this n.gger needs to go watch some fireworks or somethin. jeebus

__________________

She still can! =)

What i don't get is why he keeps calling it research as if hes some kind of genius working to solve some sort of problem by creating things to destroy halo. If someone really wants to do something good, go do it on something that matters, not halo. It's all pretty retarded, if he has the time to waste his "research" on halo like this, then what hes doing really doesn't matter.

I say if you have the ability to ruin it, you should now fix it, asshole.
This whole thing isn't exactly ruining my halo experience, except for times like right now where i get pissed over some bullsh.t. I have only had the server I'm in crashed by haloloop2 once, which was the first day it came out.

I say stop that madness, but i would encourage it if we actually had a support team that would better the game because of problems like this, which we don't.

I have no idea what you just typed. I felt like I'm reading a whole different story after I read the first sentence.

__________________

Click the link like 5 posts back and you will see my friend.
luigi says something like this is his research, he put like a 10,000 word essay on bungie forums.

He's what you call a "white-hat" hacker. He finds vulnerabilities, writes POC's, and let's someone else fix them. Without him posting the code, no one would fix it, and presumably somebody ELSE could figure out the exploit and then create and sell a similar program to people, and never even release what the vulnerability is or the source code etc etc. I DO, however, think that it was wrong of him to publicly post such a harmful program, rather than going straight to the developers. That's just irresponsible.

Ah well.

He posted this at the bungie forums..

I, Luigi Auriemma, usually don't reply in forums on which people talk about my research in fact the only time I did it was when I posted the links to my haloboom and haloloop patches for 1.04 in the Gearbox forum (yes I'm the author of these patches which move all the servers on which you play with your 1.04 versions, surprised?).
But in the last week I have had the occasion to read so much stupid comments, idiocies and other wrong and absurd things about me and my research that was impossible to ignore them.

I will go in order and this post will be long, so would be useful if you want to link it EVERYWHERE there is a direct or indirect discussion about my stuff.

First would be useful to stop to define "exploit" my research, the fact that not all the people have the technically skills and the background to understand something (and security is not something easy to understand) doesn't mean that they must offend the others.

These codes with these strange names are just open source GPLed proof-of-concepts which in full disclosure are required for demonstrating a vulnerability or an idea about a possible problem and are usually used by the other people in my same field (security/bugs researching) for confirming and consequently indexing the vulnerabilities and naturally by the same admins or the people who use one of the vulnerable products to test if and how much critical is the problem.
Just FYI I have found hundreds of vulnerabilities in any game and non-game software (Apache, MySQL, Emule, Utorrent and so on), everything is documented on my websites and the hundreds of mirrors and security websites everywhere in the world.

Like anything in the world (for example the knives you use to cut your food) also my research can be used in malicious way and naturally I can't control this. That's why in my field is important to be neutral and thinking only to my research moreover if there is the experience that help to understand what is good and what isn't.

Now, about "halofp" probably if instead of wasting your time in useless comments you had a bit of brain you had the occasion to search on Internet and see that:
- the fake players is a type of bug (not really a security vulnerability but a design bug) which has been found and researched by me since the 2003 and is highly documented with informations about what causes this problem and how to solve it
- the so called "halofp" exists from the 15th April 2005

Yes the far 2005, but probably nobody of you heard about me just because Bungie has never credited me in its patches they released for the vulnerabilities I found in the past and which were reported to them BEFORE the releasing of my public advisories.
But why I have spent time to contact the developers and waiting months before the releasing of informations about a security vulnerability found by me without being credited if some idiots think that I want to "ruin" their community?
And moreover why I need to ruin a game that I don't have?
I have played Halo only on Xbox with a friend of mine many years ago and was very funny, probably the best FPS I have played on this console.

The strange thing is that was enough to search on Internet something about the person who found these security vulnerabilities to know the answers to these questions but as usual the lazy people prefer to insult the work of the others instead of spending one minute on Internet and using their brain.
Anway I can do nothing except writing this post which probably these same people will never read.

Now, why all these old research has becoming so (in)"famous" only now?
The fact is that seems that someone had the ehmmm "great" idea to spread the words about the malicious usage of my research with links to my primary website... the only good things I see in this is that at least he credited me (credited for something showed as bad is not a nice thing) and naturally that the "haloloop2" bug has been fixed in less than a week.

I have talked about primary website since all my research is decentralized on some official mirrors and hundreds of security websites located in any part of the world (packetstorm and its mirrors for example), and I'm in the security scene by over 6 years ever on the same websites (feel free to check on http://www.archive.org/web/web.php) just to show you the genuinity of my research and my experience in this field.

I have read about people talking about shutting down my website (what of them???) but, trust me, nobody can be so stupid to try something similar first for the reason I have explained before, then because it's only a personal page written in a technical way (for people in my same field) and last because I don't want that all the Halo community must pay for the actions of some stupid individuals (moreover because I personally know some Halo admins and players which are very very good people) and although I can promise that I will never react to such actions I must also alert you that exist other critical vulnerabilities not yet disclosed which have been found by me in Halo.
I repeat, I have NEVER and NEVER will abuse of my stuff since I do only research but I'm human like any of you...
I hope my message is clear and anyone has understood it clearly and, consequently, wants to spread the word.

About the new vulnerabilities I was talking: some minutes after the releasing of the new 615 hotfix I have found a new loop vulnerability and I have quickly contacted Roger Wolfson about it and he has the new proof-of-concept in his hands (NOBODY else has informations about this bug).
Unfortunately he is now travelling and he will be able to put the hands on a new possible fix only after one month.
Naturally I will wait the releasing of the hotfix for releasing these informations, so don't ask about details.

If something is not clear feel free to contact me or you can continue the discussion here or on the thread on my forum opened just for the discussion about the Halo loop vulnerability:

http://aluigi.freeforums.org/haloloop-again-t404.html

I would also be happy to comment technically the vulnerabilities (moreover halofp which is very interesting, for example why someone without a valid cdkey can fill a Halo server?) and how to protect yourself and consequently taking actions versus who is exploiting them, but it's all up to you so let me know if you are interested and I will continue my discussions here.

And remember that knowledge and true informations are the only things in which you must trust and which can help since the disinformations which some ignorants (admins, attackers and players) are doing causes only worst effects.

Nice sig remedy. Lulz!

__________________

thats awesome news