6 ms·

A Call of Duty exploit

152 points by danso 9y ago

icebraining 9y ago
It's missing the actual exploit, no?
- Simpliplant 9y ago
  Link to GitHub repo is available at the end of article https://github.com/momo5502/cod-exploit https://github.com/momo5502/cod-exploit
  - icebraining 9y ago
    Thanks!
- taspeotis 9y ago
  “As the vulnerability has been patched, the code is available on GitHub.”
  - gsich 9y ago
    Well patched, they downgraded the game to an older build with other problems.
movover 9y ago
Interesting read - This is actually how a ton of game trainers/bots are made (especially ones used by Chinese gold farms in MMORPGs), along with private servers (except the other way around, where you send packets to the client). For some games, the bots are advanced enough where they can interact with all of the game's network protocol and behave similarly to a human, all while just being a 'terminal' for the game that sends custom packets. Hacking games via packet manipulation is nothing new either - I remember one of the big MMOs ~10 years ago having an exploit which would allow anyone to delete anyone else's in-game guild, and similarly, log into any user's account under some specific conditions.
- deleted 9y ago
  [deleted]
- simongr3dal 9y ago
  Episode 7 and 8 of the Darknet Diaries podcast has ~ 25 min each talking about hacking and exploiting games in this way. https://darknetdiaries.com/episode/7 https://darknetdiaries.com/episode/7 https://darknetdiaries.com/episode/8 https://darknetdiaries.com/episode/8
- arca_vorago 9y ago
  On the opposite end, I have used a program that does image recognition called sikuli to a act as much like a human as possible instead of doing the low level thing. My favorite hack I feel responsible for was the wow zeppelin hack (zeppling fly points were stored client side ) so you could change them and the zepplin would take you somewhere else!
  - Mononokay 9y ago
    > My favorite hack I feel responsible for was the wow zeppelin hack (zeppling fly points were stored client side ) so you could change them and the zepplin would take you somewhere else! Wait, really? I'm surprised I hadn't heard of this.
    - arca_vorago 9y ago
      It was back in the vanilla wow days. I was active over at some german run wow hacking forum, did some reverse engineering, and posted about finding the values being stored client side in ram. A few months later someone did it... and then it was patched almost immediately. It's entirely possible they weren't related and whoever did it found the values themselves, but that's not as fun a story to tell myself or others so I stick to my version. Now you have me feeling all nostalgic for the day wow went from beta to live... and those early vanilla days of 40 man raids.
      - Mononokay 9y ago
vectorEQ 9y ago
a lot of work is done in game hacks to inject network packets, but they usually rely on packets not being sanitized and just injecting other values. Like for instance in some mmorpg you can edit packets that are sent, to add extra skill points on leveling up or other edits in the binary information. Encrypting would help against this. I haven't seen them exploiting clients with malicious packets. This kind of thing is a little scary, for instance, what if you let their game install some known hack into itself? Then you would be able to get all playes VAC bans, which are permanent in any case i think as VAC cannot decern if the hack was inject by another player or the player who was victim of this install. if you would do that in matches, you could get adversaries banned from tournaments etc.
- indigochill 9y ago
  If network packets are being sent, doesn't that then mean that some amount of computation is happening on the client and in theory then any encryption of data from the client to the server is moot because the user can simply perform the injection in the process prior to the encryption (and vice versa, encryption to the client is moot because that data must be decrypted in order to be operated on, at which point the user can alter it)? Admittedly I have very little experience with game hacking, so I could be misunderstanding something.
  - vortico 9y ago
    Yes, encryption is essentially pointless because it only delays the discovery of a hack by a few days. The goal of an MMORPG network protocol designer is to make the official client the easiest/fastest way to train levels and kill monsters, so that writing a custom client doesn't give you much benefit over it.
- tokyodude 9y ago
  it's far far worse than that. you can inject arbitrary code to all opponents so install a root kit and read their Bank account or install a cyberlocker ransomware or turn their machine into a bot net. Windows and Mac (and Linux) really need to switch to as sandboxed systems and deprecate the 1980s style of code execution. The threats have changed and it's completely unacceptable how much access desktop apps have
gsich 9y ago
On the Steam Forums they deleted all threads regarding this.

