1 Topic by johndrad (edited by johndrad 2015-08-10 18:43:41)

  • johndrad
  • New member
  • Offline

Topic: IP Spoofing Exploit

So there are some guys using an ip spoofing exploit.

Basically what they do is following:

1. Create an fake gameserver to log incomming requests. (To get ip + port of players)
2. Save the IP's in an database.
3. Use an rootserver to spoof an udp packet for Teeworlds.

This way they can send every packet.

Here is how to fix it.
You need to update the teeworlds server code.

Way #1:
1. Write an Handshake for the beginning of a new client connection.
    In the Handshake the gameserver should generate an random key.
2. In every packet the Client should provide this key.

Way #2:
Dont make players connect to every server to get the informations.
Make a way to get the Server information without this process.
This way there is no way to get the IP of the players.

Ps: The guys using this exploit are Meskalin, FruchtiHD and Solala

2 Reply by jxsl13

  • jxsl13
  • jxsl13
  • Member
  • Offline

Re: IP Spoofing Exploit

If there woulndt be such ppl, there wouldnt be any security progress big_smile

Teeworlds [ friends ] clan
Some YouTube Stuff about Teeworlds

3 Reply by Deepfinder

  • Deepfinder
  • Member
  • Offline

Re: IP Spoofing Exploit

Create a Issue at Github?
https://github.com/teeworlds/teeworlds/issues

I will be banned if I troll again ...

4 Reply by unsigned char*

  • unsigned char*
  • unsigned char*
  • Member
  • Offline

Re: IP Spoofing Exploit

See https://github.com/teeworlds/teeworlds/pull/986

Why I'm a pointer? http://3.bp.blogspot.com/-Zem9Ozn7BOo/T … itchie.jpg

5 Reply by johndrad

  • johndrad
  • New member
  • Offline

Re: IP Spoofing Exploit

And still its an problem that persists...

6 Reply by Kompl.exe

  • Kompl.exe
  • Member
  • Offline

Re: IP Spoofing Exploit

I have to say this: This issue is fixed since about a year i think, but it won't be in 0.6 anymore i guess because it would break the compability.

Wait until 0.7, there are no massive abuses so everything should be fine.

How to database by FFanta: http://puu.sh/jdPVk/fa37a95ac2.png

7 Reply by Henningstone

  • Henningstone
  • Henningstone
  • Member
  • Offline

Re: IP Spoofing Exploit

You are totally right, most of the 0.6 exploits will be fixed in 0.7, but it is very hard to fix that in 0.6 aswell because it would break too much since it is such a big change.
People cry about things that aren't fixed in 0.6, but they should rather help on 0.7 instead of reporting and reporting things that were new years ago.

8 Reply by Kompl.exe (edited by Kompl.exe 2015-08-11 08:46:05)

  • Kompl.exe
  • Member
  • Offline

Re: IP Spoofing Exploit

Also I dont feel like it is a good idea to break any compabilities because many mods wouldnt be playable anymore from one moment to the other.

Unexperienced players with the old client would be confused that they cant play anymore on the most servers.

Thoose might  be some reasons why the devs will only fix it in  0.7. If you want to speed the progress up, dont waste your time to create a topic that already has been discussed, but instead contribute to 0.7!

Edit: I couldnt take your post to serious after I saw that you said some names in particular. That makes you just a snitch to me.

How to database by FFanta: http://puu.sh/jdPVk/fa37a95ac2.png

9 Reply by Dune

  • Dune
  • Dune
  • Moderator
  • Offline

Re: IP Spoofing Exploit

Kompl.exe wrote:

Also I dont feel like it is a good idea to break any compabilities because many mods wouldnt be playable anymore from one moment to the other.

I believe it's a good thing that unmaintained mods eventually go away.

Not Luck, Just Magic.

10 Reply by Pikotee

  • Pikotee
  • Member
  • Offline

Re: IP Spoofing Exploit

@johndrad: you're totally wrong...

these people use a VPS, not a rootserver, just FYI^^

The next target is to bypass the password protection used to avoid dummies

and this thread is completly senseless, as e.g. when i developed a spoofing programm a teeworlds moderator was one of the first i showed it to

Greetings Piko

#yemDX is a known troll

11 Reply by Deepfinder

  • Deepfinder
  • Member
  • Offline

Re: IP Spoofing Exploit

Dune wrote:

I believe it's a good thing that unmaintained mods eventually go away.

No.

I will be banned if I troll again ...

