WEBVTT 00:05.050 --> 00:08.910 It's like somebody else already has control over the stream. 00:09.990 --> 00:11.290 Oh, there it went. 00:11.290 --> 00:14.530 Now it's still doing the thing. 00:17.860 --> 00:19.360 And there we are. 00:19.360 --> 00:20.780 And there we are. 00:20.780 --> 00:21.520 All right. 00:21.520 --> 00:22.860 Welcome back. 00:22.860 --> 00:24.720 So we have another session. 00:24.720 --> 00:28.700 This time is going to be with our friend here, Jack Baker. 00:28.700 --> 00:29.400 Welcome, Jack. 00:30.080 --> 00:30.940 Thank you. 00:30.940 --> 00:31.960 Glad to be here. 00:31.980 --> 00:32.720 All right. 00:32.720 --> 00:34.180 And also we've got Fallible here as well. 00:34.180 --> 00:34.980 Hey, Fallible. 00:35.140 --> 00:36.000 Hello. 00:36.000 --> 00:46.100 So Jack was going to tell us a little bit, at least he did tell us a little bit in his presentation, about how he kind of attacked game servers. 00:46.420 --> 01:00.260 Jack, do you want to kind of give a little bit of an introduction of yourself and just kind of a super brief overview of your talk so that other people might get more interested in it as well, on top of some of the other questions that we're already seeing in the TrackOne Live QA channel? 01:01.060 --> 01:02.360 Yeah, for sure. 01:02.360 --> 01:04.660 So my name is Jack Baker. 01:04.660 --> 01:07.960 I don't have much of a background to talk about. 01:08.220 --> 01:10.760 This is my second time speaking at DEF CON. 01:10.760 --> 01:13.560 Both times have been about hacking video games. 01:14.120 --> 01:20.380 And for my talk this year, it was basically about finding bugs in game engines. 01:20.380 --> 01:32.780 So basically looking at the core software that you build video games on with the hope that finding bugs in the engine means finding bugs in a thousand different games, basically amplifying that effort. 01:32.780 --> 01:44.900 So I had a reasonable amount of luck looking at Unreal Engine 4 from Epic Games and UNet, the core networking protocol of Unity. 01:45.200 --> 01:48.020 And I talk about four of those bugs. 01:48.920 --> 01:54.460 And I give some POCs, typical DEF CON stuff, I guess. 01:54.460 --> 01:57.140 Yeah, it was all pretty awesome stuff in there. 01:57.140 --> 02:00.840 Falvo, do we have any questions coming in yet for Jack? 02:00.840 --> 02:03.240 We have a very first question over here. 02:03.240 --> 02:03.820 I like this one. 02:03.820 --> 02:05.760 This is from Hawkeye Dank. 02:06.480 --> 02:16.940 Do you believe that most game servers slash developers are heading towards a zero-trust architecture for newer games in order to better protect the game servers? 02:17.960 --> 02:19.660 That is a good question. 02:19.660 --> 02:23.180 So I would actually argue that to some extent that has already been done. 02:23.180 --> 02:36.640 If I were to go back a bunch to when I was a teenager trying to learn to hack video games, I remember that there was sort of this philosophy that the only online game you really couldn't hack was RuneScape. 02:36.640 --> 02:45.640 And the reason for that is RuneScape is about as close as you'll get to just a pure thin client in a big video game. 02:45.640 --> 02:54.740 And so you couldn't really manipulate the client to do things like teleport or whatever because it was just basically just button presses. 02:54.740 --> 03:03.000 In that case, though, people still managed to quote-unquote hack RuneScape, but it was in the form of logical bugs. 03:03.000 --> 03:06.860 It wasn't trust being placed on the client. 03:06.920 --> 03:19.120 So to answer that question, I think that you absolutely can make a zero-trust game engine as is, but you're balancing performance and security. 03:19.120 --> 03:30.280 And if you go too far on the security side, you end up with a game like RuneScape, which is very low, very slow, with not a whole lot going on. 03:30.280 --> 03:39.120 It's very difficult to apply that to something like, I don't know, Fortnite, where you've got a thousand, no, I guess a hundred people shooting guns. 03:39.120 --> 03:40.860 You've got all this math going on. 03:40.860 --> 03:43.520 It's just a different scale of a problem. 