1
00:00:05,050 --> 00:00:08,910
It's like somebody else already has control over the stream.

2
00:00:09,990 --> 00:00:11,290
Oh, there it went.

3
00:00:11,290 --> 00:00:14,530
Now it's still doing the thing.

4
00:00:17,860 --> 00:00:19,360
And there we are.

5
00:00:19,360 --> 00:00:20,780
And there we are.

6
00:00:20,780 --> 00:00:21,520
All right.

7
00:00:21,520 --> 00:00:22,860
Welcome back.

8
00:00:22,860 --> 00:00:24,720
So we have another session.

9
00:00:24,720 --> 00:00:28,700
This time is going to be with our friend here, Jack Baker.

10
00:00:28,700 --> 00:00:29,400
Welcome, Jack.

11
00:00:30,080 --> 00:00:30,940
Thank you.

12
00:00:30,940 --> 00:00:31,960
Glad to be here.

13
00:00:31,980 --> 00:00:32,720
All right.

14
00:00:32,720 --> 00:00:34,180
And also we've got Fallible here as well.

15
00:00:34,180 --> 00:00:34,980
Hey, Fallible.

16
00:00:35,140 --> 00:00:36,000
Hello.

17
00:00:36,000 --> 00:00:46,100
So Jack was going to tell us a little bit, at least he did tell us a little bit in his presentation, about how he kind of attacked game servers.

18
00:00:46,420 --> 00:01:00,260
Jack, do you want to kind of give a little bit of an introduction of yourself and just kind of a super brief overview of your talk so that other people might get more interested in it as well, on top of some of the other questions that we're already seeing in the TrackOne Live QA channel?

19
00:01:01,060 --> 00:01:02,360
Yeah, for sure.

20
00:01:02,360 --> 00:01:04,660
So my name is Jack Baker.

21
00:01:04,660 --> 00:01:07,960
I don't have much of a background to talk about.

22
00:01:08,220 --> 00:01:10,760
This is my second time speaking at DEF CON.

23
00:01:10,760 --> 00:01:13,560
Both times have been about hacking video games.

24
00:01:14,120 --> 00:01:20,380
And for my talk this year, it was basically about finding bugs in game engines.

25
00:01:20,380 --> 00:01:32,780
So basically looking at the core software that you build video games on with the hope that finding bugs in the engine means finding bugs in a thousand different games, basically amplifying that effort.

26
00:01:32,780 --> 00:01:44,900
So I had a reasonable amount of luck looking at Unreal Engine 4 from Epic Games and UNet, the core networking protocol of Unity.

27
00:01:45,200 --> 00:01:48,020
And I talk about four of those bugs.

28
00:01:48,920 --> 00:01:54,460
And I give some POCs, typical DEF CON stuff, I guess.

29
00:01:54,460 --> 00:01:57,140
Yeah, it was all pretty awesome stuff in there.

30
00:01:57,140 --> 00:02:00,840
Falvo, do we have any questions coming in yet for Jack?

31
00:02:00,840 --> 00:02:03,240
We have a very first question over here.

32
00:02:03,240 --> 00:02:03,820
I like this one.

33
00:02:03,820 --> 00:02:05,760
This is from Hawkeye Dank.

34
00:02:06,480 --> 00:02:16,940
Do you believe that most game servers slash developers are heading towards a zero-trust architecture for newer games in order to better protect the game servers?

35
00:02:17,960 --> 00:02:19,660
That is a good question.

36
00:02:19,660 --> 00:02:23,180
So I would actually argue that to some extent that has already been done.

37
00:02:23,180 --> 00:02:36,640
If I were to go back a bunch to when I was a teenager trying to learn to hack video games, I remember that there was sort of this philosophy that the only online game you really couldn't hack was RuneScape.

38
00:02:36,640 --> 00:02:45,640
And the reason for that is RuneScape is about as close as you'll get to just a pure thin client in a big video game.

39
00:02:45,640 --> 00:02:54,740
And so you couldn't really manipulate the client to do things like teleport or whatever because it was just basically just button presses.

40
00:02:54,740 --> 00:03:03,000
In that case, though, people still managed to quote-unquote hack RuneScape, but it was in the form of logical bugs.

41
00:03:03,000 --> 00:03:06,860
It wasn't trust being placed on the client.

42
00:03:06,920 --> 00:03:19,120
So to answer that question, I think that you absolutely can make a zero-trust game engine as is, but you're balancing performance and security.

