4 ms·

I expect for most people^, their moral codes would be more of an obstacle to exploiting this than the fear of getting caught, but I still agree with you that $1

I expect for most people^, their moral codes would be more of an obstacle to exploiting this than the fear of getting caught, but I still agree with you that $10k sounds low and that there should perhaps be an exception to the maximum for bugs of this severity. As far as the best way to remove money from the system, I would think the first step would be buying bitcoins with paypal (perhaps from a bunch of different localbitcoins sellers), then using a mixing service to anonymize them, and hold onto them for a reasonably long period of time before spending. I haven't looked into it in any detail myself, but I'm sure there are "best practices" out there for anonymizing your bitcoin transactions. ^I should clarify that I would be one of those people! That doesn't make the intellectual exercise of thinking through how one would pull it off less interesting though.

qnr 12y ago
> I would think the first step would be buying bitcoins with paypal This is where your plan fails. Since it is very easy to rollback the payment with paypal, no one is going to sell you bitcoins in exchange for it, except for tiny amounts. If you look at localbitcoins for example, there are very few sellers who accept paypal, all of them limit trades to very small amounts (mostly $100-200) and require high feedback scores and some form of KYC Excerpt from one of the offers: "Due to previous fraudulent transactions. I can only sell you bitcoin via PayPal if you take a photo of yourself holding valid U.S. government issued ID where your face matches the photo. "
- tempestn 12y ago
  Ah, I see. Didn't realize it was that easy to reverse Paypal transactions (and I've obviously never tried to buy BTC with Paypal.) Back to the drawing board I guess! Any online casinos still take Paypal?
IkmoIkmo 12y ago
Don't think that this one will get you too far. Buying any significant amount of bitcoin using Paypal is next to impossible, unless you're a highly trusted party (e.g. friends or family or a reputable business like SecondMarket, but they wouldn't use Paypal anyway). It pretty much doesn't happen (apart from scams where a scammer will try to buy from unsuspecting users, then reverse the Paypal transaction and then lie to Paypal pretending they didn't buy anything. Paypal will side with the bad guy in 999/1000 cases, not because they're evil but it's policy. In fact, paypal shuts down bitcoin sellers by freezing their account.
scobar 12y ago
I agree with the parent comment that $10k is low for a bug of this severity. However, it's a step in the right direction that a non-trivial bounty was given, and it seems the person who found and reported the bug was satisfied with the reward. IIRC, Yahoo didn't offer monetary rewards at all until recently after the t-shirt scandal. I reported the first item duplication method I discovered in a very popular online game, and received a virtual pat on the back as a reward. I didn't even get a beta invite for a new game or expansion pack. I understand if a smaller company or open source game couldn't afford to pay a monetary bounty, but this company could definitely afford it. I used the next dupe methods I found in that game and another more popular game by the same company to make money selling items to players. I should have reported all of the bugs instead of exploiting them regardless of the insulting lack of any bounty. We desperately needed money, and I gave in to temptation. I know that I was wrong, and hopefully my comment won't evoke responses that focus on my mistake alone. I certainly would've strongly considered reporting the bugs for a monetary bounty above $1k, the freedom to publicly explain the dupe method after the bug was patched, and a small acknowledgement from the company that I had found the bug. Thought experiments about the most effective way to exploit a bug are a great way to discover places that flags should be set to trigger notifications of unusual activity in order to mitigate damage from exploitation. If the company that developed the game had put more effort into considering the question, "If a dupe method did exist in this game, what would be the most effective ways to profit from it?" then I wouldn't have been able to exploit the bugs for nearly ten years.
- deleted 12y ago
  [deleted]
- IkmoIkmo 12y ago
  > then I wouldn't have been able to exploit the bugs for nearly ten years. Holy shit, what game was this and in what ballpark did you raise selling duped items for nearly 10 years!? That's a story right there. Did you ever get caught? As for rewards in virtual games... it's just a lot lower priority I guess, as it's all virtual. There's no direct loss to the company if someone is able to dupe items, unless it's really widespread, but in that case it's very noticeable quick (system wide deflation, fewer boss runs / grinding, rapidly rising item counts). It upsets the game balance and affects enjoyability (which indirectly affects subscriptions and thereby company profits), but it's not direct money out of the company's pockets (unless it's a shitty game where you can directly buy items with real money. In that case it can dampen revenues fairly quickly). > flags should be set to trigger notifications of unusual activity in order to mitigate damage from exploitation. I was an admin for a while and had access to every single chat log. It's pretty scary how privacy in virtual worlds doesn't at all exist, nor is there any debate about it that I know of. I'm sure companies like facebook or WoW have restrictions and various policies in place, but in a lot of games an admin will be able to simply read your chat. I frequently had to look into reports of things like racial slurs in private chats to warn or ban users (and yes, people indeed fake-reported other users they hated, so I always had to check the logs for evidence), and just scrolling through the convos you'd scroll past the craziest private things. In my early teens a decade ago now I couldn't help but read some of them. (morally pretty embarrassing to say). Anyway, as to the relevance of all this, needless to say every.single.time an exploit was found, you'd have users telling their friends in private chat IN game. You could search the logs for 'admin' or 'secret' or 'exploit' and you'd find messages like this 'Dude, keep this a secret cause admins will find out, but I just found a money duping exploit'. Anyway no admin ever did searches like this in practice, but it was pretty easy to build a flagging system. We eventually did build a proper flagging panel with charts of total credits in the game, or total unique boss items, or total XP earned. There'd trends for the time of the day in the US/Europe mostly, and trends for the day of the week (monday low, saturday high), and you could easily see deviations from that with exploits. In short, everyone always tells their friends, and not out-of-game either, and they almost always go full retard and become insanely wealthy in the span of days. Also, when veteran players complain of another player hacking, it almost always ends up being true after tons of denial. And it usually takes long to fix because almost half of the time the hacking player is a veteran player who is respected, trusted, well-connected and at times in partnership with admins who play themselves. Man online games are awesome, it's like the bold and the beautiful sometimes haha. Haven't played any in years though, wish I had the time I did as a teen! Feel free to share your stories! :) > hopefully my comment won't evoke responses that focus on my mistake alone Really don't care :P It's a game, and somehow, the drama of stuff like this is what made persistent online games so much fun. (talking about games like EVE online here, for games like counterstrike cheating is simply never fun or funny). For example check out this video: https://www.youtube.com/watch?v=XrYe_4vHzgE https://www.youtube.com/watch?v=XrYe_4vHzgE Mostly based on a story of two corporations vying for wormhole space based on cheating, completely awesome and epic

