread.php?t=1386818 >> >> If your clients are complaining about "*cough*" spam or similar through >> Steam chat, this is what's causing it. It may be wise to just completely >> kill your server until the Facepunch folks release an update to fix this >> (even though it's 3 AM in the UK), as it's rumored that even if rcon/client >> uploads are disabled, it'll still work. >> >> ___ >> To unsubscribe, edit your list preferences, or view the list archives, >> please visit: >> https://list.valvesoftware.com/cgi-bin/mailman/listinfo/hlds_linux >> > ___ > To unsubscribe, edit your list preferences, or view the list archives, please > visit: > https://list.valvesoftware.com/cgi-bin/mailman/listinfo/hlds_linux ___ To unsubscribe, edit your list preferences, or view the list archives, please visit: https://list.valvesoftware.com/cgi-bin/mailman/listinfo/hlds_linux
Re: [hlds_linux] Garry's Mod server admins: be alert to a Lua rcon exploit currently making the rounds
Yes, this unfortunately impacted a lot of European CS:S servers (L4D(2) and other engines will forever be compromised). Based on the scope, everything the server's user was running as is compromised. However, the running guess is that people were still only after quick wins; such as changing the server hostname and printing garbage. Thanks, Kyle. On Mon, Apr 21, 2014 at 7:14 AM, Valentin G. wrote: > So was this used to obtain rcon passwords in other games such as TF2? > > On Sat, Apr 19, 2014 at 9:45 PM, Tyrone wrote: >> The exploit works on all source based games according to Garry. >> >> >> On Fri, Apr 18, 2014 at 11:11 PM, wickedplayer494 >> wrote: >> >>> http://facepunch.com/showthread.php?t=1386818 >>> >>> If your clients are complaining about "*cough*" spam or similar through >>> Steam chat, this is what's causing it. It may be wise to just completely >>> kill your server until the Facepunch folks release an update to fix this >>> (even though it's 3 AM in the UK), as it's rumored that even if rcon/client >>> uploads are disabled, it'll still work. >>> >>> ___ >>> To unsubscribe, edit your list preferences, or view the list archives, >>> please visit: >>> https://list.valvesoftware.com/cgi-bin/mailman/listinfo/hlds_linux >>> >> ___ >> To unsubscribe, edit your list preferences, or view the list archives, >> please visit: >> https://list.valvesoftware.com/cgi-bin/mailman/listinfo/hlds_linux > > ___ > To unsubscribe, edit your list preferences, or view the list archives, please > visit: > https://list.valvesoftware.com/cgi-bin/mailman/listinfo/hlds_linux ___ To unsubscribe, edit your list preferences, or view the list archives, please visit: https://list.valvesoftware.com/cgi-bin/mailman/listinfo/hlds_linux
Re: [hlds_linux] [hlds] Mandatory CS:S, DoD:S, and HL2:DM updates released
What? it was .RU site - what could go wrong with that? http://forums.pelicanparts.com/uploads22/941048597_free_candy_van1386440078.jpg On Mon, Apr 21, 2014 at 12:09 PM, ics wrote: > Just a worhy note for everyone, don't trust every site you see on the > internet. No one knows if these sites will log the entries to a file and > you can imagine the rest. > > -ics > > Denis Eliseev kirjoitti: > >> Better version for practically all interfaces https://ssl.sky-play.ru/ >> gameservers_en.html >> >> 20.04.2014, 22:33, "Ross Bemrose" : >> >>> I've heard that this adds the sv_setsteamaccount command to these games. >>> Is that true? >>> >>> If so, I'll remind players that I have a temp webpage for registering >>> those accounts until Valve makes one... you can find it at >>> http://tf2.rbemrose.com/steamreg.html >>> >>> You can also find it on my sourcemod-snippets GitHub at >>> https://github.com/powerlord/sourcemod-snippets/blob/ >>> master/steamreg.html , >>> but the webpage is not actually useable there (clicking the Raw button >>> will give you just the source which you can save and run locally). >>> >>> On 4/19/2014 8:57 PM, Tony Paloma wrote: >>> >>>We've released mandatory updates for CS:S, DoD:S, and HL2:DM. The notes for the updates are below. The new version for each game is 2192040. - Updated Orange Box games with server, client, and engine fixes from Team Fortress 2 ___ To unsubscribe, edit your list preferences, or view the list archives, please visit: https://list.valvesoftware.com/cgi-bin/mailman/listinfo/hlds >>> ___ >>> To unsubscribe, edit your list preferences, or view the list archives, >>> please visit: >>> https://list.valvesoftware.com/cgi-bin/mailman/listinfo/hlds >>> >> ___ >> To unsubscribe, edit your list preferences, or view the list archives, >> please visit: >> https://list.valvesoftware.com/cgi-bin/mailman/listinfo/hlds >> > > > ___ > To unsubscribe, edit your list preferences, or view the list archives, > please visit: > https://list.valvesoftware.com/cgi-bin/mailman/listinfo/hlds > ___ To unsubscribe, edit your list preferences, or view the list archives, please visit: https://list.valvesoftware.com/cgi-bin/mailman/listinfo/hlds_linux
