00:00:00.000-->00:00:05.125
>> alright, hello everybody,
like he uh just said my name is
Manfred and I’m a security

00:00:05.125-->00:00:11.875
analyst and researcher at
independent security evaluators,
and today we’ll be talking about

00:00:11.875-->00:00:19.708
20 years of MMORPG hacking uh
the title is better graphics and
same exploits, because, cause it

00:00:19.708-->00:00:27.042
really is true. Uh it's been a
pretty weird day, this talk is
being modified to not include

00:00:27.042-->00:00:39.875
some undisclosed exploits.
[booooo] I was told uh yeah
[laughs] yeah, so I’ll tell you

00:00:39.875-->00:00:48.958
about that. Alright, disclaimer,
I’ve been doing this for 20
years, how I’ve done it for so

00:00:48.958-->00:00:56.667
long without you know uh running
into any problems uh I found
over 100 ODays and over 22 plus

00:00:56.667-->00:01:04.042
online games, uh the key is to
be ethical, uh also be
invisible, be Caspar the

00:01:04.042-->00:01:09.583
friendly hacking ghost. You
don’t want the game developers
to know you are in there, you

00:01:09.583-->00:01:14.792
don’t want the players to know
you’re there you’re kind of in
there just doing your own thing

00:01:14.792-->00:01:21.083
kinda like you know controlling
the metr matrix. Um, if you can
provide a solid service that

00:01:21.083-->00:01:26.958
fills a gap. Um, that means you
do it in a way that doesn’t harm
players, um don’t disrupt game

00:01:26.958-->00:01:37.500
services, don’t do anything that
will negatively impact uh a game
company's bottom line, that’s a

00:01:37.500-->00:01:44.625
pretty important one. Um, don’t
get roots, don’t own servers and
don’t get auth unauthenticated

00:01:44.625-->00:01:51.875
access to uh online game
choices. Uh, but you can however
use built in game features to

00:01:51.875-->00:01:59.667
find unintended features, stuff
that developers you know, never
imagined that would be possible.

00:01:59.667-->00:02:04.583
And, if you can provide the
servers that puts annoying bot
farmers out of business, uh,

00:02:04.583-->00:02:14.750
that's even better cause bot
farmers suck [chuckles]. Uh, to
be ethical has little uh

00:02:14.750-->00:02:22.250
asterisks next to it, um,
twenty, seventeen years ago I
did some stuff I wasn’t too

00:02:22.250-->00:02:30.625
proud of, uh don’t do that we’ll
talk about it in the next coming
slides.Uh with that said let's

00:02:30.625-->00:02:37.292
talk about hacking some online
games. Uh but first let's talk
about my name, Manfred, it's a

00:02:37.292-->00:02:45.042
pretty generic name [cheers from
audience] Yeah. Uh I use to play
ultima online back in pre-alpha,

00:02:45.042-->00:02:54.708
alpha beta and release back in
1997, uh I played on the pacific
shard, uh back in its golden age

00:02:54.708-->00:03:00.958
it had free for all pvp ganking,
griefing, I mean you kill
somebody and you take all their

00:03:00.958-->00:03:08.875
s**t basically. It’s [laughter]
it’s it’s the wild west. Um, so,
I did a lot of ganking and

00:03:08.875-->00:03:16.167
reefing and pvp jacked a lot of
peoples stuff in game uh so I
picked a name that kind of fit

00:03:16.167-->00:03:25.583
the persona and that name was
f**kchump [laughter] spelled
with a p uh you know uh so one

00:03:25.583-->00:03:33.833
day uh I went out I was sitting
afk at the bank inside the game
and I went afk for like twenty

00:03:33.833-->00:03:40.042
minutes to go grab like some
krispy kreme donuts, my typical
lunch uh I come back and I

00:03:40.042-->00:03:47.417
notice my name is different and
um I look at the text message
log and there's like a GM

00:03:47.417-->00:03:52.958
talking to me, he’s like hey
we’ve had too many complaints of
your griefing and ganking plus

00:03:52.958-->00:03:58.792
we can’t have you running around
as f**kchump [laughter] so he
just picked a random name and

00:03:58.792-->00:04:10.375
named me Manfred, so I was named
by a GM [laughter] so I..ever
since, uh that just stuck. Uh,

00:04:10.375-->00:04:23.750
we’ll be talking about I think
all of these games except two
[laughter]. We’ll be talking

00:04:23.750-->00:04:32.958
about low hanging fruit
exploits. Uh, uh all the games
in the previous slide had one

00:04:32.958-->00:04:40.250
thing in common and that is they
all suffered from integer
overflow exploits. Uh, what’s an

00:04:40.250-->00:04:47.250
integer overflow? It’s basically
when you perform an arithmetic
operation and you basically

00:04:47.250-->00:04:54.875
either change signs or you go
from the maximum positive to
zero, or you go from zero to the

00:04:54.875-->00:05:03.875
maximum positive and vice versa.
Uh it’s a pretty simple concept
uh happens a lot. Uh here’s one

00:05:03.875-->00:05:11.708
in action in a debugger so we’ll
load up EAX with one will load
up ebx with the value of two and

00:05:11.708-->00:05:19.750
then we’ll subtract ebx by one,
ebx changes into one, we’ll
subtract another one from ebx so

00:05:19.750-->00:05:28.833
ebx is zero, and we’ll subtract
from ebx one more time and ebx
turn into the maximum thirty tid

00:05:28.833-->00:05:37.375
bit integer value which is four
point something billion uh and
if he notes eflags on the bottom

00:05:37.375-->00:05:42.833
right uh the carry flag got sent
so that's a really simple way to
know if uh something overflowed

00:05:42.833-->00:05:51.333
or underflowed. Uh if you go the
other way we’ll load up eax with
the maximum uh nth thirty two

00:05:51.333-->00:05:56.583
value which is four point some
billion and then we’ll add one
to it. You know you’d think

00:05:56.583-->00:06:00.875
you’d have four point one
billion plus one which you’d go
to zero, not a good thing. It’s

00:06:00.875-->00:06:07.292
pretty simple. Um, I’ve seen a
lot of people post in like stack
overflow about how to test for

00:06:07.292-->00:06:15.083
overflows and you know they try
to do high level tests like if x
is greater than x plus one then

00:06:15.083-->00:06:25.000
you know you have an overflow,
otherwise you're fine [laughter]
uh, compilers feed that they’ll

00:06:25.000-->00:06:31.292
look at x is greater than x plus
one they’ll be like what the
hell is this c**p [laughter]?

