8 ms·

Tencent owns 40% of Epic Games, which develops the incredibly popular Fortnite Battle Royale computer game. Epic Games happens to also develop the influential t

Tencent owns 40% of Epic Games, which develops the incredibly popular Fortnite Battle Royale computer game. Epic Games happens to also develop the influential tool Unreal Engine, which is used widely throughout industry to produce interactive 3D applications. Fortnite BR, like other competitive online games, runs anti-cheat software in-order to detect cheaters. Fornite BR happens to use Easy Anti-Cheat and BattlEye [1] [2]. Anti-cheat software runs with very high privilege. More importantly, with many anti-cheat software, every session a new binary payload is downloaded directly from the internet. Anti-cheat software seems like a great platform to launch targeted malware in-order to achieve a beachhead on a computer network: highly targeted, and effectively undetectable. I would expect most software developers don't sandbox their gaming machines from their work-from-home environments. [1] https://www.reddit.com/r/FortNiteBR/comments/82xyhb/launch_error_easyanticheat_not_installed/dvdng3a/ https://www.reddit.com/r/FortNiteBR/comments/82xyhb/launch_e... [2] https://www.thesun.co.uk/tech/7446514/fortnite-cheats-beware-epic-games-buys-game-security-firm-kamu/ https://www.thesun.co.uk/tech/7446514/fortnite-cheats-beware...