qnr 12y ago

> I would think the first step would be buying bitcoins with paypal This is where your plan fails. Since it is very easy to rollback the payment with paypal, no one is going to sell you bitcoins in exchange for it, except for tiny amounts. If you look at localbitcoins for example, there are very few sellers who accept paypal, all of them limit trades to very small amounts (mostly $100-200) and require high feedback scores and some form of KYC Excerpt from one of the offers: "Due to previous fraudulent transactions. I can only sell you bitcoin via PayPal if you take a photo of yourself holding valid U.S. government issued ID where your face matches the photo. "

tempestn 12y ago
Ah, I see. Didn't realize it was that easy to reverse Paypal transactions (and I've obviously never tried to buy BTC with Paypal.) Back to the drawing board I guess! Any online casinos still take Paypal?

IkmoIkmo 12y ago

Don't think that this one will get you too far. Buying any significant amount of bitcoin using Paypal is next to impossible, unless you're a highly trusted party (e.g. friends or family or a reputable business like SecondMarket, but they wouldn't use Paypal anyway). It pretty much doesn't happen (apart from scams where a scammer will try to buy from unsuspecting users, then reverse the Paypal transaction and then lie to Paypal pretending they didn't buy anything. Paypal will side with the bad guy in 999/1000 cases, not because they're evil but it's policy. In fact, paypal shuts down bitcoin sellers by freezing their account.

