start	end	text
5050	8910	It's like somebody else already has control over the stream.
9990	14530	Oh, there it went. Now it's still doing the thing.
17860	19360	And there we are.
19360	21520	And there we are. All right.
21520	24720	Welcome back. So we have another session.
24720	28700	This time is going to be with our friend here, Jack Baker.
28700	29400	Welcome, Jack.
30080	31960	Thank you. Glad to be here.
31980	34980	All right. And also we've got Fallible here as well. Hey, Fallible.
35140	36000	Hello.
36000	40800	So Jack was going to tell us a little bit,
40800	42720	at least he did tell us a little bit in his presentation,
42720	46100	about how he kind of attacked game servers.
46420	49200	Jack, do you want to kind of give a little bit of an introduction of yourself
49200	51520	and just kind of a super brief overview of your talk
51520	55500	so that other people might get more interested in it as well,
55500	58060	on top of some of the other questions that we're already seeing
58060	60260	in the TrackOne Live QA channel?
61060	62360	Yeah, for sure.
62360	64660	So my name is Jack Baker.
64660	67960	I don't have much of a background to talk about.
68220	70760	This is my second time speaking at DEF CON.
70760	73560	Both times have been about hacking video games.
74120	76740	And for my talk this year,
76740	80380	it was basically about finding bugs in game engines.
80380	82760	So basically looking at the core software
82760	84860	that you build video games on
84860	87240	with the hope that finding bugs in the engine
87240	89760	means finding bugs in a thousand different games,
89760	92780	basically amplifying that effort.
92780	96340	So I had a reasonable amount of luck
96340	100300	looking at Unreal Engine 4 from Epic Games
100300	104900	and UNet, the core networking protocol of Unity.
105200	108020	And I talk about four of those bugs.
108920	114460	And I give some POCs, typical DEF CON stuff, I guess.
114460	117140	Yeah, it was all pretty awesome stuff in there.
117140	120840	Falvo, do we have any questions coming in yet for Jack?
120840	123240	We have a very first question over here.
123240	125760	I like this one. This is from Hawkeye Dank.
126480	129660	Do you believe that most game servers slash developers
129660	133420	are heading towards a zero-trust architecture for newer games
133420	136940	in order to better protect the game servers?
137960	139660	That is a good question.
139660	141660	So I would actually argue that to some extent
141660	143180	that has already been done.
143180	146480	If I were to go back a bunch to when I was a teenager
146480	148560	trying to learn to hack video games,
148560	150980	I remember that there was sort of this philosophy
150980	154820	that the only online game you really couldn't hack
154820	156640	was RuneScape.
156640	159680	And the reason for that is RuneScape is about as close
159680	162400	as you'll get to just a pure thin client
163560	165640	in a big video game.
165640	168660	And so you couldn't really manipulate the client
168660	170820	to do things like teleport or whatever
170820	174740	because it was just basically just button presses.
174740	179160	In that case, though, people still managed to
179160	181040	quote-unquote hack RuneScape,
181040	183000	but it was in the form of logical bugs.
183000	186860	It wasn't trust being placed on the client.
186920	189320	So to answer that question,
189320	192640	I think that you absolutely can make a zero-trust
193520	194920	game engine as is,
194920	199120	but you're balancing performance and security.
199120	201200	And if you go too far on the security side,
201200	203120	you end up with a game like RuneScape,
203120	207860	which is very low, very slow,
207860	210280	with not a whole lot going on.
210280	212940	It's very difficult to apply that to something like,
212940	216300	I don't know, Fortnite, where you've got a thousand,
216300	219120	no, I guess a hundred people shooting guns.
219120	220860	You've got all this math going on.
220860	223520	It's just a different scale of a problem.
223520	227120	But we're getting much better at it.
227120	229480	Game engines have gotten significantly better
229480	231640	at taking that trust away.
231640	234960	So yeah, I think that's where things are going to keep moving,
234960	238980	is taking that trust away and finding clever ways
238980	244100	to make servers that can still handle a first-person shooter,
244100	245620	still handle Fortnite,
245620	249660	but don't have to put trust on the client to do that.
249660	252720	And from the perspective of game hackers,
252720	257200	hacking will just become more of a process
257200	258680	of finding logical bugs,
258680	261420	rather than doing what we typically do now,
261420	264020	which is exploiting those trust relationships.