00:06:31.292-->00:06:38.750
So, you know compilers will
optimize that stuff out of their
unless generally don’t think

00:06:38.750-->00:06:45.542
that. So here’s an overly
simplified typical MMORPG
architecture, you have your user

00:06:45.542-->00:06:52.417
that's interacting with a game
client, the game client is
processing UI events, uh it

00:06:52.417-->00:06:58.375
turns these UI events into
messages that get sent to the
server. So usually all of these

00:06:58.375-->00:07:05.042
events fall down into a single
sent data routine uh where it
gets encrypted and then sent

00:07:05.042-->00:07:11.875
down the network to the game
server. The game server does
backwards, it reads the data

00:07:11.875-->00:07:17.708
from the network, it has like a
receive data routine where it
decrypts the buffer, analyzes

00:07:17.708-->00:07:23.500
the packet and then takes
appropriate actions, and then
notifies the game client and any

00:07:23.500-->00:07:32.167
other clients in the vicinity.
Um, so when you're hacking
online games, you basically want

00:07:32.167-->00:07:36.917
to do man in the middle attacks,
you want to take over the
protocol and the messages that

00:07:36.917-->00:07:42.667
the client and server are
sending to each other. Um,
online games usually use

00:07:42.667-->00:07:47.625
proprietary and modified
encryption and sometimes they do
like weird stuff where they'll

00:07:47.625-->00:07:53.042
use like blowfish and triple des
on top of each other and then
they’ll exer everything and then

00:07:53.042-->00:07:58.667
they’ll add five to it and then
the cherry on top or whatever
[laughter]. Um, they try to

00:07:58.667-->00:08:03.417
obfuscate things so that people
don’t look at their protocol.
Um, it’s time consuming to

00:08:03.417-->00:08:10.917
reverse, you may have to keep
track of renegotiations mid
session, uh, cypher changes mid

00:08:10.917-->00:08:19.958
session, um plus whatever their
doing probably and will change
every patch cycle. Uh,

00:08:19.958-->00:08:24.875
especially in rift online they
patch like every other day which
is really annoying. Um also,

00:08:24.875-->00:08:35.250
online games usually insert anti
tampering junk into their
packets, like an Hmac, some kind

00:08:35.250-->00:08:40.958
of a checksum, I’ve seen a lot
of these games roll with there
own checksum which makes things

00:08:40.958-->00:08:47.958
interesting. Uh, delta sequence
numbers, they’ll get fancy and
do like per packet or per packet

00:08:47.958-->00:08:52.625
type sequence numbers, so uh
movement packets will have
different sequence numbers than

00:08:52.625-->00:09:00.917
speech packets or inventory
interaction packets. Um on top
of that they obfuscate opcodes

00:09:00.917-->00:09:08.042
uh, basically the operation code
that describes what the packet
is going to be. Um, they

00:09:08.042-->00:09:14.042
obfuscate data types like
integers, strings and thirty
twos and sixty fours and

00:09:14.042-->00:09:18.875
sixteens, bytes, bullings, uh
all of this is done pre
encryption, and it's used to

00:09:18.875-->00:09:25.667
basically stop people from
modifying the game in memory,
like modifying packets in memory

00:09:25.667-->00:09:32.167
using like a simple uh hex. Uh,
so if you try to do a network
command, the middle approach for

00:09:32.167-->00:09:39.250
dealing with encrypted,
compressed, checksummed,
sequenced, and obfuscate packets

00:09:39.250-->00:09:45.750
which is a lot of bull c**p. So,
how do you uh go about
completely attacking a game? You

00:09:45.750-->00:09:50.708
do an applicational error man
the middle.Uh you inject the DLL
, there’s like twenty woops,

00:09:50.708-->00:09:56.417
there’s like twenty different
ways to inject DLL into a
process especially in widows. Um

00:09:56.417-->00:10:03.250
so the game client has a send
data routine so you inject the
DLL, the DLL will hoke to send

00:10:03.250-->00:10:09.167
data routine where you can roll
your own custom send data
routine where you can examine

00:10:09.167-->00:10:15.208
packets and modify packets as
you see fit. And then you can
get fancy and you can add a

00:10:15.208-->00:10:20.292
whole GUI to the thing so you
inject DLL, you spin up the
GUI, and the GUI basically

00:10:20.292-->00:10:26.542
spits out uh all the packets and
has functionality for uh you
know uh replaying the packets

00:10:26.542-->00:10:34.833
and modifying a packet in real
time. And then you have some
crazy hacker dude which happens

00:10:34.833-->00:10:42.500
to be somebody we all know and
love, um, so power point
bulletins and diagrams and stuff

00:10:42.500-->00:10:51.167
is nice but what does it look
like in practice? It looks like
a little line [laughter]. Let’s

00:10:51.167-->00:11:03.542
go back, no, alright. It shows
up for like a split second.
Alright [laughter] well if I

00:11:03.542-->00:11:13.500
just keep doing that you can get
like [laughter] Alright hold on,
let me see if I uh can play it

00:11:13.500-->00:11:20.250
from the drive. We have some
extra time since uh I won’t be
doing the live exploit cause I

00:11:20.250-->00:11:36.083
was told that would be a dumb
thing to do [laughter]. Alright,
no video uhhhh lets see, try

00:11:36.083-->00:11:51.292
this guy, [VLC], yeah where’s
VLC? [inaudible audience talk]
Do we have [laughter] Quicktime?