152 points by danso 9y ago

icebraining 9y ago

It's missing the actual exploit, no?

Simpliplant 9y ago
Link to GitHub repo is available at the end of article https://github.com/momo5502/cod-exploit https://github.com/momo5502/cod-exploit
- icebraining 9y ago
  Thanks!
taspeotis 9y ago
“As the vulnerability has been patched, the code is available on GitHub.”
- gsich 9y ago
  Well patched, they downgraded the game to an older build with other problems.

movover 9y ago

Interesting read - This is actually how a ton of game trainers/bots are made (especially ones used by Chinese gold farms in MMORPGs), along with private servers (except the other way around, where you send packets to the client). For some games, the bots are advanced enough where they can interact with all of the game's network protocol and behave similarly to a human, all while just being a 'terminal' for the game that sends custom packets. Hacking games via packet manipulation is nothing new either - I remember one of the big MMOs ~10 years ago having an exploit which would allow anyone to delete anyone else's in-game guild, and similarly, log into any user's account under some specific conditions.

deleted 9y ago
[deleted]
simongr3dal 9y ago
Episode 7 and 8 of the Darknet Diaries podcast has ~ 25 min each talking about hacking and exploiting games in this way. https://darknetdiaries.com/episode/7 https://darknetdiaries.com/episode/7 https://darknetdiaries.com/episode/8 https://darknetdiaries.com/episode/8
arca_vorago 9y ago
On the opposite end, I have used a program that does image recognition called sikuli to a act as much like a human as possible instead of doing the low level thing. My favorite hack I feel responsible for was the wow zeppelin hack (zeppling fly points were stored client side ) so you could change them and the zepplin would take you somewhere else!
- Mononokay 9y ago
  > My favorite hack I feel responsible for was the wow zeppelin hack (zeppling fly points were stored client side ) so you could change them and the zepplin would take you somewhere else! Wait, really? I'm surprised I hadn't heard of this.
  - arca_vorago 9y ago
    It was back in the vanilla wow days. I was active over at some german run wow hacking forum, did some reverse engineering, and posted about finding the values being stored client side in ram. A few months later someone did it... and then it was patched almost immediately. It's entirely possible they weren't related and whoever did it found the values themselves, but that's not as fun a story to tell myself or others so I stick to my version. Now you have me feeling all nostalgic for the day wow went from beta to live... and those early vanilla days of 40 man raids.
    - Mononokay 9y ago

vectorEQ 9y ago

a lot of work is done in game hacks to inject network packets, but they usually rely on packets not being sanitized and just injecting other values. Like for instance in some mmorpg you can edit packets that are sent, to add extra skill points on leveling up or other edits in the binary information. Encrypting would help against this. I haven't seen them exploiting clients with malicious packets. This kind of thing is a little scary, for instance, what if you let their game install some known hack into itself? Then you would be able to get all playes VAC bans, which are permanent in any case i think as VAC cannot decern if the hack was inject by another player or the player who was victim of this install. if you would do that in matches, you could get adversaries banned from tournaments etc.

indigochill 9y ago
If network packets are being sent, doesn't that then mean that some amount of computation is happening on the client and in theory then any encryption of data from the client to the server is moot because the user can simply perform the injection in the process prior to the encryption (and vice versa, encryption to the client is moot because that data must be decrypted in order to be operated on, at which point the user can alter it)? Admittedly I have very little experience with game hacking, so I could be misunderstanding something.
- vortico 9y ago
  Yes, encryption is essentially pointless because it only delays the discovery of a hack by a few days. The goal of an MMORPG network protocol designer is to make the official client the easiest/fastest way to train levels and kill monsters, so that writing a custom client doesn't give you much benefit over it.
tokyodude 9y ago
it's far far worse than that. you can inject arbitrary code to all opponents so install a root kit and read their Bank account or install a cyberlocker ransomware or turn their machine into a bot net. Windows and Mac (and Linux) really need to switch to as sandboxed systems and deprecate the 1980s style of code execution. The threats have changed and it's completely unacceptable how much access desktop apps have

gsich 9y ago

On the Steam Forums they deleted all threads regarding this.