264360	266220	Well, that's interesting.
266220	269240	So a slightly different angle of a question
269240	271760	coming from Blackfoot over here.
272040	275100	Why do you think there is so little security knowledge share
275100	276600	between game companies?
276600	278480	Example, little documentation
278480	282420	and hardening of UE4 dedicated servers.
284540	286140	That's a pretty good question.
286140	288160	If I had to guess, it would just be because
288160	292440	game engines are such big pieces of software
292440	295780	that when you develop your own game engine,
295780	298500	you're sort of going to try to hold it close to your chest.
298500	301580	You don't really want to give your competitors
302520	308120	a competing game engine the keys to the kingdom, so to speak.
308120	310540	So architecturally, most game engines are built
310540	311860	from the ground up.
311860	313680	There's not a lot of shared code,
313680	318140	and that's just because it's a big investment
318620	320860	and no one wants to share that.
320880	323480	It's sort of a boring business answer, I think,
323480	326740	but it's really just Unreal and Unity
326740	330720	and whoever else don't want to share their work with each other.
331200	333700	So in your presentation,
333700	335760	one of the things that you were showing
335760	338740	was kind of like the teleporting and the fast running.
338800	340380	I remember at one point in there,
340380	342600	you're just kind of showing somebody running at the normal speed
342600	346660	and then the exploit that you were able to find
346660	348840	where somebody's zipping across the screen.
348980	350800	In addition to running,
350800	352200	do you think there are other things
352200	354520	that people could use that kind of thing for?
354520	357500	Maybe be able to shoot faster, shoot more?
357800	359780	Maybe what other kind of things have you thought of
359780	363080	that somebody could use that type of exploit for in their games?
363660	364780	Yeah, absolutely.
364780	366880	So with that particular bug,
366880	370440	I found what I think is really interesting.
370440	373940	It's basically a bug where you can use the unique properties
373940	377940	of some special floating point values
377940	382100	to basically confuse the server into doing something it shouldn't.
382100	385400	And so I have actually tried basically that exact technique
385400	389660	on other games, other commands and stuff like that.
389660	394020	And you can usually get something unpredictable to happen.
394020	395260	I think I mentioned in my talk,
395340	397440	a lot of times it's not a good thing.
397440	400020	A lot of times you're just harming yourself,
400020	403120	but you can usually cause the game to do something it shouldn't.
403300	408580	And so, yeah, I think these logical bugs,
408580	411600	especially like mathematical bugs, if you can find those,
411600	416460	are a really good way to exploit games
416460	419720	because while the bugs aren't the most common,
419720	421440	they are very predictable.
421440	423720	They're not a memory corruption bug
423720	425980	where you have to worry about layout of the memory
425980	427920	and all those complicated things.
427920	433140	And they tend to, I guess,
433140	436800	slip by the architectural protection.
436800	439860	So in that case, like the bug you talked about,
439860	443580	Unreal Engine has a pretty robust way to prevent speed hacking.
444100	448120	And using just a couple quirks of,
448960	452480	basically, quirks of decimal numbers,
452480	454500	you can cause it to do something it shouldn't.
454500	456780	And that is super useful.
456780	459960	So that particular kind of bug, I'd say, yes,
459960	462340	definitely applies in other places.
462460	465840	It's just a matter of looking for it.
465860	469180	And I guess that's it.
469180	471200	I don't know how I was going to end that sentence.
471240	473360	No, I really liked what you showed there,
473360	477780	especially the things that we find in other places
477780	480360	across security and other types of hacking.
480360	483100	You go, well, okay, let's divide by zero.
483100	484520	Let's use not a number.
484520	488200	Let's use these things that are the outsides
488200	490840	of this language that's being used
491360	495420	and see what happens when you throw it at the system.
495420	497580	And it's just nice to see,
498280	501480	in the niche that you found yourself in,
501660	503520	a lot of the same techniques work.
504280	507580	Yeah, I guess one other thing I like about that bug
507580	510800	is that it's not something that's fixed by, say,
510800	512540	oh, we're going to stop writing things in C
512540	516020	and start writing them in Go or Rust or something.
516020	519940	These are bugs that still exist even in,
519940	522480	quote-unquote, safe languages.
