Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hacking GTA V RP Servers Using Web Exploitation Techniques

nullpt.rs

Post reply on HN
Print view View original

21–30 of 40 posts

Re: Hacking GTA V RP Servers Using Web Exploitation Techniques

#21

Post by Capricorn2481 »

mavamaarten wrote: post #7
serf wrote: post #5

it's nice seeing someone open with telling everyone that GTA V is some of the most poisoned online gameplay with regards to cheating. I don't agree with the conclusion that it's because it's peer-to-peer. that's not why -- it's because of lazy developer methods and a lower prioritization of security effort. the biggest genuine effort that Rockstar puts into anti-cheat effort is an occassional memory-structure shuffle…

Yeah, they absolutely don't care. It cannot be hard to detect griefing and obnoxious cheating by just looking at player behavior. How hard can it be to detect 90000000000 in-game dollars to be added to players, how hard can it be to detect that someone is blowing up everyone in the server, ... They just don't care, and it's a shame because GTA V still holds up as a fantastic game even after all these years.

For what it's worth, I used to play GTA online a lot and was getting bored with it. For a last hurrah, I had my account hacked by a friend to give me billions. I bought all the stuff I wanted even though I was told to be careful with buying too much (as if I was money laundering).

I opened it up recently and my money was back to normal. I imagine I did something that got me detected. In all honesty, it was a blessing, because I realized I was only playing the game for the addictive grind and I didn't enjoy the game itself. The online mode is like a second job, and it's exacerbated by the highest rewards being specifically designed to grief new players. Rocket bikes with car seeking missiles really killed the game for me

Re: Hacking GTA V RP Servers Using Web Exploitation Techniques

#22

Post by mtlynch »

Jerrrry wrote: post #3

I miss these kinda posts, so rare now. I know XSS is dying due to CORS and DLL injection is mooted by ALSR, that API's are usually authenticated and authorized, but damn... I wish there was a more collective place to showcase modern exploits, they just hit nice in the feelies.

>I know XSS is dying due to CORS

CORS isn't related to XSS. CORS actually isn't a security protection at all. It's a way for web apps to explicitly disable standard protections that browsers apply to enforce same origin policy.

You might be thinking of Content Security Policy (CSP).[0] That's the most effective protection I'm aware of for XSS, but it's not very widely used because so few JavaScript libraries are compatible with it.

[0] https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP

Re: Hacking GTA V RP Servers Using Web Exploitation Techniques

#23

Post by Jerrrry »

mtlynch wrote: post #22
Jerrrry wrote: post #3

I miss these kinda posts, so rare now. I know XSS is dying due to CORS and DLL injection is mooted by ALSR, that API's are usually authenticated and authorized, but damn... I wish there was a more collective place to showcase modern exploits, they just hit nice in the feelies.

> I know XSS is dying due to CORS CORS isn't related to XSS. CORS actually isn't a security protection at all. It's a way for web apps to explicitly disable standard protections that browsers apply to enforce same origin policy. You might be thinking of Content Security Policy (CSP).[0] That's the most effective protection I'm aware of for XSS, but it's not very widely used because so few JavaScript libraries are com…

yea, i meant CSP.

>so few JavaScript libraries are compatible with it.

is this because of the 'eval' function specifically, or is there other reasons?

Re: Hacking GTA V RP Servers Using Web Exploitation Techniques

#24

Post by Jerrrry »

l33t7332273 wrote: post #10
shitlord wrote: post #9

Earlier quoted context omitted.

ASLR doesn't stop DLL injection.

I think GP confused DLL injection with return to libc. I see why; in return to libc, which is prevented by ASLR, you are injecting the control of flow into the middle of a DLL(that DLL is libc). The terminology is a little confusing.

meant hooking functions statically or even dynamically with a minimal amount of codegolf'd asm instructions inserted via buffer overflow, and repairing the stack to sneak by stack smashing detecting, but yea, libc is implied in the linux environment

Re: Hacking GTA V RP Servers Using Web Exploitation Techniques

#25

Post by Jerrrry »

nullpt_rs wrote: post #16
curiousgal wrote: post #2

That was a very nice write-up!

Thank you! Hope to publish more like it soon :)

Looking forward to reading it -- genuine, raw, straight up hacking is almost nostalgic at this point.

wish we could get more bug bounty write up submissions

Re: Hacking GTA V RP Servers Using Web Exploitation Techniques

#26

Post by xcdzvyn »

Capricorn2481 wrote: post #21
mavamaarten wrote: post #7

Earlier quoted context omitted.

Yeah, they absolutely don't care. It cannot be hard to detect griefing and obnoxious cheating by just looking at player behavior. How hard can it be to detect 90000000000 in-game dollars to be added to players, how hard can it be to detect that someone is blowing up everyone in the server, ... They just don't care, and it's a shame because GTA V still holds up as a fantastic game even after all these years.