00:11:51.292-->00:12:05.208
[Laughter] >>Installer right
there[audience boos] N N N Not
yet [applause] man this lap tops a

00:12:05.208-->00:12:31.417
piece of s**t [laughter]. What’s
going on here? [laughter] No. Is
the suspense killing you guys?

00:12:31.417-->00:12:42.875
Oh wait, what do we have? Try
what? [inaudible audience
member] Yeah, I’m trying to uh

00:12:42.875-->00:13:00.917
uhhh why is it not going full
screen? Full screen control F.
[Laughter] Oh. [clears throat],

00:13:00.917-->00:13:09.083
uh yeah I’ll have to explain
what’s going on so this is an
inject uh well on the upper

00:13:09.083-->00:13:17.167
right uh is a GUI that was
spun up by an injected DLL uh
plugged into Dark Age of

00:13:17.167-->00:13:23.042
Camelot, a really old game from
two thousand eleven. And what
I’m doing here is modifying

00:13:23.042-->00:13:31.000
speech packets. Um, so I’m
sending a text message with the
null terminator removed, so I’m

00:13:31.000-->00:13:38.042
getting back server memory
[laughter] I mean [clears
throat] this worked back in two

00:13:38.042-->00:13:43.833
thousand and eleven and I tested
it like a few days ago and it
still worked so [laughter] I

00:13:43.833-->00:13:49.750
guess it's not like a huge
concern of theres. Uh back when
the game was popular back in two

00:13:49.750-->00:13:53.833
thousand and one I could just
sit here and like spit out
packets after packets with the

00:13:53.833-->00:13:58.292
null terminator removed and I
could you know listen on other
people's conversations, see

00:13:58.292-->00:14:03.417
weird stuff that was going on
the server memory, uh get all
sorts of weird strings back. Uh

00:14:03.417-->00:14:20.667
let's see Alright let’s go to
the Ultima online. So we saw the
tool I used, uh I saw you saw

00:14:20.667-->00:14:27.250
that I can modify packets and do
some stuff that normally
shouldn’t happen. Uh, so Ultima

00:14:27.250-->00:14:32.958
online had non instanced
housing, uh games these days
have instanced housing so pretty

00:14:32.958-->00:14:37.792
much anybody is guaranteed a
house. Uh Ultima online had PVP,
one of my favorite features, and

00:14:37.792-->00:14:47.250
it had tons of exploits, uh like
this exploit right here is uh is
normally the skills on the right

00:14:47.250-->00:14:55.167
uh there normally not supposed
to go above a hundred points,
[laughter, clears throat] uh,

00:14:55.167-->00:15:01.125
one day the developers decided
to patch in poison in the game,
like where you could poison

00:15:01.125-->00:15:06.125
people, uh and they had the
bright idea if you drink a
poison potion it’ll reduce your

00:15:06.125-->00:15:11.667
stamina by ten points or five
points depending on the quality
of the poison. So if you make a

00:15:11.667-->00:15:20.458
character with like two stamina
and you drink some poison, it’ll
cause your stamina to roll down

00:15:20.458-->00:15:26.833
and become sixty five thousand
six five five three five.
[laughter] And there’s a lot of

00:15:26.833-->00:15:31.458
skills that are based off of
your stamina like alchemy,
blacksmithing, and carpentry and

00:15:31.458-->00:15:35.375
stuff like that. So, when you
have sixty five thousand
stamina, you have some pretty

00:15:35.375-->00:15:40.667
awesome skills, so you can make
some, so you can do some epic
crafting and make some awesome

00:15:40.667-->00:15:47.125
overly powered stuff. And this
one didn’t, yeah you just use
the game interface using you

00:15:47.125-->00:15:55.208
don’t have to do anything wonky.
Uh Ultima online had housing, um
if you’ve seen the picture this

00:15:55.208-->00:16:02.833
house is like new, we’ll talk
about that. Uh they implemented
a house DK system where it

00:16:02.833-->00:16:09.375
prevents you know uh players
that quit the game or lost
interest in the game from having

00:16:09.375-->00:16:13.917
houses that take up valuable
real estate in a game. Uh
there’s multiple stages uh,

00:16:13.917-->00:16:19.625
there’s like new, like in the
picture, where uh a player
interacted with it within an

00:16:19.625-->00:16:25.667
hour, there’s slightly worn,
that happens after a week,
there’s somewhat worn uh a week

00:16:25.667-->00:16:31.042
after that, fairly worn another
week, uh greatly worn a week
after that, and then it becomes

00:16:31.042-->00:16:36.208
in danger of collapsing. So
after about five or six weeks uh
it becomes in danger of

00:16:36.208-->00:16:44.208
collapsing, and this is where it
gets fun. Oh man, there’s gonna
be another video after this, I

00:16:44.208-->00:16:50.292
hope it works. Uh, so when it
goes to in danger of collapsing,
they pick a random time of five,

00:16:50.292-->00:16:54.458
ten or fifteen hours, so you
don’t really know exactly when
it's going to collapse, so you

00:16:54.458-->00:16:58.583
can’t set your alarm and be like
hey somebody’s house is going to
fall down I’m gonna get some mad

00:16:58.583-->00:17:06.708
loot. Uh, anyway, uh none of
this is housing, just to make
the point here, there's usually

00:17:06.708-->00:17:11.500
about thirty thousand players
per server in Ultima online, but
there’s only about three

00:17:11.500-->00:17:18.167
thousand spots for a house, so
you have twenty seven thousand
homeless players [laughter] that

00:17:18.167-->00:17:24.667
really want a house. Here’s
demand and market for stake and
effect where you have [laughter]