522500	526280	And I think in more than just video games,
526280	529340	that's where this sort of exploitation is going.
529340	531980	And that's why I like that bug so much.
533140	536560	All right, so Hawkeye has another question for you.
536560	539780	He asks, have you noticed any new trends
539780	543620	of input validation in high-user games like Fortnite?
544460	548540	Yeah, I mean, I keep going back to the same example,
548540	551540	but Unreal Engine 4 uses a really,
552760	556560	really robust system for validating user input
556560	558640	and specifically user movement
559480	562820	in a way that scales really well,
562820	565480	but also basically eliminates your ability
565480	570340	to manipulate your movement in any significant way.
570340	575340	And so essentially the broad strokes are basically
575340	581380	taking authority over your character's location,
581380	582760	putting it on the server,
582760	586300	and giving the client the possibility to call functions
586300	589360	in order to request that you move.
589360	592780	And that way, the server has the context to say,
592780	594680	well, you're trying to move too fast.
595760	597400	I'm not going to allow that.
597400	601200	I'm going to limit movement to a specific range.
601200	605780	And so really, I think the entirety of evolutions
605780	609540	in the security of game engines recently
609540	613140	has just been on giving more context to the server
613140	615320	so we can say, well, that's not right.
615320	617560	I'm going to stop that from happening
617560	619980	and ensuring that the client doesn't have the trust
619980	622000	to just overrule the server.
622000	625020	I can't remember whether you said in your presentation
625020	630180	if you've talked to the engine companies
630180	633140	about these vulnerabilities and if they have fixed
633140	635820	the exploits that you found.
635820	638440	But if they do see somebody trying to send
638440	642240	like your NAN, not a number, at the server,
642240	644260	what types of things would you think
644260	646860	that they should do to that?
646860	649300	Should they kind of just adjust or ban?
649300	652420	What are your thoughts for how people could...
652420	653880	what should happen to them?
654300	659380	Yeah, so three of the four bugs I talk about are fixed.
660540	666000	And the speed hack one, the NAN one, was one of those.
666000	667580	It was actually a pretty easy fix.
667580	669800	They just put a tiny little check in there that says
669800	672520	if this is NAN, just abort, get out of there.
672640	675060	But in general, I would say
677220	679060	what they should...
680040	684660	I would recommend possibly that if you're a game engine developer
684660	687000	or you're working on Unreal and you think,
687000	691400	oh, this could be a problem, it's not unreasonable to just say
691400	694980	you shouldn't be able to use NAN in any argument.
694980	698040	That's not going to happen under normal circumstances.
698280	701320	And just essentially eliminate that from the serialization
701900	704260	and deserialization process.
704260	707220	Unreal doesn't do that because it wants to consider itself
707220	708780	sort of impartial to that.
708780	713640	Whatever goes in one end is deserialized on the other end.
714000	720780	But I think it would be a pretty reasonable assumption to say
720780	724040	if you're getting certain types of, say, floating point numbers,
724040	726280	this is blatantly invalid.
726280	727700	And we can probably just toss it out
727700	730080	before we even consider anything else.
731320	735780	Just a general input validation on what's coming in.
735880	737720	Typical boring stuff.
738560	740480	Isn't it that way?
740540	744460	Well, so I don't really want to give away the punchline
744460	747020	to your presentation because it fits so well,
747020	750020	but we'll just kind of hand wave that and say,
750020	755800	so when you've been doing this, how often do you get booted
755800	759060	from whatever game you're playing?
759060	762760	Or how many times have you had your accounts banned?
763920	766040	When you're building your own stuff,
766040	768820	you get banned less than you might expect.
768820	773260	I did a talk last year on hacking, basically, browser games.
773300	778440	And for one of the demonstrations, I took a game.
778440	781260	I don't want to say its name. I've done enough to them.
781560	785160	But I took this game and it has a global scoreboard
785160	790700	and I just set my score to 1, 3, 3, 3, 3, 3, 3, 3, something, 7,
790700	792780	and username to HiDefCon.
792780	794600	And they banned me pretty quickly.
794600	796760	I think that was pretty obvious.
796840	800620	But in general, if you're building your own game hacks,
800620	803240	there is a pretty good chance you're going to get away with it.
