Looking for a mod to guard against a MOTD overflow attack

[Tschallacka]

Heya,

 

**Edited 03/07/2015 with relevant information. I found out his attack vector**

 

I'm having issues with a hacker who crashes my 1.7.10 server by repeatedly requesting the MOTD by which the memory overflows on the server because of the json that gets compiled over and over(playercount and such)

 

He crashes my server multiple times a day because he doesn't get whitelisted.

 

So, basicaly I want to write/use a mod that logs how often the MOTD gets requested. I know I have to use the trail that sends s00PacketServerInfo, but what i'm wondering is how to get the IP of the user requestion so I can log it and hand it over to IPtables if it reaches a treshold.

 

Kind regards,

 

Tschallacka

[Tschallacka]

Hmmh, then he must be using a different weakness.

 

I so thought he used this one...

 

Clearly he's not whitelisted. I'm kinda stuck atm with coreprotect and cauldron. so im still chugging along with forge 1231.

 

I am writing my own anti grief/logging mod as we speak, and it would be relatively simple to turn it into a 1.7.10 mod so we can finally update forge.

 

I was just hoping someone would have made a coremod to fix this.

[LexManos]

packet logs are your friend.

 

[Tschallacka]

Okay, so he started bragging about how smart he is and bla bla but he dropped his attack vector.

 

He's requesting the motd multiple times which causes the server to crash because of all the json that gets compiled to answer the request.

 

Now my question is basically this:

 

Is there a way in forge that I can catch when S00PacketServerInfo is sent and to which ip? Then I can log that so IPTables can block it.

 

If I should write a coremod for this, which would be the best point to hook it in so I can get the IP? Anyone have experience with this?

[LexManos]

Haha this isn't a overflow issue at most it'd be a OOM issue. (Seriously would of been simple to detect if you sent the crash log)

But this is an interesting avenue.

Anyways did a little work to mitigate it, https://github.com/MinecraftForge/MinecraftForge/commit/5064d33519649a61b4975727b7522eeb4b50f7dc

This doesn't 100% solve it because the 'send small packet to server get large response' aspect still exists. But that shouldn't be that big of a issue unless your server is on a thin uplink.

But it addresses the memory issue.

The server invalidates the cache every 5 seconds, because it's dumb and shuffles the player list for an unknown reason (really guys...) but meh.

[Tschallacka]

I wish I had crash logs, then it would have been easy to pinpoint. But what we got were only the crashes that the service just stopped because the OS killed it/detected it dying.

 

Thanks for the modifications though :-)