43
00:03:19,120 --> 00:03:30,280
And if you go too far on the security side, you end up with a game like RuneScape, which is very low, very slow, with not a whole lot going on.

44
00:03:30,280 --> 00:03:39,120
It's very difficult to apply that to something like, I don't know, Fortnite, where you've got a thousand, no, I guess a hundred people shooting guns.

45
00:03:39,120 --> 00:03:40,860
You've got all this math going on.

46
00:03:40,860 --> 00:03:43,520
It's just a different scale of a problem.

47
00:03:43,520 --> 00:03:47,120
But we're getting much better at it.

48
00:03:47,120 --> 00:03:51,640
Game engines have gotten significantly better at taking that trust away.

49
00:03:51,640 --> 00:04:09,660
So yeah, I think that's where things are going to keep moving, is taking that trust away and finding clever ways to make servers that can still handle a first-person shooter, still handle Fortnite, but don't have to put trust on the client to do that.

50
00:04:09,660 --> 00:04:24,020
And from the perspective of game hackers, hacking will just become more of a process of finding logical bugs, rather than doing what we typically do now, which is exploiting those trust relationships.

51
00:04:24,360 --> 00:04:26,220
Well, that's interesting.

52
00:04:26,220 --> 00:04:31,760
So a slightly different angle of a question coming from Blackfoot over here.

53
00:04:32,040 --> 00:04:36,600
Why do you think there is so little security knowledge share between game companies?

54
00:04:36,600 --> 00:04:42,420
Example, little documentation and hardening of UE4 dedicated servers.

55
00:04:44,540 --> 00:04:46,140
That's a pretty good question.

56
00:04:46,140 --> 00:04:58,500
If I had to guess, it would just be because game engines are such big pieces of software that when you develop your own game engine, you're sort of going to try to hold it close to your chest.

57
00:04:58,500 --> 00:05:08,120
You don't really want to give your competitors a competing game engine the keys to the kingdom, so to speak.

58
00:05:08,120 --> 00:05:11,860
So architecturally, most game engines are built from the ground up.

59
00:05:11,860 --> 00:05:20,860
There's not a lot of shared code, and that's just because it's a big investment and no one wants to share that.

60
00:05:20,880 --> 00:05:30,720
It's sort of a boring business answer, I think, but it's really just Unreal and Unity and whoever else don't want to share their work with each other.

61
00:05:31,200 --> 00:05:38,740
So in your presentation, one of the things that you were showing was kind of like the teleporting and the fast running.

62
00:05:38,800 --> 00:05:48,840
I remember at one point in there, you're just kind of showing somebody running at the normal speed and then the exploit that you were able to find where somebody's zipping across the screen.

63
00:05:48,980 --> 00:05:54,520
In addition to running, do you think there are other things that people could use that kind of thing for?

64
00:05:54,520 --> 00:05:57,500
Maybe be able to shoot faster, shoot more?

65
00:05:57,800 --> 00:06:03,080
Maybe what other kind of things have you thought of that somebody could use that type of exploit for in their games?

66
00:06:03,660 --> 00:06:04,780
Yeah, absolutely.

67
00:06:04,780 --> 00:06:10,440
So with that particular bug, I found what I think is really interesting.

68
00:06:10,440 --> 00:06:22,100
It's basically a bug where you can use the unique properties of some special floating point values to basically confuse the server into doing something it shouldn't.

69
00:06:22,100 --> 00:06:29,660
And so I have actually tried basically that exact technique on other games, other commands and stuff like that.

70
00:06:29,660 --> 00:06:34,020
And you can usually get something unpredictable to happen.

71
00:06:34,020 --> 00:06:37,440
I think I mentioned in my talk, a lot of times it's not a good thing.

72
00:06:37,440 --> 00:06:43,120
A lot of times you're just harming yourself, but you can usually cause the game to do something it shouldn't.

73
00:06:43,300 --> 00:07:01,440
And so, yeah, I think these logical bugs, especially like mathematical bugs, if you can find those, are a really good way to exploit games because while the bugs aren't the most common, they are very predictable.

74
00:07:01,440 --> 00:07:07,920
They're not a memory corruption bug where you have to worry about layout of the memory and all those complicated things.

75
00:07:07,920 --> 00:07:16,800
And they tend to, I guess, slip by the architectural protection.

