| Welcome, Guest |
You have to register before you can post on our site.
|
| Online Users |
There are currently 177 online users.
» 1 Member(s) | 175 Guest(s)
![Baidu[BOT]](images/baidu.png "Baidu[BOT]")
|
| Latest Threads |
who is still online here?
Forum: Other news
Last Post: JajoRNICa
30-08-2026, 12:36 AM
» Replies: 23
» Views: 5,124
|
R.I.P. Bl@ckEye
Forum: Other news
Last Post: Hani
03-07-2026, 12:06 PM
» Replies: 12
» Views: 6,749
|
muahhahahahaa
Forum: N!tmod Application
Last Post: HeXomega
19-06-2026, 11:25 PM
» Replies: 5
» Views: 2,258
|
Display disagree
Forum: Problems
Last Post: Lanttu
24-05-2026, 02:30 AM
» Replies: 1
» Views: 945
|
counting
Forum: Spam
Last Post: Vegehan
22-01-2026, 01:26 AM
» Replies: 2,144
» Views: 282,429
|
TWC ROSTER UPDATES
Forum: Enemy Territory
Last Post: Lanttu
03-01-2026, 01:13 PM
» Replies: 11
» Views: 7,173
|
Leaving
Forum: No Download
Last Post: Nirv
19-12-2025, 08:15 PM
» Replies: 6
» Views: 2,425
|
No Download Chatroom
Forum: No Download
Last Post: Manius88
17-11-2025, 06:15 PM
» Replies: 1,551
» Views: 557,459
|
Maps
Forum: Suggestions & Questions
Last Post: ZonElax
10-04-2025, 10:33 PM
» Replies: 3
» Views: 3,024
|
Heading out
Forum: Trickjump
Last Post: Lanttu
30-03-2025, 11:30 PM
» Replies: 1
» Views: 1,687
|
New Year, new goals.
Forum: Important news
Last Post: Thrasher
22-01-2025, 01:09 AM
» Replies: 19
» Views: 8,167
|
Leaving
Forum: Other news
Last Post: Manius88
02-10-2024, 02:33 PM
» Replies: 4
» Views: 3,645
|
Ban appeal
Forum: Ban Appeal
Last Post: Htos1
24-09-2024, 08:25 PM
» Replies: 8
» Views: 4,492
|
|
|
| GUID security |
|
Posted by: Ligustah - 14-12-2012, 02:11 AM - Forum: Important news
- Replies (32)
|
 |
The current events have convinced me that we are indeed in need of better protection against GUID spoofing. I therefor will continue working on my authenticator plugin for the servers.
Each time a user connects to one of the servers, his info will be checked against a database that will be able to tell if that person is a GUID stealer. To do that, all members are required to 'claim' their GUIDs in that database (go here and upload your GUID to do that: http://board.twcclan.org/misc.php?twc=ident ). The database can then check if the person using your GUID on the server is really you (it will do so by comparing the IP used on the server to the last known forum IP). If not, it will simply disallow usage of !commands.
I think that's a fair trade, since it will stop any script kiddy GUID stealer, but won't stop you from playing, in case the system should fail for some reason.
This will probably go live sometime next week, so please report any problems you might encounter.
Thanks in advance.
-- Ligustah
|
|
|
| New QMM plugin (work in progress) |
|
Posted by: Ligustah - 22-05-2012, 01:18 PM - Forum: Server/forum changes
- Replies (31)
|
|
I moved this thread here, so people other than high admins (including guests) can read it, because I will soon release the source code for the authentication plugin for other clans to integrate
[Update#2]
TODO list for my own reference:
[/Update]
[Update]
I decided to move this thread from the Master Supreme Base to this forum.
Feel free to comment on this and post suggestions or questions if you have any.
[/Update]
Hi,
I'd like to present my recent experiments.
I went for another attempt at writing a useful GUID spoofing protection,
and I think I came up with a rather cool concept.
First consider this simple PHP script:
Code: <?php
print_r($_POST);
So I wrote a QMM plugin that is capable of POSTing all userinfo associated with a client to a remote web server upon connection.
The tricky part is, that we can now ask the web server (in this case our PHP script) to do something with that information and then tell us what to do.
As mentioned above, for testing purposes I just let the script return all the info it receives, which the plugin will print to server log:
Code: ClientBegin: 0
[HTTP] received response code 200
Array
(
[cg_delag] => 1
[cg_jaymiscflags] => 0
[cg_etVersion] => Enemy Territory, ET 2.60c
[cg_uinfo] => 13 0 30
[cg_jaymod_title] => Jaymod 2.2.0
[cl_mac] => c4:17:fe:b8:11:a8
[cl_cpu] => i586
[pmove_fixed] => 0
[g_password] => none
[cl_guid] => 1CD338CA42008CCF264EC21BEF09D67E
[cl_punkbuster] => 1
[cl_anonymous] => 0
[snaps] => 20
[rate] => 25000
[name] => Ligustah
[cl_wwwDownload] => 1
[protocol] => 82
[qport] => 218
[challenge] => -1652453754
[ip] => 141.23.85.9:27961
)
As you can see, the userinfo contains lots of interesting information, such as ip, MAC and GUID.
We could now have the PHP script check those information against the forum database, so we could see if the IP provided matches with the last known IP address used to browse the forum.
This, of course, means that we have to associate GUIDs with forum accounts. That should be fairly easy, if we just add another profile field. I actually wrote a program long ago that would allow people to proof their ownership over a certain GUID by checking the etkey on the computer of that person. We might as well just ask people to upload their etkey and calculate the GUID from that.
Anyways, so the cool thing is that we could actually detect if someone uses a GUID he is not supposed to use and then do some action based on that. We might ask the player to enter a PIN code that he can look up in his forum account or something like that.
And as long as a player is not authorized he will be unable to use any !commands (maybe even prevent any action).
Now that's pretty cool already, but this might be useful for many more things, like:- Check the connection GUID against a global banlist
- Play a birthday song on the server.
- Allow people to automatically have their level set, if they lost it for whatever reason.
- Issue promotions via a web site
- Remind people to check forum, if they have been inactive there for some time
- Automatically give level to people in the members group or remove it if they are not in
- Automatically create banners with recent forum announcements.
- Allow players to send private messages to players on another server.
And that's just what I came up within 2 minutes. By allowing the servers to talk to a remote server like this, we can integrate them in a way that is extremely flexible.
As always, this is a work in progress and might not ever be finished. But I personally think it's pretty cool and I don't think I'll lose interest in this soon :P
-- Ligustah
|
|
|
|
|
Join us on our TWC Discord channel
