- Turn on Addon Signatures

[MH6~SPARTA~]

Please either turn on addon signatures or disable addons entirely, because the server got assaulted by a hacker(s) today (12:25AM EST). The addons are also probably the cause of a lot of the instability.

 

It was 100% a hacker, because they popped up a GUI message box on the screen saying something like "It's party time...let's blow something up with dynamite!" or something to that effect. This was after all the friendly AI in base went rogue and began firing on friendlies (abandoning their AA posts in the process). There was also some rogue friendly AI spawned west of the base. No, the men they were shooting had not TKed. They were not red on the map. They fired at anyone and everyone regardless of who they were. Any Blackhawk hovering in base was also shot with Stingers by the AI.

 

If possible, and if ArmA2 keeps server logs, please check them and see who joined with addons around 12:00/12:15AM EST.

 

Thanks

 

Edit: A guy named Jeff was rambling on about the hacks, even spouting names of hacker groups, and blaming both me and another player for them (Pheonix). This is probably the same Jeff that intentionally TKed me a few days ago too, so it'd be nice if someone kept an eye on him from now on. Not saying he's the hacker, but it does seem kind of iffy.

[Jef]

I came on to post the same thing, since I'm apparently not allowed to ask about it ingame. Yes the server was hacked.... again. Same douchebags from TKC........ again, all they are doing is running simple scripts as addons, if you don't allow their addons then they are SOL.

 

Here's how you do it, for tutorial's sake we will say you want to enable your clients to join with @xxx mod.

 

1) In the server.cfg, look for and edit or add this line:

verifySignatures=1

 

2) Download xxx mod from a legitimate site, and look for a file or files that end with .bikey ie "xxx.bikey"

 

3) Move the bikeys to the "keys" folder in your server directory.

 

4) Make sure players joining have the bisign files in their addons directories (there are often multiple of these per addon)

Also note: With VOP mod the 2.1 version was released to the major sites with keys, then the author made a small update which he only released on the BIS forums with more keys, make sure you decide which one to use and the bikey and bisigns coorespond to the correct version.

 

5) Join game with chosen mod and see if it kicks you.

 

 

For more server.cfg variables look here: http://community.bistudio.com/wiki/server.cfg

 

and : http://community.bistudio.com/wiki/ArmA:_Addon_Signatures

 

 

[MH6~SPARTA~]

I came on to post the same thing, since I'm apparently not allowed to ask about it ingame. Yes the server was hacked.... again. Same douchebags from TKC........ again, all they are doing is running simple scripts as addons, if you don't allow their addons then they are SOL.

 

Here's how you do it, for tutorial's sake we will say you want to enable your clients to join with @xxx mod.

 

1) In the server.cfg, look for and edit or add this line:

 

2) Download xxx mod from a legitimate site, and look for a file or files that end with .bikey ie "xxx.bikey"

 

3) Move the bikeys to the "keys" folder in your server directory.

 

4) Make sure players joining have the bisign files in their addons directories (there are often multiple of these per addon)

Also note: With VOP mod the 2.1 version was released to the major sites with keys, then the author made a small update which he only released on the BIS forums with more keys, make sure you decide which one to use and the bikey and bisigns coorespond to the correct version.

 

5) Join game with chosen mod and see if it kicks you.

 

 

For more server.cfg variables look here: http://community.bistudio.com/wiki/server.cfg

 

and : http://community.bistudio.com/wiki/ArmA:_Addon_Signatures

 

Thanks for the post. I'd rather they just disable addons entirely personally but I know some people like to have them.

 

[Jef]

And no I'm not a hacker, I do find it interesting that you and Phoenix both left around the same time after the little "jeff stop hacking" game, the same crap I see TKC do on other servers. And I also found it interesting someone locked my keyboard shortly after I started talking to Morgan.

 

However I do know where the hacks came from, the same douchebags that have been at it since arma1 www.tkc-community.net

 

I don't know who TKed you a few days ago and I have seen other players with the same name, usually the hackers wont blatently TK though, they like to watch people try to figure out whats happening.

[MH6~SPARTA~]

And no I'm not a hacker, I do find it interesting that you and Phoenix both left around the same time after the little "jeff stop hacking" game, the same crap I see TKC do on other servers. And I also found it interesting someone locked my keyboard shortly after I started talking to Morgan.

 

However I do know where the hacks came from, the same douchebags that have been at it since arma1 www.tkc-community.net

 

I don't know who TKed you a few days ago and I have seen other players with the same name, usually the hackers wont blatently TK though, they like to watch people try to figure out whats happening.

