EVE Search - CCP Cover up after exploitable client surfaces?

Check My IP Information

All Channels

EVE General Discussion

CCP Cover up after exploitable client surfaces?

» Click here to find additional results for this topic using Google

Monitor this thread via RSS [?]

Pages: [1] 2 :: one page

Author	Thread Statistics \| Show CCP posts - 1 post(s)
Lexa Stone	Posted - 2010.07.04 20:02:00 - [1] There was a thread yesterday showing a video of a modified EVE client which had python code injected into it allowing the person to isntantly scan out anyone anywhere in the system. In the video it also showed numberous GM abilities in drop down menus. People were saying the client is flawed and that this can be easily replicated. Now today that thread is missing. What the **** CCP? Something very wrong is going on here and CCP is pulling the wool over your eyes and covering up any evidence.

Chribba Otherworld Enterprises Otherworld Empire	Posted - 2010.07.04 20:04:00 - [2] Standard practise. Just leave it alone until they fix the issue. Threads like this only cause more damage than good tbh. Secure 3rd party service \| my in-game channel 'Holy Veldspar'

Drykor Minmatar Aperture Harmonics K162	Posted - 2010.07.04 20:04:00 - [3] At least it's still on http://www.eve-search.com/ !
Cryptkiller Minmatar Ebola Allstars	Posted - 2010.07.04 20:04:00 - [4] CCP always deletes posts which discuss TOS violations. Much like this one will. If you really need the original post use Eve Search, otherwise its still being discussed on relevant, unofficial forums.
Balsak Minmatar Friends of Bigfoot	Posted - 2010.07.04 20:07:00 - [5] No cover up at all. There are no posts allowed talking about cheats and exploits so it was removed to the moderated threads section while the matter is investigated. There was a post about this earlier and explained by CCP Navigator if my memory is correct, I can't be bothered to try and find the post.
Aerilis Gallente Percussive Diplomacy	Posted - 2010.07.04 20:09:00 - [6] hurf durf python
Barkaial Starfinder Minmatar Conflagration.	Posted - 2010.07.04 20:09:00 - [7] Quote: Hello Netacq, The thread in question has been moved to the moderation area of the forums in order that the subject matter can be investigated thoroughly. As is always the case with threads that discuss exploits or potential exploits we ask that you submit a bug report for QA to investigate the issue or submit a petition if you have information relevant to customer support. You can also alert the Community team by using the "Report Post" feature. As per the forum rules, discussing exploits on the forums is not permitted as per the forum rules. 13 Do not post about bugs and exploits. Bugs and exploits should be reported through the proper method by filing a report for our Quality Assurance department. You can find the form here. Discussions about unverified problems in the game can cause unnecessary panic in the community. When there is an issue the community needs to be aware of, we will make an official statement about it. Thread locked.
Lobster Man Metafarmers	Posted - 2010.07.04 20:13:00 - [8] Originally by: Balsak No cover up at all. There are no posts allowed talking about cheats and exploits so it was removed to the moderated threads section while the matter is investigated. There was a post about this earlier and explained by CCP Navigator if my memory is correct, I can't be bothered to try and find the post. http://www.eveonline.com/ingameboard.asp?a=topic&threadID=1347767
Balsak Minmatar Friends of Bigfoot	Posted - 2010.07.04 20:22:00 - [9] Originally by: Lobster Man Originally by: Balsak No cover up at all. There are no posts allowed talking about cheats and exploits so it was removed to the moderated threads section while the matter is investigated. There was a post about this earlier and explained by CCP Navigator if my memory is correct, I can't be bothered to try and find the post. http://www.eveonline.com/ingameboard.asp?a=topic&threadID=1347767 Thank you kind sir. Dinner and beer were far more important things on my list of things to do than digging up posts for people
Niccolado Starwalker Gallente Shadow Templars	Posted - 2010.07.04 20:28:00 - [10] Originally by: Lexa Stone There was a thread yesterday showing a video of a modified EVE client which had python code injected into it allowing the person to isntantly scan out anyone anywhere in the system. In the video it also showed numberous GM abilities in drop down menus. People were saying the client is flawed and that this can be easily replicated. Now today that thread is missing. What the ** CCP? Something very wrong is going on here and CCP is pulling the wool over your eyes and covering up any evidence. If it was possible to hack or modify the eve client, do you really expect CCP to let it float around on the forums? I dont know anything about the case you mention, but lets say for the sake of the discussion this is true, CCP would be blody stupid to let it float around the forums. Too many stupid idiots would try it out, and then CCP would have no other choice to ban them. permanently! Originally by:** Dianabolic Your tears are absolutely divine, like a fine fine wine, rolling down your cheeks until they flow down the river of LOL.