00:17:24.667-->00:17:35.583
limited supply, uh, high prices.
Alright, here’s the video, lets
see if this works. Uh, this is a

00:17:35.583-->00:17:39.250
house that’s in danger of
collapsing, it’s going to
collapse in a few seconds after,

00:17:39.250-->00:17:47.667
if the video starts and then
you’ll see craziness go down.
Oh, hey it works. So, it’s going

00:17:47.667-->00:18:01.500
to collapse any second now, uh
[laughter] you see alderwood
just hit the ground and there he

00:18:01.500-->00:18:10.125
buys, basically there’s a riot
going on [laughter and applause]
there’s like people caging

00:18:10.125-->00:18:17.667
people in with like uh stone
walls [laughter] uh, it's kinda
like mutually assured

00:18:17.667-->00:18:23.250
destruction with no [laughter]
there’s like dead bodies down
here, horses [laughter], there’s

00:18:23.250-->00:18:36.167
a ghost running around up there
[laughter] anyway, you get the
point. [clears throat] um, since

00:18:36.167-->00:18:41.917
there’s huge housing demand, and
market forces are in play, uh
this is a quote from Richard

00:18:41.917-->00:18:46.917
Garriott, he created Ultima
Online and the Ultima series,
pretty interesting guy, uh he

00:18:46.917-->00:18:53.125
said that “after the game
launched, it wasn’t unusual to
see houses sell on ebay for, uh,

00:18:53.125-->00:19:01.000
ten thousand dollars.” I mean
you could get a house in Mexico
for that [laughter]. Which is

00:19:01.000-->00:19:07.583
probably nicer than the virtual
house that might collapse one
day and have a huge fight over

00:19:07.583-->00:19:15.667
it. Um, houses have features,
you can transfer ownership of a
house, you can change locks, uh

00:19:15.667-->00:19:28.000
you can demolish a house. And
then you have unintended
features, i.e. hex, [laughter].

00:19:28.000-->00:19:37.542
Soo to demolish a house, and
this was fixed a long time ago
in ninety nine, uh all you have

00:19:37.542-->00:19:43.583
to do is have one house on the
server, you open the house menu
and you select demolish and then

00:19:43.583-->00:19:49.708
you get like a confirmation
screen like do you really wanna
do this? Not really, so you

00:19:49.708-->00:19:53.917
don’t wanna confirm, cause you
don’t wanna demolish your own
house. So you send that

00:19:53.917-->00:20:10.292
[laughter] yeah [laughter]
[applause] So you send a crafted
packet with a house you want

00:20:10.292-->00:20:21.000
demolished and there house
demolishes [laughter]. So I took
this screenshot cause um I’d run

00:20:21.000-->00:20:26.042
around it like three o’clock in
the morning looking for houses
that are in danger of

00:20:26.042-->00:20:31.083
collapsing, cause you know I
didn’t want to delete somebody’s
house that was new or that they

00:20:31.083-->00:20:35.917
were using. So, I was looking
for houses that would normally
collapse, I’d go around early in

00:20:35.917-->00:20:42.833
the morning, uh and in this case
I found a huge tower uh that was
in danger of collapsing. So I

00:20:42.833-->00:20:49.250
was like sweet, so I deleted the
tower, I placed three small
houses in place, um and then

00:20:49.250-->00:21:01.500
this guy pops in and he’s like
“hey where’s my tower?”
[laughter] and I’m over here in

00:21:01.500-->00:21:07.000
the purple shirt and purple
pants [laughter] and I’m like I
don’t know what happened man

00:21:07.000-->00:21:15.542
[laughter]. [clears throat] so,
so I’m kinda just sitting around
and going hey how’s this gonna

00:21:15.542-->00:21:20.208
play out, this might be
interesting [laughter]. So,
after a few minutes like all of

00:21:20.208-->00:21:25.583
his buddies show up and their
like hey where’s the house?
[laughter] Like all my s**t was

00:21:25.583-->00:21:33.417
in your house and now it's all
gone [laughter]. So then the GM
pops in, uh, the first thing

00:21:33.417-->00:21:38.125
they do is uh the GM is over
here in the red robe, uh first
thing they do is swarm the GM

00:21:38.125-->00:21:44.542
cause they think the GM deleted
their house. [laughter, clears
throat] I’m like oh this is

00:21:44.542-->00:21:49.333
isn't going very well
[laughter]. So, So, I’m just
watching uh the GM’s getting

00:21:49.333-->00:21:56.167
swamped, probably having a bad
day, and then there’s the guy up
top he knows what’s up

00:21:56.167-->00:22:03.375
[laughter] he’s like either it
was GM’s or hackers and and
there I am just sitting

00:22:03.375-->00:22:15.542
innocently Ha [laughter]. Um,
yeah, so, since I’m not doing
the live demo, I have a few

00:22:15.542-->00:22:22.875
minutes to talk about what
happens next. So, in the Ultima
online, um, I made a lot of

00:22:22.875-->00:22:27.125
friends with like the GM’s and a
lot of people that were
counselors that help out with

00:22:27.125-->00:22:32.250
the game so I decided with my
friend that we you know we found
some hacks and were like we’ll

00:22:32.250-->00:22:39.375
help em out, we’ll the game has
so many bugs we’ll give em a few
bugs that we really don’t care

00:22:39.375-->00:22:46.208
about, you know just as an act
of good faith and so we shared
these exploits with them, the GM

00:22:46.208-->00:22:52.500
talked to us, um we kind of
developed a relationship where
we’d share information with the

00:22:52.500-->00:23:01.042
GM. Uh, so we found an exploit
where we could place houses
underground, which had

00:23:01.042-->00:23:07.375
interesting consequences cause
if you have a house underground
and somebody walks on the land

00:23:07.375-->00:23:11.583
above it, they’re invading your
house. So you could kill em
without repercussions

