[valve] Admin Slowhacking

Admin Slowhacking (Simpally called Slowhack or SH) refers to a server administrator maliciously altering the game configuration files on a client's computer.

GoldSource games

Slowhacking is provided by AMXX scripting.

 client_cmd ( index, const command[], {Float,...} )


client_cmd- Executes command on a player.

Example of harmful slowhacking

Use setinfo as a HTTP cookie.

client_cmd(id, "setinfo ^"lang^" ^"%s^"", pLang);

Blocking

A Counter-Strike update on February 21, 2013, provides protection for players - a cvar cl_filterstuffcmd.

Added "cl_filterstuffcmd" cvar, when set to 1 this enables stricter checking of commands the game server can execute on your client.

List of blocked cvars and commands

cl_filterstuffcmd 0

motd_write
cl_filterstuffcmd
bind
unbind
unbindall
connect

cl_filterstuffcmd 1 

gl_*
r_*
hud_*
cl_*
m_*
_restart
_set_vid_level
_setaddons_folder
_setgamedir
_sethdmodels
_setrenderer
_setvideomode
rate
connect
retry
timerefresh
alias
bind
unbind
unbindall
cd
exec
exit
kill
quit
say
setinfo
sensitivity
sys_ticrate
writecfg
removedemo
ex_interp
developer
fps_max
speak_enabled
voice_enable
volume
mp3volume
motd_write

However, a bug still makes it possible to make client execute blocked commands. https://github.com/ValveSoftware/halflife/issues/1497