N!tmod - GUID verification & other security features

[Nitrox*]

Haiiii there!

 

I just finished working on N!tmod GUID checker.

 

I've spent more than an hour testing it with randomly hacked or invalid guid and none of my attemps to connect were successfull.

 

Here is a screenshot showing what clients with invalid guid will see when they will attempt to connect to a N!tmod (future versions) server.

 

 

By default, N!tmod accepts connections from players that have no guid (i.e.: cl_guid = "unknown")

 

If you're running a server and you don't want to allow empty guids, you can simply set g_allowNoGUID to 0 (Other checks willl still be performed)

 

We will also probably add a Valid IP checker.

[-=Medic=-]

wow tonton great job and great feature

[Nitrox*]

Ok i'm back for more infos, i had to take some screenshots to compare Jaymod and N!tmod. I compared to Jaymod because Jaymod is the most used mod after ETPro (and still so hackable...)

 

Note : I used a hacked client to perform these tests, still this hacked client is available to everyone that knows how to use google.

 

You probably already heard of the famous ET callvote exploit. If you didn't, it allows you passing rcon commands by calling some specific votes with a special string.

 

Jaymod (without any addon) is 100% vulnerable.

 

N!tmod isn't vulnerable to this exploit. And what's the good thing ? It's built in the mod. You don't need to install any server addons

 

Want any proofs ? There we go :

 

Jaymod 2008-01-25-2.1.8 (latest release, older versions are also vulnerable)

 

 

N!tmod 1.4-feb28 (older versions are NOT vulnerable either)

 

 

When using N!tmod, the vote isn't even called because the vote string isn't valid.

 

Safe eh?

[Nitrox*]

Fixed another callvote / ref exploit a few hours ago (This exploit is still present on ETpub, NQ, ETPro, and Jaymod)

[Adrian]

Hey nice work man great staff

[bLiNk]

Nice feature Nitrox. Suggestion. For the 2nd error message box attached to the screenshot in your first post:

 

This server doesn't allow connections with an empty GUID

You should add a note at the bottom of the box for those who want to resolve that particular issue on the spot. Something like this:

 

Note: To remedy issue, type in "pb_cl_enable;pb_cdkeyreg" without the quotes in game console.

Edit: Changed procedure to enable PunkBuster Client and issue Cdkeyreg/GUID all in one step.

Edited March 3, 2010 by bLiNk

[-=Medic=-]

Nice feature Nitrox. Suggestion. For the 2nd error message box attached to the screenshot in your first post:

 

 

You should add a note at the bottom of the box for those who want to resolve that particular issue on the spot. Something like this:

 

 

 

yes +1

[ohurcool]

You spelled "length" wrong twice in the upper-left box.

[Nitrox*]

Ooops

lmao i have a problem with this word, i keep spelling it wrong :s Prolly the fact that i'm a frenchie

 

Thanks for telling me, code fixed