00:23:11.583-->00:23:23.792
[laughter]. Right, um, so we
disclosed this bug to a GM, uh
the GM got fired, cause they,

00:23:23.792-->00:23:31.458
the company thought the GM was
working with us, cause they’re
like how are these guys finding

00:23:31.458-->00:23:37.792
these bugs, you know they have
to have inside information. So
the GM gets fired, uh, uh I get

00:23:37.792-->00:23:42.458
banned ,my friend gets banned, a
bunch of ours get banned. So
we’re like alright, we tried to

00:23:42.458-->00:23:47.458
help you out, uh screw you guys
[laughter]. So we went around
and deleted houses on like all

00:23:47.458-->00:23:59.125
servers that Ultima online ran.
We deleted about probably five,
six hundred houses. We knew it

00:23:59.125-->00:24:05.125
wouldn’t be a bad thing cause we
know they have back ups. But, we
did this Sunday night, when

00:24:05.125-->00:24:09.417
nobody's working so, they'd come
in and hav- uh deal with a huge
headache on Monday morning. So

00:24:09.417-->00:24:14.333
what they did is you know they
acknowledged there was a housing
exploit, um, and rolled back the

00:24:14.333-->00:24:20.083
servers. I mean, it was a minor
inconvenience, but no harm no
foul I guess, but you know we

00:24:20.083-->00:24:26.250
moved on, we tried to be helpful
and they screwed us so we’re
like alright uh, we’ll say our

00:24:26.250-->00:24:34.000
farewell. Um, a lot of people do
hacking for profit, which is a
dangerous thing to do. Uh, when

00:24:34.000-->00:24:40.208
you do that, the first step is
you know reverse engineer the
game configure virtual tools

00:24:40.208-->00:24:49.750
find the exploit, profit, fill
player demand. Uh do it in a
ethical way, uh like we talked

00:24:49.750-->00:24:54.417
about during the disclosure,
once the exploit gets fixed
proceed to step one and find a

00:24:54.417-->00:25:00.917
new exploit. Uh, a lot of these
games have multiple exploits in
my experience, um, there's

00:25:00.917-->00:25:08.333
usually five or six exploits
that deal with increasing uh in
game currency or in game items.

00:25:08.333-->00:25:16.750
Uh, there’s also a gold rush
p-period where uh when a game
launches, there’s a lot more

00:25:16.750-->00:25:21.708
players playing, uh most of em
are level one being a level one
player in a MMORPG kinda sucks.

00:25:21.708-->00:25:27.167
Uh so there they want in game
currency to boost up their
character so it makes the

00:25:27.167-->00:25:34.208
leveling process easier. Here’s
your typical level one MMO
character [laughter] fighting to

00:25:34.208-->00:25:42.042
survive. Uh, as you level up, it
pretty much stays the same but
the crabs change color

00:25:42.042-->00:25:55.458
[laughter][applause] Um, but
yeah virtual currency is a valid
business model. Uh, there’s huge

00:25:55.458-->00:26:02.500
concern demand, there’s a lot of
farming going on, especially in
China where um,uh, uh wages are

00:26:02.500-->00:26:07.625
pretty low in two thousand and
five they were estimating that
there's a hundred thousand full

00:26:07.625-->00:26:12.542
time Chinese farmers. In two
thousand and nine they were
expecting you know close to a

00:26:12.542-->00:26:18.875
million. Uh, in two thousand and
nine the farming market, the
underground farming market was

00:26:18.875-->00:26:26.083
estimated to be two billion
dollars uh US. So who are the
main players in farming and

00:26:26.083-->00:26:34.000
hacking for profit? You have
casual hackers, uh, you have
professional hackers, who knows

00:26:34.000-->00:26:41.250
how many there are? And then you
have Nation States. Uh, North
Korea was caught using a team of

00:26:41.250-->00:26:50.542
hackers to infiltrate lineage
online in South Korea. Uh, they
caught thirty hackers that made

00:26:50.542-->00:26:56.375
six million dollars over two
years. They were busted and I
guess sent back to North Korea.

00:26:56.375-->00:27:06.417
Uh, yeah, that guy [laughter].
Uh, so the second game I was
involved in and hacked was The

00:27:06.417-->00:27:14.042
Dark Age of Camelot. Um, usually
in online games, characters are
saved every few minutes, uh

00:27:14.042-->00:27:18.833
never in real time cause that
would be too much stress on the
database. So they usually save

00:27:18.833-->00:27:23.750
em I think in The Dark Age of
Camelot they were saved every
five minutes and always when you

00:27:23.750-->00:27:30.917
log out. Uh, so when you log out
there's a sequence of packets
that happens, one of them is a

00:27:30.917-->00:27:36.208
B801 packet. If you send that
packet while you’re in game and
not doing the logout sequence,

00:27:36.208-->00:27:44.583
you disassociate your session
with the instance of your
character. So, the game doesn’t

00:27:44.583-->00:27:49.167
think you’re logged in even
though your character is logged
in. So, you can log in again and

00:27:49.167-->00:27:56.917
get a fresh copy of your
character from the database. So,
uh, here’s me logged in twice,

00:27:56.917-->00:28:03.750
and what you can do with this is
load up your inventory, uh wait
for a safe to happen, uh dump

00:28:03.750-->00:28:09.583
your inventory on a friend or on
the bank and do the B801 packet
where you can log in again and

00:28:09.583-->00:28:16.083
you have all the items that were
previously saved. So you can
duplicate the entire inventory

00:28:16.083-->00:28:23.917
of your character, including
your um gold. Uh, this exploit
worked up until two thousand ten

00:28:23.917-->00:28:29.417
I believe. [chuckles, laughter].
I mean, doesn’t surprise me
since these have that weird null

00:28:29.417-->00:28:37.958
terminating stream that’s
disclosing server memory. Um
Anarchy online is next, um you

