Hello,

there is a new spam and crash exploit out there, we have seen it today on 
our CS:S server. What happend? A player connected and was able to send some 
spam messages which looked like they came from the server console, the 
players name is "h 4 x" in the following log. It seems the messages where 
spammed during the connection, so I suppose he used a proxy to send 
malformed packets during connection. After his spam, he connected again and 
crashed the server.

Here the console spam:

L 11/15/2009 - 17:22:38: "h 4 x<552><STEAM_ID_PENDING><>" connected, address 
"87.122.42.104:27005"
L 11/15/2009 - 17:22:38: "Console<0><Console><Console>" say "SPAM"
L 11/15/2009 - 17:22:38: "Console<0><Console><Console>" say "OWNED"
L 11/15/2009 - 17:22:38: "Console<0><Console><Console>" say "SPAM"
L 11/15/2009 - 17:22:38: "Console<0><Console><Console>" say "SPAM"
L 11/15/2009 - 17:22:38: "Console<0><Console><Console>" say "Wollt ihr 
dieses Script kaufen?"
L 11/15/2009 - 17:22:38: "Console<0><Console><Console>" say "Dann added 
ruhsi643 in Steam"
L 11/15/2009 - 17:22:38: "Console<0><Console><Console>" say "SPAM"
L 11/15/2009 - 17:22:38: "Console<0><Console><Console>" say "HACKED"
L 11/15/2009 - 17:22:38: "Console<0><Console><Console>" say "SPAM"
L 11/15/2009 - 17:22:38: "Console<0><Console><Console>" say "OWNED"
L 11/15/2009 - 17:22:38: "Console<0><Console><Console>" say "SPAM"
L 11/15/2009 - 17:22:38: "Console<0><Console><Console>" say "SPAM"
L 11/15/2009 - 17:22:38: "Console<0><Console><Console>" say "Wollt ihr 
dieses Script kaufen?"
L 11/15/2009 - 17:22:38: "Console<0><Console><Console>" say "Dann added 
ruhsi643 in Steam"
L 11/15/2009 - 17:22:38: "Console<0><Console><Console>" say "SPAM"
L 11/15/2009 - 17:22:38: "Console<0><Console><Console>" say "HACKED"
L 11/15/2009 - 17:22:38: "Console<0><Console><Console>" say "SPAM"
L 11/15/2009 - 17:22:39: "Console<0><Console><Console>" say "OWNED"
L 11/15/2009 - 17:22:39: "Console<0><Console><Console>" say "SPAM"
L 11/15/2009 - 17:22:39: "Console<0><Console><Console>" say "SPAM"
L 11/15/2009 - 17:22:39: "Console<0><Console><Console>" say "Wollt ihr 
dieses Script kaufen?"
L 11/15/2009 - 17:22:39: "Console<0><Console><Console>" say "Dann added 
ruhsi643 in Steam"
L 11/15/2009 - 17:22:39: "Console<0><Console><Console>" say "SPAM"
L 11/15/2009 - 17:22:39: "Console<0><Console><Console>" say "HACKED"
L 11/15/2009 - 17:22:39: "Console<0><Console><Console>" say "SPAM"
L 11/15/2009 - 17:22:39: "Console<0><Console><Console>" say "OWNED"
L 11/15/2009 - 17:22:39: "Console<0><Console><Console>" say "SPAM"
L 11/15/2009 - 17:22:39: "Console<0><Console><Console>" say "SPAM"
L 11/15/2009 - 17:22:39: "h 4 x<552><STEAM_0:0:17742854><>" STEAM USERID 
validated
L 11/15/2009 - 17:22:39: "Console<0><Console><Console>" say "SPAM"
L 11/15/2009 - 17:22:39: "Console<0><Console><Console>" say "SPAM"
L 11/15/2009 - 17:22:39: "Console<0><Console><Console>" say "Wollt ihr 
dieses Script kaufen?"
L 11/15/2009 - 17:22:39: "Console<0><Console><Console>" say "Dann added 
ruhsi643 in Steam"
L 11/15/2009 - 17:22:39: "Console<0><Console><Console>" say "SPAM"
L 11/15/2009 - 17:22:39: "Console<0><Console><Console>" say "HACKED"
L 11/15/2009 - 17:22:39: "Console<0><Console><Console>" say "SPAM"
L 11/15/2009 - 17:22:39: "Console<0><Console><Console>" say "OWNED"
L 11/15/2009 - 17:22:39: "Console<0><Console><Console>" say "SPAM"
L 11/15/2009 - 17:22:39: "Console<0><Console><Console>" say "SPAM"
L 11/15/2009 - 17:22:39: "Console<0><Console><Console>" say "Wollt ihr 
dieses Script kaufen?"
L 11/15/2009 - 17:22:39: "Console<0><Console><Console>" say "Dann added 
ruhsi643 in Steam"
L 11/15/2009 - 17:22:39: "Console<0><Console><Console>" say "SPAM"
L 11/15/2009 - 17:22:39: "Console<0><Console><Console>" say "HACKED"
L 11/15/2009 - 17:22:39: "Console<0><Console><Console>" say "SPAM"
L 11/15/2009 - 17:22:39: "Console<0><Console><Console>" say "OWNED"
L 11/15/2009 - 17:22:39: "Console<0><Console><Console>" say "SPAM"
L 11/15/2009 - 17:22:39: "Console<0><Console><Console>" say "SPAM"
L 11/15/2009 - 17:22:39: "Console<0><Console><Console>" say "Wollt ihr 
dieses Script kaufen?"
L 11/15/2009 - 17:22:39: "Console<0><Console><Console>" say "Dann added 
ruhsi643 in Steam"
L 11/15/2009 - 17:22:40: "h 4 x<552><STEAM_0:0:17742854><>" disconnected 
(reason "Disconnect by user.")

The last log line is:

L 11/15/2009 - 17:27:00: "CRASHED BY ruhsi643 ADDET 
ruhsi<557><STEAM_ID_PENDING><>" connected, address "87.122.42.104:27005"

After this line, the server crashed. This is the last line, because we run 
our server with logflush.

Best regards

Ronny Schedel 


_______________________________________________
To unsubscribe, edit your list preferences, or view the list archives, please 
visit:
http://list.valvesoftware.com/mailman/listinfo/hlds_linux

Reply via email to