Relentless

Alright, we're having an issue on one of our regulars on whether he is evading a PB ban or not... He is banned right now because we caught him with the same IP of a known hacker. However, both have dynamic IPs, and the hacker was caught two years ago (2006). http://www.pbbans.com/mbi-viewban-56d22e5e-vb15677.html is the link to the original ban. ---Our Regular--- This is the GUID (from our logs) of LOR: 61121c35c858d367693f42ffb533a6b7 (It is clean) We caught him using the IP: 83.221.80.247 And these are the other IPs you have on file for him. [Germany] 83.221.80.63 [Germany] 217.68.173.196 [Germany] 217.68.173.242 So, in conclusion, is LOR (the regular) considered to be a hacker and therefore ban evading as he shared an ip in common with a known hacker, or is this simply an odd coincidence where two guys have the same ISP and one of them was caught cheating?

120115 is the error message, disallowed driver.

Well, over the past day we've noticed numerous kicks from PB towards numerous players (over 100 different players), for 2-3 reasons. http://bunker.aaxxss.com/forums/index.php?...mp;#entry216377 http://bunker.aaxxss.com/forums/index.php?...mp;#entry216386 Now, I've been playing ET for years, never had a problem. In fast, I was on ET for 4-5 hours not even 24 hours ago, again no problem. I try to play today, same server, nothing changed at all (pc wasn't even on between times), and I'm kicked ever 2 minutes... I believe it is restricted driver 11025 (could 110125)... I switch between an nvidia 7600 and an nvidia 8900, depending upon which PC I'm on... Same problems for both. I also know people who, with teh same driver, have no problems, and others who have problems with ATI drivers...

I'm just wondering, as the program I guess can run on ALL Quake3 based games.

We run an older version of ETPub, largely because the newer versions will cause MAX_GAMESTATE_CHARS more often (64 players). Any chance there will be a PB update that will help fight this?

We have subnet bans on the, but they just avoid them. If we make them any bigger we lose some Regulars and Members. Yes, we do own our own servers and host them at locations such as Server Beach, etc... Problem is there, if we make the firewalls to block them, we wind up blocking Regulars/Members.

Its for W:ET. What happens (as far as we can tell) is that someone connects with no GUID and begins to generate a lot of 'false' or 'bot' players. Each 'bot' has their hunkmegs cranked up all the way to try and crash the server. Also, we believe that they might be running RCON Brute Force hacking, but are not positive.

64.34.183.34:27960 Its streaming to PB. This is a screenshot we have of it. It's happened numerous other times in the past week as well.

Just wondering if there's any defense against this? We've been attacked a number of times (10+) over the past week.

My only question is... Is X-Ray compatible WITH PB? If you can run both at the same time, why not do it? Thats my only question concerning it.

I think he's talking about a Shrubbot form of adminning (W:ET). Where you can give out levels to players by a command and each level has some corresponding commands on it... Is that what you mean?

Thats what I thought. Just wanted to be sure.

Well, he's saying that he talks to PB and EB, and that they are going to start 'banning' servers and clans for running it... I'm 99.9% certain that he's just blowing smoke, but still, just want to be safe.

Well, I have a question here for any PB Admin... The other day I was asking around on the CoD4 forums (oscardelta...), about how the servers are adminned, and mentioned shrubbot. One of the people there replied, and I quote: - Sorry dude, its just BS and those servers and admins should be perma-banned! - Matter of fact, now that I'm thinking about it. Report these scripts to PB! They never really considered scanning a server it's self, 'bout time they do! - Oh I dont speak for Punk Buster, I speak to them. And report cheating little admins such as yourself and Bunker whoever? bunker is? BTW, been around FPS a very very long time Dont matter what you have done for them in the past, a cheat is a cheat is a cheat! And admins who cheat are an even lower form of life than the aimbotters running around! Another PUNK BUSTED, via self admission! So, my question is (I guess you can call it that), what is Punk Buster's OFFICIAL stance on Shrubbot. Shrubbot is the most basic admin_mod on ETPub, NQ, and Jaymod servers. For a quick refresher, it is the !kick, !warn, !ban, !listplayers, etc... commands.