Lexa Stone	Posted - 2010.07.04 20:34:00 - [11] No that was not the thread this is http://www.eveonline.com/ingameboard.asp?a=topic&threadID=1347565 and it has been locked by concord see
Spades Slick Caldari Rookies Academy Elite The Compass	Posted - 2010.07.04 20:39:00 - [12] Originally by: Lexa Stone No that was not the thread this is http://www.eveonline.com/ingameboard.asp?a=topic&threadID=1347565 and it has been locked by concord see You do realize that's, like, an inside joke between CCP and the players, right?
Balsak Minmatar Friends of Bigfoot	Posted - 2010.07.04 20:39:00 - [13] Originally by: Lexa Stone No that was not the thread this is http://www.eveonline.com/ingameboard.asp?a=topic&threadID=1347565 and it has been locked by concord see The thread Lobsterman linked was the one I was talking about where CCP Navigator gave a response as to what happened to the original one from yesterday that you were talking about.
Gladys Pank Amarr Trillionaire High-Rollers Suicidal Bassoon Orkesta	Posted - 2010.07.04 20:45:00 - [14] Don't worry, it's easy to censor discussion of these issues than fix anything. Give it another five years and they might do something about these loopholes.
Pajama Sam The Tuskers The Tusker Bastards	Posted - 2010.07.04 20:50:00 - [15] Originally by: Gladys Pank Don't worry, it's easy to censor discussion of these issues than fix anything. Give it another five years and they might do something about these loopholes. This, pretty much.
Messoroz	Posted - 2010.07.04 20:54:00 - [16] Edited by: Messoroz on 04/07/2010 20:55:22 Edited by: Messoroz on 04/07/2010 20:54:03 I believe that video is the perfect example of why writing good chunks of multiplayer code in scripting language is a bad idea. The same problem exists for all unreal engine games because of its unrealscript language and has plagued it from the old versions to the current 3.0 games.
Darth Kilth Minmatar DRAMA Inc	Posted - 2010.07.04 20:59:00 - [17] Originally by: Messoroz Edited by: Messoroz on 04/07/2010 20:55:22 Edited by: Messoroz on 04/07/2010 20:54:03 I believe that video is the perfect example of why writing good chunks of multiplayer code in scripting language is a bad idea. The same problem exists for all unreal engine games because of its unrealscript language and has plagued it from the old versions to the current 3.0 games. Maybe the reators of games should learn a lesson that they should make some new code for games, somethign new and original so there will not be a couple of hacks for the game in one week after release. Of course the the hacks would be released a few days later so it would end up doing pretty much nothing. Originally by: CCP Capslock OH GOD THE TESTING
Messoroz	Posted - 2010.07.04 21:06:00 - [18] Edited by: Messoroz on 04/07/2010 21:07:05 Originally by: Darth Kilth -------------------------------------------------------------------------------- Maybe the reators of games should learn a lesson that they should make some new code for games, somethign new and original so there will not be a couple of hacks for the game in one week after release. The problem isn't reusing code, it's using a script language on the client side are that wide open like a prisoner bending over in a prison shower to **** without protection and serverside checks.
Mme Pinkerton United Engineering Services	Posted - 2010.07.04 21:09:00 - [19] Originally by: Messoroz I believe that video is the perfect example of why writing good chunks of multiplayer code in scripting language is a bad idea. The same problem exists for all unreal engine games because of its unrealscript language and has plagued it from the old versions to the current 3.0 games. Scripting languages just make the job a little easier but with administrator/root privileges (which you generally can easily get on your local machine) you can always inject code as you wish (just use a debugger, combined debugger/disassembler/visualization tools like IDA help a lot with wrapping your mind around the issue). On the part of CCP it's basically a matter of obfuscating the relevant code enough to make things like this (i.e. code injections) impractical - you will never get rid of them (maybe if the operating system would run checksums on the code segments in memory but that would possibly affect a lot of legitimate applications that have a need to change executable code during runtime like JIT compilers). The only real solution to this problem would be to fix it by moving more code server-side.
Messoroz	Posted - 2010.07.04 21:11:00 - [20] Edited by: Messoroz on 04/07/2010 21:14:25 Edited by: Messoroz on 04/07/2010 21:13:35 Edited by: Messoroz on 04/07/2010 21:12:17 Originally by: Mme Pinkerton Originally by: Messoroz I believe that video is the perfect example of why writing good chunks of multiplayer code in scripting language is a bad idea. The same problem exists for all unreal engine games because of its unrealscript language and has plagued it from the old versions to the current 3.0 games. Scripting languages just make the job a little easier but with administrator/root privileges (which you generally can easily get on your local machine) you can always inject code as you wish (just use a debugger, combined debugger/disassembler/visualization tools like IDA help a lot with wrapping your mind around the issue). On the part of CCP it's basically a matter of obfuscating the relevant code enough to make things like this (i.e. code injections) impractical - you will never get rid of them (maybe if the operating system would run checksums on the code segments in memory but that would possibly affect a lot of legitimate applications that have a need to change executable code during runtime like JIT compilers). The only real solution to this problem would be to fix it by moving more code server-side. But that's my point, scripting languages make the job ridiculously easier. Otherwise you can't inject anything without doing the work debugging the assembly. Heck, making a whole new ui element like the uber scanner in the video would require ALOT of time of debugging work to figure out the proper assembly code. The other popular code injection method I know of are when header files are leaked or are accessible like in the case for source engine games which makes life just as easy as scripting languages.