Negitivefrags 8y ago
I think the concept that Tencent is asking Epic to infect your computer with malware is a ridiculous conspiracy theory. I work for a western studio for which Tencent is a majority shareholder, and I can tell you, Tencent hasn't even hinted at wanting any of our data, let harvesting more. As far as I can tell, their motives are simple and capitalistic. Somewhat ironically, it was all the western potential acquiring companies that had agendas that were very ethically distasteful to us. Tencent certainly complies with Chinese laws in china, but can you blame it? Wouldn't you comply with the law of your country?
- Judgmentality 8y ago
  > I work for a western studio for which Tencent is a majority shareholder, and I can tell you, Tencent hasn't even hinted at wanting any of our data, let harvesting more. How would you know if they did? Most employees have zero interactions with their employer's investors.
  - Negitivefrags 8y ago
    Because I am the CTO of the company, and because the only interaction Tencent has with our company are during it's board meetings, which I am also a member of.
    - xiphias2 8y ago
      Nice comeback :) The person who asked should have looked at your profile.
    - undefinedblog 8y ago
      Awww, right in his face, that's cruial!
    - loriverkutya 8y ago
      The only interaction you know about. I was working for a telco hardware and software manufacturer and I remember when about 15 years ago, I was the QA, who was sent to China with an engineer to implement "a feature" onsite (yes it was a backdoor). Everybody could guessed in my team, why are we were sent there. Also worked at a cinema control software company and we had to implement the same feature. So yeah, it only take one engineer to implement a feature. (or a bug)
      - Angostura 8y ago
        > Everybody could guessed in my team So pretty widely known.
        loriverkutya 8y ago
        Yeah, because we did not gave a shit about the NDA we had to sign.
      - ascar 8y ago
        And your CTO didn't know about your trip abroad? Seems highly unlikely.
- unionpivo 8y ago
  What makes you think something like this would be announced on company wide email? One or two guys, working on cheat detection might know something, or most likely are just told to ignore whatever, they see.
  - huffmsa 8y ago
    Like Google's Dragonfly. Or AT&T letting the NSA splice intercepts in the main fiber room. Ntk only.
  - empath75 8y ago
    intelligence services play the long game. Gradually exert pressure, put friendly management in place, move supporting services to Chinese data centers, etc. Maybe it takes 10 years. They aren’t in any rush.
  - sky_nox 8y ago
    Click on his profile. He's the CTO of the company.
    - philwelch 8y ago
      Even if you're the CTO of a US company that's being infiltrated by a foreign intelligence agency, there are only three possibilities: * You are a foreign intelligence asset and and any denials on your part are lies. * You are not a foreign intelligence asset, but you know that strange things are afoot and have informed the FBI. In order to not jeopardize the counterintelligence investigation, you have been instructed to play dumb, and hence, any denials on your part are lies. * You are not a foreign intelligence asset and you have not noticed the infiltration. In this situation, you're not lying when you deny that anything's going on, you're just ignorant. Of course, if your company isn't being infiltrated by foreign intelligence, you will also, correctly, deny that the company is being infiltrated. I'm not saying that his company is being infiltrated or compromised; I'm saying that there's virtually zero informational value in someone in his position denying such a thing because no one would ever admit it.
- yorwba 8y ago
  > all the western potential acquiring companies that had agendas that were very ethically distasteful to us. Interesting, can you elaborate?
  - Negitivefrags 8y ago
    I don't want to give examples of specific companies for what I hope are obvious reasons. But in basically all cases western companies were much more interested in buying us for our users, which they could then subject to whatever their business model is. Selling ads, selling subscriptions, selling data, whatever. Our companies profit was actually a negative to these western companies since it simply increases the price that they would have to pay to get at the users.
- loriverkutya 8y ago
  If the country law is aimed to achive 100% surveillance and zero privacy, yes, you can blame it.
  - Moru 8y ago
    Yes, there is a difference between giving all your information by your own free will and the state spying on everything you do. On the other hand how many knows how much Facebook and Google collects about you and where that information ends up some time later? There was a lot of scifi about the information society and how that could derail in the future, where machines decides if you might commit a crime in the future and take preventative meassures. We are not far away from it now, just takes a few small jumps in the imagination to end up there :-)
    - PavlovsCat 8y ago
      > There was a lot of scifi about the information society More importantly, there is a lot of literature about totalitarianism.
- orly1337 8y ago
  > Tencent certainly complies with Chinese laws in china, but can you blame it? Wouldn't you comply with the law of your country? Since you've put yourself out here as CTO of a Tencent owned company... I've heard that in China, Fortnite requires a Chinese "real ID" to play. Aka China knows exactly who you are at all times. They also "punish" you for playing more than 3 hours at a time if you're under 18. And I can't prove, but assume they also record all conversations (otherwise... What is point of using real id??) This doesn't sound like something Epic games would want to be associated with if Tencent wasn't a major shareholder. Are you saying you've had no pressure at all to implement similar features and make your games "more friendly to the Chinese market"? To me it feels just like China buying up slivers of hollywood so nothing critical of the regime makes the big screen
  - omnimus 8y ago
    The question is if this chinese id is requirement from gov to enter the market... how many corporations would refuse (EA for example)? Especialy with Fortnite which is sure to be super profitable. I am not saying Epic/Tencent is good or anything just that you don't need to be partialy owned by chinese company for this to happen. It is financial capitalist decision. Similar to why other companies want to enter china market. It would be more suspicious if Epic was doing it even when Fortnite woulnt be profitable in china.