scobar 12y ago

I agree with the parent comment that $10k is low for a bug of this severity. However, it's a step in the right direction that a non-trivial bounty was given, and it seems the person who found and reported the bug was satisfied with the reward. IIRC, Yahoo didn't offer monetary rewards at all until recently after the t-shirt scandal. I reported the first item duplication method I discovered in a very popular online game, and received a virtual pat on the back as a reward. I didn't even get a beta invite for a new game or expansion pack. I understand if a smaller company or open source game couldn't afford to pay a monetary bounty, but this company could definitely afford it. I used the next dupe methods I found in that game and another more popular game by the same company to make money selling items to players. I should have reported all of the bugs instead of exploiting them regardless of the insulting lack of any bounty. We desperately needed money, and I gave in to temptation. I know that I was wrong, and hopefully my comment won't evoke responses that focus on my mistake alone. I certainly would've strongly considered reporting the bugs for a monetary bounty above $1k, the freedom to publicly explain the dupe method after the bug was patched, and a small acknowledgement from the company that I had found the bug. Thought experiments about the most effective way to exploit a bug are a great way to discover places that flags should be set to trigger notifications of unusual activity in order to mitigate damage from exploitation. If the company that developed the game had put more effort into considering the question, "If a dupe method did exist in this game, what would be the most effective ways to profit from it?" then I wouldn't have been able to exploit the bugs for nearly ten years.

deleted 12y ago
[deleted]
IkmoIkmo 12y ago
> then I wouldn't have been able to exploit the bugs for nearly ten years. Holy shit, what game was this and in what ballpark did you raise selling duped items for nearly 10 years!? That's a story right there. Did you ever get caught? As for rewards in virtual games... it's just a lot lower priority I guess, as it's all virtual. There's no direct loss to the company if someone is able to dupe items, unless it's really widespread, but in that case it's very noticeable quick (system wide deflation, fewer boss runs / grinding, rapidly rising item counts). It upsets the game balance and affects enjoyability (which indirectly affects subscriptions and thereby company profits), but it's not direct money out of the company's pockets (unless it's a shitty game where you can directly buy items with real money. In that case it can dampen revenues fairly quickly). > flags should be set to trigger notifications of unusual activity in order to mitigate damage from exploitation. I was an admin for a while and had access to every single chat log. It's pretty scary how privacy in virtual worlds doesn't at all exist, nor is there any debate about it that I know of. I'm sure companies like facebook or WoW have restrictions and various policies in place, but in a lot of games an admin will be able to simply read your chat. I frequently had to look into reports of things like racial slurs in private chats to warn or ban users (and yes, people indeed fake-reported other users they hated, so I always had to check the logs for evidence), and just scrolling through the convos you'd scroll past the craziest private things. In my early teens a decade ago now I couldn't help but read some of them. (morally pretty embarrassing to say). Anyway, as to the relevance of all this, needless to say every.single.time an exploit was found, you'd have users telling their friends in private chat IN game. You could search the logs for 'admin' or 'secret' or 'exploit' and you'd find messages like this 'Dude, keep this a secret cause admins will find out, but I just found a money duping exploit'. Anyway no admin ever did searches like this in practice, but it was pretty easy to build a flagging system. We eventually did build a proper flagging panel with charts of total credits in the game, or total unique boss items, or total XP earned. There'd trends for the time of the day in the US/Europe mostly, and trends for the day of the week (monday low, saturday high), and you could easily see deviations from that with exploits. In short, everyone always tells their friends, and not out-of-game either, and they almost always go full retard and become insanely wealthy in the span of days. Also, when veteran players complain of another player hacking, it almost always ends up being true after tons of denial. And it usually takes long to fix because almost half of the time the hacking player is a veteran player who is respected, trusted, well-connected and at times in partnership with admins who play themselves. Man online games are awesome, it's like the bold and the beautiful sometimes haha. Haven't played any in years though, wish I had the time I did as a teen! Feel free to share your stories! :) > hopefully my comment won't evoke responses that focus on my mistake alone Really don't care :P It's a game, and somehow, the drama of stuff like this is what made persistent online games so much fun. (talking about games like EVE online here, for games like counterstrike cheating is simply never fun or funny). For example check out this video: https://www.youtube.com/watch?v=XrYe_4vHzgE https://www.youtube.com/watch?v=XrYe_4vHzgE Mostly based on a story of two corporations vying for wormhole space based on cheating, completely awesome and epic