Durzel The Xenodus Initiative.	Posted - 2010.07.04 21:54:00 - [21] Why am I not surprised that the client is 100% trusted to tell the server how close to the gate an autopilot warp will end, at what speed your warp ends (i.e. can go from full speed to dead stop) or that the client is furnished with the location of everyone in the system and trusted to just hide this information (or not, as that uberscanner shows). Dear oh dear.
Gariuys Evil Strangers Inc.	Posted - 2010.07.04 22:23:00 - [22] Originally by: Messoroz Edited by: Messoroz on 04/07/2010 21:08:41 Edited by: Messoroz on 04/07/2010 21:07:05 Originally by: Darth Kilth -------------------------------------------------------------------------------- Maybe the reators of games should learn a lesson that they should make some new code for games, somethign new and original so there will not be a couple of hacks for the game in one week after release. The problem isn't reusing code, it's using a script language on the client side are that wide open like a prisoner bending over in a prison shower to **** without protection and serverside checks. And you really think there are no server side checks to spot injected code. EVE is 7 years old, you really think this is the first time or the last time something like this has happened? It's python, any good programmer hell even a not so good one can really do a lot of things with the EVE client. But if you ever actually use it, you'll be the prisoner and Oveur the nerfbat.
Gariuys Evil Strangers Inc.	Posted - 2010.07.04 22:28:00 - [23] Originally by: Messoroz But that's my point, scripting languages make the job ridiculously easier not just a little. Otherwise you can't inject anything without doing the work debugging the assembly. Heck, making a whole new ui element like the uber scanner in the video would require ALOT of time of debugging work to figure out the proper assembly code. The other popular code injection method I know of are when header files are leaked or are accessible like in the case for source engine games which makes life just as easy as scripting languages. Then there are also directx based aimbotss and stuff for shooters which were my favs to write long ago :P Yeah but even if you take into account the extra work you need to do to prevent code injection or rather spot when it happens, the reduced development cycle when using python is still worth it.
Ghaylenty	Posted - 2010.07.04 22:33:00 - [24] read up about it. ccp seeds the torrents to catch would-be hackers. you can manipulate the client but nothing comes of it because the relay server which interfaces with the client is completly secure. if it worked like you imagined it would, you would have access to all server-side information, and all the customers would be at risk for having their payment information stolen. a hacked client would be the least of your concerns. luckily your description of the problem indicates you have absolutely no clue, and as such, don't understand what the problem -really- is. nobody's payment information is at risk because there is no risk. the client is just the client, and packet injection has been around since UO... they even had a special client for staff and family which also got released, but surprise surprise, even UO's archaeic security proved too much for any hacker and they never had a problem even though both their clients, GM and customer alike, were made open source by users. and now you think ccp more than 10 years later has a security issue because a PYTHON BASED CLIENT became open source?? lol. i actually fly amarr
Mah'D	Posted - 2010.07.04 22:57:00 - [25] Originally by: Ghaylenty read up about it. ccp seeds the torrents to catch would-be hackers. you can manipulate the client but nothing comes of it because the relay server which interfaces with the client is completly secure. if it worked like you imagined it would, you would have access to all server-side information, and all the customers would be at risk for having their payment information stolen. a hacked client would be the least of your concerns. luckily your description of the problem indicates you have absolutely no clue, and as such, don't understand what the problem -really- is. nobody's payment information is at risk because there is no risk. the client is just the client, and packet injection has been around since UO... they even had a special client for staff and family which