Quote: --- Original message by: darkassassin14
u just make som folder and place a copy of those files he sed and theninstall the patch

Quote: --- Original message by: Ro0ster

do i place a copy of the ones inside the download, or the ones already in there?

Quote: Well just when we thought it was safe to put that Halo CD back in....Unfortunately..The same guy that released the haloloop2 exploit has now released another one that works against the new patch...It is called halofp.exe here is his website that he is distributing it from.
http://aluigi.altervista.org/index.htm
what this exploit does is make the server seem full and then after some time it crashes the server...Isnt there something we can do to stop this guy?? Roger, Hopefully you see this and its not too much to ask to fix this bug as well...This is getting rediculous....

Quote: --- Original message by: darkassassin14
hey maybe we can get him arrested lol. i hate haxors. i played against one be 4 he made himself run super fast and put on super jump (wich was no prob with dev) and made his fuel rod shoot fast. and the funny part is i owned him then i gave him an exeption with my dev lol and it closed down. he musta really sucked to get ownd even tho he got hax lol

Quote: --- Original message by: Mailas
I cant talk in the game anymore!!!!
I press T and the thing comes up, but I cant type anything!
I cant see what other people are typing either!!

Is this happening to anyone else?

Quote: hey maybe we can get him arrested lol

Quote: Posted By: aluigi

I, Luigi Auriemma, usually don't reply in forums on which people talk about my research in fact the only time I did it was when I posted the links to my haloboom and haloloop patches for 1.04 in the Gearbox forum (yes I'm the author of these patches which move all the servers on which you play with your 1.04 versions, surprised?).
But in the last week I have had the occasion to read so much stupid comments, idiocies and other wrong and absurd things about me and my research that was impossible to ignore them.

I will go in order and this post will be long, so would be useful if you want to link it EVERYWHERE there is a direct or indirect discussion about my stuff.

First would be useful to stop to define "exploit" my research, the fact that not all the people have the technically skills and the background to understand something (and security is not something easy to understand) doesn't mean that they must offend the others.

These codes with these strange names are just open source GPLed proof-of-concepts which in full disclosure are required for demonstrating a vulnerability or an idea about a possible problem and are usually used by the other people in my same field (security/bugs researching) for confirming and consequently indexing the vulnerabilities and naturally by the same admins or the people who use one of the vulnerable products to test if and how much critical is the problem.
Just FYI I have found hundreds of vulnerabilities in any game and non-game software (Apache, MySQL, Emule, Utorrent and so on), everything is documented on my websites and the hundreds of mirrors and security websites everywhere in the world.

Like anything in the world (for example the knives you use to cut your food) also my research can be used in malicious way and naturally I can't control this. That's why in my field is important to be neutral and thinking only to my research moreover if there is the experience that help to understand what is good and what isn't.

Now, about "halofp" probably if instead of wasting your time in useless comments you had a bit of brain you had the occasion to search on Internet and see that:
- the fake players is a type of bug (not really a security vulnerability but a design bug) which has been found and researched by me since the 2003 and is highly documented with informations about what causes this problem and how to solve it
- the so called "halofp" exists from the 15th April 2005

Yes the far 2005, but probably nobody of you heard about me just because Bungie has never credited me in its patches they released for the vulnerabilities I found in the past and which were reported to them BEFORE the releasing of my public advisories.
But why I have spent time to contact the developers and waiting months before the releasing of informations about a security vulnerability found by me without being credited if some idiots think that I want to "ruin" their community?
And moreover why I need to ruin a game that I don't have?
I have played Halo only on Xbox with a friend of mine many years ago and was very funny, probably the best FPS I have played on this console.

The strange thing is that was enough to search on Internet something about the person who found these security vulnerabilities to know the answers to these questions but as usual the lazy people prefer to insult the work of the others instead of spending one minute on Internet and using their brain.
Anway I can do nothing except writing this post which probably these same people will never read.

Now, why all these old research has becoming so (in)"famous" only now?
The fact is that seems that someone had the ehmmm "great" idea to spread the words about the malicious usage of my research with links to my primary website... the only good things I see in this is that at least he credited me (credited for something showed as bad is not a nice thing) and naturally that the "haloloop2" bug has been fixed in less than a week.

I have talked about primary website since all my research is decentralized on some official mirrors and hundreds of security websites located in any part of the world (packetstorm and its mirrors for example), and I'm in the security scene by over 6 years ever on the same websites (feel free to check on http://www.archive.org/web/web.php) just to show you the genuinity of my research and my experience in this field.

I have read about people talking about shutting down my website (what of them???) but, trust me, nobody can be so stupid to try something similar first for the reason I have explained before, then because it's only a personal page written in a technical way (for people in my same field) and last because I don't want that all the Halo community must pay for the actions of some stupid individuals (moreover because I personally know some Halo admins and players which are very very good people) and although I can promise that I will never react to such actions I must also alert you that exist other critical vulnerabilities not yet disclosed which have been found by me in Halo.
I repeat, I have NEVER and NEVER will abuse of my stuff since I do only research but I'm human like any of you...
I hope my message is clear and anyone has understood it clearly and, consequently, wants to spread the word.

About the new vulnerabilities I was talking: some minutes after the releasing of the new 615 hotfix I have found a new loop vulnerability and I have quickly contacted Roger Wolfson about it and he has the new proof-of-concept in his hands (NOBODY else has informations about this bug).
Unfortunately he is now travelling and he will be able to put the hands on a new possible fix only after one month.
Naturally I will wait the releasing of the hotfix for releasing these informations, so don't ask about details.

If something is not clear feel free to contact me or you can continue the discussion here or on the thread on my forum opened just for the discussion about the Halo loop vulnerability:

http://aluigi.freeforums.org/haloloop-again-t404.html

I would also be happy to comment technically the vulnerabilities (moreover halofp which is very interesting, for example why someone without a valid cdkey can fill a Halo server?) and how to protect yourself and consequently taking actions versus who is exploiting them, but it's all up to you so let me know if you are interested and I will continue my discussions here.

And remember that knowledge and true informations are the only things in which you must trust and which can help since the disinformations which some ignorants (admins, attackers and players) are doing causes only worst effects.

Quote: --- Original message by: NT Productions
This is called DDOS Hacking. They take their Server IP and with the press of a button,



I'm downloading the patch now. I don't want that to happen to me :S

Quote: Posted by: TRCXFIRE
well someone must have found a legal hole, that aluigi was performing illegal activities.. because his site is shutdown.

Quote: Posted By: Garnisop
His site didn't get shut down, it got DDoS'd. Next time get it right.

Quote: --- Original message by: supersniper
wait what happened to build 614 for Halo PC
If anyone has that can I has the patch??

Also this stopped all the aimbots OMG o_O
Edited by supersniper on Jul 7, 2008 at 12:27 AM

Quote: --- Original message by: onysf
i havn't downloaded the patch yet but i got a feeling i shouldn't or should i?

Quote: --- Original message by: NT Productions
This is called DDOS Hacking. They take their Server IP and with the press of a button,



I'm downloading the patch now. I don't want that to happen to me :S

Quote: --- Original message by: HALOIDE
is there a crack for 1.07 version ^^??

Quote: --- Original message by: AHS_SONIC
what the hell is an md5 hash???

Quote: --- Original message by: Scorpio
I downloaded that patch and it fuxed up my Halo CE and I had to reinstall it. Even after reinstallation, it was still glitchy for a week.