803240	805520	So I get banned pretty rarely.
808100	810620	So congratulations or I'm sorry.
810940	812940	However you feel about that.
813160	814540	It's a mixed bag.
815560	820720	Where do you also often kind of see the line here along the same,
820720	823840	I guess similar to what Fallible was just talking about,
823840	828280	where the old question about research versus going over the line,
828280	832720	because essentially you are affecting other users, potentially,
833260	834960	as well as that game engine.
834960	839300	So where is kind of your line on how far you'll go with your research?
839360	843620	Or is it because it's in the name of research, you'll just go all the way with it?
843620	847020	I mean, I won't do anything that's, I think,
847020	852540	directly affecting someone spending money or someone or anything like that.
852540	855860	I'm not stealing items from people in online games.
855860	857660	That certainly crosses the line.
857660	860600	But, you know, if someone's in a lobby of a first person shooter
860600	865440	and someone wall hacks through and, you know, no scopes them in the head,
865440	868720	I don't think they've been significantly harmed in any way.
868720	874980	So I think that is within moral bounds for me.
874980	876000	Excellent.
878200	882420	Can you explain some of the technical setup that you have
882420	886360	in order to capture the data that you're sending across?
886360	890440	And what tools are you using? What's your lab look like?
890440	895020	Yeah, so working with Unreal Engine especially,
895020	898500	I needed to actually buy a new desktop to do
898500	902020	because on the laptop I was working on,
902020	905920	it took most of the day to compile Unreal from source.
905920	909660	And I was doing that several times a day.
909660	913660	So that was not good math working out there.
913660	918320	So essentially, I do all of my Unreal development on Linux,
918320	922780	which is a little less supported, but it's just more comfortable for me.
922780	928940	And the other, I guess the other thing that's really a challenge
928940	932960	is the specifically Unreal source is so big
932960	939340	that trying to open it in most like project editors is, it does not work.
939340	944440	VS code gets by just a little bit, but even then it gets tripped up
944440	948240	when you try to go to this function or something like that,
948240	952360	it'll end up, it'll spin its wheels for five minutes and say,
952360	955520	yeah, couldn't find it, even though you know it exists.
955520	958700	So I wish I had a better setup.
958700	961180	I'm sure people who do actual video game development
961180	965060	have better experiences with building Unreal from source.
965060	971520	But I guess my lab is just, it's a system 76 desktop
971520	976200	with the highest boxes checked on everything,
976200	979580	just so that I can compile Unreal as many times as I want
979580	981160	and it doesn't take me all day.
982600	986600	So in that way, you're looking at the guts of the code,
986600	988960	you're really building it each time.
988960	992800	It's not a situation of you're just capturing everything in Wireshark
992800	995840	and modifying it somehow.
996400	999440	No, I wish it was a little easier.
999440	1005960	With Unet, you can get away with just looking at the traffic in Wireshark.
1005960	1010220	Unreal is pretty difficult because everything is like bit aligned,
1010220	1013260	so you'll have a string that starts four bits in
1013260	1015080	and just looks like gibberish.
1015120	1017960	So you really do have to be looking at it at the low level
1017960	1019840	to really make any sense of it.
1021020	1022320	That makes sense.
1022320	1025440	And how does somebody get started with that kind of thing?
1025440	1029520	Because this sounds extremely technical and you have to know quite a bit.
1029560	1032240	How does somebody, where would be the entry point
1032240	1034580	if somebody was interested in this kind of research
1034580	1037700	in order to start figuring these kinds of things out,
1037700	1041060	or if they wanted to just even look at how games work?
1041640	1044840	Yeah, well, I mean, all the code is out there for Unreal Engine,
1044840	1048740	but I don't think that's something you should just jump straight into,
1048740	1053380	especially if you're not pretty familiar with C++,
1053380	1056200	because it is a complicated code base.
1056200	1060820	I think the best thing you can do to understand hacking video games
1060820	1063300	is to build them.
1063400	1066760	It's sort of a, I don't know, cliche answer,
1066760	1069500	but that is what teaches you, oh, this is how that works.
1069500	1070740	This is how I'd write it.
1070740	1075420	This is probably how it looks on the back end.
