6 ms·

> So hopefully this cheat will be VAC / PB undetected for ever ;) That attitude really grinds my gears. I'd much prefer to see something like "here's how we th

by berti 7y ago

> So hopefully this cheat will be VAC / PB undetected for ever ;) That attitude really grinds my gears. I'd much prefer to see something like "here's how we think Valve could fix this permanently".

Stevvo 7y ago
I've got no problem with people writing hacks for games; with the shit that gets released these days I expect it would often be far more rewarding than playing the game itself. That said, authors should follow responsible disclosure, give the game company some time to respond before releasing.
- dvt 7y ago
  > That said, authors should follow responsible disclosure, give the game company some time to respond before releasing. Stack-smashing attacks have been around since at least 1988[1]. This cheat has less to do with the game itself and more to do with the computing architecture (i.e. stack-based). ROP is an active area of research and "code hardening" is a way to mitigate such an attack[2], but (from what I understand) usually comes with performance penalties. [1] https://lwn.net/Articles/732201/ https://lwn.net/Articles/732201/ [2] https://cs.brown.edu/~vpk/papers/ccr.sp18.pdf https://cs.brown.edu/~vpk/papers/ccr.sp18.pdf
  - jakear 7y ago
    I don't see your point. Do you think the authors shouldn't give responsible disclosure because the underlying mechanism has been around for a while? The company would obviously fix the area where false data is allowed to be injected, not systematically harden their entire codebase against any possible ROP-based attack.
    - kuroguro 7y ago
      There are going to be hundreds or thousands more, possibly outside of their code. They are easy to introduce in your code, fairly easy to find and hard to fix. It's more of an idea or PoC on how to write cheats than a specific exploit. On another note it's not an exploit in the classic sense - if you own your game you're legally allowed to do what you want with it in most countries AFAIK. I'm not convinced responsible disclosure even applies here.
- MrStonedOne 7y ago
  I don't think R.D. should apply when the exploit can benefit the device owner in gaining control over their device. Rooting/jailbreaking/safetynet exploits (and exploits that can be used for rooting and jailbreaking) shouldn't go to google and apple first, they should go to the users first. The same applies for bypassing anti-cheats or other modification prevention systems or other attestation systems.
  - kingosticks 7y ago
    Even when that benefit is at the direct expense of other users? Your device rooting example is different compared to online cheating in this respect and to me that's key.
- PyroLagus 7y ago
  > I've got no problem with people writing hacks for games; with the shit that gets released these days I expect it would often be far more rewarding than playing the game itself. Hacks in singleplayer games are fun. Hacks in multiplayer games are not. If someone thinks the game is shit and unrewarding, they should just not play it and not ruin it for everyone else.
  - ryanlol 7y ago
    There are loads of people who enjoy cheating in multiplayer games so much that they’re willing to spend hundreds of dollars a month on the hacks.
- p410n3 7y ago
  Sorry to disappoint, but stuff like the glowESP for csgo are around since the source engine released in 2004. Even normal cheats on github like charlatano are undetected, and that one is pretty popular. They dont really do shit
- chapium 7y ago
  Its multiplayer though. Doing this creates "fun" by cheating others.
ryanlol 7y ago
This sounds really petty to me, it grinds your gears that the attack developer is proud of their work? Seems like the next logical step will be for one of the many people specializing in defenses to develop a "permanent" fix :)
- PyroLagus 7y ago
  It's not petty. Hacks in multiplayer games ruin the game for everyone else, and the hack developer hopes that the hack will stay undetected forever. That's not proud. It's more like "I hope you can use this to be assholes and ruin the game for all other players as long as the game exists." Also, this is just a game, but if it was ransomware and the dev said "hopefully this ransomware will be antivirus undetected for ever", you'd probably have a different opinion, no?
  - ryanlol 7y ago
    Perhaps I'm just going with a more charitable interpretation. The hack developer came up with what he thinks is a new approach that fundamentally undermines the approach taken by anticheat developers, of course he hopes that his work wasn't in vain. Yeah, I think it is petty to call him out for having a "bad attitude" because of this.

by berti 7y ago

> So hopefully this cheat will be VAC / PB undetected for ever ;) That attitude really grinds my gears. I'd much prefer to see something like "here's how we think Valve could fix this permanently".

