5 ms·

He wasn't talking about mass data collection used to sell advertising, he was talking about a the admin of a server with maybe a dozen users having access to hi

by ripdog 5y ago

He wasn't talking about mass data collection used to sell advertising, he was talking about a the admin of a server with maybe a dozen users having access to his IP, which potentially could be used for DDOS or geolocation. The kind of 'data collection' which could have visible impacts upon his life.

Topgamer7 5y ago
Or someone with knowledge could port scan you and actually attack you to gain a foothold in your network.
- ripdog 5y ago
  Of course, but it seems fairly unlikely that the average gamer is running public-facing internet services.
  - jfim 5y ago
    There are some games that run peer to peer connections, and for those to work, they require inbound connections to work. As far as the security of the average game codebase is concerned, I'd say it's pretty terrible as nobody really audits these codebases for buffer overflows/RCEs.
    - paulmd 5y ago
      Source Engine (CS:GO, Team Fortress 2, etc) has a bunch of RCE that were disclosed to Valve years ago and which they did nothing about, and which have been released to public at this point. Join a server and they can RCE on your machine. Another one can be triggered just from a Steam invite. Too bad Valve makes money now and not games, they can't even get a fix out after it's been disclosed for years. https://twitter.com/the_secret_club/status/1381201949647904768 https://twitter.com/the_secret_club/status/13812019496479047... https://twitter.com/the_secret_club/status/1380960120725733376 https://twitter.com/the_secret_club/status/13809601207257333... https://twitter.com/the_secret_club/status/1380868759129296900 https://twitter.com/the_secret_club/status/13808687591292969... Titanfall (the original) is another one (also Source Engine underneath but rewritten by Respawn/EA), a salty hacker who was mad he was getting rekt has been taking down the multiplayer service off and on for years now. https://www.reddit.com/r/titanfall/comments/d10ori/tales_from_the_aged_frontier/ https://www.reddit.com/r/titanfall/comments/d10ori/tales_fro... Last I heard he was starting to hit Titanfall 2 xbox servers too (since nothing has been done after years attacking the first one, why wouldn't he escalate it further?) and Respawn just don't care, they're done with it, they make piles of money from Apex now and don't care about supporting their older stuff. https://mp1st.com/news/titanfall-2-servers-down-due-to-ddos-attack-respawn-working-on-it https://mp1st.com/news/titanfall-2-servers-down-due-to-ddos-... Given the clientele of this website, hoping a little name-and-shame might bring some attention to the issues...
      - jfim 5y ago
        As frustrating as it is, not a whole lot of people in the video game industry really care about that, and for those that do, they can't really do that much about it. Once a game is sold, there's not much of an incentive to keep it alive other than making sure it's moderately playable so that they manage to sell expansion packs or downloadable content. A hypothetical "someone might overflow a buffer and run arbitrary code" bug is going to be pretty low on the list compared to "all the graphics are broken on the latest nvidia driver because our code base is held together by duct tape and wishful thinking." Even for the developers that do care about writing decent code (and a lot of them do care about making great games), after 60 hours or more a week of fixing random bugs on Barbie's Plastic Adventures, Call of Battlefield, or Mobile Lootbox Idle Clicker, there's not that much motivation left at the end of the day to work on these kinds of issues.
        paulmd 5y ago
        It’s pretty frustrating with games like TF2 that still generate significant amounts of revenue but can’t even get major security problems patched let alone basic bugs fixed. And I’m not talking about selling new copies, I’m talking about hundreds of millions of dollars a year in lootbox revenue.
        jfim 5y ago