    - yorwba 8y ago
      Since you mention EA, it appears that they partner with Tencent Games for the FIFA franchise: https://eafifa.qq.com/ https://eafifa.qq.com/
yorwba 8y ago
40% ownership won't grant them the ability to abuse the anti-cheat software, unless I misunderstand how partial ownership works.
- benj111 8y ago
  If for example they also owned battlEye they would have a seat at the table to 'suggest' that was used for anti cheating. No comment on the wider claims, but 40% does give them a tremendous amount of at least soft power.
  - yorwba 8y ago
    Sure, but then the problem would be their ownership of the anti-cheat company, not of Epic. FWIW, BattlEye appears to be German and Easy Anti-Cheat Finnish (and bought by Epic).
- huffmsa 8y ago
  They only need to get another 11% to vote with them.(assuming they have 40% voting representation). That's one or two other shareholders you need to bribe / convince. Not difficult, especially when the company you just invested in is learning what it's like to have scrooge McDuck money and want more.
  - baybal2 8y ago
    They don't need to do anything with shareholders to spy on anybody. Heck, if China wants to spy on anybody, they don't even need to resort to technology to begin with... Unlike the PRC, USA is a more or less open society — want someone's secret? Just send your man there; Want to influence someone? Just ask...... I totally don't understand American concern with technology being used by espionage, while it lets this go.
    - huffmsa 8y ago
      You're thinking too small. Yes, stealing individual secrets is best done with old school tradecraft. Spies in suits, photos of scandals with dominatrixes. But what if you want build a system which can identify homosexuals based on textual conversations? You buy Grindr. Or what if you want to get a backdoor for future exploitation on almost every computer in the US? You buy Fortnite. Because one of those computers will belong to the child of someone important. It only takes one slip by them to get Stuxnet from their home PC to their work PC. You mustn't be afraid to dream a little bigger darling.
huffmsa 8y ago
Sent me into a small panic there. But I remembered I've got work and play on separate OSes, on separate encrypted disks.
- close04 8y ago
  Still in the same system and network I assume. If you are an "irrelevant" target let's say, one where there are no stakes in getting to you, this is good enough. Otherwise it's a matter of getting into your UEFI or disk firmware (since both disk share the same system), or rest of the network (router, IoT crap, another system, etc.) and the fact that you have an encrypted disk won't matter that much. It's about how important a target you are. You only have to make one mistake, and "they" only have to get it right once. There's no defense that you can put up against a team of dedicated hackers with nation state backing unless you are either not on their radar, or have nothing inherently hackable in your life.
  - huffmsa 8y ago
    A dedicated team? Of course not. But it's still worthwhile to protect oneself from being an easy target for a system which just scoops anything interesting off the disk it's installed on.
tya99 8y ago
> Anti-cheat software seems like a great platform to launch targeted malware in-order to achieve a beachhead on a computer network: highly targeted, and effectively undetectable. > I would expect most software developers don't sandbox their gaming machines from their work-from-home environments. I have been worried about this for some time. In my country we have a lot of issues with metadata retention so I set something up like this[0]. I have separate VLANs: • VLAN 1: Management (no tag, null route) • VLAN 2: Untrusted (routes direct to ISP via ppp0) • VLAN 3: Trusted (routes direct to ISP via ppp0) • VLAN 4: Trusted (routes via tun0 - VPN connection for private browsing etc) • VLAN 5: Null route for devices that do not require internet access of any kind, desk phones printers etc. (Doesn't have to be a Raspberry Pi, you can use anything that Alpine Linux runs on which is x86_64, x86, ppc64le, s390x, armhf, aarch64 (ARM8 like Raspberry Pi 3), armv7 (Raspberry Pi 2, and friends).[1] [0] https://wiki.alpinelinux.org/wiki/Linux_Router_with_VPN_on_a_Raspberry_Pi_(IPv6) https://wiki.alpinelinux.org/wiki/Linux_Router_with_VPN_on_a... [1] https://alpinelinux.org/downloads/ https://alpinelinux.org/downloads/ The idea is that anything on VLAN2 is completely segregated at the switch and router level from the rest of my network.
- mindslight 8y ago
  Upgrading to managed switches, I had thought about making a bunch of VLANs in a similar manner. But I ended up settling on something much simpler. There are essentially just two segments / types of switch ports (I may have stuck with the many-vlans thing if switch ports had RGB LEDs showing what zone they were in...). First, the "trusted" network, which does switch management, servers, reasonably-behaved hosts, etc. Then, a second "access" segment. Ports in this segment are setup to not be able to talk to one another through the switching fabric at all - the only thing they can talk to is the router. Ports on the same switch are prohibited from talking by the switch's config, and different switches are given different associated VLANs. This is good for visitors, Android, Internet of Trash, etc. For routing, the horizon seen by each device is controlled directly by its own macaddr on the router itself. Two hosts on the same segment can see drastically different routing tables and Internet connections. This isn't perfect, as it can be easily spoofed unless I start pushing the switchport-mac mapping out to the switches. But it works for now. But I believe "sandboxing" in the original comment was talking about the machine itself, not network access. So PC gaming means being disciplined about getting another machine, or at least a second GPU for PCIE passthrough in a VM. In general I think we're in a time of decommodification. The easiest way to sandbox between security boundaries is separate machines, of which there is an inexpensive surplus of. No need to have banking and games on the same tablet, when a second hand nexus7 (flo) is $40 on fleabay.
deleted 8y ago
[deleted]
LorenPechtel 8y ago
Until some anti-malware outfit figures it out, then they're in some very hot water.
noir_lord 8y ago
I dual boot windows and Linux, work is always done on Linux with FDE and I never access files on one from the other but it's a threat model I never considered, Fortnite is installed because the boy plays if a lot when I'm not using the gaming/dev PC.

