Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Rumors of GTA online exploits allowing remote code execution on gamer PCs

old.reddit.com

Post reply on HN
Print view View original

41–50 of 50 posts

Re: Rumors of GTA online exploits allowing remote code execution on gamer PCs

#41

Post by kevincox »

Stevvo wrote: post #13

Whilst an issue like this can occur with any network architecture, going with Peer-to-peer looks like a terrible decision. 'Never trust the client' and all that. The in-game money cost real money, but the client is trusted so anyone can edit their balance in memory as the game is running. Ridiculous.

It's always a balance between performance and security.

Yes, it is better to have the server parse, validate and reserialize messages from other players to add another layer of defense in front of the client. But the client shouldn't be trusting the server anyways so going peer-to-peer shouldn't be an issue. The fact is that server pricing isn't going to catch everything anyways.

Probably the biggest problem with P2P these days is that it shares your IP which can be used for tracking or DoS attacks.

Re: Rumors of GTA online exploits allowing remote code execution on gamer PCs

#42

Post by mlyle »

kevincox wrote: post #41
Stevvo wrote: post #13

Whilst an issue like this can occur with any network architecture, going with Peer-to-peer looks like a terrible decision. 'Never trust the client' and all that. The in-game money cost real money, but the client is trusted so anyone can edit their balance in memory as the game is running. Ridiculous.

It's always a balance between performance and security. Yes, it is better to have the server parse, validate and reserialize messages from other players to add another layer of defense in front of the client. But the client shouldn't be trusting the server anyways so going peer-to-peer shouldn't be an issue. The fact is that server pricing isn't going to catch everything anyways. Probably the biggest problem with P2P…

> But the client shouldn't be trusting the server anyways so going peer-to-peer shouldn't be an issue.

If there's things like durable money between matches, etc: without someone in the loop to validate what happened you can't really solve this problem peer to peer. (If we define security to encompass "secure game state" and not just "safety from remote code execution")

Re: Rumors of GTA online exploits allowing remote code execution on gamer PCs

#43

Post by kevincox »

mlyle wrote: post #42
kevincox wrote: post #41

Earlier quoted context omitted.

It's always a balance between performance and security. Yes, it is better to have the server parse, validate and reserialize messages from other players to add another layer of defense in front of the client. But the client shouldn't be trusting the server anyways so going peer-to-peer shouldn't be an issue. The fact is that server pricing isn't going to catch everything anyways. Probably the biggest problem with P2P…

> But the client shouldn't be trusting the server anyways so going peer-to-peer shouldn't be an issue. If there's things like durable money between matches, etc: without someone in the loop to validate what happened you can't really solve this problem peer to peer. (If we define security to encompass "secure game state" and not just "safety from remote code execution")

This is usually done by logging state to the server which does some validation.

Most validation that the server does can be run on clients just as easily. (The main issue is what information is visible to clients. But if you are doing mostly P2P you usually end up making tradeoff that the client gets most information)

Re: Rumors of GTA online exploits allowing remote code execution on gamer PCs

#44

Post by doober »

tinus_hn wrote: post #38
DefineOutside wrote: post #25

I've played with and studied netcode and I'm unsure what GTA netcode would even look like. I've seen cheats to the point where everyone is just teleported to the cheater, the cheater spawning millions of dollars, cheaters taking away millions of dollars from people, the cheater unlocking all the online collectables for everyone in the lobby at the same time, people screwing with singleplayer sessions, cheaters crashi…

How can the game handle another player pushing you if you don’t ‘accept actions from other players’?

by letting a dedicated server also simulate the world and all entities?

client send new origin to server -> server checks if everything is in bounds with the simulation/world -> tells other clients ur new position

Re: Rumors of GTA online exploits allowing remote code execution on gamer PCs

#45

Post by xcvbjbhvfgx »

someperson wrote: post #2

A remote code execution exploit in GTA 5 Online should not a surprise to anybody who has played GTA 5 Online. Cheaters have been rampant for many years, with people using apparently purchased cheat tools that allow them to choose to do server-side things like drop unlimited money and spawn vehicles anywhere, rapidly cycling through weather changes, and locking people permanently in cages. But get on the bad side of a…

not to mention the dozen shaddy EA extra apps you are forced to install just to be able to open the game. none to combat cheats but just abandoned attemps at lame game stores and desktop spammers

Re: Rumors of GTA online exploits allowing remote code execution on gamer PCs

#46

Post by doober »

armchairhacker wrote: post #14
bakugo wrote: post #10

Almost every single online game out there that relies on players connecting to each other instead of only a central server is vulnerable to these types of exploits, it's often just a question of finding them. Every once in a while I feel like playing one of the older Call of Duty games on my steam library again, but then I remember that they all have known unfixed RCE exploits.

This is why you rewrite it in Rust \s But seriously, one of the reasons games should maybe be less C++ and more memory-safe languages, if not Rust then languages like C# or JavaScript. And maybe incorporate formal methods into game-dev. The code which handles server responses should be sufficiently isolated from any of the unsafe code (e.g. rendering), so that you can ideally prove (or non-ideally, at least be very c…

"Maybe it still won't be sufficient against state actors, but it would mean that you can reliably play an old game like you can reliably view a webpage."

https://www.cvedetails.com/product/15031/Google-Chrome.html?...

oh and muh rust magic safety https://github.com/Qwaz/rust-cve

Re: Rumors of GTA online exploits allowing remote code execution on gamer PCs

#47

Post by tinus_hn »

doober wrote: post #44
tinus_hn wrote: post #38

Earlier quoted context omitted.

How can the game handle another player pushing you if you don’t ‘accept actions from other players’?

by letting a dedicated server also simulate the world and all entities? client send new origin to server -> server checks if everything is in bounds with the simulation/world -> tells other clients ur new position

And now everything is twice as slow and you need enormous server capacity. They chose a different system and not because they couldn’t think of your obvious idea.

Re: Rumors of GTA online exploits allowing remote code execution on gamer PCs

#48

Post by doober »

tinus_hn wrote: post #47
doober wrote: post #44

Earlier quoted context omitted.

by letting a dedicated server also simulate the world and all entities? client send new origin to server -> server checks if everything is in bounds with the simulation/world -> tells other clients ur new position

And now everything is twice as slow and you need enormous server capacity. They chose a different system and not because they couldn’t think of your obvious idea.

[flagged]

Re: Rumors of GTA online exploits allowing remote code execution on gamer PCs

#49

Post by DefineOutside »

tinus_hn wrote: post #38
DefineOutside wrote: post #25

I've played with and studied netcode and I'm unsure what GTA netcode would even look like. I've seen cheats to the point where everyone is just teleported to the cheater, the cheater spawning millions of dollars, cheaters taking away millions of dollars from people, the cheater unlocking all the online collectables for everyone in the lobby at the same time, people screwing with singleplayer sessions, cheaters crashi…

How can the game handle another player pushing you if you don’t ‘accept actions from other players’?

I meant letting other players control your character, why is teleporting someone else to anywhere on the map a valid action?

Re: Rumors of GTA online exploits allowing remote code execution on gamer PCs

#50

Post by tinus_hn »

DefineOutside wrote: post #49
tinus_hn wrote: post #38

Earlier quoted context omitted.

How can the game handle another player pushing you if you don’t ‘accept actions from other players’?

I meant letting other players control your character, why is teleporting someone else to anywhere on the map a valid action?

Pushing another player is also teleporting them to somewhere else on the map. And if you think oh I’ll just have some limits they’ll just do the same thing in multiple frames.
Post reply on HN