Originally by: Genya Arikaido

---

Edited by: Genya Arikaido on 04/07/2010 03:56:08
Being ever dubious, but cautious, I did some poking around...and found the original curious coder who found and explain his methods on his site, for anyone at all to read.

Let's just say this video is very likely to be real, as the method would work. I've tested it with another Python-based program, and it does exactly as advertised, exposes every client function to the user.

To be clear, I COULD, do the following in EVE, should it be used:
find out precisely where anyone in EVE is at, find out their skill info, their ISK, spawn ships, items, ISK, teleport, teleport others, Instakill anyone, add any amount of SP to themselves or anyone, fly Jovian Battleships, change the session timer for themselves, warp to zero on autopilot, buy everyone's stuff for 0.01 isk, Delete stuff in your hangars, delete your corp, alliance, characters.... the list is as long as your imagination.

Obviously some things are going to be ridiculously obvious. I'm certain ISK and SP stuff is logged, else certain petition results would be impossible. However, it's the passive informational side that carries the worst implications. This uber scanner as posted here is entirely possible, and very easy to do...and leaves NO trace of use on the server, its logs, or anything else. session timers, might. warping to 0 on autopilot probably wouldn't either, as I don't think you need to ask the server permission to turn AP on or off (as the button is always instant).

CCP, I don't know what to tell you. Watchdog programs are the usual solution, but then you have privacy activists banging on your door. Some of the data that can be exploited is needed for normal client function, and cannot be restricted to normal users.

I'm filling in a bug report, and detailed explanation now, CCP...this is beyond critical.

---