        Games like DotA 2 that still get attention from Valve have all kinds of broken things. Bots were endemic in certain MMR brackets for a while (might still be, no idea), and they were pretty straightforward to detect. Multiple kinds of griefing were pretty much ignored, reporting players didn't do anything for a while, and so on. Even Rockstar had the issue about load times for GTA online, which had they even bothered to look into it, would've netted them dozens of millions of dollars. Until there's something absolutely catastrophic like a worm that spreads through a popular online game and formats hard drives/mines bitcoin/transfers all the hats to third parties, the industry will keep on doing the same thing as usual with no care. I wish it was different, but it's not, unfortunately. I definitely understand your frustration though.
- serf 5y ago
  with the amount of automated systems out there port-scanning IP ranges for vulnerabilities, being on discord with one (a vulnerability), even if discord exposed IPs, is not much more dangerous than just sitting around twiddling your thumbs waiting for a bot to hit your IP. The risk of personal identification due to IP I can buy into; the risk that your already public IP may be exposed to a do-bad-criminal who wants to exploit you via Discord.. feels no more dangerous than having a vulnerable computer connected, anyway.
  - Topgamer7 5y ago
    Don't underestimate the skill and ingenuity of pissed off 15 year olds. With near unlimited time on their hands, and an information rich internet, they can find how to start pentesting. Blind devotion to a cause and a flexible mind can overcome many problems.
sascha_sl 5y ago
Discord has the same issue, essentially everyone who works in a somewhat technical role has access to their moderation tools that have zero auditing and reports of abuse (reading people's DMs "as a joke") are not uncommon. Discord also refuses to delete any data you give them. Deleting a Discord account sets a lockout flag, changes the nickname to "Deleted User" and resets the avatar to default. That's it. They don't even bother setting the user ID on your messages to something common, to a bot (and anyone who turns on developer mode) all your messages still contain your Discord ID. I also learned from personal experience that they ignore any requests for deleting data coming in via GDPR. These people need to get slapped in a lawsuit.
- uzakov 5y ago
  > Discord has the same issue, essentially everyone who works in a somewhat technical role has access to their moderation tools that have zero auditing and reports of abuse (reading people's DMs "as a joke") are not uncommon. This is the first time I hear of this, can you please link a source?
  - sascha_sl 5y ago
    The Discord subreddit has a few threads about this, but it has always been an open secret back when the Discord Developers guild still existed. I'm pretty sure it got axed because some staff members got too memey about abusing their database access.
    - judge2020 5y ago
      So Discord has the same issue should be Discord had the same issue - I also can't find any mention of such abuse of power. The only thing is supposedly this Trust & Safety employee that revoked the vanity url /furry to give it to another server[0], and T&S needs full database access like that for obvious reasons (even if this employee did abuse it). 0: https://discord.news/trust-and-scam/ https://discord.news/trust-and-scam/
      - 5y ago
superkuh 5y ago
And I am saying that there are human people working at companies too. The only difference is that if they cause you indirect harm their legal liability is abstracted enough you can't do anything.
- judge2020 5y ago
  They're not talking about Discord and their employees having your IP, they're talking about teamspeak server admins being able to see it and using it for nefarious means. On Discord, just because someone joins a server you created doesn't mean you get their IP. With teamspeak being decentralized, your IP is sent to admins which are much closer and interested in the same topics you are, so if you make them mad, they have the ability to retaliate by performing a DDOS or geolocating you to expose your location. With Discord, there's trust that Discord isn't going to suddenly make your IP address public for some reason - even if you make an employee mad, them accessing your IP just to leak it would be jeopardizing their cushy VC-backed job all just to 'expose' someone on the internet.