76
00:07:16,800 --> 00:07:23,580
So in that case, like the bug you talked about, Unreal Engine has a pretty robust way to prevent speed hacking.

77
00:07:24,100 --> 00:07:34,500
And using just a couple quirks of, basically, quirks of decimal numbers, you can cause it to do something it shouldn't.

78
00:07:34,500 --> 00:07:36,780
And that is super useful.

79
00:07:36,780 --> 00:07:42,340
So that particular kind of bug, I'd say, yes, definitely applies in other places.

80
00:07:42,460 --> 00:07:45,840
It's just a matter of looking for it.

81
00:07:45,860 --> 00:07:49,180
And I guess that's it.

82
00:07:49,180 --> 00:07:51,200
I don't know how I was going to end that sentence.

83
00:07:51,240 --> 00:08:00,360
No, I really liked what you showed there, especially the things that we find in other places across security and other types of hacking.

84
00:08:00,360 --> 00:08:03,100
You go, well, okay, let's divide by zero.

85
00:08:03,100 --> 00:08:04,520
Let's use not a number.

86
00:08:04,520 --> 00:08:15,420
Let's use these things that are the outsides of this language that's being used and see what happens when you throw it at the system.

87
00:08:15,420 --> 00:08:23,520
And it's just nice to see, in the niche that you found yourself in, a lot of the same techniques work.

88
00:08:24,280 --> 00:08:36,020
Yeah, I guess one other thing I like about that bug is that it's not something that's fixed by, say, oh, we're going to stop writing things in C and start writing them in Go or Rust or something.

89
00:08:36,020 --> 00:08:42,480
These are bugs that still exist even in, quote-unquote, safe languages.

90
00:08:42,500 --> 00:08:49,340
And I think in more than just video games, that's where this sort of exploitation is going.

91
00:08:49,340 --> 00:08:51,980
And that's why I like that bug so much.

92
00:08:53,140 --> 00:08:56,560
All right, so Hawkeye has another question for you.

93
00:08:56,560 --> 00:09:03,620
He asks, have you noticed any new trends of input validation in high-user games like Fortnite?

94
00:09:04,460 --> 00:09:30,340
Yeah, I mean, I keep going back to the same example, but Unreal Engine 4 uses a really, really robust system for validating user input and specifically user movement in a way that scales really well, but also basically eliminates your ability to manipulate your movement in any significant way.

95
00:09:30,340 --> 00:09:49,360
And so essentially the broad strokes are basically taking authority over your character's location, putting it on the server, and giving the client the possibility to call functions in order to request that you move.

96
00:09:49,360 --> 00:09:54,680
And that way, the server has the context to say, well, you're trying to move too fast.

97
00:09:55,760 --> 00:09:57,400
I'm not going to allow that.

98
00:09:57,400 --> 00:10:01,200
I'm going to limit movement to a specific range.

99
00:10:01,200 --> 00:10:15,320
And so really, I think the entirety of evolutions in the security of game engines recently has just been on giving more context to the server so we can say, well, that's not right.

100
00:10:15,320 --> 00:10:22,000
I'm going to stop that from happening and ensuring that the client doesn't have the trust to just overrule the server.

101
00:10:22,000 --> 00:10:35,820
I can't remember whether you said in your presentation if you've talked to the engine companies about these vulnerabilities and if they have fixed the exploits that you found.

102
00:10:35,820 --> 00:10:46,860
But if they do see somebody trying to send like your NAN, not a number, at the server, what types of things would you think that they should do to that?

103
00:10:46,860 --> 00:10:49,300
Should they kind of just adjust or ban?

104
00:10:49,300 --> 00:10:52,420
What are your thoughts for how people could...

105
00:10:52,420 --> 00:10:53,880
what should happen to them?

106
00:10:54,300 --> 00:10:59,380
Yeah, so three of the four bugs I talk about are fixed.

107
00:11:00,540 --> 00:11:06,000
And the speed hack one, the NAN one, was one of those.

108
00:11:06,000 --> 00:11:07,580
It was actually a pretty easy fix.

109
00:11:07,580 --> 00:11:12,520
They just put a tiny little check in there that says if this is NAN, just abort, get out of there.

110
00:11:12,640 --> 00:11:19,060
But in general, I would say what they should...

111
00:11:20,040 --> 00:11:34,980
I would recommend possibly that if you're a game engine developer or you're working on Unreal and you think, oh, this could be a problem, it's not unreasonable to just say you shouldn't be able to use NAN in any argument.

