SA-MP Server attack

[Wayne]

these attackers are small smugglers (bots) wich have no P2P and isnt a player. i got info from then
all players if you see a large amount of bots use /report (one bot ID) [reason]
the names starts like strange names example: AxzAPSAPsPSa16DS yes this is a familiar name remember crashbots from SA-MP 0.1b?
Admins should kick/ban these bots.
this cheater is messing with SA-MP main list i got some info
they use -1 ping and are non players
also they are small smugglers
ive banned one of them kicked the rest..
at least i think they got no IP also no P2P wich makes the ban effect more harder than normal one
check this quote from Cam

The server crashers does not exploit the SA-MP code, but rather the networking API (RakNet). Going through other people's coding looking for possible errors is not easy, nor is it fun, and it doesn't come to our attention until it is exploited.

Yes he is sure.. there is errors wich not allows they really crashes but it causes a SA:MP main server list crash.
here is a general info
How it went in sequence.
1.Starts out 9 legit players playing peaceful on GamerX which has 125 player slots.
2.These bots start to join quite fast...Took 16 seconds exact for the entire group to join.
3.After all bots joined player count was 124/125
4.Bots had ping -1 and IP was 255.255.255.255 from the GetPlayerIP SA-MP function and then sat there and nothing to much going on.
5.On server for 45 seconds exactly and then all of them got kicked/banned by some system it took 12 seconds total to kick/ban them all..
some pics about these smugglers
http://img410.imageshack.us/img410/2159/gtasa200707212155119500vw0.jpg
http://img526.imageshack.us/img526/281/gtasa200707212155119500nr9.jpg
http://img244.imageshack.us/img244/6294/gtasa200707212155119500la0.jpg
quote from kyeman

If you are running an SA-MP 0.2.1 server, please note the following:

A join flooding robot that is capable of causing a denial of service attack is circulating on the internet. It is capable of filling the open game slots on your server and disconnecting existing users.

We have made a temporary fix in the form of a filterscript that you can load on your server to prevent these join flooding attacks. It can be found on our forum here:
http://forum.sa-mp.com/index.php?topic=24525.0

If your server is attacked by this tool, and you have system level packet logs with the IP addresses of the attacker, please email them to [team AT sa-mp.com]

If you are a server owner, and are found to be using this tool to artificially inflate your player count, we may ban your server from listing itself on our master list. Please do not do this.

[Shifter]

Iv seen this Hack thing b4 on anothe game (Jedi Knight 2) It was extremly annoying because the servers would constently be full untill they were reset.

[Andre9977]

i actually had to kick 30 bots... Well, its pretty easy. Yes their names are very scary. We actually freaked out, when this happent first time.
And here is the best part: One players ping reachec 10000 during kicking bots  :redface:

[Wayne]

these cheaters really dont give a fuck .. they got almost SA-MP script IP code
Posted on: July 23, 2007, 07:24:02 AMit has something familiar with 0.1b crashbot
the names are familiar no?

[Obi1]

any of u heard of MLRS?? he hcaked argonath b4 his name stood for Multiple Launch Rocket System he used infinite ammo hack..

[Andre9977]

Rocket launcher guy...

[Obi1]

ye he amde me $2000 lol before he got banned
Posted on: July 23, 2007, 11:11:07 AMno he didnt give me money.... he killed me 4 times giving me $500...lol

[Luca_Scalise]

I don't understand if they are Bots with AI or not  :trust:

[Tice]

the names are familiar no?

Well, yes. It seems like the same script for 0.1b adapted for 0.2.1, so it uses the same charhash names.

any of u heard of MLRS?? he hcaked argonath b4 his name stood for Multiple Launch Rocket System he used infinite ammo hack..

MLRS was a s0biet scriptkiddie. These guys are using what look like Python scripts that made multiple connection requests from localhost somehow (-1 ping), until the script is denied connection. The only malicious thing that this script can do is wait for it's bots to be kicked (kicking 124 players all at once = boom) or the server is reset.

I don't understand if they are Bots with AI or not

No, they're a simple script to connect to the server, until they are kicked.

[lionz]

ive seen that on world of warcraft too. they are so annoying

[Wayne]

on the first time when i see those bots i thinked they were crashboters 

[Tice]

If you are running an SA-MP 0.2.1 server, please note the following:

A join flooding robot that is capable of causing a denial of service attack is circulating on the internet. It is capable of filling the open game slots on your server and disconnecting existing users.

We have made a temporary fix in the form of a filterscript that you can load on your server to prevent these join flooding attacks. It can be found on our forum here:
Forum Link

If your server is attacked by this tool, and you have system level packet logs with the IP addresses of the attacker, please email them to [team AT sa-mp.com]

If you are a server owner, and are found to be using this tool to artificially inflate your player count, we may ban your server from listing itself on our master list. Please do not do this.

[Wayne]

good quote.. thats quite another info about those

[Yoshi]

Theys till do it on jedi academy.

[Wayne]

we are talking about SA-MP not jedi academy
Posted on: July 23, 2007, 07:30:58 PMthe problem has with curlyboy the crashbot maker to SA-MP 01b so he gave the sources to someone then he just adapted and using localhost
thats helped a lot.