Negitivefrags 8y ago

I think the concept that Tencent is asking Epic to infect your computer with malware is a ridiculous conspiracy theory. I work for a western studio for which Tencent is a majority shareholder, and I can tell you, Tencent hasn't even hinted at wanting any of our data, let harvesting more. As far as I can tell, their motives are simple and capitalistic. Somewhat ironically, it was all the western potential acquiring companies that had agendas that were very ethically distasteful to us. Tencent certainly complies with Chinese laws in china, but can you blame it? Wouldn't you comply with the law of your country?

Judgmentality 8y ago
> I work for a western studio for which Tencent is a majority shareholder, and I can tell you, Tencent hasn't even hinted at wanting any of our data, let harvesting more. How would you know if they did? Most employees have zero interactions with their employer's investors.
- Negitivefrags 8y ago
  Because I am the CTO of the company, and because the only interaction Tencent has with our company are during it's board meetings, which I am also a member of.
  - xiphias2 8y ago
    Nice comeback :) The person who asked should have looked at your profile.
  - undefinedblog 8y ago
    Awww, right in his face, that's cruial!
  - loriverkutya 8y ago
    The only interaction you know about. I was working for a telco hardware and software manufacturer and I remember when about 15 years ago, I was the QA, who was sent to China with an engineer to implement "a feature" onsite (yes it was a backdoor). Everybody could guessed in my team, why are we were sent there. Also worked at a cinema control software company and we had to implement the same feature. So yeah, it only take one engineer to implement a feature. (or a bug)
    - Angostura 8y ago
      > Everybody could guessed in my team So pretty widely known.
      - loriverkutya 8y ago
        Yeah, because we did not gave a shit about the NDA we had to sign.
    - ascar 8y ago
      And your CTO didn't know about your trip abroad? Seems highly unlikely.
unionpivo 8y ago
What makes you think something like this would be announced on company wide email? One or two guys, working on cheat detection might know something, or most likely are just told to ignore whatever, they see.
- huffmsa 8y ago
  Like Google's Dragonfly. Or AT&T letting the NSA splice intercepts in the main fiber room. Ntk only.
- empath75 8y ago
  intelligence services play the long game. Gradually exert pressure, put friendly management in place, move supporting services to Chinese data centers, etc. Maybe it takes 10 years. They aren’t in any rush.
- sky_nox 8y ago
  Click on his profile. He's the CTO of the company.
  - philwelch 8y ago
    Even if you're the CTO of a US company that's being infiltrated by a foreign intelligence agency, there are only three possibilities: * You are a foreign intelligence asset and and any denials on your part are lies. * You are not a foreign intelligence asset, but you know that strange things are afoot and have informed the FBI. In order to not jeopardize the counterintelligence investigation, you have been instructed to play dumb, and hence, any denials on your part are lies. * You are not a foreign intelligence asset and you have not noticed the infiltration. In this situation, you're not lying when you deny that anything's going on, you're just ignorant. Of course, if your company isn't being infiltrated by foreign intelligence, you will also, correctly, deny that the company is being infiltrated. I'm not saying that his company is being infiltrated or compromised; I'm saying that there's virtually zero informational value in someone in his position denying such a thing because no one would ever admit it.
yorwba 8y ago
> all the western potential acquiring companies that had agendas that were very ethically distasteful to us. Interesting, can you elaborate?
- Negitivefrags 8y ago
  I don't want to give examples of specific companies for what I hope are obvious reasons. But in basically all cases western companies were much more interested in buying us for our users, which they could then subject to whatever their business model is. Selling ads, selling subscriptions, selling data, whatever. Our companies profit was actually a negative to these western companies since it simply increases the price that they would have to pay to get at the users.
loriverkutya 8y ago
If the country law is aimed to achive 100% surveillance and zero privacy, yes, you can blame it.
- Moru 8y ago
  Yes, there is a difference between giving all your information by your own free will and the state spying on everything you do. On the other hand how many knows how much Facebook and Google collects about you and where that information ends up some time later? There was a lot of scifi about the information society and how that could derail in the future, where machines decides if you might commit a crime in the future and take preventative meassures. We are not far away from it now, just takes a few small jumps in the imagination to end up there :-)
  - PavlovsCat 8y ago
    > There was a lot of scifi about the information society More importantly, there is a lot of literature about totalitarianism.
orly1337 8y ago
> Tencent certainly complies with Chinese laws in china, but can you blame it? Wouldn't you comply with the law of your country? Since you've put yourself out here as CTO of a Tencent owned company... I've heard that in China, Fortnite requires a Chinese "real ID" to play. Aka China knows exactly who you are at all times. They also "punish" you for playing more than 3 hours at a time if you're under 18. And I can't prove, but assume they also record all conversations (otherwise... What is point of using real id??) This doesn't sound like something Epic games would want to be associated with if Tencent wasn't a major shareholder. Are you saying you've had no pressure at all to implement similar features and make your games "more friendly to the Chinese market"? To me it feels just like China buying up slivers of hollywood so nothing critical of the regime makes the big screen
- omnimus 8y ago
  The question is if this chinese id is requirement from gov to enter the market... how many corporations would refuse (EA for example)? Especialy with Fortnite which is sure to be super profitable. I am not saying Epic/Tencent is good or anything just that you don't need to be partialy owned by chinese company for this to happen. It is financial capitalist decision. Similar to why other companies want to enter china market. It would be more suspicious if Epic was doing it even when Fortnite woulnt be profitable in china.
  - yorwba 8y ago
    Since you mention EA, it appears that they partner with Tencent Games for the FIFA franchise: https://eafifa.qq.com/ https://eafifa.qq.com/