112
00:11:34,980 --> 00:11:38,040
That's not going to happen under normal circumstances.

113
00:11:38,280 --> 00:11:44,260
And just essentially eliminate that from the serialization and deserialization process.

114
00:11:44,260 --> 00:11:48,780
Unreal doesn't do that because it wants to consider itself sort of impartial to that.

115
00:11:48,780 --> 00:11:53,640
Whatever goes in one end is deserialized on the other end.

116
00:11:54,000 --> 00:12:06,280
But I think it would be a pretty reasonable assumption to say if you're getting certain types of, say, floating point numbers, this is blatantly invalid.

117
00:12:06,280 --> 00:12:10,080
And we can probably just toss it out before we even consider anything else.

118
00:12:11,320 --> 00:12:15,780
Just a general input validation on what's coming in.

119
00:12:15,880 --> 00:12:17,720
Typical boring stuff.

120
00:12:18,560 --> 00:12:20,480
Isn't it that way?

121
00:12:20,540 --> 00:12:39,060
Well, so I don't really want to give away the punchline to your presentation because it fits so well, but we'll just kind of hand wave that and say, so when you've been doing this, how often do you get booted from whatever game you're playing?

122
00:12:39,060 --> 00:12:42,760
Or how many times have you had your accounts banned?

123
00:12:43,920 --> 00:12:48,820
When you're building your own stuff, you get banned less than you might expect.

124
00:12:48,820 --> 00:12:53,260
I did a talk last year on hacking, basically, browser games.

125
00:12:53,300 --> 00:12:58,440
And for one of the demonstrations, I took a game.

126
00:12:58,440 --> 00:12:59,580
I don't want to say its name.

127
00:12:59,580 --> 00:13:01,260
I've done enough to them.

128
00:13:01,560 --> 00:13:12,780
But I took this game and it has a global scoreboard and I just set my score to 1, 3, 3, 3, 3, 3, 3, 3, something, 7, and username to HiDefCon.

129
00:13:12,780 --> 00:13:14,600
And they banned me pretty quickly.

130
00:13:14,600 --> 00:13:16,760
I think that was pretty obvious.

131
00:13:16,840 --> 00:13:23,240
But in general, if you're building your own game hacks, there is a pretty good chance you're going to get away with it.

132
00:13:23,240 --> 00:13:25,520
So I get banned pretty rarely.

133
00:13:28,100 --> 00:13:30,620
So congratulations or I'm sorry.

134
00:13:30,940 --> 00:13:32,940
However you feel about that.

135
00:13:33,160 --> 00:13:34,540
It's a mixed bag.

136
00:13:35,560 --> 00:13:52,720
Where do you also often kind of see the line here along the same, I guess similar to what Fallible was just talking about, where the old question about research versus going over the line, because essentially you are affecting other users, potentially,

137
00:13:53,260 --> 00:13:54,960
as well as that game engine.

138
00:13:54,960 --> 00:13:59,300
So where is kind of your line on how far you'll go with your research?

139
00:13:59,360 --> 00:14:03,620
Or is it because it's in the name of research, you'll just go all the way with it?

140
00:14:03,620 --> 00:14:12,540
I mean, I won't do anything that's, I think, directly affecting someone spending money or someone or anything like that.

141
00:14:12,540 --> 00:14:15,860
I'm not stealing items from people in online games.

142
00:14:15,860 --> 00:14:17,660
That certainly crosses the line.

143
00:14:17,660 --> 00:14:28,720
But, you know, if someone's in a lobby of a first person shooter and someone wall hacks through and, you know, no scopes them in the head, I don't think they've been significantly harmed in any way.

144
00:14:28,720 --> 00:14:34,980
So I think that is within moral bounds for me.

145
00:14:34,980 --> 00:14:36,000
Excellent.

146
00:14:38,200 --> 00:14:46,360
Can you explain some of the technical setup that you have in order to capture the data that you're sending across?

147
00:14:46,360 --> 00:14:48,360
And what tools are you using?

148
00:14:48,360 --> 00:14:50,440
What's your lab look like?

149
00:14:50,440 --> 00:15:05,920
Yeah, so working with Unreal Engine especially, I needed to actually buy a new desktop to do because on the laptop I was working on, it took most of the day to compile Unreal from source.

150
00:15:05,920 --> 00:15:09,660
And I was doing that several times a day.