Stevvo 7y ago

I've got no problem with people writing hacks for games; with the shit that gets released these days I expect it would often be far more rewarding than playing the game itself. That said, authors should follow responsible disclosure, give the game company some time to respond before releasing.

dvt 7y ago
> That said, authors should follow responsible disclosure, give the game company some time to respond before releasing. Stack-smashing attacks have been around since at least 1988[1]. This cheat has less to do with the game itself and more to do with the computing architecture (i.e. stack-based). ROP is an active area of research and "code hardening" is a way to mitigate such an attack[2], but (from what I understand) usually comes with performance penalties. [1] https://lwn.net/Articles/732201/ https://lwn.net/Articles/732201/ [2] https://cs.brown.edu/~vpk/papers/ccr.sp18.pdf https://cs.brown.edu/~vpk/papers/ccr.sp18.pdf
- jakear 7y ago
  I don't see your point. Do you think the authors shouldn't give responsible disclosure because the underlying mechanism has been around for a while? The company would obviously fix the area where false data is allowed to be injected, not systematically harden their entire codebase against any possible ROP-based attack.
  - kuroguro 7y ago
    There are going to be hundreds or thousands more, possibly outside of their code. They are easy to introduce in your code, fairly easy to find and hard to fix. It's more of an idea or PoC on how to write cheats than a specific exploit. On another note it's not an exploit in the classic sense - if you own your game you're legally allowed to do what you want with it in most countries AFAIK. I'm not convinced responsible disclosure even applies here.
MrStonedOne 7y ago
I don't think R.D. should apply when the exploit can benefit the device owner in gaining control over their device. Rooting/jailbreaking/safetynet exploits (and exploits that can be used for rooting and jailbreaking) shouldn't go to google and apple first, they should go to the users first. The same applies for bypassing anti-cheats or other modification prevention systems or other attestation systems.
- kingosticks 7y ago
  Even when that benefit is at the direct expense of other users? Your device rooting example is different compared to online cheating in this respect and to me that's key.
PyroLagus 7y ago
> I've got no problem with people writing hacks for games; with the shit that gets released these days I expect it would often be far more rewarding than playing the game itself. Hacks in singleplayer games are fun. Hacks in multiplayer games are not. If someone thinks the game is shit and unrewarding, they should just not play it and not ruin it for everyone else.
- ryanlol 7y ago
  There are loads of people who enjoy cheating in multiplayer games so much that they’re willing to spend hundreds of dollars a month on the hacks.
p410n3 7y ago
Sorry to disappoint, but stuff like the glowESP for csgo are around since the source engine released in 2004. Even normal cheats on github like charlatano are undetected, and that one is pretty popular. They dont really do shit
chapium 7y ago
Its multiplayer though. Doing this creates "fun" by cheating others.

ryanlol 7y ago

This sounds really petty to me, it grinds your gears that the attack developer is proud of their work? Seems like the next logical step will be for one of the many people specializing in defenses to develop a "permanent" fix :)

PyroLagus 7y ago
It's not petty. Hacks in multiplayer games ruin the game for everyone else, and the hack developer hopes that the hack will stay undetected forever. That's not proud. It's more like "I hope you can use this to be assholes and ruin the game for all other players as long as the game exists." Also, this is just a game, but if it was ransomware and the dev said "hopefully this ransomware will be antivirus undetected for ever", you'd probably have a different opinion, no?
- ryanlol 7y ago
  Perhaps I'm just going with a more charitable interpretation. The hack developer came up with what he thinks is a new approach that fundamentally undermines the approach taken by anticheat developers, of course he hopes that his work wasn't in vain. Yeah, I think it is petty to call him out for having a "bad attitude" because of this.