1075540	1078860	Also, I would say if you're going to look at games
1078860	1081860	written in a particular engine, Unity games are pretty good
1081860	1087100	because they're usually built, well, they're built with C Sharp
1087100	1090800	and they're typically easy to decompile back to C Sharp
1090800	1094720	with something like DN Spy, if I'm pronouncing that correctly.
1094720	1096320	However, that's verbalized.
1096320	1100000	So you can actually look at the code of the game, modify it,
1100000	1103220	see what happens, and basically hack games
1103220	1108480	without too much actual binary reverse engineering
1108480	1110920	or anything like that.
1111620	1120200	So we got a question from Jay that I'm going to obscure this a little bit.
1120200	1122720	The question is way too specific,
1122720	1130420	so let's go more along the lines of where else would be interesting to look?
1130420	1134920	If you were done with the research that you've done so far
1134920	1137700	and you were looking for a new product,
1137700	1142340	what would be the things that would draw you to a new product?
1143900	1149800	Yeah, so one thing I would say is that when you look at Unity,
1149800	1154360	there are a lot of different multiplayer solutions.
1154360	1158680	So I looked at UNet, which is sort of the... it's provided by Unity,
1158680	1162460	but there are third-party solutions that are pretty common.
1162820	1165660	Photon, Mirror, I haven't looked at those at all,
1165660	1168480	and I think that there's a pretty solid chance
1168480	1171320	that the same kind of bugs apply there.
1171460	1174800	And then I think most of the research I did,
1174800	1178560	obviously I'm just looking at the core engines for games,
1178560	1182160	but looking at specific games, you can find these exact same bugs.
1182160	1186880	They just may not apply to other games.
1186880	1189180	So I think most of this research still applies.
1189180	1192160	It just needs to be targeted either at different games
1192160	1195980	or different multiplayer protocols, even different game engines.
1195980	1198380	Game Maker, there are...
1198380	1200900	Well, I think I've looked at the two more common game engines.
1200900	1202960	There are other engines out there.
1204100	1207500	In other words, just find another big target and play,
1207500	1209780	or just go and learn something.
1209780	1213240	If you happen to be using a game, then this might be a good opportunity.
1214540	1216260	Hawkeye Dank asked another question
1216260	1220220	about the outcome of your work,
1220220	1222860	and he wants to know if you've managed
1222860	1224820	to pull any bounties for this.
1225720	1228540	Yeah, I turned down bounties for a few things
1228540	1230500	because I wanted to talk about them.
1230500	1233880	If I was really min-maxing it, I probably would have accepted bounties
1233880	1237300	for a few more, but you never know.
1237760	1241380	So yes, Unity and Epic Games
1241380	1243860	were both really good about this.
1245400	1246680	Epic has
1246680	1248640	HackerOne program.
1248640	1251460	Unity, you want to just go straight to their security
1251460	1255380	at unity3d... whatever, I don't want to give you the wrong email.
1255380	1257440	Security at email address.
1257440	1259800	But both were awesome to work with.
1259800	1263780	I would highly recommend it,
1263780	1266380	and yes, there is definitely money to be made.
1267120	1269060	And you've looked at the Unreal
1269060	1272380	and Unity engines. Are there any others that you've looked at
1272380	1274200	or found bugs with?
1275660	1278180	I have done a fair amount of reverse engineering
1278180	1281620	on GameMaker, which is one of the
1281620	1284780	more common engines, certainly less than Unity
1284780	1288200	or Unreal. Not from a security perspective,
1288200	1291240	just from a how do I hack this game
1291240	1293840	or how do I mod this game
1294840	1296040	aspect.
1296400	1300060	I guess one of the problems is that some of these
1300060	1303400	smaller engines don't provide you the same
1304140	1306100	tools. They may not have an entire
1306100	1309060	networking solution, so there's less
1309060	1312180	places for bugs to be hiding. That's why
1312180	1315680	I think Unity and Unreal were such good targets.
1315680	1318680	But I do think there is opportunity for bugs
1318680	1321740	in those other engines. I just really haven't done the work
1321740	1323100	in that context.
1323100	1326980	And have you also looked at the individual games itself?
1326980	1329500	And what's really the difference between trying to find
1329500	1333540	vulnerabilities in the game engine and a specific game?