151
00:15:09,660 --> 00:15:13,660
So that was not good math working out there.

152
00:15:13,660 --> 00:15:22,780
So essentially, I do all of my Unreal development on Linux, which is a little less supported, but it's just more comfortable for me.

153
00:15:22,780 --> 00:15:39,340
And the other, I guess the other thing that's really a challenge is the specifically Unreal source is so big that trying to open it in most like project editors is, it does not work.

154
00:15:39,340 --> 00:15:55,520
VS code gets by just a little bit, but even then it gets tripped up when you try to go to this function or something like that, it'll end up, it'll spin its wheels for five minutes and say, yeah, couldn't find it, even though you know it exists.

155
00:15:55,520 --> 00:15:58,700
So I wish I had a better setup.

156
00:15:58,700 --> 00:16:05,060
I'm sure people who do actual video game development have better experiences with building Unreal from source.

157
00:16:05,060 --> 00:16:21,160
But I guess my lab is just, it's a system 76 desktop with the highest boxes checked on everything, just so that I can compile Unreal as many times as I want and it doesn't take me all day.

158
00:16:22,600 --> 00:16:28,960
So in that way, you're looking at the guts of the code, you're really building it each time.

159
00:16:28,960 --> 00:16:35,840
It's not a situation of you're just capturing everything in Wireshark and modifying it somehow.

160
00:16:36,400 --> 00:16:39,440
No, I wish it was a little easier.

161
00:16:39,440 --> 00:16:45,960
With Unet, you can get away with just looking at the traffic in Wireshark.

162
00:16:45,960 --> 00:16:55,080
Unreal is pretty difficult because everything is like bit aligned, so you'll have a string that starts four bits in and just looks like gibberish.

163
00:16:55,120 --> 00:16:59,840
So you really do have to be looking at it at the low level to really make any sense of it.

164
00:17:01,020 --> 00:17:02,320
That makes sense.

165
00:17:02,320 --> 00:17:05,440
And how does somebody get started with that kind of thing?

166
00:17:05,440 --> 00:17:09,520
Because this sounds extremely technical and you have to know quite a bit.

167
00:17:09,560 --> 00:17:21,060
How does somebody, where would be the entry point if somebody was interested in this kind of research in order to start figuring these kinds of things out, or if they wanted to just even look at how games work?

168
00:17:21,640 --> 00:17:36,200
Yeah, well, I mean, all the code is out there for Unreal Engine, but I don't think that's something you should just jump straight into, especially if you're not pretty familiar with C++, because it is a complicated code base.

169
00:17:36,200 --> 00:17:43,300
I think the best thing you can do to understand hacking video games is to build them.

170
00:17:43,400 --> 00:17:49,500
It's sort of a, I don't know, cliche answer, but that is what teaches you, oh, this is how that works.

171
00:17:49,500 --> 00:17:50,740
This is how I'd write it.

172
00:17:50,740 --> 00:17:55,420
This is probably how it looks on the back end.

173
00:17:55,540 --> 00:18:12,680
Also, I would say if you're going to look at games written in a particular engine, Unity games are pretty good because they're usually built, well, they're built with C Sharp and they're typically easy to decompile back to C Sharp with something like DN Spy,

174
00:18:12,680 --> 00:18:14,720
if I'm pronouncing that correctly.

175
00:18:14,720 --> 00:18:16,320
However, that's verbalized.

176
00:18:16,320 --> 00:18:30,920
So you can actually look at the code of the game, modify it, see what happens, and basically hack games without too much actual binary reverse engineering or anything like that.

177
00:18:31,620 --> 00:18:40,200
So we got a question from Jay that I'm going to obscure this a little bit.

178
00:18:40,200 --> 00:18:50,420
The question is way too specific, so let's go more along the lines of where else would be interesting to look?

179
00:18:50,420 --> 00:19:02,340
If you were done with the research that you've done so far and you were looking for a new product, what would be the things that would draw you to a new product?

180
00:19:03,900 --> 00:19:14,360
Yeah, so one thing I would say is that when you look at Unity, there are a lot of different multiplayer solutions.

181
00:19:14,360 --> 00:19:22,460
So I looked at UNet, which is sort of the... it's provided by Unity, but there are third-party solutions that are pretty common.

182
00:19:22,820 --> 00:19:31,320
Photon, Mirror, I haven't looked at those at all, and I think that there's a pretty solid chance that the same kind of bugs apply there.