00:28:37.958-->00:28:44.333
can see I have sixty-five
thousand strength, agility,
stamina and

00:28:44.333-->00:28:50.625
intelligence.[laughter]. Uh,
this was another integer
overflow bug that letcha have,

00:28:50.625-->00:28:59.042
get away with crazy things. Uh
Asheron’s Call 2, I only spent
like a month on that. Uh, I had

00:28:59.042-->00:29:04.375
a pretty lame bug, uh was an
instance crash by moving, so you
have your inventory and if you

00:29:04.375-->00:29:12.458
move something to an invalid
inventory slot like slay slot
negative one, uh the game server

00:29:12.458-->00:29:18.042
instance you're on would crash.
So what you do is you hand off
all of your stuff to a friend,

00:29:18.042-->00:29:23.167
your friend logs out, and then
you crash the instance that
you’re on and then you log in

00:29:23.167-->00:29:29.167
again with all your items, so
you duplicate whatever you want.
Um, Shadow Bane, that’s uh,

00:29:29.167-->00:29:36.625
thats a long story but I’ll keep
it brief. Uh Shadow Bane
developer said should we do an

00:29:36.625-->00:29:48.417
Alpha? Should we do a Beta? And
somebody said F**k it, let’s do
it live [laughter][applause].

00:29:48.417-->00:29:56.833
Uh, pretty much anything that
was a packet that Shadow Bane
had two exploits attached to it.

00:29:56.833-->00:30:01.917
So it was like an exponential
curve of exploits [laughter] and
like you could change the

00:30:01.917-->00:30:10.542
exploits and basically create
your own game. [laughter] Um,
you could like open up and loot

00:30:10.542-->00:30:17.458
other players bank accounts, uh
my favorite thing was I was
watching the incoming packets

00:30:17.458-->00:30:25.375
and I noticed that uh the
opcodes for stuff coming to the
client were the same as the ones

00:30:25.375-->00:30:31.417
going to the server. So I was
like what would happen if the
server notified you that you

00:30:31.417-->00:30:35.250
gained some experience, what
would happen if you sent that to
the server from the client

00:30:35.250-->00:30:48.208
[laughter]. Well, it turns out
you get massive quick leveling
so [laughter] So here I am just

00:30:48.208-->00:30:55.458
spamming uh in experience gain
packets to the server and it's
just leveling me up. Each time

00:30:55.458-->00:31:00.375
you level up like puts up a cone
of lights above your head and
yeah it was pretty interesting

00:31:00.375-->00:31:05.083
to watch. So I got like a
hundred and twenty two levels
within a few seconds [laughter].

00:31:05.083-->00:31:12.667
Which you’d think would flag
somewhere but they never banned
me for that one. [laughter] Uh,

00:31:12.667-->00:31:26.958
Lineage two, so lineage two you
could interact with a vendor,
you could uh buy items, uh when

00:31:26.958-->00:31:33.708
you buy items you send an op
code, an item type an item list
slot that the vendor was

00:31:33.708-->00:31:39.375
displaying it in, and the item
price. Uh you could change the
item type to buy any item in

00:31:39.375-->00:31:44.167
game for whatever price you
wanted,[laughter] even the stuff
that wasn’t supposed to be

00:31:44.167-->00:31:50.667
purchased in game like GM
equipment, GM armor and stuff
like that. Same thing for

00:31:50.667-->00:31:59.708
selling, uh you could sell a
stick and say it was like a
level fifty epic sword and you

00:31:59.708-->00:32:09.458
know get massive gold for a
stick. Uh, Final Fantasy online,
uh was an interesting one, uh

00:32:09.458-->00:32:15.000
anywhere they dealt with
integers, you could overflow
them, so there were exploits in

00:32:15.000-->00:32:20.458
player trading, splitting
stacks, uh auction house
purchases, vendor purchases,

00:32:20.458-->00:32:30.792
vendor sales, there were about
six or seven. Uh, World of
Warcraft, so World of Warcraft

00:32:30.792-->00:32:34.833
had talent trees, so as you
leveled up you could boost
yourself and certain aspects of

00:32:34.833-->00:32:41.458
your class. Um, one exploit I
kinda found by accident, I was
just trying to figure out how

00:32:41.458-->00:32:47.750
the talentrise worked and then I
noticed something weird going
on, uh I could increase my

00:32:47.750-->00:32:53.208
talents beyond the maximum
allowed value. Normally, you’re
supposed to have five out of

00:32:53.208-->00:32:58.708
five points maximum, I found the
way to increase that to like
fifteen out of five so you

00:32:58.708-->00:33:05.583
tripled the effect. So you could
create insanely powerful
characters in World of Warcraft,

00:33:05.583-->00:33:11.667
like for instance of uh Elf
Hunter, you could boost your
critical strike chance to

00:33:11.667-->00:33:19.125
eighteen percent instead of a
legit six. Where’s the second
packet? That’s weird, anyway, um

00:33:19.125-->00:33:23.042
so to be honest, I don’t
remember exactly how this
worked, this was like eleven

00:33:23.042-->00:33:33.333
years ago, but basically, uh you
sent a talent increase packet
and then you followed up with a

00:33:33.333-->00:33:39.958
lowering poll being filled when
with one switch at zero F and
then that would max out uh

00:33:39.958-->00:33:46.333
whatever skill you’re targeting.
Um, so I hooked up my friends
with this exploit, and we were

00:33:46.333-->00:33:51.708
running molten core I think
molten core is a 20 or 40 person
dungeon, and we were doing it

00:33:51.708-->00:33:59.208
with 8 people [laughter]. Um, uh
this worked for like a year
until we kinda got over zealous

00:33:59.208-->00:34:04.708
and started doin- started taking
it to PVP and like killing
people in one hit and stuff like