Re: [hlds_linux] [hlds] Mandatory Nuclear Dawn update released
Thanks for this Nicholas, I hope that pulling ND out of beta for Linux and the other fixes will lure some new players to this great game, so we can actually play some fun matches again online. On Sun, Apr 20, 2014 at 9:23 PM, Nicholas Hastings wrote: > A mandatory update for Nuclear Dawn has been released. > > For anyone still running servers, you will need to update in order for > clients to still be able to connect. This is the final version of the update > that has been on the "linuxbeta" branch for the past few months. > > As a reminder, ND Dedicated Server's app id is 111710. > > The full changelog is below. > > General: > - Added client support for Linux. > - Fixed Russian and Czech Languages not being selectable in Steam game > properties. > - Fixed minimap placement issues that would sometimes occur after resolution > change. > - Fixed issue where commander could get stuck on a ladder in RTS view. > - Fixed sonic turret fire range being slightly shorter than lock-on range. > - Whitelisted r_decals client convar by community request. > - Improved overall stability. > > Community-created Content: > - Updated Workshop map instructions link. > - Added missing "Final" Hammer compile configuration. > - Fixed typo in Hammer fgd file causing Empire wall and barrier issues. > - Fixed client crash when subscribed to Workshop file that no longer exists > or has been made private. > - Fixed server crashes that could occur when attempting to sync Workshop > maps when Steam was down or syncing current map. > - Fixed uploading maps of size > 100mb to Workshop. > - Increased individual user Workshop storage quota to 1gb. > - Greatly improved client subscribed Workshop map sync time on game launch. > - HTTPS map downloads with self-signed certificates now work. > - Clients now automatically download game server Workshop-synced maps > directly from Workshop on connect. > - Map support files (scripts, loading image, etc.) now get > automatically"bspzipped" into the map before upload if not already in map. > > -- > Nicholas Hastings > > > ___ > To unsubscribe, edit your list preferences, or view the list archives, > please visit: > https://list.valvesoftware.com/cgi-bin/mailman/listinfo/hlds > -- Idleness is not doing nothing. Idleness is being free to do anything. - Floyd Dell ___ To unsubscribe, edit your list preferences, or view the list archives, please visit: https://list.valvesoftware.com/cgi-bin/mailman/listinfo/hlds_linux
Re: [hlds_linux] Garry's Mod server admins: be alert to a Lua rcon exploit currently making the rounds
I guess the "shadow update" has fixed the exploit now? It definitely looks like they didn't go quite far with the exploit (we were hit by it aswell). I assume they downloaded the server.cfg to get a hold of the rcon password, correct? And there probably is no trace of any of this happening. Would it be worth wile to move sensitive stuff to randomly named files for the future, or was it possible to obtain file listings through this exploit? On 4/21/14, Kyle Sanderson wrote: > Yes, this unfortunately impacted a lot of European CS:S servers > (L4D(2) and other engines will forever be compromised). Based on the > scope, everything the server's user was running as is compromised. > However, the running guess is that people were still only after quick > wins; such as changing the server hostname and printing garbage. > > Thanks, > Kyle. > > On Mon, Apr 21, 2014 at 7:14 AM, Valentin G. wrote: >> So was this used to obtain rcon passwords in other games such as TF2? >> >> On Sat, Apr 19, 2014 at 9:45 PM, Tyrone wrote: >>> The exploit works on all source based games according to Garry. >>> >>> >>> On Fri, Apr 18, 2014 at 11:11 PM, wickedplayer494 >>> >>> wrote: >>> http://facepunch.com/showthread.php?t=1386818 If your clients are complaining about "*cough*" spam or similar through Steam chat, this is what's causing it. It may be wise to just completely kill your server until the Facepunch folks release an update to fix this (even though it's 3 AM in the UK), as it's rumored that even if rcon/client uploads are disabled, it'll still work. ___ To unsubscribe, edit your list preferences, or view the list archives, please visit: https://list.valvesoftware.com/cgi-bin/mailman/listinfo/hlds_linux >>> ___ >>> To unsubscribe, edit your list preferences, or view the list archives, >>> please visit: >>> https://list.valvesoftware.com/cgi-bin/mailman/listinfo/hlds_linux >> >> ___ >> To unsubscribe, edit your list preferences, or view the list archives, >> please visit: >> https://list.valvesoftware.com/cgi-bin/mailman/listinfo/hlds_linux > > ___ > To unsubscribe, edit your list preferences, or view the list archives, > please visit: > https://list.valvesoftware.com/cgi-bin/mailman/listinfo/hlds_linux > ___ To unsubscribe, edit your list preferences, or view the list archives, please visit: https://list.valvesoftware.com/cgi-bin/mailman/listinfo/hlds_linux
