Fix for the Certification Server

[Amanda98]

Originally Posted by jangan322

Perfection, InsaneSRo, ******, elitesro, atomix, salvation = 100% patched and secure.


so yeah... no one cares about this ****** hack anymore... good game!

For now...

[jangan322]

Originally Posted by Amanda98

For now...

rofl, i would love to see you try and hack one of those servers.

[Miki Maus]

Originally Posted by rushcrush

well not so important since all the ports changed to new numbers(the hacker wont know it ^^)

nmap - ip adress - port range. gf.

[B3G0D0FW4R]

Why he cant get port of server?
netstat -n

FTW

[Amanda98]

Originally Posted by jangan322

rofl, i would love to see you try and hack one of those servers.

Why pointing at me? Oriya is the one who u should worry about But my prediction is if Oriya could get hundred bucks by just messing your server database i don't think he would stop now.

[harddriver]

Reading threw all of these posts here is a idea if we can implement it on our servers. Why not just setup a validation packet that the server will allow the connection if it has this packet. And this packet is only included with the sro_client? But also for those of you that have servers up and you are the owners if you find out whos doing this, which you can by pulling logs im hoping you have logs bc if not then you are just dumb. But anyways if you own your own server and this happens to you then you can find out who is doing it and then sue them for lost of revenues and damagaes. Even though this is a illegal copy of the game they are hacking a server you are paying real money for. I know any servers hosted in the usa you can pursue this and the server host can hunt down whos doing it and file a case against them regardless what country they live in.

But back on topic here. Changing the ports wont work as someone said all they have to do is do a port scanner. I personally havent tested things to see where the problem lies in how secure everything is. But I went to college for networking engineer and there is a way to setup a validation packet on every single connection. The Us military does it with all of their logins to their network. To explain it a bit in more lamen terms though. Basically stating a validation packet meaning for database login set it up so only a ip can login to it. Like a certain town or city or a certain pc. if you limit who can login to your database or your main root of the server by a validation then you will knock out most of the hacks out there. Just a thought maybe this c++ coder could work on something like that for a fix. If I get time ill look at it and try to develop something like that and test it out and see if it works.

[gigola123]

Originally Posted by benco

On waiting my thread validated by admins :
Sorry in advance for this proof exploit and for double post.

For shut up members who don't trust me this is a screenshot of EWsRO database I'm not a *******, I didn't touch his data. Please Admin of this server confirm my actions.

DB data exemple :



Connection with SMC :



If someone would want to check if his server is secured or he don't trust me, pm me tonight to prove you.
As I wrote I'm not a *******. It's for that I have never reveale or exploit this security hole.

B3nc0 has the solution to fix this problem! I spoke with him about the exloit .
If you want to resolve your problem the best solution it's to speak with him

[kevin_owner]

benco I agree with you that this fix doesn't solve all the problem but it fixes a very important one.

I just check their cert and you're right they are NOT secure but neither are a lot of other servers I checked. However the servers who use this fix are save and I can't use this exploit anymore.

But once again there are tons of other security measures which you should take to make your server secure. Just this fix doesn't solve everything and their might be more stuff wrong with the certification server.

[benco]

I knew this issue when I worked on a pserver project. I have talked about it to my friends but I didn't solve it do to a conflict with one memenber and I leaved project. But I'm not a cracker, I didn't reveale or exploited this issue.

Originally Posted by gigola123

B3nc0 has the solution to fix this problem! I spoke with him about the exloit .
If you want to resolve your problem the best solution it's to speak with him

I'm currently experimenting an other hole issue. BUT if my hypothese is in the good way, this bug issue will not work.

For fixed server (like ClassOnline) admins :

Could you please contact me with PM forum and give me your new ports to trying my test ?

You help will fast my test than scanning port

[_Dev1l_]

Originally Posted by jangan322

Perfection, InsaneSRo, ******, elitesro, atomix, salvation = 100% patched and secure.


so yeah... no one cares about this ****** hack anymore... good game!

bro we need also many server safe 100% and many still need ur help.

[Shane¸]

could you tell me the ports of this cert server?

[kevin_owner]

You define the port in the srNodeData.ini file.

The certification server is probably [entry1] but just to be sure that it's the certification server check if the node_id=1 a few lines below this node_id= you can find a field called port and there you can change the port.

[benco]

Originally Posted by _Dev1l_

bro we need also many server safe 100% and many still need ur help.

Before making a server, please think about private life and security of your members

[PortalDark]

Originally Posted by benco

Before making a server, please think about private life and security of your members

simple words
learn basic server security

Firewalls
If you don’t plan to run one of these, get your server off the net! Whether it’s a home server or corporate, you should have at least one firewall that is decent. Make sure it has the ability to block specific IPs/ranges, and also specific ports and applications. Basically, a firewall on a unsecured Windows 2000 installation can secure it well. You can make sure all ports are blocked, in exception of the server ones. For example, if all you are running is a HTTP server, you should only allow traffic to connect on port 80. Also, you will run into situations where someone is illegally trying to gain access to your server – with your firewall, you can simply block that IP address.

[pushipu]

Firewalls will not help you avoid this.. let's say tested and worked (got hacked)...