Server crash by "hack tool"

[Satansbraten]

Hi guys.

Maybe you know there's a tool going around with which it's possible to let a TO server crash. I hosted a server on my PC and attacked it myself. The log looks like this:

Critical: FString<<
Critical: UControlChannel::ReceivedBunch
Critical: UChannel::ReceivedSequencedBunch
Critical: Direct
Critical: UChannel::ReceivedRawBunch
Critical: DispatchDataToChannel
Critical: BunchData
Critical: UNetConnection::ReceivedPacket
Critical: UNetConnection::ReceivedRawPacket
Critical: UTcpNetDriver::TickDispatch
Critical: UpdatePreNet
Critical: ULevel::Tick
Critical: (NetMode=1)
Critical: TickLevel
Critical: UGameEngine::Tick
Critical: UpdateWorld
Critical: UServerCommandlet::Main
Exit: Executing UObject::StaticShutdownAfterError
Exit: Exiting.
Uninitialized: Name subsystem shut down
Uninitialized: Log file closed, 08/30/05 00:32:07

I tried to replace the core.dll like it's said here: http://forums.tactical-ops.de/showthread.php?t=68841
Then the server doesnt crash anymore, but in the log is:

NetComeGo: Open MyLevel 08/30/05 00:40:37 80.171.xxx.xxx:xxx [note: IP of the "hacker"]
DevNet: NotifyAcceptingChannel Control 0 server Level TO-Blister.MyLevel: Accepted
Log: Received ICMP port unreachable from 192.168.0.2:4585. No matching connection found.
Log: Received ICMP port unreachable from 192.168.0.2:4585. No matching connection found.
Log: Received ICMP port unreachable from 192.168.0.2:4585. No matching connection found.
Log: Received ICMP port unreachable from 192.168.0.2:4585. No matching connection found.
Log: Received ICMP port unreachable from 192.168.0.2:4585. No matching connection found.
Log: Received ICMP port unreachable from 192.168.0.2:4585. No matching connection found.

and this message appears for about 200 times. I think on a internetserver it causes an extremly lag. Is there any fix for this problem out yet? I didn't find anything

Thanks for help

[HydroShok]

My ut2004-vanilla server is crashes so much i'm about to give up. Already had the RAM switched out in my server. I noticed my latest error message looks similar to yours. Probably isn't related, just a coincidence. Towards the end I have almost identical message as you.



NetComeGo: Open myLevel 09/16/05 07:21:32 161.38.223.244:7661
ScriptLog: New Player MenZ id=da343ac33b2636ff5954411294abcdcc
Log: Walked out of world!!!
NetComeGo: Open myLevel 09/16/05 07:23:29 84.61.33.114:64185
Log: Client netspeed is 10000
NetComeGo: Close TcpipConnection 161.38.223.244:7648 09/16/05 07:24:11
NetComeGo: Close TcpipConnection 84.61.33.114:64185 09/16/05 07:24:32
NetComeGo: Close TcpipConnection 161.38.223.244:7657 09/16/05 07:24:52
Log: Walked out of world!!!
NetComeGo: Close TcpipConnection 161.38.223.244:7661 09/16/05 07:25:10
NetComeGo: Open myLevel 09/16/05 07:25:23 69.134.173.190:4261
Log: Client netspeed is 10000
Critical: FArray::Realloc
Critical: 5*2
Critical: UObject::InitProperties
Critical: UObject::StaticAllocateObject
Critical: (AntiTCCSecurity Transient)
Critical: UObject::StaticConstructObject
Critical: ULevel::SpawnActor
Critical: (AntiTCCSecurity)
Critical: UObject:rocessEvent
Critical: (AntiTCCSecurePlayer DM-Deck17.AntiTCCSecurePlayer, Function Engine.Controller.PreBeginPlay)
Critical: ULevel::SpawnActor
Critical: (AntiTCCSecurePlayer)
Critical: UObject:rocessEvent
Critical: (xDeathMatch DM-Deck17.xDeathMatch, Function UnrealGame.DeathMatch.Login)
Critical: ULevel::SpawnPlayActor
Critical: ULevel::NotifyReceivedText
Critical: UControlChannel::ReceivedBunch
Critical: UChannel::ReceivedSequencedBunch
Critical: Direct
Critical: UChannel::ReceivedRawBunch
Critical: DispatchDataToChannel
Critical: BunchData
Critical: UNetConnection::ReceivedPacket
Critical: UNetConnection::ReceivedRawPacket
Critical: UTcpNetDriver::TickDispatch
Critical: UpdatePreNet
Critical: ULevel::Tick
Critical: (NetMode=1)
Critical: TickLevel
Critical: UGameEngine::Tick
Critical: Level Deck 17
Critical: UpdateWorld
Critical: UServerCommandlet::Main
Exit: Executing UObject::StaticShutdownAfterError
Exit: Double fault in object ShutdownAfterError
Exit: Exiting.
Log: FileManager: Reading 0 GByte 152 MByte 393 KByte 621 Bytes from HD took 13.064240 seconds (12.906240 reading, 0.158000 seeking).
Log: FileManager: 1.597009 seconds spent with misc. duties
Uninitialized: Name subsystem shut down
Uninitialized: Log file closed, 09/16/05 07:25:29

[[ISS]BlackIce]

Not really yours just looks like a error that occured during the login call i might be wrong this is just my opinion his on the other hand looks like a simple ICMP Port Unreachable DoS attack. Could be easily blocked by chanigng firewall settings if he is using windows if he is on a flavor of *nix i don't know i haven't been on it with inetenet long enough to explore it well.

[‮‮‮]

ICMP Port Unreachable DoS attack I think that type of attack can only be done on linux or old windows machien currently because the support for raw sawkets was removed by microsoft.