yorwba 8y ago

40% ownership won't grant them the ability to abuse the anti-cheat software, unless I misunderstand how partial ownership works.

benj111 8y ago
If for example they also owned battlEye they would have a seat at the table to 'suggest' that was used for anti cheating. No comment on the wider claims, but 40% does give them a tremendous amount of at least soft power.
- yorwba 8y ago
  Sure, but then the problem would be their ownership of the anti-cheat company, not of Epic. FWIW, BattlEye appears to be German and Easy Anti-Cheat Finnish (and bought by Epic).
huffmsa 8y ago
They only need to get another 11% to vote with them.(assuming they have 40% voting representation). That's one or two other shareholders you need to bribe / convince. Not difficult, especially when the company you just invested in is learning what it's like to have scrooge McDuck money and want more.
- baybal2 8y ago
  They don't need to do anything with shareholders to spy on anybody. Heck, if China wants to spy on anybody, they don't even need to resort to technology to begin with... Unlike the PRC, USA is a more or less open society — want someone's secret? Just send your man there; Want to influence someone? Just ask...... I totally don't understand American concern with technology being used by espionage, while it lets this go.
  - huffmsa 8y ago
    You're thinking too small. Yes, stealing individual secrets is best done with old school tradecraft. Spies in suits, photos of scandals with dominatrixes. But what if you want build a system which can identify homosexuals based on textual conversations? You buy Grindr. Or what if you want to get a backdoor for future exploitation on almost every computer in the US? You buy Fortnite. Because one of those computers will belong to the child of someone important. It only takes one slip by them to get Stuxnet from their home PC to their work PC. You mustn't be afraid to dream a little bigger darling.