We don't stream a message saying it, however when you connect you do get the whole message list from PB checking your settings. Besides, just about everyone knows that we stream to PB, and if a cheater doesn't see that then he'll get caught and banned. We almost always have a RCON user online (either in game or on msn), so anytime a suspected hacker is on we just demo and SS them, and if they are cheating its time for the ban-hammer.

Our rcon is long, has numbers, upper case, lower case, etc... Trust me, we stream every server to PB, have some very smart anti-cheat experts/programmers, etc... The hack's effects: A player will connect with no GUID, and begin to generate numerous, false players with names composed of random numbers/letters. You can kick the false players as much as possible, but they keep regenerating. When you check the logs, you see that they are all attempting to brute-force RCON. Only way to stop it for the short-term (that we've found) is to Ban via IP. The problem with that, any hacker smart enough to do this can easily fake/get a new IP... Hence, is there anything PB and/or EB can do?

He doesn't have the password, he's attempting to bruteforce it using numerous random accounts that he generates once he connects. We went from 30/64 to 60/64 within minutes of him connecting, and once we were able to ban him via IP we were back to 30.

We have manually added them. We do run 2.6b (on all servers). We are currently attempting to take legal action against them (talking to their ISP atm). The attack they used has been posted here before: Connect with no GUID, and then generate lots of phony players (names like: SHD787SAK389WS) and attempt to hack the RCON attempting to crash the server. With a Shrubbot ban, everyone is banned (invalid ban entry - no GUID).

So, I've got a question for the PB staff: If evidence (server logs) can be provided clearly showing that a player is attempting to (and successfully did) hack a server, is that enough to place a manual PB ban on said player? Two Bunker servers were attacked on the 25th by the same guy, one which he crashed. Is this a possibility, or out of the question?

Define tweak? Is largening the FoV from the basic 90 to 120 a tweak? What about taking the time to bind various movements and actions to keys? What about binding a key to binoculars + arty? Or a key that pulls out the srynge, uses it, then pulls back out my smg? Both of those examples might be considered cheating by some, but can be done by anyone. My advice: Stream to PB, and then if you want guidelines on what you can/can't change beyond that use basic ETPro guidelines. Let people tweak their game to what suits them best, and if they own you all the time just take the time to learn how to do it and practice more. Half of the reason ET is so fun is because of everything you can change in it, customize in it, to make it run perfectly for you. Don't take that away from people jsut because you don't know how to/don't like it.

That long? When I emailed EB I got a response within 2 hours...

Only thing I'd like to see is a way to search bans based upon what server they were caught on... Other than that good job. Might not always agree with some of the decision, but you guys atleast take the time to explain the reasoning behind it which is more than many would do.

Exactly, when an admin goes spec they leave. They might also have a spec alert as well, which would really be tough to get legit demos of... Hopefully someone who sees this will be able to get a nice long demo and some screenies of it and some bans can be added to the PB index :rolleyes:

Guess I wasnt clear enough. The admin who caught it is a different admin than the one who searched the logs to ban him. Anyway, I just added you to xfire. Out PB S.A. I found, but he is only active once a week or so on weekends right now.

There would be some screenshots/demos, however he manually disconnected. Our campaign writer manually shifted through 680MBs or logs in order to find the player, his GUID, and his IP and then manually added him to the shrubbot banlist. On the server, it was just at that stage where you know something fishy is up, and therefore am about to start demo'ing him. The admin who caught it is not an rcon admin, hence PBSS were out of the question. As for our streaming admins... A couple months ago the two guys who were the streaming admins left, and there has really been no notice of who the new ones are (and with at last count 187 members, its not the easiest thing to find quickly)