1334300	1336540	I guess usually the difference
1336540	1339320	is whether or not you're going to have an easily accessible
1339320	1342300	source. So Unreal Engine games,
1342300	1346460	like reverse engineering an actual released Unreal Engine game
1346460	1349200	can be pretty tedious because you're not looking at the source.
1349200	1352320	You're not typically even looking at something with symbols.
1352320	1354920	You're just looking at a gigantic blob in
1354920	1358020	Ida or Ghidra. But I have
1358020	1361440	had some success there. I don't want to burn bridges, so I'm
1361440	1363720	just going to leave it at that.
1364320	1367380	But I guess the main
1367380	1368960	difference is just how much
1369760	1373740	effort goes into reverse engineering.
1376540	1377460	This sounds
1377460	1380160	like a pretty specific question, but we'll toss it out there.
1380160	1383080	So thoughts on cheat engine or memory scanners
1383080	1385560	as a toolkit from beginners? That's from
1385560	1387080	Ethics.
1388460	1391620	Cheat engine is awesome. It's how I started learning.
1391620	1394040	My talk last year was on essentially applying
1394880	1397780	a lot of the methods and techniques of cheat engine to
1397780	1401180	WebAssembly, so games in your browser, basically.
1401180	1403760	So I think cheat engine is great. It is
1404080	1406080	a problem that as
1406660	1409840	game engines get more secure,
1409840	1411800	those techniques don't work as well.
1411800	1415820	To give a general example, what cheat
1415820	1418700	engine generally does, what you're usually doing with it, is
1418700	1421780	you look for something like your health and you say, OK, I'm looking
1421780	1424600	for something in memory that's 100.
1424600	1427800	Then I take some damage and say, OK, of all those values that used
1427800	1430460	to be 100, which one is now 87
1430460	1433440	or something like that? And that helps you find
1433440	1436620	the value in memory that corresponds to your health.
1436620	1438940	And then you can manipulate that.
1439360	1441900	Give yourself more health, whatever.
1442200	1445520	But as games take trust away from the client,
1445520	1448680	that process doesn't work anymore. You can manipulate your health
1448680	1451540	client side, but the server still knows you have 87
1451540	1454320	health, not 10,000 or whatever.
1454400	1457660	So, I do think
1457660	1460640	if you're looking at the right games, that is a great way
1460640	1463520	to get into game hacking and understand those basic concepts.
1463520	1465900	But it's not going to work on
1466840	1469360	PUBG or something where someone has
1469360	1472240	put a conscious effort into making it secure
1472240	1474920	and something that's come out in the last
1475340	1478060	five years, a decade, something like that.
1478060	1481040	And how much now are the developers trying to go
1481040	1483400	with more, I don't know if it's the right term for it,
1483400	1487100	the thin client, so that people can't really
1487100	1489860	make changes in the client side or
1489860	1493300	in their mobile device phone and give myself a million lives
1493300	1496380	or a million gems or coins or anything like that
1496380	1498940	and trying to keep all of that on the server. How much of
1498940	1502280	that do you kind of see with the games
1502280	1505780	and the servers? In my experience,
1505780	1508660	it's really just whatever the engine does,
1508660	1511180	the developer will follow. Unreal
1511720	1514260	sets you up really well to
1514780	1517680	build an architecture where those game hacks
1517680	1520740	don't work or are exceptionally difficult.
1520740	1523960	And so you see developers doing a pretty good job.
1524460	1526780	Unity does not set you up quite
1526780	1529600	as well from the start, and so you'll see the majority
1529600	1532260	of those, I guess we'll call
1532260	1536060	simple attacks, do often work.
1536320	1538320	That's not to say that you can't build
1538640	1541380	a secure architecture on Unity. It just
1541380	1544140	means that Unity's not doing the work
1544140	1547540	for you, and like I said, developers
1547540	1550780	will typically follow what the engine does.
1550780	1553520	So as the core software, as
1553520	1557280	the water level rises, developers get better at it as well.
1557360	1559360	Cool. Is there anything that
1559360	1562340	you didn't get a chance to put into your presentation that
1562340	1565320	is additional research that you might have done, or are there any
1565320	1568360	kind of other areas that you think other people might be able
1568360	1570800	to add on to the research that you've done?