12 Reply by Alirezakaj

  • Alirezakaj
  • Alirezakaj
  • Member
  • Offline

Re: IP Spoofing Exploit

teeworlds security  too low ,   
in 0.7  they must cod tee  that no one see ip address of servers  and ip of players
use dns connection for server and use player identity for ban them in game by rcon
this is the soloution
but tee staffs  wont do this ,

join  my telegram group  teeworld players  :  https://t.me/teeworlds2019
Teeworld Developers group : https://t.me/teeworldsdev

13 Reply by Kompl.exe

  • Kompl.exe
  • Member
  • Offline

Re: IP Spoofing Exploit

You are wrong. We cant see any IPs of players.

Here is what he tried to explain in his first post: We have set up a fake/honeypot server which logs the IP of a packet whenever a client requests the server's info (the masterserver only sends IPs of the servers, serverinfo like name, playercount or map are send by the server to the client directly) we just put his IP and port into our database. So at this point we have the IP of every player, but we dont know which IP is which player, so there is no real problem with that.

To get a players IP, we send a packet from every IP in our database to the server the player plays on (could be a chatpacket) and then we can see which player was which IP in the chat, the playerflag or whatever.

Long story short: Whenever you click on "refresh" in your serverbrowser, everyone gets your IP, but they dont know that it is yours.

How to database by FFanta: http://puu.sh/jdPVk/fa37a95ac2.png

14 Reply by johndrad

  • johndrad
  • New member
  • Offline

Re: IP Spoofing Exploit

Kompl.exe wrote:

You are wrong. We cant see any IPs of players.

Here is what he tried to explain in his first post: We have set up a fake/honeypot server which logs the IP of a packet whenever a client requests the server's info (the masterserver only sends IPs of the servers, serverinfo like name, playercount or map are send by the server to the client directly) we just put his IP and port into our database. So at this point we have the IP of every player, but we dont know which IP is which player, so there is no real problem with that.

To get a players IP, we send a packet from every IP in our database to the server the player plays on (could be a chatpacket) and then we can see which player was which IP in the chat, the playerflag or whatever.

Long story short: Whenever you click on "refresh" in your serverbrowser, everyone gets your IP, but they dont know that it is yours.

"We"
No wonder you call me a "snitch".

So basically what you guys try to say is, if nobody extremly abuses this exploit, you wont fix anything?
So this exploit is known for more than 1 year, and nothing changed?

This is really a shame.
The first game i see, who accepts hackers.
Well done teeworlds...

15 Reply by Dune

  • Dune
  • Dune
  • Moderator
  • Offline

Re: IP Spoofing Exploit

From what I've read it seems this exploit is already fixed in the upcoming version.

Not Luck, Just Magic.

16 Reply by Kompl.exe

  • Kompl.exe
  • Member
  • Offline

Re: IP Spoofing Exploit

Dune wrote:

From what I've read it seems this exploit is already fixed in the upcoming version.

Absolutely correct, not in 0.6.4, but in 0.7.

Let me refer both of you to https://github.com/teeworlds/teeworlds/ … -129743528

It is not true at all that teeworlds accepts hackers, why would they let anyone put them under pressure to release a unfinished, maybe buggy version of the game? As I said before, if you are not pleased with the current developement-speed feel free to contribute to 0.7.

How to database by FFanta: http://puu.sh/jdPVk/fa37a95ac2.png

17 Reply by johndrad (edited by johndrad 2015-08-11 11:25:00)

  • johndrad
  • New member
  • Offline

Re: IP Spoofing Exploit

It does not change the fact its atm possible to hack such stuff.

You guys are so calm because nobody disrupt your gameplay.
But if you would get kicked by solala like i did, you would understand why it gets me pissed.

Nvm i leave you now.
I see you guys are lazy as shit and always come with the argument: "Its fixxed since 1 year"

Its not fixxed and possible since 1 year.
Its fixxed, if you guys update the servercode.
Now ban me, delete this thread or whatever i dont care.
I saw that you guys dont care a little bit about the security of your game.

Kompl.exe wrote:

It is not true at all that teeworlds accepts hackers, why would they let anyone put them under pressure to release a unfinished, maybe buggy version of the game? As I said before, if you are not pleased with the current developement-speed feel free to contribute to 0.7.

Of course as one of the mentioned hackers you choose such words.
If this exploit would be fixxed, you wouldnt have the power over the people like you have now.

18 Reply by heinrich5991

  • heinrich5991
  • heinrich5991
  • Moderator / Donor
  • Offline

Re: IP Spoofing Exploit

johndrad wrote:

It does not change the fact its atm possible to hack such stuff.

You guys are so calm because nobody disrupt your gameplay.
But if you would get kicked by solala like i did, you would understand why it gets me pissed.

Nvm i leave you now.
I see you guys are lazy as shit and always come with the argument: "Its fixxed since 1 year"

Its not fixxed and possible since 1 year.
Its fixxed, if you guys update the servercode.
Now ban me, delete this thread or whatever i dont care.
I saw that you guys dont care a little bit about the security of your game.