by ripdog 5y ago

Topgamer7 5y ago

Or someone with knowledge could port scan you and actually attack you to gain a foothold in your network.

ripdog 5y ago
Of course, but it seems fairly unlikely that the average gamer is running public-facing internet services.
- jfim 5y ago
  There are some games that run peer to peer connections, and for those to work, they require inbound connections to work. As far as the security of the average game codebase is concerned, I'd say it's pretty terrible as nobody really audits these codebases for buffer overflows/RCEs.
  - paulmd 5y ago
    Source Engine (CS:GO, Team Fortress 2, etc) has a bunch of RCE that were disclosed to Valve years ago and which they did nothing about, and which have been released to public at this point. Join a server and they can RCE on your machine. Another one can be triggered just from a Steam invite. Too bad Valve makes money now and not games, they can't even get a fix out after it's been disclosed for years. https://twitter.com/the_secret_club/status/1381201949647904768 https://twitter.com/the_secret_club/status/13812019496479047... https://twitter.com/the_secret_club/status/1380960120725733376 https://twitter.com/the_secret_club/status/13809601207257333... https://twitter.com/the_secret_club/status/1380868759129296900 https://twitter.com/the_secret_club/status/13808687591292969... Titanfall (the original) is another one (also Source Engine underneath but rewritten by Respawn/EA), a salty hacker who was mad he was getting rekt has been taking down the multiplayer service off and on for years now. https://www.reddit.com/r/titanfall/comments/d10ori/tales_from_the_aged_frontier/ https://www.reddit.com/r/titanfall/comments/d10ori/tales_fro... Last I heard he was starting to hit Titanfall 2 xbox servers too (since nothing has been done after years attacking the first one, why wouldn't he escalate it further?) and Respawn just don't care, they're done with it, they make piles of money from Apex now and don't care about supporting their older stuff. https://mp1st.com/news/titanfall-2-servers-down-due-to-ddos-attack-respawn-working-on-it https://mp1st.com/news/titanfall-2-servers-down-due-to-ddos-... Given the clientele of this website, hoping a little name-and-shame might bring some attention to the issues...
    - jfim 5y ago
      As frustrating as it is, not a whole lot of people in the video game industry really care about that, and for those that do, they can't really do that much about it. Once a game is sold, there's not much of an incentive to keep it alive other than making sure it's moderately playable so that they manage to sell expansion packs or downloadable content. A hypothetical "someone might overflow a buffer and run arbitrary code" bug is going to be pretty low on the list compared to "all the graphics are broken on the latest nvidia driver because our code base is held together by duct tape and wishful thinking." Even for the developers that do care about writing decent code (and a lot of them do care about making great games), after 60 hours or more a week of fixing random bugs on Barbie's Plastic Adventures, Call of Battlefield, or Mobile Lootbox Idle Clicker, there's not that much motivation left at the end of the day to work on these kinds of issues.
      - paulmd 5y ago
        It’s pretty frustrating with games like TF2 that still generate significant amounts of revenue but can’t even get major security problems patched let alone basic bugs fixed. And I’m not talking about selling new copies, I’m talking about hundreds of millions of dollars a year in lootbox revenue.
        jfim 5y ago
        Games like DotA 2 that still get attention from Valve have all kinds of broken things. Bots were endemic in certain MMR brackets for a while (might still be, no idea), and they were pretty straightforward to detect. Multiple kinds of griefing were pretty much ignored, reporting players didn't do anything for a while, and so on. Even Rockstar had the issue about load times for GTA online, which had they even bothered to look into it, would've netted them dozens of millions of dollars. Until there's something absolutely catastrophic like a worm that spreads through a popular online game and formats hard drives/mines bitcoin/transfers all the hats to third parties, the industry will keep on doing the same thing as usual with no care. I wish it was different, but it's not, unfortunately. I definitely understand your frustration though.
serf 5y ago
with the amount of automated systems out there port-scanning IP ranges for vulnerabilities, being on discord with one (a vulnerability), even if discord exposed IPs, is not much more dangerous than just sitting around twiddling your thumbs waiting for a bot to hit your IP. The risk of personal identification due to IP I can buy into; the risk that your already public IP may be exposed to a do-bad-criminal who wants to exploit you via Discord.. feels no more dangerous than having a vulnerable computer connected, anyway.
- Topgamer7 5y ago
  Don't underestimate the skill and ingenuity of pissed off 15 year olds. With near unlimited time on their hands, and an information rich internet, they can find how to start pentesting. Blind devotion to a cause and a flexible mind can overcome many problems.

sascha_sl 5y ago

Discord has the same issue, essentially everyone who works in a somewhat technical role has access to their moderation tools that have zero auditing and reports of abuse (reading people's DMs "as a joke") are not uncommon. Discord also refuses to delete any data you give them. Deleting a Discord account sets a lockout flag, changes the nickname to "Deleted User" and resets the avatar to default. That's it. They don't even bother setting the user ID on your messages to something common, to a bot (and anyone who turns on developer mode) all your messages still contain your Discord ID. I also learned from personal experience that they ignore any requests for deleting data coming in via GDPR. These people need to get slapped in a lawsuit.

uzakov 5y ago
> Discord has the same issue, essentially everyone who works in a somewhat technical role has access to their moderation tools that have zero auditing and reports of abuse (reading people's DMs "as a joke") are not uncommon. This is the first time I hear of this, can you please link a source?
- sascha_sl 5y ago
  The Discord subreddit has a few threads about this, but it has always been an open secret back when the Discord Developers guild still existed. I'm pretty sure it got axed because some staff members got too memey about abusing their database access.
  - judge2020 5y ago
    So Discord has the same issue should be Discord had the same issue - I also can't find any mention of such abuse of power. The only thing is supposedly this Trust & Safety employee that revoked the vanity url /furry to give it to another server[0], and T&S needs full database access like that for obvious reasons (even if this employee did abuse it). 0: https://discord.news/trust-and-scam/ https://discord.news/trust-and-scam/
    - 5y ago

superkuh 5y ago

And I am saying that there are human people working at companies too. The only difference is that if they cause you indirect harm their legal liability is abstracted enough you can't do anything.

judge2020 5y ago
They're not talking about Discord and their employees having your IP, they're talking about teamspeak server admins being able to see it and using it for nefarious means. On Discord, just because someone joins a server you created doesn't mean you get their IP. With teamspeak being decentralized, your IP is sent to admins which are much closer and interested in the same topics you are, so if you make them mad, they have the ability to retaliate by performing a DDOS or geolocating you to expose your location. With Discord, there's trust that Discord isn't going to suddenly make your IP address public for some reason - even if you make an employee mad, them accessing your IP just to leak it would be jeopardizing their cushy VC-backed job all just to 'expose' someone on the internet.