Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Randar: A Minecraft exploit that uses LLL lattice reduction to crack server RNG

github.com

Post reply on HN
Print view View original

51–60 of 122 posts

Re: Randar: A Minecraft exploit that uses LLL lattice reduction to crack server RNG

#51

Post by rhaps0dy »

joshu wrote: post #26
dzdt wrote: post #9

Back in 1999-2000 there was an "International RoShamBo Programming Competition" [1] where computer bots competed in the game of rock-paper-scissors. The baseline bot participant just selected its play randomly, which is a theoretically unbeatable strategy. One joke entry to the competition was carefully designed to beat the random baseline ... by reversing the state of the random number generator and then predicting…

I submitted the optimally bad entrant the first year, cheesebot. https://web.archive.org/web/20180719050236/http://webdocs.cs...

Nice! How does Cheesebot work and why did it lose?

Re: Randar: A Minecraft exploit that uses LLL lattice reduction to crack server RNG

#52

Post by marshray »

saagarjha wrote: post #43
pclmulqdq wrote: post #40

Earlier quoted context omitted.

RNG vulnerabilities are usually really bad in terms of the systems they compromise. It often means exposure of keys, huge numbers of jailbroken devices, or something similar. Making at most tens of thousands of dollars in Minecraft with one is sort of cute and fun in comparison. Of course, I could be underestimating this by a lot.

This is a bug in how Minecraft does things, not a bug in the generator itself (which has long been known to be vulnerable to such things).

If "random" implies "contains no information", then it is indeed a bug in anything calling itself a "random number generator".

But that's just my opinion. The world is free to use the word however it wants.

Re: Randar: A Minecraft exploit that uses LLL lattice reduction to crack server RNG

#53

Post by dzdt »

rhaps0dy wrote: post #28
dzdt wrote: post #16

Earlier quoted context omitted.

The whole commentary about the "supermodified" class of competition entrants is making my laugh: > Nostradamus was written by Tim Dierks, a VP of Engineering at Certicom, who has a lot of expertise in cryptography. The program defeats the optimal player by reverse-engineering the internal state of the random() generator, which he states "was both easier and harder than I thought it would be". To be sporting, it then…

I was very curious about the Psychic Friends Network. One can find the code here ( https://github.com/MrValdez/Roshambo/blob/master/rsb-iocaine... ), and it's easy to deobfuscate substantially by running it through the C preprocessor. I believe it works as follows: - It plays randomly for the first 998 turns ( https://github.com/MrValdez/Roshambo/blob/master/rsb-iocaine... ): this line is "if (*turn - In the last 2 t…

Thanks for the deep dive. Yes fun to follow.

Re: Randar: A Minecraft exploit that uses LLL lattice reduction to crack server RNG

#54

Post by dontupvoteme »

bee_rider wrote: post #7

Pretty cool exploit. The idea of a free for all bug abusing server is pretty neat, a whole ‘nother level of the game. I guess this is what “actually fighting” (rather than just using in-game battling mechanics) would look like if the metaverse really happened ever.

>The idea of a free for all bug abusing server is pretty neat, a whole ‘nother level of the game.

Isn't this basically any non-VAC CS 1.6 server?

Re: Randar: A Minecraft exploit that uses LLL lattice reduction to crack server RNG

#55

Post by dontupvoteme »

orbital-decay wrote: post #27
bee_rider wrote: post #7

Pretty cool exploit. The idea of a free for all bug abusing server is pretty neat, a whole ‘nother level of the game. I guess this is what “actually fighting” (rather than just using in-game battling mechanics) would look like if the metaverse really happened ever.

> The idea of a free for all bug abusing server is pretty neat, a whole ‘nother level of the game. Balance converging around bugs and exploits is pretty typical for all PvP sandbox games with cutthroat gameplay, even if not allowed by the server. ARK: Survival Evolved and Eve Online are infamous for having huge clans (thousands of players) willing to go extreme lengths at metagaming and bug exploitation. It isn't alw…

This happened in PvE situations too -- Everquest always had people, especially guilds, running ShowEQ/MacroEQ to read mob locations off of the wire/from memory. Often could be used in non-unethical ways[1]

Sometimes you got funny situations like top guilds cheesing new raid content in their race to finish it first, leading the devs to go "cmon bro, you only played yourself" and then patching it immediately after, but almost never taking any loot away or banning anyone.

Also funny is the common situation where you don't want to _admit_ to everyone in your guild that you have at least one person running it, but you can kind of figure it out and it becomes an open secret.

1 - These are the days where you might have to clear down a dungeon 4 hours to see if a mob is up, or, even worse, to see if it's camped or not. Alternatively (or as a cover) people just parked alts but you get the idea. Also, come to think of it, Diablo had this too with maphacks and grabit and such

Re: Randar: A Minecraft exploit that uses LLL lattice reduction to crack server RNG

#56

Post by leijurv »

danielwmayer wrote: post #44

Yo Leijurv this is so sick! As a fellow game hacker this sort of stuff is super inspiring. My girlfriend and I watch all the fitmc videos even though neither of us play minecraft, and love the ones detailing your insane tooling the most. Ever since we watched the nocom one I’ve wondered what you do professionally - are you in the infosec space? With the amount of math and computer science knowledge you put into your…

I'm just a regular SWE! Infosec or algorithmic trading - maybe someday.

Re: Randar: A Minecraft exploit that uses LLL lattice reduction to crack server RNG

#58

Post by ro_bit »

leijurv wrote: post #49
ajcp wrote: post #46

Earlier quoted context omitted.

The narration in this video is so over-the-top you'd think they were talking about Stuxnet or something. I love it.

Yes, absolutely :) that's why we went to FitMC to make the video, he always delivers.

Between nocom and this I'm sure at least a dozen people who had no idea about reverse engineering are going to eventually have a career in it thanks to his videos, even if I find them incredibly cheesy. His videos have a habit of reaching and engrossing all sorts of people who otherwise wouldn't really care about minecraft server exploits, and maybe that will inspire some of them to learn more

Thanks for the writeup!

Re: Randar: A Minecraft exploit that uses LLL lattice reduction to crack server RNG

#59

Post by sleepingreset »

timdierks wrote: post #23
dzdt wrote: post #9

Back in 1999-2000 there was an "International RoShamBo Programming Competition" [1] where computer bots competed in the game of rock-paper-scissors. The baseline bot participant just selected its play randomly, which is a theoretically unbeatable strategy. One joke entry to the competition was carefully designed to beat the random baseline ... by reversing the state of the random number generator and then predicting…

That's me! Thanks for pulling up the quote from long ago: > "With his obvious technical skill, and his "cheat early and often" attitude, Tim could have a promising career as an AI programmer in the computer games industry. :)" Instead took a path of security, authoring the TLS RFC and principal engineer in Google security. Thanks for the flashback.

you're a wizard bro. hell yea

Re: Randar: A Minecraft exploit that uses LLL lattice reduction to crack server RNG

#60

Post by eru »

dzdt wrote: post #9

Back in 1999-2000 there was an "International RoShamBo Programming Competition" [1] where computer bots competed in the game of rock-paper-scissors. The baseline bot participant just selected its play randomly, which is a theoretically unbeatable strategy. One joke entry to the competition was carefully designed to beat the random baseline ... by reversing the state of the random number generator and then predicting…

I remember someone doing the same to an online poker site that had helpfully documented its PRNG in a laudable attempt at transparency.

(And the transparency got them an improvement in their security in the end.)

Post reply on HN