1571320	1574480	Yeah, so a couple things come to mind. The first
1574480	1577600	is the floating point bugs I talked about.
1577600	1579720	I think that can apply a lot.
1579980	1582980	I very briefly mentioned this, but
1582980	1586400	that attack does actually apply to Unity.
1586400	1589160	The difference is that you don't need to speed
1589160	1591840	hack Unity. You can just, or at least by
1592400	1595260	using the core components that are provided for you, you can just
1595260	1598480	tell it, I'm at x, y, z. And if you tell it
1598480	1601360	I'm at nan, nan, nan, you get
1601360	1604240	teleported to this weird dimension where everything is
1604240	1607680	infinitely small. It's kind of cool. It's not very useful.
1607920	1610660	So I think that kind of attack applies
1611220	1613420	to a lot of things, and I'd like to see
1613420	1616500	where else it goes. Something else that I feel
1616500	1619640	like I wanted to do, but I didn't quite
1619640	1622280	find all the pieces, was I found
1622520	1625440	a number of memory corruption bugs, like buffer
1625440	1628560	overflow, stuff like that.
1628560	1631540	And a lot of those seemed like
1631540	1634300	they would be good for turning something into remote code
1634300	1637540	execution, but the problem that I was always running into
1637540	1640420	is I couldn't imagine a situation
1640420	1643600	where you were looking at a game server and you knew what it
1643600	1646400	looked like on the back end. So a memory corruption exploit
1647160	1649160	requires some knowledge of
1649160	1652060	memory, of the layout of memory, where
1652980	1655600	code is, gadgets, stuff
1655600	1658820	like that. And while you may have a copy of the client, you don't have a
1658820	1661820	copy of the server. And so even if you can bypass
1661820	1665040	all those difficult protections, ASLR,
1665040	1667520	stuff like that, I just couldn't imagine
1667680	1670680	a scenario where I could turn
1670680	1673520	one of these into an RCE exploit on
1673520	1676440	an actual server. And so that's why I
1676440	1679680	felt a little disappointed in myself, because I had what
1679680	1682800	felt like good bugs, but it didn't
1682800	1684700	feel practical to turn them into
1685500	1688540	an exploit that would work in the real world.
1688660	1691560	So I would love to see someone actually pull that off.
1692380	1694540	So we are right down
1694540	1697720	to the bare end of this thing. So two questions.
1697720	1700500	One is, would you be willing to
1700500	1703600	post places that people can find you later, whether that
1703600	1706320	be an email or a website or Twitter?
1706340	1709780	We can do that in the TrackOne channel at the end of this.
1709780	1712600	And two, if you were to leave us
1712600	1715300	with a call to action, something you would like us to
1716040	1718880	consider as we're moving forward. I've been asking this of everybody.
1718880	1721640	I kind of like this question. What should we take away from
1721640	1725040	this and in our own work? And how can we
1725040	1728660	translate your stuff into ours? What would you want us to do?
1729240	1730700	Yeah, so absolutely.
1730700	1734060	I will post my GitHub. It is on the slides
1734060	1737600	as well, but I'll post it again. My email address is there too.
1737600	1739780	Hit me up. I've already had a few people.
1739780	1742480	I've had a couple of really interesting conversations, so I really
1742480	1745560	appreciate it when people reach out. And
1745560	1748800	I don't know. If I could ask for anything,
1748800	1751560	it would be that if you're
1751880	1755320	a security person, you work pen testing or whatever,
1755320	1757760	try hacking video games. It's fun.
1757760	1760680	I know you probably like video games because you're a nerd
1760680	1763340	and you're at DEF CON. So am I.
1763340	1766380	Try it. It's rewarding.
1766740	1769700	It gets your adrenaline pumping. And getting banned
1769700	1772720	is fun too. So that's my
1772720	1775720	recommendation. If you haven't ever gotten banned from a
1775720	1778540	video game, give it a shot. Awesome.
1778580	1781320	Well, thank you so much for doing this, Jack. Appreciate you
1781320	1784840	taking the time to be with us and really enjoyed your presentation.
1784840	1787760	Hopefully everybody else goes and checks that out.
1787760	1791280	So thank you so much. Yeah, thank you guys. This was fun.
1791920	1793880	All right. We will be back
1793880	1796280	in about 30 minutes with another speaker.