 

My game crashed. I'll give you the benefit of the doubt that you weren't the same Jeff who shot me with a Stinger/SMAW while I was in the Harrier, though, in light of your recent postings. I just hope ArmA2 saves server logs so we can find out who the actual hacker is.

[Morgan]

Jeff,

 

Thanks for posting. The information is much more relevant here in forum than endlessly talking about hackers on our server.

 

Thanks.

[Zeno~SPARTA~]

Signature verification has been added to server 1

 

Z

[MH6~SPARTA~]

Signature verification has been added to server 1

 

Z

Awesome, thanks

[Jef]

Cool, which addon signatures are you allowing. If not already I'd recommend VOP and RH helicopter sounds.

[Morgan]

Personally Id like to see us disallow all addons, as anyone could fake an existing addon just by calling it the same and giving it their own keyfile.

 

I am sure the admin folks will decide on some and let everyone know if/when they figure it out.

[Forrester~SPARTA~]

does this imply an action to be taken by anyone who wants to join the srver or is it server sided only? (kinda noob here)

[Zeno~SPARTA~]

at the moment no addons are allowed

 

[Halli~SPARTA~]

Good Zeno lets run it like this for a bit and see how it goes.

The current add ons really don't provide more than sound so just turn the game up some eh.

[Jef]

Personally Id like to see us disallow all addons, as anyone could fake an existing addon just by calling it the same and giving it their own keyfile.

 

I am sure the admin folks will decide on some and let everyone know if/when they figure it out.

 

 

Nope you are dead wrong, that is not how signature checking works, if the player alters the original pbo file in any way the signature won't verify. BIS isn't that dumb. The bisign and pbo files have to be original, the only way they could fool you is if a hacker released a mod disguised as a sound mod or something and had hacks embedded in it. In that event I'm sure the community would catch on very fast.

 

 

From bis

Addon signatures are a way to reduce cheating in Armed Assault. They are used to detect data files modified by anyone else but the addon creator. They are based on strong cryptographic principles (private/public key pairs), therefore hacking around them is very hard.

Edited August 11, 2009 by Jeff

[Morgan]

Umm.. actually I am completely correct. Let's saqy I take a hacker script... create a brand new PBO, create a keyfile with my own keymaker, call it the same name as any existing popular file.

 

Keyfile makers are plentiful and easy to get, hacking scripts are easy to get, presto-blammo... all done.

 

Not talking about modifying an existing file.

[Jef]

Umm.. actually I am completely correct. Let's saqy I take a hacker script... create a brand new PBO, create a keyfile with my own keymaker, call it the same name as any existing popular file.

 

Keyfile makers are plentiful and easy to get, hacking scripts are easy to get, presto-blammo... all done.

 

Not talking about modifying an existing file.

 

That wouldn't work the bisign wouldn't verify against the server's key file and you wouldn't be allowed onto the server.

[Zeno~SPARTA~]

No need to discuss it, for now no addons will be allowed. We'll see about adding a couple later.

 

Forrester if you dont run any addons you'll be fine.

[Durka-Durka~SPARTA~]

I'm assuming this doesn't apply to the tac server, correct?

[custard~SPARTA~]

I'm assuming this doesn't apply to the tac server, correct?

 

 

I wouldn't have thought so they need a password to get in anyway

[Morgan]

That wouldn't work the bisign wouldn't verify against the server's key file and you wouldn't be allowed onto the server.

 

(unless the server was running my file, thinking it was another popular file.)

 

However, as Zeno says, no need to delve into it further. Thanks again for your participation/feedback. Always appreciated.

[Jef]

(unless the server was running my file, thinking it was another popular file.)

 

However, as Zeno says, no need to delve into it further. Thanks again for your participation/feedback. Always appreciated.

 

Ok, It has little to do with your filename, and much more to do with the encrypted contents of the file. Only the author of the addon has the specific private key to create addons with that encrypted signature, nobody else can create bisigns or bikeys with the identical encryption unless they are some kind of super hacker. If the encrypted contents don't jive, no joining happens.

 

If you are saying a Sparta member could manually load a .bikey into the keys folder that was created by a hacker under the disguise of another modname, yes that could happen, if the person who moved installed the bikey was dumb enough to download it from somewhere that isn't legitimate. Also you would probably figure that out when everyone running the legitimate version of that mod is unable to join.

[Zeno~SPARTA~]

Like I said there is nothing more to say here, so this topic is closed.