7 ms·
SkillzTruth - Proof of concept demonstrating how to cheat on Skillz apps
- cheeze 4y agoWhat is Skillz? Can anyone provide context?
- deleted 4y ago[deleted]
- fishtoaster 4y agoSkillz is a company that provides real-money components (gambling, iirc) for mobile games. If you have a mobile game, it's a platform you can tack on to allow your players to compete against eachother for cash (and so monetize your game). https://www.skillz.com/ https://www.skillz.com/ https://en.wikipedia.org/wiki/Skillz_(company) https://en.wikipedia.org/wiki/Skillz_(company)
- airza 4y agoI really am living to see manmade horrors beyond my comprehension.
- bigmattystyles 4y agoJust wait until you learn about human history.
- Gigachad 4y agoIs this really that hard to comprehend? It's a slight twist on a ticket based arcade game or a slot machine. It's pretty common knowledge that they are a waste of money.
- airza 4y agoThe concept of having a slot machine in my pocket sets off so many mental alarm bells that it’s incomprehensible to me that people would gamble on what looks like Bejeweled.
- Gigachad 4y agoI’m not saying it’s good. But it hardly seems beyond comprehension.
- vorpalhex 4y agoSharks on mobile non-gambling games can easily spend over $500 a month on a game. That's the "buy an energy refill to chop more wood!" sort of games. Now imagine if you pretend it's a competition. You can "beat the machine", as these games are dressed up. And you can wager on them. Every casino in Vegas has lifers burning their cash. Now you spread that to over a billion devices with no gambling commission.
- kerpotgh 4y ago[dead]
- jsnell 4y agoIf it's players competing against each other, then skill-based matchmaking would lead to most players having a roughly 50% win rate naturally. But the win rates are the only real reason the OP gives for this being a scam. So the submission could really do with some extra context.
- dangero 4y agothey claim to have very sophisticated anti-cheat tech that he was able to overcome with a simple MITM attack This is from their IPO S-1: "We collect over 300 data points during each gameplay session to feed our big data assets which augment all elements of our platform. Our key data science technologies drive our player rating and matching, anti-cheat and anti-fraud, and user experience personalization engine."
- _yrbh 4y agoWow - that’s just a blatant lie.
- stirfish 4y agoI worked there for about a month before it was named skillz. One thing I didn't expect was how much the psychology of a casual game changes when there's money on the line. Imagine playing 5 minutes of angry birds while waiting for a bus, versus playing the same game for bus fare.
- deleted 4y ago[deleted]
- deleted 4y ago[deleted]
- munk-a 4y agoThey create and offer games[1] that purport to be a way for users to win real money. This is gambling though the company uses very precise language to try to avoid being classified as a gambling company (since that would make their business super illegal in a bunch of jurisdictions). They are, from reports, extremely scummy[2] and, to be honest, their entire business is exploitative and targets people with addictions. 1. https://games.skillz.com/ https://games.skillz.com/ 2. https://ca.trustpilot.com/review/skillz.com https://ca.trustpilot.com/review/skillz.com
- QuarterReptile 4y agoLots of righteous upvoting, no comments (that's what I did too, at first.) Has anyone examined it? It has the ring of so much malware and exploits masquerading as cheats from my childhood of playing crappy games, and there's little information on the page. Edit: I watched some of the video, and he wants you to add a new certificate authority... no explanation of how the 'cheating' works. Edit 2: Looks like I jumped to conclusions too hastily about motives. Still, I found no satisfying explanation anywhere.
- vuln 4y agoHe doesn't look like your typical malicious actor (where's the hoodie?!) but who knows these days. His LinkedIn is at the bottom of the page. https://www.linkedin.com/in/brianhamachek https://www.linkedin.com/in/brianhamachek
- QuarterReptile 4y agoThanks, that's probably useful context.
- deleted 4y ago[deleted]
- carom 4y agoIt feels more like a short seller play.
- vermilingua 4y agoInterestingly, the video was posted (and presumably the site went live) within 30min of the NYSE (where Skillz is listed) closing.
- VectorLock 4y agoWould there have been a better time to post?
- jhiesey 4y agoIf this is truly meant as a PoC to raise awareness, shouldn't there be a writeup of how it works and/or source code? I'm not interested in running some random binary that claims to hack a game, but a technical description of the vuln would be interesting.
- fire 4y agoAs far as I can tell, all this does is mitm yourself so the proxy server can change the data being sent to the server, which is like, the most basic of possible ways to cheat a game, and only works on games that fully trust the client and have absolutely no server-side validation. Yikes
- _yrbh 4y agoYou're absolutely correct. I was stunned how little security they employ.