00:34:04.708-->00:34:11.250
that, uh players and the GMs
didn’t take too kindly on that
so uh like a bunch of us got

00:34:11.250-->00:34:19.958
banned. [laughter] Which is
pretty typical, um [laughter]
it’s kinda like groundhog day,

00:34:19.958-->00:34:23.833
it’s like you play a game, you
find the same exploits, you get
banned and then you move on to

00:34:23.833-->00:34:30.250
the next game [clears throat].
So, Lord of the Rings online, uh
it was similar to Lineage 2

00:34:30.250-->00:34:35.792
where you could sell and yen to
a vendor and say it's something
else. So you could sell a rock

00:34:35.792-->00:34:42.708
to a vendor and say it's a
diamond and make mass profit.
Uh, Rift online, Rift online

00:34:42.708-->00:34:51.250
gets a gold star for anti
reverse engineering technology.
Uh, they would patch biweekly

00:34:51.250-->00:34:59.917
usually like uh twice a week, uh
they would modify the layout of
their functions, so if you had

00:34:59.917-->00:35:04.708
like an area that you’re
interested in and they patched,
suddenly that area is in a

00:35:04.708-->00:35:09.792
totally different part of the
program so you kinda got to
start all over. Um, [clears

00:35:09.792-->00:35:14.042
throat] each patch was pre
obfuscated before it went to
encryption and this obfuscation

00:35:14.042-->00:35:20.792
happened in a different thread.
Um, so you have a packet that
gets its op code encrypted or

00:35:20.792-->00:35:25.667
obfuscated uh any data types
that are in that packet get
obfuscated in different threads

00:35:25.667-->00:35:35.208
and then it gets sent to
encryption. [clears throat] So,
to find a good spot to hook into

00:35:35.208-->00:35:41.958
Rift where you can view all the
packets you’d have to track
down, you know uh the routines

00:35:41.958-->00:35:49.417
for all 300 packets and then
hook em all which is not really
realistic. Uh, but they did make

00:35:49.417-->00:35:56.750
one mistake, they didn’t endline
their obfuscation routine so any
obfuscation they did came in

00:35:56.750-->00:36:04.417
through a common point, so,
doing some tricky hacky stuff uh
by hooking the obfuscation

00:36:04.417-->00:36:11.667
routines uh you could rebuild
the entire packet and then you
know have your way with it. Uh,

00:36:11.667-->00:36:20.083
like Final Fantasy online,
everything that Rift did with an
integer had an overflow bug in

00:36:20.083-->00:36:30.333
it. Uh trading, banking,
inventory, and vendors. Uh
here’s an example of so it says

00:36:30.333-->00:36:36.292
zero silver withdrawn from the
guild bank but then it says you
receive 400 platinum. Uh, What I

00:36:36.292-->00:36:42.750
did is I told the game to give
me negative 400 platinum. So the
message says your silver

00:36:42.750-->00:36:48.125
withdrawn cause it didn’t know
how to display negative 400 I
guess and then it just gave me

00:36:48.125-->00:36:56.208
400 platinum s- why not?
[chuckle, laughter]. Uh Age of
Conan, this one was interesting,

00:36:56.208-->00:37:01.917
uh there was a trade window
exploit, uh so if you're playing
or uh trading with another

00:37:01.917-->00:37:10.042
player uh you could give em an
item and so let's say you give
em like an awesome sword and you

00:37:10.042-->00:37:15.125
put it into slot 1 of the trade
window and then you could send
the packet to si-uh- you could

00:37:15.125-->00:37:19.583
send the packet to put that same
sword into slot 2 of the trade
window, so they would see 2

00:37:19.583-->00:37:26.292
swords, that are linked to 1
sword in your inventory. So you
could load up somebody’s

00:37:26.292-->00:37:32.292
inventory,uh I mean uh the trade
window with a bunch of epic
swords, even though you only

00:37:32.292-->00:37:39.583
have one and when the other
player accepts it, they get all
the swords you promised to give

00:37:39.583-->00:37:44.667
them even though you only had
one. So that’s, that was a way
of duplicating any item in Age

00:37:44.667-->00:37:54.208
of Conan. Uh, Darkfall Unholy
Wars um they had an interesting
client was made in Java, it take

00:37:54.208-->00:38:03.500
li-it took like 3 minutes to
load, um, uh, I didn’t like that
game [chuckles][laughter].

00:38:03.500-->00:38:09.458
Anyway, but there was a vendor
exploit in that one um this
wasn’t an integer overflow, it

00:38:09.458-->00:38:13.792
was more of a logic error, so
when you sell to a vendor you
send the operation type, the

00:38:13.792-->00:38:18.625
vendor ID the number of items
you're selling cause uh you can
sell items in bulk or batches

00:38:18.625-->00:38:25.792
and then you do a list of items
followed by a null item. [clears
throat] So, kind of like Age of

00:38:25.792-->00:38:31.333
Conan, you could send, you could
sell the same item as many times
as you wanted. And I think the

00:38:31.333-->00:38:37.667
maximum packet size was 16-->000
bytes. Um, So, and the item ID
was about 8 bytes so you could

00:38:37.667-->00:38:47.625
sell the same item a few
thousand times. Uh, Star Wars
Old Republic online, uh this is

00:38:47.625-->00:38:52.583
one of my ff kind of my
favorites cause this was super
easy uh you could delete items

00:38:52.583-->00:39:00.542
from your inventory, um so it
would look like an op code uh
the inventory slot you’re

00:39:00.542-->00:39:06.083
deleting from and the number of
items to delete uh so no
surprise that you could say I

00:39:06.083-->00:39:12.250
want to delete negative one
item. So, the game goes to
subtract negative one from your

00:39:12.250-->00:39:17.833
item and then you subtract a
negative from a negative and
then you get a positive so you

