Submit Feedback

Hard drive attack vector on The Expanse

Scoobysnacks shared this bug ago

Reported

ON 08/28/2022 The Expanse Survival Space Engineers server experienced an attack from malicious actors. This is a sanitized copy of our chat log while we investigated the issue.

Garret Sidzaka — 7:21 PM

I'm going to clear the SE cache

Garret Sidzaka — 7:29 PM

Memory leak found, harddrive almost full.

Image[KeenTicketMemoryLeak]

Gertron — Today at 10:11 PM

It was LCD panels with huge whitespace in their 'public description' probably a blueprint or something

Image[KeenTicketLCD]

Gertron — 10:30 PM

It was SunBlock and CommunistDestroyer69

unfortunately since @Garret Sidzaka wiped the log files i dont think i can get their IP addresses

Player CommunistDestroyer69 banned. (76561198124379883)

Player Sunblock banned. (76561198146464699)

Infantry56 — 10:45 PM

Could these projectors also cause trouble? There was nothing on them, but still odd

Image[KeenTicketProjector]

Garret Sidzaka — 10:48 PM

@Kienata we need input sanitation on all text inputs in the game. you gotta have the parser check the length and truncate. this is a simple fix. just sanitize all LCD and other areas players can input text

*whts happening: they are using a text bot to paste in these millinos of lines while they distract the staff with nonsense. they almost perma crashed my server. this is the famous HDD vector. *

Gertron — 10:49 PM

I think its actually from a projection blueprint with multiple LCDs all with this info

I dont think they even needed to build them tbh

Garret Sidzaka — 10:54 PM

we should call this Hard drive attack vector

Files:

I have the same bug

Replies (5)

Garret Sidzaka ●

we only had about 3 gb left we were about to go down completely. game was unplayable and crashed continueously.

the ram was at like 24 gb as well. our cloud instance can balloon, but only so far before it hit the swap file and started to become unstable

Reply URL

Space Engineers Support ●

Hello!

Thank you for contacting us. Since this is a bug report, I'm moving your ticket to our support page, where our QA team will take care of you.

Kind Regards

Keen Software House

Reply URL

Scoobysnacks ●

Hello

We were able to locate the grid that caused the issues, as well as recover the projection. These are in-game screenshots showing how the actors were able to attack the server.

Thank you.

Files:

Reply URL

error 404 ●

So a projection with a lot of space in its text did this? Lol of all the silly thinghs ...

Reply URL

Ondrej Borz ●

Hello, Engineers!

Thanks for all the information and provided screenshot.

Can you also please provide me the blueprint that is doing this, or whole the save file, so I can try it on my end as well? That would be great help!

Thanks in advance.

Kind Regards

Keen Software House: QA Department

Reply URL

Garret Sidzaka ●

WARNING:

this 8mb files unzips to over 4GB!!

Files:

URL

Infantry56 ●

This is a blueprint of the grid. I imagine that they had all 4 projectors going at some point (10,000 LCD blocks). The original grid name is in parentheses.

https://steamcommunity.com/sharedfiles/filedetails/?id=2856414889

URL

error 404 ●

I wonder what it does in singleplayer.

URL

andersenman ●

this 8mb file

… is a password-protected 7z without a password given anywhere.

this 8mb file

… is a password-protected 7z without a password given anywhere.

URL

Scoobysnacks ●

As author of the thread, offering confirmation that Garret Sidzaka and Infantry56 are providing the correct files.

Thank you, Mr. Borz.

URL

QA KeenSWH 2 ●

Hello, Engineers!

Thanks for the blueprint.

We have successfully reproduced the issue and reported it internally.

Kind Regards,

Keen Software House: QA Department

URL

Alliguierg Vasconcelos ●

Probably this attack had its positive side in the development of multiplayer.

360e735073ab07fe55f426994ac2864c

Keen please set default limits per grid and players for all active blocks. I already have to do this for performance needs on my server. Now it's a matter of security.

If you want, I compile my list of limits that I currently use.

URL