For what it's worth, I used to play GTA online a lot and was getting bored with it. For a last hurrah, I had my account hacked by a friend to give me billions. I bought all the stuff I wanted even though I was told to be careful with buying too much (as if I was money laundering). I opened it up recently and my money was back to normal. I imagine I did something that got me detected. In all honesty, it was a blessing…

> as if I was money laundering

Yeah, it's suspected a very common trigger for R*, for whatever reason, is depositing cash into your in-game bank account. You're far less likely to be banned if you only pay in cash.

Re: Hacking GTA V RP Servers Using Web Exploitation Techniques

#27

Post by lispisok »

serf wrote: post #5

it's nice seeing someone open with telling everyone that GTA V is some of the most poisoned online gameplay with regards to cheating. I don't agree with the conclusion that it's because it's peer-to-peer. that's not why -- it's because of lazy developer methods and a lower prioritization of security effort. the biggest genuine effort that Rockstar puts into anti-cheat effort is an occassional memory-structure shuffle…

>These ban cycles and 'enforced ignorance' to the problem nets them more profit than it would otherwise; disenchanted players play less, reducing infrastructure costs -- and banned players buy another 2 dollar copy of the game -- but it kills user experience outside of single player entirely.

Game devs vehemently deny this but there are games out there with perverse incentives for the game devs regarding cheaters. Escape From Tarkov is another game that is losing many players to the cheater issue while the devs drag their feet addressing the problem, or any problem in that game really. Why would they? Once the devs have legitimate players' money, them playing the game is just costing them money by paying for servers. Banning enough cheaters just frequently enough to buy another copy is how they get recurring revenue. As much as I hate the subscription model taking over everything I think if it was used in games like Tarkov it would be a much better game because it would align incentives to keep players engaged. On the other hand that would probably come with a bunch of dark patterns.

I have a personal conspiracy that Tarkov kept making the early game for new players harder and more insufferable while making the game more easy after you have grinded long enough, (for people like streamers who basically are the advertising) was a decision to get people excited to buy the game watching streamers with their far better experience, then shortly quit by making their experience insufferable.

Re: Hacking GTA V RP Servers Using Web Exploitation Techniques

#28

Post by tehbeard »

usui wrote: post #6
serf wrote: post #5

it's nice seeing someone open with telling everyone that GTA V is some of the most poisoned online gameplay with regards to cheating. I don't agree with the conclusion that it's because it's peer-to-peer. that's not why -- it's because of lazy developer methods and a lower prioritization of security effort. the biggest genuine effort that Rockstar puts into anti-cheat effort is an occassional memory-structure shuffle…

Rockstar doing something about cheaters on their online experience won't affect a thing for what this post is talking about. The exploit in this post is for FiveM servers, a third-party mod. The interactions on here are not usually peer-to-peer.

R* recently bought FiveM, so it's a bit less third party now.

https://www.polygon.com/23828445/gta-5-mods-roleplay-red-dea...

Maybe they'll do the same as mojang did with bukkit, and leave it out to dry...

Re: Hacking GTA V RP Servers Using Web Exploitation Techniques

#29

Post by rainonmoon »

Jerrrry wrote: post #25
nullpt_rs wrote: post #16

Earlier quoted context omitted.

Thank you! Hope to publish more like it soon :)

Looking forward to reading it -- genuine, raw, straight up hacking is almost nostalgic at this point. wish we could get more bug bounty write up submissions

My friend, you seem genuine in your enthusiasm if a little misinformed, so in the spirit of trying to stoke that rather than smother it, can I gently alert you to the thousands of bug bounty write ups you can read online? A decent place to start is the various H1 Disclosed writeups [0] but there's an avalanche of this sort of content on Medium (most not as well written as OP's, it must be said, but still very technical and detailed.) Good news! The time you're nostalgic for is right now! If people would like to share other blogs below which also post technical writeups for this poster, feel free. I'll throw in another one [1] too.

[0] https://twitter.com/h1disclosed

[1] https://jub0bs.com/posts/

Re: Hacking GTA V RP Servers Using Web Exploitation Techniques

#30

Post by zarroboogs »

usr012384 wrote: post #12
serf wrote: post #5

it's nice seeing someone open with telling everyone that GTA V is some of the most poisoned online gameplay with regards to cheating. I don't agree with the conclusion that it's because it's peer-to-peer. that's not why -- it's because of lazy developer methods and a lower prioritization of security effort. the biggest genuine effort that Rockstar puts into anti-cheat effort is an occassional memory-structure shuffle…

This post is about private servers using a 3rd party mod called FiveM. How do you expect Rockstar to police them?

Rockstar owns FiveM now
Post reply on HN