We’re encountering one person in particular (Active now) being able to completely freeze game servers here via what we originally theorised to be sending too many or too large of requests to the chat system, but at this point we’re not sure and can’t find any data through F9 output.
We’ve tried a system that limits messages sent in a short time span which led us away from this idea after that didn’t prevent crashing.
How to reproduce this issue:
They appear to be using a bot on many alternate accounts to join servers and crash games in an automated way. The user joins the game and the server immediately crashes with no chat and no F9 server logs that retrieve anything useful to diagnose this so far. If you join the game now you should be able to catch this happening yourself each time a server begins.
This has been happening regularly over the past week and since the beginning of April.
Thank you for reading, I will provide any other information I can find and if you need me to record any data for this specific case I can post that here as well.
If you have an admin installed in-game, could you possibly check :chatlogs ?
There’s a server crash method recently that abuses the use of game.Players:Chat(message) and it doesn’t show up their bubble chat (however, it shows up in chatlogs)
If this is the case ^, then I might be able to help you with it.
They can also crash servers with admin systems suchas Adonis, Basic Admin etc, Via the :clean Command, They use the game.Players.Chat(":clean") Loop it which then crashes the server due to overload.
Yep, that’s another one I’ve seen, we have patched the ;clean command issue by adding a debounce for each request to the admin system regardless of the command they use.
I’m just trying that now astra_wr, I’ll let you know if it gives me any information in time before they crash the server and I will post what I find here.
What we’ve found so far is it may well be abuse of the !clean command after all, but in differing ways like stringing the commands together into one single line. HmmBilly also mentioned this, you were right.
Here’s the kind of script they use clientside:
Solutions include (courtesy of astra_wr):
Disabling the !clean function entirely regardless of your admin system in game
"The script has a certain pattern, so it looks something like “!clean !clean !clean !clean !clean !clean !clean” so having a check for this in particular and not allowing it to go through or be acknowledged at all by the admin system.
“On Chatted, you can use string:split(” “) and look for the patterns. If the pattern happens too frequently, then kick. (amateur method)”
" Limit how often players can call the remote. (SayMessageRequest remote under the ChatServiceRunner) – record timestamp using tick() of the last time the player called the remote, then if it was less than 0.5 seconds ago, reject it. (ensure its per-player)
(probably the best method)"
Thank you for the help with this, as it bypassed or overtook the chat spam checks we had, if this works over a period I will update again here to let you guys know.
I reported this problem to Irreflexive already but the players name is the same as something in the workspace and it is getting the players name instead of the intended location. Hope this helped!
Adonis has a rate logger/limit for chat commands, remotes etc so I don’t believe your issue is going to be lie within its source code. (Testing the clean command and it successfully ruled out the excess calls)
My game is having this issue also (players dropped from 400 to 50 in a matter of minutes). I don’t think this is a game specific issue as I use few public frameworks and a lot of games in the same genre as mine are having the same thing happen to them. My game has anti-exploits for old crash methods such as RightGrip crash, Chat crash and Animation crash, but this seems to bypass it. My game has also gotten DDoSed via IP in the past, but this does not seem to be the case today as DDoS via IP tends to not instantly crash a server, plus this happens immediately once a user joins the game, whereas a DDoS can happen externally.
This is not admin chat crash. I fixed that in my game by removing the old admin and adding my own, and got someone to test the clean command crash. However today people seem to be able to crash again, I have logged chat aswell and I don’t see anything suspicious. I think it’s a platform wide issue.
My game had the same issue. Here is the script they use (obfusucated), I havn’t had time to look at it yet but I believe it spams the :Clone command. fastcrashh.lua (32.9 KB)
There is a post on this same issue. It seems like the server crashes due to exploiters creating localplayers, which confuses the client and crashes the server. This issue is still on going right now, but hopefully will get patched sooner or later.