183
00:19:31,460 --> 00:19:42,160
And then I think most of the research I did, obviously I'm just looking at the core engines for games, but looking at specific games, you can find these exact same bugs.

184
00:19:42,160 --> 00:19:46,880
They just may not apply to other games.

185
00:19:46,880 --> 00:19:49,180
So I think most of this research still applies.

186
00:19:49,180 --> 00:19:55,980
It just needs to be targeted either at different games or different multiplayer protocols, even different game engines.

187
00:19:55,980 --> 00:19:58,380
Game Maker, there are...

188
00:19:58,380 --> 00:20:00,900
Well, I think I've looked at the two more common game engines.

189
00:20:00,900 --> 00:20:02,960
There are other engines out there.

190
00:20:04,100 --> 00:20:09,780
In other words, just find another big target and play, or just go and learn something.

191
00:20:09,780 --> 00:20:13,240
If you happen to be using a game, then this might be a good opportunity.

192
00:20:14,540 --> 00:20:24,820
Hawkeye Dank asked another question about the outcome of your work, and he wants to know if you've managed to pull any bounties for this.

193
00:20:25,720 --> 00:20:30,500
Yeah, I turned down bounties for a few things because I wanted to talk about them.

194
00:20:30,500 --> 00:20:37,300
If I was really min-maxing it, I probably would have accepted bounties for a few more, but you never know.

195
00:20:37,760 --> 00:20:43,860
So yes, Unity and Epic Games were both really good about this.

196
00:20:45,400 --> 00:20:48,640
Epic has HackerOne program.

197
00:20:48,640 --> 00:20:55,380
Unity, you want to just go straight to their security at unity3d... whatever, I don't want to give you the wrong email.

198
00:20:55,380 --> 00:20:57,440
Security at email address.

199
00:20:57,440 --> 00:20:59,800
But both were awesome to work with.

200
00:20:59,800 --> 00:21:06,380
I would highly recommend it, and yes, there is definitely money to be made.

201
00:21:07,120 --> 00:21:10,700
And you've looked at the Unreal and Unity engines.

202
00:21:10,700 --> 00:21:14,200
Are there any others that you've looked at or found bugs with?

203
00:21:15,660 --> 00:21:25,900
I have done a fair amount of reverse engineering on GameMaker, which is one of the more common engines, certainly less than Unity or Unreal.

204
00:21:26,200 --> 00:21:36,040
Not from a security perspective, just from a how do I hack this game or how do I mod this game aspect.

205
00:21:36,400 --> 00:21:44,920
I guess one of the problems is that some of these smaller engines don't provide you the same tools.

206
00:21:44,920 --> 00:21:51,400
They may not have an entire networking solution, so there's less places for bugs to be hiding.

207
00:21:51,460 --> 00:21:55,680
That's why I think Unity and Unreal were such good targets.

208
00:21:55,680 --> 00:22:00,100
But I do think there is opportunity for bugs in those other engines.

209
00:22:00,100 --> 00:22:03,100
I just really haven't done the work in that context.

210
00:22:03,100 --> 00:22:06,980
And have you also looked at the individual games itself?

211
00:22:06,980 --> 00:22:13,540
And what's really the difference between trying to find vulnerabilities in the game engine and a specific game?

212
00:22:14,300 --> 00:22:20,500
I guess usually the difference is whether or not you're going to have an easily accessible source.

213
00:22:20,640 --> 00:22:29,200
So Unreal Engine games, like reverse engineering an actual released Unreal Engine game can be pretty tedious because you're not looking at the source.

214
00:22:29,200 --> 00:22:32,320
You're not typically even looking at something with symbols.

215
00:22:32,320 --> 00:22:36,720
You're just looking at a gigantic blob in Ida or Ghidra.

216
00:22:37,120 --> 00:22:39,820
But I have had some success there.

217
00:22:39,820 --> 00:22:43,720
I don't want to burn bridges, so I'm just going to leave it at that.

218
00:22:44,320 --> 00:22:53,740
But I guess the main difference is just how much effort goes into reverse engineering.

219
00:22:56,540 --> 00:23:00,160
This sounds like a pretty specific question, but we'll toss it out there.

220
00:23:00,160 --> 00:23:05,040
So thoughts on cheat engine or memory scanners as a toolkit from beginners?

221
00:23:05,040 --> 00:23:07,080
That's from Ethics.

222
00:23:08,460 --> 00:23:09,960
Cheat engine is awesome.

