Better security

xAndrewx · #1 05-07-2006, 11:46 PM

Is there anyway to improve Graal's security? This is mainly to stop the hacking. Player's have found yet another way to edit there strings/flags.

Demisis_P2P · #2 05-08-2006, 12:13 AM

Sorry :{

HunterCano · #3 05-08-2006, 02:47 AM

Quote:

Originally Posted by xAndrewx

Is there anyway to improve Graal's security? This is mainly to stop the hacking. Player's have found yet another way to edit there strings/flags.

Ideas would help.

I've also noticed this on N-Pulse, mainly in the Spar Center. Players have been enabling their weapons somehow, and when his/her attributes are viewed, their weapons are displayed as disabled.

Quote:

Originally Posted by Demisis_P2P

Sorry :{

Chris · #4 05-08-2006, 02:53 AM

Quote:

Originally Posted by HunterCano

Ideas would help.

Allowing cheatwindows to detect programs listed without having to detect frame rate acceleration. Right now it will only detect the specified programs if the program is running with a faster frame rate.

At least that's what we've noticed on Era.

ViCtOrEhEhEh · #5 05-08-2006, 03:14 AM

Quote:

Originally Posted by HunterCano

Ideas would help.

I've also noticed this on N-Pulse, mainly in the Spar Center. Players have been enabling their weapons somehow, and when his/her attributes are viewed, their weapons are displayed as disabled.

Ha I always do that glitch.

HunterCano · #6 05-08-2006, 03:22 AM

Quote:

Originally Posted by ViCtOrEhEhEh

Ha I always do that glitch.

I sure wish they would fix this 'glitch' then. Personally i reported it numerous times, but nothing is being down, not yet atleast. It's quite annoying waiting to spar, and you have a bunch of fools trying to act funny by hitting you in a nopkzone/weaponsdisabled area.

Except for you of course, since you live in NYC, and i love NYC.

Tyhm · #7 05-09-2006, 12:53 AM

There's always the Original Classic method. Have everyone else in the level watch if anyone else in the level is doing something...

Chris · #8 05-09-2006, 05:22 AM

Quote:

Originally Posted by Tyhm

There's always the Original Classic method. Have everyone else in the level watch if anyone else in the level is doing something...

Kinda hard when you have over 150 players to watch.

HunterCano · #9 05-09-2006, 12:44 PM

That applies for UN only i guess then.

Snakeandy7 · #10 05-09-2006, 02:16 PM

I guess you goto bed early.

Chris · #11 05-09-2006, 03:16 PM

Quote:

Originally Posted by HunterCano

That applies for UN only i guess then.

Umm.. At peak times, 4pm-10pm EST, Era passes UN's playercount routinely.

HunterCano · #12 05-09-2006, 03:21 PM

Quote:

Originally Posted by Snakeandy7

I guess you goto bed early.

I guess so.

Polo · #13 05-09-2006, 04:38 PM

Quote:

Originally Posted by Chris

Kinda hard when you have over 150 players to watch.

I remember when we had over 300 to watch. I'd say having more people actually makes it easier, as players tend to report things more.

Chris · #14 05-09-2006, 10:40 PM

Quote:

Originally Posted by Polo

I remember when we had over 300 to watch. I'd say having more people actually makes it easier, as players tend to report things more.

Sadly, that was back before the players we have now. UN and Era doesn't exactly have the best eggs in the dozen, if you get what I'm saying.

Rick · #15 05-09-2006, 10:42 PM

Quote:

Originally Posted by xAndrewx

Is there anyway to improve Graal's security? This is mainly to stop the hacking. Player's have found yet another way to edit there strings/flags.

Err... so what if they can edit flags? you shouldn't be using client editable flags for things you need to be secure. So unless you're doing stupid things scripting wise, it shouldn't be an issue.

Snakeandy7 · #16 05-10-2006, 08:10 AM

Weird enough, it's not the client.flags that they're editing.
Into more details, it's CLIENTR.

Malinko · #17 05-10-2006, 05:03 PM

Quote:

Originally Posted by Snakeandy7

Weird enough, it's not the client.flags that they're editing.
Into more details, it's CLIENTR.

Ever tried it? Like, with some program to help find a method to solve the problem?

I know on Unholy Nation, with their Event Points, they have a database that matches the current amount of Event Points then it changes when events are won and if it's changed, it detects it with RemoteControl.

Then again, I guess with the new scripting engine, it would be less of a hassle to have each account have its own folder to compare stuff within?

Chicken_l33t · #18 05-10-2006, 05:59 PM

Snandy, try hack Graal yourself. It sounds pretty weird, but that way you find the flaws and can prevent it yourself or get someone to do this for you.

xAndrewx · #19 05-10-2006, 07:05 PM

We shouldn't need to worry about this though, the graal client should some-what prevent it.

Rick · #20 05-10-2006, 07:21 PM

Quote:

Originally Posted by Snakeandy7

Weird enough, it's not the client.flags that they're editing.
Into more details, it's CLIENTR.

So? You shouldn't be checking clientr flags clientside.

Warcaptain · #21 05-10-2006, 07:24 PM

Quote:

Originally Posted by Rick

So? You shouldn't be checking clientr flags clientside.

Why? There's no way to falsify a clientr. flag clientside o.O

Quote:

Originally Posted by xAndrewx

We shouldn't need to worry about this though, the graal client should some-what prevent it.

Yes, the Graal client has clientr/client flags for this.

Snakeandy7 · #22 05-10-2006, 08:20 PM

Quote:

Originally Posted by Rick

So? You shouldn't be checking clientr flags clientside.

I don't think we are... o_o

Malinko · #23 05-10-2006, 08:37 PM

Quote:

Originally Posted by Chicken_l33t

Snandy, try hack Graal yourself. It sounds pretty weird, but that way you find the flaws and can prevent it yourself or get someone to do this for you.

He has the right, for the benefit of his world, as long as he reports it.

I mean, Damix helped me with Kingdoms and the graphics replacement.

Admins · #24 05-11-2006, 12:44 AM

If someone knows hacking working methods then report them via forum pm.
The script variables are usually quite secure on clientside, but you should never rely on them. It can never be prevented that something is sent/received incorrectly or some bugged script is setting a variable to a wrong value, so do only things on the server which cannot go wrong even if there is bad input from the clientside.
(Bad input means: client. vars being edited, invalid triggers being sent)