3 ms·

I'm fascinated to find out how they pulled this off. There's been cases before where a malicious gameserver controlled by an attacker could RCE clients which co

I'm fascinated to find out how they pulled this off. There's been cases before where a malicious gameserver controlled by an attacker could RCE clients which connect to it, but in this case the server was controlled by a trusted party, and the attackers shouldn't even have been able to know which server they were playing on, nevermind connect to it since they weren't invited. There must be layers to this one.

diggan 3y ago
Yeah, or a RCE that allowed them to directly hit each individual client, rather than coming from the server? Seems there are mentions of Easy Anti-Cheat having a vulnerability, but I'm not sure how trustworthy that is. It's a widely used anti-cheat, if it has a vulnerability, it would be big news, bigger than the "Apex Legends final being postponed" story. But who would blow such a 0day on ruining a competition, instead of doing something profitable and sneaky? Gotta admire that, seems it was just for "fun".
- jsheard 3y ago
  FWIW EasyAntiCheat are saying they're not to blame, and the finger pointing at them was only speculation in the first place. https://twitter.com/TeddyEAC/status/1769725032047972566 https://twitter.com/TeddyEAC/status/1769725032047972566 Unless something similar happens in another game with EAC I would assume it's exploit(s) in the game itself - the remote attack surface of the game is orders of magnitude larger than the anti-cheat after all. > Yeah, or a RCE that allowed them to directly hit each individual client, rather than coming from the server? Maybe, but Apex has dedicated servers so there isn't a great deal of client-to-client communication to potentially exploit.
- ImPostingOnHN 3y ago
  > But who would blow such a 0day on ruining a competition, instead of doing something profitable and sneaky? The article points out: > In the Genburten clip, the streamer’s chat can be seen to read “Apex hacking global series by Destroyer2009 & R4ndom.” So maybe some other folks had their own CTF competition concurrently. Pretty cyberpunk. Who knows what the prize was.

diggan 3y ago

Yeah, or a RCE that allowed them to directly hit each individual client, rather than coming from the server? Seems there are mentions of Easy Anti-Cheat having a vulnerability, but I'm not sure how trustworthy that is. It's a widely used anti-cheat, if it has a vulnerability, it would be big news, bigger than the "Apex Legends final being postponed" story. But who would blow such a 0day on ruining a competition, instead of doing something profitable and sneaky? Gotta admire that, seems it was just for "fun".

jsheard 3y ago
FWIW EasyAntiCheat are saying they're not to blame, and the finger pointing at them was only speculation in the first place. https://twitter.com/TeddyEAC/status/1769725032047972566 https://twitter.com/TeddyEAC/status/1769725032047972566 Unless something similar happens in another game with EAC I would assume it's exploit(s) in the game itself - the remote attack surface of the game is orders of magnitude larger than the anti-cheat after all. > Yeah, or a RCE that allowed them to directly hit each individual client, rather than coming from the server? Maybe, but Apex has dedicated servers so there isn't a great deal of client-to-client communication to potentially exploit.
ImPostingOnHN 3y ago
> But who would blow such a 0day on ruining a competition, instead of doing something profitable and sneaky? The article points out: > In the Genburten clip, the streamer’s chat can be seen to read “Apex hacking global series by Destroyer2009 & R4ndom.” So maybe some other folks had their own CTF competition concurrently. Pretty cyberpunk. Who knows what the prize was.