2010-03-01, 01:38 PM
Gawd! Wasn't this patched a while ago? Nexon must have really poor version control, they probably lost or didn't include the patch when the last migration from Neo city addition from KMS. Their whole development department really needs a overhaul.
How this hack is able to work is the CC message don't include any unique private ID only the server and the real users knows, it just uses the IGN to register on the new channel when CCing. So the hacker can spam the new channel with the victim's IGN using the fake CC message ahead of time and beat the victim to it. Easy patch is to include a special ID (or to include the IP), generated randomly upon the CC command and send back to the both the client and the new channel server which will be used in the CC authentication.
There is no law in preventing altering the content of TCP/IP message. To me technically packet editing is not just changing the content of the data payload, but altering the header of a packet, as like in cases for IP spoofing.
How this hack is able to work is the CC message don't include any unique private ID only the server and the real users knows, it just uses the IGN to register on the new channel when CCing. So the hacker can spam the new channel with the victim's IGN using the fake CC message ahead of time and beat the victim to it. Easy patch is to include a special ID (or to include the IP), generated randomly upon the CC command and send back to the both the client and the new channel server which will be used in the CC authentication.
There is no law in preventing altering the content of TCP/IP message. To me technically packet editing is not just changing the content of the data payload, but altering the header of a packet, as like in cases for IP spoofing.