223
00:23:09,960 --> 00:23:11,620
It's how I started learning.

224
00:23:11,620 --> 00:23:21,180
My talk last year was on essentially applying a lot of the methods and techniques of cheat engine to WebAssembly, so games in your browser, basically.

225
00:23:21,180 --> 00:23:23,060
So I think cheat engine is great.

226
00:23:23,080 --> 00:23:31,800
It is a problem that as game engines get more secure, those techniques don't work as well.

227
00:23:31,800 --> 00:23:44,600
To give a general example, what cheat engine generally does, what you're usually doing with it, is you look for something like your health and you say, OK, I'm looking for something in memory that's 100.

228
00:23:44,600 --> 00:23:51,980
Then I take some damage and say, OK, of all those values that used to be 100, which one is now 87 or something like that?

229
00:23:51,980 --> 00:23:56,620
And that helps you find the value in memory that corresponds to your health.

230
00:23:56,620 --> 00:23:58,940
And then you can manipulate that.

231
00:23:59,360 --> 00:24:01,900
Give yourself more health, whatever.

232
00:24:02,200 --> 00:24:07,400
But as games take trust away from the client, that process doesn't work anymore.

233
00:24:07,400 --> 00:24:14,320
You can manipulate your health client side, but the server still knows you have 87 health, not 10,000 or whatever.

234
00:24:14,400 --> 00:24:23,520
So, I do think if you're looking at the right games, that is a great way to get into game hacking and understand those basic concepts.

235
00:24:23,520 --> 00:24:38,060
But it's not going to work on PUBG or something where someone has put a conscious effort into making it secure and something that's come out in the last five years, a decade, something like that.

236
00:24:38,060 --> 00:24:58,500
And how much now are the developers trying to go with more, I don't know if it's the right term for it, the thin client, so that people can't really make changes in the client side or in their mobile device phone and give myself a million lives or a million gems or coins or anything like that and trying to keep all of that on the server.

237
00:24:58,500 --> 00:25:03,360
How much of that do you kind of see with the games and the servers?

238
00:25:03,980 --> 00:25:10,580
In my experience, it's really just whatever the engine does, the developer will follow.

239
00:25:10,720 --> 00:25:20,740
Unreal sets you up really well to build an architecture where those game hacks don't work or are exceptionally difficult.

240
00:25:20,740 --> 00:25:23,960
And so you see developers doing a pretty good job.

241
00:25:24,460 --> 00:25:36,060
Unity does not set you up quite as well from the start, and so you'll see the majority of those, I guess we'll call simple attacks, do often work.

242
00:25:36,320 --> 00:25:40,620
That's not to say that you can't build a secure architecture on Unity.

243
00:25:40,620 --> 00:25:50,780
It just means that Unity's not doing the work for you, and like I said, developers will typically follow what the engine does.

244
00:25:50,780 --> 00:25:57,280
So as the core software, as the water level rises, developers get better at it as well.

245
00:25:57,360 --> 00:25:58,240
Cool.

246
00:25:58,340 --> 00:26:10,800
Is there anything that you didn't get a chance to put into your presentation that is additional research that you might have done, or are there any kind of other areas that you think other people might be able to add on to the research that you've done?

247
00:26:11,320 --> 00:26:14,080
Yeah, so a couple things come to mind.

248
00:26:14,080 --> 00:26:17,600
The first is the floating point bugs I talked about.

249
00:26:17,600 --> 00:26:19,720
I think that can apply a lot.

250
00:26:19,980 --> 00:26:26,400
I very briefly mentioned this, but that attack does actually apply to Unity.

251
00:26:26,400 --> 00:26:30,200
The difference is that you don't need to speed hack Unity.

252
00:26:30,200 --> 00:26:37,460
You can just, or at least by using the core components that are provided for you, you can just tell it, I'm at x, y, z.

253
00:26:37,600 --> 00:26:45,620
And if you tell it I'm at nan, nan, nan, you get teleported to this weird dimension where everything is infinitely small.

254
00:26:45,620 --> 00:26:46,400
It's kind of cool.

255
00:26:46,400 --> 00:26:47,680
It's not very useful.

256
00:26:47,920 --> 00:26:55,280
So I think that kind of attack applies to a lot of things, and I'd like to see where else it goes.

257
00:26:55,340 --> 00:27:08,560
Something else that I feel like I wanted to do, but I didn't quite find all the pieces, was I found a number of memory corruption bugs, like buffer overflow, stuff like that.