00:39:17.833-->00:39:32.292
increase whatever you have by
any amount you wish. Uhhh let’s
see So, Guild Wars 2 had two

00:39:32.292-->00:39:38.583
auction house exploits, uh one
of em was an integer overflow,
where you could buy stuff for

00:39:38.583-->00:39:43.125
free, uh however, when you’re
buying stuff for free, the
player that listed these items

00:39:43.125-->00:39:47.917
gets the full amount of uh the
transaction amount. So if they
were selling something for

00:39:47.917-->00:39:53.708
10-->000 gold uh you’d glitch the
game to buy it for free, the
other player would get 10-->000

00:39:53.708-->00:40:01.125
gold. And also, the second
exploit throws an oddity when
buying multiple items. Um, you

00:40:01.125-->00:40:09.333
could buy one item legit, and
the rest of the items you could
buy for a single copper. Again,

00:40:09.333-->00:40:21.125
the player selling these items
would get the full amount. Um,
I’ll skip over that, actually no

00:40:21.125-->00:40:29.333
I won’t. Um, so when doing the
overflow exploit to buy stuff
for free uh there’s you you

00:40:29.333-->00:40:33.583
basicall- there was a web
interface you basically send uh
the number of items you want to

00:40:33.583-->00:40:37.792
buy and the price you want to
buy it for, uh if you notice the
price has a leading zero on it

00:40:37.792-->00:40:43.917
and that's pretty important for
an interesting reason uh the
price for this exploit to work

00:40:43.917-->00:40:50.875
must have a leading zero uh
server side its 3000 oxel and
coding uh typically in Guild of

00:40:50.875-->00:40:57.042
Wars 2 you’re not allowed to bid
for more than 10-->000 gold I
think but if you encode it as an

00:40:57.042-->00:41:10.250
oxel you can bid as much as you
want. Um, so if you bid for that
much its uh its uh 1/4th of the

00:41:10.250-->00:41:16.333
maximum 64 bit value, so if you
buy 4 items uh the price comes
out to be 4 copper because you

00:41:16.333-->00:41:25.500
ov- overflow of 64 bit register.
Um the second exploit is so it's
a little messy but here’s the

00:41:25.500-->00:41:31.708
gist of it, um essentially
there’s a feature where you can
buy multiple items and multiple

00:41:31.708-->00:41:36.542
price ranges so you could buy a
hat for 5 copper, a hat for 6
copper, a hat for 7 copper and a

00:41:36.542-->00:41:41.167
hat for 8 copper. But what if
you told the server that you
want to buy a hat for 5 copper

00:41:41.167-->00:41:54.083
and the other 3 hats you want to
buy for 1 copper, well it works.
Uh, not sure if I should show

00:41:54.083-->00:42:08.417
the video [applause] [laughter].
Oh, it's cause it got moved to
the memory stick uh hold on, I

00:42:08.417-->00:42:25.000
got this. Alright, uh so this is
the second exploit in action
where you’re buying one item

00:42:25.000-->00:42:30.917
legit and you’re buying the
other items for a single copper,
so what I’m doing is listing 4

00:42:30.917-->00:42:36.917
items, I’m buying, so I’m
listing these items myself, I’m
buying the first one legit and

00:42:36.917-->00:42:45.458
I’m buying the other 3 for a
single copper. But I get the
full amount for all four. So, uh

00:42:45.458-->00:42:55.667
I’m generating like mass amounts
of gold in just a few minutes, I
think I create 15-->000 gold in

00:42:55.667-->00:43:01.208
like 10 minutes, just by
automating this exploit, which
is pretty cool if you wanna you

00:43:01.208-->00:43:23.542
know buy uh some items in game.
Let’s see where were we? Um,
Elder Scrolls online, I will not

00:43:23.542-->00:43:34.750
talk about that [chuckles]
[laughter] yeah, close your eyes
uh ESO does have multiple

00:43:34.750-->00:43:42.375
integer overflows I’ll say that
uh and I will say that they use
the same code base on PC, PS4

00:43:42.375-->00:43:50.542
and Xbox so uh the exploits in
that game work on consoles too.
Uh and it's not video time

00:43:50.542-->00:44:02.250
[laughter] Oh Final Fantasy 14
um so they use the same code
base as Final Fantasy uh 11,

00:44:02.250-->00:44:07.458
before they put in the fixes
[laughter] so they had Final
Fantasy 11, they had all these

00:44:07.458-->00:44:10.792
exploits, they fixed all these
exploits and they launch a
sequel which has all the same

00:44:10.792-->00:44:22.167
exploits again [laughter]. Yeah
hahaha. And also they had an
exploit where you separate the

00:44:22.167-->00:44:28.875
stack into two separate pieces,
and there was a-a integer
overflow in that. Um it was

00:44:28.875-->00:44:33.125
basically an opcode with the
source slot, the destination
slot and the quantity of items

00:44:33.125-->00:44:38.958
you want to split and as you can
see if you overflow it you can
create 2 billion silencing

00:44:38.958-->00:44:50.458
potions or 2 billion of whatever
you want. [laughter] Yeah, so we
were gonna do a live demo but uh

00:44:50.458-->00:45:05.208
>>Do it, Do it, just do it
[applause][whistling] [presenter
clears throat] show me what

00:45:05.208-->00:45:14.125
you've got >>Yeah hahahahaha
[applause] So, I mean I could
pass my hat around for a legal

00:45:14.125-->00:45:23.417
fund and if we raise a couple
hundred grand
[laughter][inaudible audience

00:45:23.417-->00:45:29.625
talk][laughter] I mean it's only
200 bitcoins, I mean you guys
can spare some bitcoins right?

00:45:29.625-->00:45:35.875
But uh yeah we’ll stop here uh
do you guys have any questions?
>>Boo >>Boo hahah [laughter]

00:45:35.875-->00:00:00.000
welp that's it [applause].
Alright, thank you [applause]