It's not good we leave that impression. It wasn't fixed before because it seemed that it couldn't be fixed without backward-incompatiblities, now we know it's possible, and I agree with you that we should probably release as soon as possible.

(Note that the last time we had such a vulnerability we didn't take so long, the 0.6.3 release was out a lot faster.)

19 Reply by johndrad

  • johndrad
  • New member
  • Offline

Re: IP Spoofing Exploit

heinrich5991 wrote:
johndrad wrote:

It does not change the fact its atm possible to hack such stuff.

You guys are so calm because nobody disrupt your gameplay.
But if you would get kicked by solala like i did, you would understand why it gets me pissed.

Nvm i leave you now.
I see you guys are lazy as shit and always come with the argument: "Its fixxed since 1 year"

Its not fixxed and possible since 1 year.
Its fixxed, if you guys update the servercode.
Now ban me, delete this thread or whatever i dont care.
I saw that you guys dont care a little bit about the security of your game.

It's not good we leave that impression. It wasn't fixed before because it seemed that it couldn't be fixed without backward-incompatiblities, now we know it's possible, and I agree with you that we should probably release as soon as possible.

(Note that the last time we had such a vulnerability we didn't take so long, the 0.6.3 release was out a lot faster.)

Thank god 1 guy who actually cares about the problem.

Yes its true it is possible and there are more than 1 ways.
Another way would be for example, to check every server that registers in depth.
To avoid fake servers.

And if such an fake server is detected blacklist its ip from the masterservers.

Or write an masterserver which provides the informations about the servers.
And just update the informations, if an server sends new informations. (For example if a player joined)
This way you keep relatively low the traffic of the masterservers.

And in the Client, he just asks the masterservers to get the informations.

20 Reply by Kompl.exe

  • Kompl.exe
  • Member
  • Offline

Re: IP Spoofing Exploit

I dont see the problem about getting all IPs, as long as it is prevented to tell which IP is which player (spoofing...). Its a bad idea to let the masterserver provide all the server information, it would increase the traffic significantly.

And the other thing is: Why would my server be masterserver banned? It's a normal server where people can play on (and do).

How to database by FFanta: http://puu.sh/jdPVk/fa37a95ac2.png

21 Reply by heinrich5991

  • heinrich5991
  • heinrich5991
  • Moderator / Donor
  • Offline

Re: IP Spoofing Exploit

johndrad wrote:

Thank god 1 guy who actually cares about the problem.

Yes its true it is possible and there are more than 1 ways.
Another way would be for example, to check every server that registers in depth.
To avoid fake servers.

And if such an fake server is detected blacklist its ip from the masterservers.

Or write an masterserver which provides the informations about the servers.
And just update the informations, if an server sends new informations. (For example if a player joined)
This way you keep relatively low the traffic of the masterservers.

And in the Client, he just asks the masterservers to get the informations.

The first idea would probably not work out in practice as you could just use a normal server to harvest IP addresses. The second solution would work, but would put a lot of burden onto the master servers. The better solution would be a token that needs to be sent with each packet, which is indeed implemented but not merged for 0.7. The implemented solution for 0.6 is a very brittle one (complexity of 2^12=2048 once you know the ip/port, which isn't very much of a protection), and would be improved if I was asked.

22 Reply by jxsl13 (edited by jxsl13 2015-08-11 19:15:58)

  • jxsl13
  • jxsl13
  • Member
  • Offline

Re: IP Spoofing Exploit

Doubt the teeworlds masterserver has enough bandwidth to hide ips and handle all the refresh requests done by people every day.

This could work as one method, but It's kinda like you gotta type a generated code, which is shown as the server name in order to join a server, I'd prefer if the actual type in your password prompt would be a string sent by the server and used as that kinda handshake or whatever method automatically if it starts with whatever symbol would be good to get it to be seen by the client as the generated password.

Teeworlds [ friends ] clan
Some YouTube Stuff about Teeworlds

23 Reply by johndrad

  • johndrad
  • New member
  • Offline

Re: IP Spoofing Exploit

Ofc you could even add encryption in future versions tongue
Chacha20 is a very fast & secure stream encryption.

24 Reply by Shadd!X

  • Shadd!X
  • New member
  • Offline

Re: IP Spoofing Exploit

I am not sure, but I think clients like DDNet use different sockets/ports for serverinfo requests and actual connections.
Try using such a client. That way people will have a hard time brute forcing your actual port.

25 Reply by heinrich5991

  • heinrich5991
  • heinrich5991
  • Moderator / Donor
  • Offline

Re: IP Spoofing Exploit

Shadd!X wrote:

I am not sure, but I think clients like DDNet use different sockets/ports for serverinfo requests and actual connections.
Try using such a client. That way people will have a hard time brute forcing your actual port.

@johndrad: This is good advice, at least until 0.6.4 is out.