- greshake 4y agoGood job, they definitely look shady as hell. Did you consider doing responsible disclosure and doing a write-up after? Aren't you worried about any retaliation? I'm pretty sure this type of company has a decent amount of money to spend on legal cases..
- _yrbh 4y agoEverything I said about them is true. I’ve been sued before.
- cheriot 4y agoFor once, the evil company is on a path toward bankruptcy. Not because law enforcement or regulators stepped in, though. It's just a cash flow negative company with declining revenue living off money raised in 2021.
- maerF0x0 4y ago> Analysis of player win/loss ratios clearly shows that all players win roughly 50% of games, regardless of their "skill". That's not an eSport. That's a slot machine. > The average win rate for a brand new player is 56%. The average win rate for the best players is 53%. Uh, that also could mean really fantastic player matching. A good match would be one in which it's unclear who would win. If the skew is too great then new players get discouraged (lose all the time) and/or skilled players get bored (they win 99% of the time) .
- AYoung010 4y agoMy anecdotal experience with competitive games has been that the top ~15% of players generally have a winrate >50%, with the top 1-5% usually clearing 55%, especially where some skill-indicative metric is used to do matchmaking. The fact that winrate is 50% across the board implies that they are somehow fixing matches, or (as the author states) simply banning their most skilled players.
- BugsJustFindMe 4y agoExcept that the specific claim is that it's greater than 50% in those categories, not 50% across the board.
- jaimehrubiks 4y agoIs competitive gaming winrate much different though? I always thought that in games such as league of legends players tend to have winrate close to 50%, and good players with slightly higher winrate end up in higher ranks by playing many games. Of course winrate is much higher when they are in lower ranks than their skill level, but they'll end up playing most of their games in their corresponding rank anyway in the long term
- GlickWick 4y agoOn average, yes. However, this is a dishonest comparison imo. Skill-based matchmaking aims to find a “good” matchup for you by putting you up against an opponent of a similar skill level. Over time you land at 50% due to this, but if you improve you’ll face better opponents and have more complex games. Skillz is just fake randomness designed to keep you from making money, and you have no control over this. I guess the birds eye view appears the same, but it’s not really the same concept.
- jsnell 4y ago> Skillz is just fake randomness designed to keep you from making money, and you have no control over this. How do you know that? Did somebody run experiments to prove it?
- jxf 4y agoYes. This is covered on the site.
- GlickWick 4y agoYep. Read the article!
- jsnell 4y agoI have read all ~250 words of the article. It makes about as many assertions as are possible in that word count, but does not present any evidence. > Analysis of player win/loss ratios clearly shows that all players win roughly 50% of games, regardless of their "skill". What analysis? What is the methodology? Where are the results? > That's not an eSport. That's a slot machine. This is obviously not true, since there's an obvious alternative explanation for ~50% win rates. So the experiment you claim is documented somewhere on this page should obviously be designed in a way that distinguish between dishonest manipulation of the game RNG vs. totally legit skill-based matchmaking. > You can never win more money than you've paid. If you somehow do, Skillz will suspend your account when you attempt to withdraw. Ok, that's bad if true. How can we as readers judge if it's true? Not by the evidence presented on this page, because there is literally none. You've told me to read the article. So where is the proof that the site is a scam? Not just an assertion that an experiment with undocumented methodology was done and produced topline results that can be explained in other ways?
- vain_cain 4y agogit repo for this: https://github.com/brianhama/SkillzTruth https://github.com/brianhama/SkillzTruth
- brucethemoose2 4y agoBasically find-and-replace a few short strings? That's hilarious. If I was a Skillz shareholder, I would start a class action suit and drag that repo/video into court. Public companies have lost for far less.
- 3l3ktr4 4y agoThis is really cool!
- jeroenhd 4y agoAs usual, a simple MitM can accomplish more than you'd expect. Together with a simple Frida script, you can easily intercept traffic for apps with certificate pinning as well; there's no quick fix for a vulnerability like this. You can't trust data from computers you don't own. Looking at the source code snippet posted, this library simply sends a "score" variable over a POST request and the server just seems to accept it as the real score; that's fine for keeping user-specific high scores, but as soon as you use that data together with any other account, you're going to have a bad time. This reminds me of the Hive Social security vulnerability (forgetting to implement ACLs on any of their endpoints and doing all the security checks client side).
- _yrbh 4y agoYea I was pretty blown away by their security model. Considering they are dealing with cash games worth hundreds of dollars to the users, it’s negligent.