also got released, but surprise surprise, even UO's archaeic security proved too much for any hacker and they never had a problem even though both their clients, GM and customer alike, were made open source by users. and now you think ccp more than 10 years later has a security issue because a PYTHON BASED CLIENT became open source?? lol. First of all yes packet injection has been around and yes you can have checks but how much of this information is actually checked and what is actually stored are two different things. If scanning is not checked or the information stored on the server then it can be easily exploited and CCP would have no clue. The video OP refers to shows the client being used on what is obviously TQ so you are an idiot. Also who said anything about payment information? All that info would be kept on a separate server from the game anyway. If the server merely asks the client to provide certain info and you modify the client so that you have access to additional information which normal players do not, and the server accepts this as it does not check for a unique ID code of some sort identifying a GM client then it is very possible for exploits such as this to evolve. It is also not the first time this has happened. Macroers have been around and CCP does not do **** all about them. As someone else stated I am almost sure this is just the tip of the iceberg and there is much more exploitation and corruption to EVE than people know about.
cprice39	Posted - 2010.07.04 23:27:00 - [26] i feel a conspiracy building............
Spurty Caldari D00M. RED.OverLord	Posted - 2010.07.04 23:47:00 - [27] My tinfoil hat is too tight for my sun burnt ears!!! NAPS: forcing you to play 'their' game
Sidekick John	Posted - 2010.07.04 23:53:00 - [28] Edited by: Sidekick John on 04/07/2010 23:54:09 Originally by: Chribba Standard practise. Just leave it alone until they fix the issue. Threads like this only cause more damage than good tbh. Do you honestly believe so Cribba? Details of a massive breach in client security has been made public, the largest in recent history, and CCP has shares no insight or information. Instead they return to their standard practise of silencing the masses leaving the community, misinformed, confused and angry.
Jada Maroo	Posted - 2010.07.05 00:02:00 - [29] CCP must have really lumpy rugs with all the stuff they keep sweeping under them.
Spurty Caldari D00M. RED.OverLord	Posted - 2010.07.05 00:03:00 - [30] There are black hat types that purposely go breaking into things that matter, contacting the owners, usually with not just details on how they got in, but fixes to stop this happening again. This is a moral service to the companies. It's done usually because the black hat doesn't want to see the company fail or be abused secretly. There is no blackmail or demand for money for this service. All that is given is plenty of time for the fix to be made and deployed. If after that time expires, there is no fix, no affirmation to the problem and likely now the company has really lost money, the information released to the security teams that assemble yearly. They then publicize the issue with much weight but no legal powers, only credibility in the news media. I work with two people on such a panel (go MIT) and so far, nothing has come their way concerning CCP. Therefore I have confidence that CCP doesn't ignore this stuff at all. NAPS: forcing you to play 'their' game



Pages: [1] 2 :: one page
First page \| Previous page \| Next page \| Last page

COPYRIGHT NOTICE
EVE Online, the EVE logo, EVE and all associated logos and designs are the intellectual property of CCP hf. All artwork, screenshots, characters, vehicles, storylines, world facts or other recognizable features of the intellectual property relating to these trademarks are likewise the intellectual property of CCP hf. EVE Online and the EVE logo are the registered trademarks of CCP hf. All rights are reserved worldwide. All other trademarks are the property of their respective owners. CCP hf. has granted permission to EVE-Search.com to use EVE Online and all associated logos and designs for promotional and information purposes on its website but does not endorse, and is not in any way affiliated with, EVE-Search.com. CCP is in no way responsible for the content on or functioning of this website, nor can it be liable for any damage arising from the use of this website.