huffmsa 8y ago

Sent me into a small panic there. But I remembered I've got work and play on separate OSes, on separate encrypted disks.

close04 8y ago
Still in the same system and network I assume. If you are an "irrelevant" target let's say, one where there are no stakes in getting to you, this is good enough. Otherwise it's a matter of getting into your UEFI or disk firmware (since both disk share the same system), or rest of the network (router, IoT crap, another system, etc.) and the fact that you have an encrypted disk won't matter that much. It's about how important a target you are. You only have to make one mistake, and "they" only have to get it right once. There's no defense that you can put up against a team of dedicated hackers with nation state backing unless you are either not on their radar, or have nothing inherently hackable in your life.
- huffmsa 8y ago
  A dedicated team? Of course not. But it's still worthwhile to protect oneself from being an easy target for a system which just scoops anything interesting off the disk it's installed on.

tya99 8y ago

> Anti-cheat software seems like a great platform to launch targeted malware in-order to achieve a beachhead on a computer network: highly targeted, and effectively undetectable. > I would expect most software developers don't sandbox their gaming machines from their work-from-home environments. I have been worried about this for some time. In my country we have a lot of issues with metadata retention so I set something up like this[0]. I have separate VLANs: • VLAN 1: Management (no tag, null route) • VLAN 2: Untrusted (routes direct to ISP via ppp0) • VLAN 3: Trusted (routes direct to ISP via ppp0) • VLAN 4: Trusted (routes via tun0 - VPN connection for private browsing etc) • VLAN 5: Null route for devices that do not require internet access of any kind, desk phones printers etc. (Doesn't have to be a Raspberry Pi, you can use anything that Alpine Linux runs on which is x86_64, x86, ppc64le, s390x, armhf, aarch64 (ARM8 like Raspberry Pi 3), armv7 (Raspberry Pi 2, and friends).[1] [0] https://wiki.alpinelinux.org/wiki/Linux_Router_with_VPN_on_a_Raspberry_Pi_(IPv6) https://wiki.alpinelinux.org/wiki/Linux_Router_with_VPN_on_a... [1] https://alpinelinux.org/downloads/ https://alpinelinux.org/downloads/ The idea is that anything on VLAN2 is completely segregated at the switch and router level from the rest of my network.

mindslight 8y ago
Upgrading to managed switches, I had thought about making a bunch of VLANs in a similar manner. But I ended up settling on something much simpler. There are essentially just two segments / types of switch ports (I may have stuck with the many-vlans thing if switch ports had RGB LEDs showing what zone they were in...). First, the "trusted" network, which does switch management, servers, reasonably-behaved hosts, etc. Then, a second "access" segment. Ports in this segment are setup to not be able to talk to one another through the switching fabric at all - the only thing they can talk to is the router. Ports on the same switch are prohibited from talking by the switch's config, and different switches are given different associated VLANs. This is good for visitors, Android, Internet of Trash, etc. For routing, the horizon seen by each device is controlled directly by its own macaddr on the router itself. Two hosts on the same segment can see drastically different routing tables and Internet connections. This isn't perfect, as it can be easily spoofed unless I start pushing the switchport-mac mapping out to the switches. But it works for now. But I believe "sandboxing" in the original comment was talking about the machine itself, not network access. So PC gaming means being disciplined about getting another machine, or at least a second GPU for PCIE passthrough in a VM. In general I think we're in a time of decommodification. The easiest way to sandbox between security boundaries is separate machines, of which there is an inexpensive surplus of. No need to have banking and games on the same tablet, when a second hand nexus7 (flo) is $40 on fleabay.

deleted 8y ago

[deleted]

LorenPechtel 8y ago

Until some anti-malware outfit figures it out, then they're in some very hot water.

noir_lord 8y ago

I dual boot windows and Linux, work is always done on Linux with FDE and I never access files on one from the other but it's a threat model I never considered, Fortnite is installed because the boy plays if a lot when I'm not using the gaming/dev PC.