258
00:27:08,560 --> 00:27:25,180
And a lot of those seemed like they would be good for turning something into remote code execution, but the problem that I was always running into is I couldn't imagine a situation where you were looking at a game server and you knew what it looked like on the back end.

259
00:27:25,180 --> 00:27:36,180
So a memory corruption exploit requires some knowledge of memory, of the layout of memory, where code is, gadgets, stuff like that.

260
00:27:36,180 --> 00:27:40,000
And while you may have a copy of the client, you don't have a copy of the server.

261
00:27:40,000 --> 00:27:55,220
And so even if you can bypass all those difficult protections, ASLR, stuff like that, I just couldn't imagine a scenario where I could turn one of these into an RCE exploit on an actual server.

262
00:27:55,220 --> 00:28:08,540
And so that's why I felt a little disappointed in myself, because I had what felt like good bugs, but it didn't feel practical to turn them into an exploit that would work in the real world.

263
00:28:08,660 --> 00:28:11,560
So I would love to see someone actually pull that off.

264
00:28:12,380 --> 00:28:16,760
So we are right down to the bare end of this thing.

265
00:28:16,760 --> 00:28:17,720
So two questions.

266
00:28:17,720 --> 00:28:26,320
One is, would you be willing to post places that people can find you later, whether that be an email or a website or Twitter?

267
00:28:26,340 --> 00:28:29,780
We can do that in the TrackOne channel at the end of this.

268
00:28:29,780 --> 00:28:37,600
And two, if you were to leave us with a call to action, something you would like us to consider as we're moving forward.

269
00:28:37,600 --> 00:28:38,880
I've been asking this of everybody.

270
00:28:38,880 --> 00:28:40,180
I kind of like this question.

271
00:28:40,180 --> 00:28:44,120
What should we take away from this and in our own work?

272
00:28:44,120 --> 00:28:47,220
And how can we translate your stuff into ours?

273
00:28:47,220 --> 00:28:48,660
What would you want us to do?

274
00:28:49,240 --> 00:28:50,700
Yeah, so absolutely.

275
00:28:50,700 --> 00:28:52,420
I will post my GitHub.

276
00:28:52,420 --> 00:28:55,420
It is on the slides as well, but I'll post it again.

277
00:28:55,420 --> 00:28:57,600
My email address is there too.

278
00:28:57,600 --> 00:28:58,200
Hit me up.

279
00:28:58,200 --> 00:28:59,780
I've already had a few people.

280
00:28:59,780 --> 00:29:05,360
I've had a couple of really interesting conversations, so I really appreciate it when people reach out.

281
00:29:05,360 --> 00:29:06,420
And I don't know.

282
00:29:06,420 --> 00:29:16,680
If I could ask for anything, it would be that if you're a security person, you work pen testing or whatever, try hacking video games.

283
00:29:16,680 --> 00:29:17,760
It's fun.

284
00:29:17,760 --> 00:29:22,020
I know you probably like video games because you're a nerd and you're at DEF CON.

285
00:29:22,020 --> 00:29:23,340
So am I.

286
00:29:23,340 --> 00:29:24,500
Try it.

287
00:29:24,500 --> 00:29:26,380
It's rewarding.

288
00:29:26,740 --> 00:29:28,860
It gets your adrenaline pumping.

289
00:29:28,860 --> 00:29:31,080
And getting banned is fun too.

290
00:29:31,100 --> 00:29:33,520
So that's my recommendation.

291
00:29:33,520 --> 00:29:37,440
If you haven't ever gotten banned from a video game, give it a shot.

292
00:29:37,720 --> 00:29:38,540
Awesome.

293
00:29:38,580 --> 00:29:40,560
Well, thank you so much for doing this, Jack.

294
00:29:40,560 --> 00:29:44,840
Appreciate you taking the time to be with us and really enjoyed your presentation.

295
00:29:44,840 --> 00:29:47,760
Hopefully everybody else goes and checks that out.

296
00:29:47,760 --> 00:29:49,280
So thank you so much.

297
00:29:49,480 --> 00:29:50,300
Yeah, thank you guys.

298
00:29:50,300 --> 00:29:51,280
This was fun.

299
00:29:51,920 --> 00:29:52,660
All right.

300
00:29:52,660 --> 00:29:56,280
We will be back in about 30 minutes with another speaker.