03:43.520 --> 03:47.120 But we're getting much better at it. 03:47.120 --> 03:51.640 Game engines have gotten significantly better at taking that trust away. 03:51.640 --> 04:09.660 So yeah, I think that's where things are going to keep moving, is taking that trust away and finding clever ways to make servers that can still handle a first-person shooter, still handle Fortnite, but don't have to put trust on the client to do that. 04:09.660 --> 04:24.020 And from the perspective of game hackers, hacking will just become more of a process of finding logical bugs, rather than doing what we typically do now, which is exploiting those trust relationships. 04:24.360 --> 04:26.220 Well, that's interesting. 04:26.220 --> 04:31.760 So a slightly different angle of a question coming from Blackfoot over here. 04:32.040 --> 04:36.600 Why do you think there is so little security knowledge share between game companies? 04:36.600 --> 04:42.420 Example, little documentation and hardening of UE4 dedicated servers. 04:44.540 --> 04:46.140 That's a pretty good question. 04:46.140 --> 04:58.500 If I had to guess, it would just be because game engines are such big pieces of software that when you develop your own game engine, you're sort of going to try to hold it close to your chest. 04:58.500 --> 05:08.120 You don't really want to give your competitors a competing game engine the keys to the kingdom, so to speak. 05:08.120 --> 05:11.860 So architecturally, most game engines are built from the ground up. 05:11.860 --> 05:20.860 There's not a lot of shared code, and that's just because it's a big investment and no one wants to share that. 05:20.880 --> 05:30.720 It's sort of a boring business answer, I think, but it's really just Unreal and Unity and whoever else don't want to share their work with each other. 05:31.200 --> 05:38.740 So in your presentation, one of the things that you were showing was kind of like the teleporting and the fast running. 05:38.800 --> 05:48.840 I remember at one point in there, you're just kind of showing somebody running at the normal speed and then the exploit that you were able to find where somebody's zipping across the screen. 05:48.980 --> 05:54.520 In addition to running, do you think there are other things that people could use that kind of thing for? 05:54.520 --> 05:57.500 Maybe be able to shoot faster, shoot more? 05:57.800 --> 06:03.080 Maybe what other kind of things have you thought of that somebody could use that type of exploit for in their games? 06:03.660 --> 06:04.780 Yeah, absolutely. 06:04.780 --> 06:10.440 So with that particular bug, I found what I think is really interesting. 06:10.440 --> 06:22.100 It's basically a bug where you can use the unique properties of some special floating point values to basically confuse the server into doing something it shouldn't. 06:22.100 --> 06:29.660 And so I have actually tried basically that exact technique on other games, other commands and stuff like that. 06:29.660 --> 06:34.020 And you can usually get something unpredictable to happen. 06:34.020 --> 06:37.440 I think I mentioned in my talk, a lot of times it's not a good thing. 06:37.440 --> 06:43.120 A lot of times you're just harming yourself, but you can usually cause the game to do something it shouldn't. 06:43.300 --> 07:01.440 And so, yeah, I think these logical bugs, especially like mathematical bugs, if you can find those, are a really good way to exploit games because while the bugs aren't the most common, they are very predictable. 07:01.440 --> 07:07.920 They're not a memory corruption bug where you have to worry about layout of the memory and all those complicated things. 07:07.920 --> 07:16.800 And they tend to, I guess, slip by the architectural protection. 07:16.800 --> 07:23.580 So in that case, like the bug you talked about, Unreal Engine has a pretty robust way to prevent speed hacking. 07:24.100 --> 07:34.500 And using just a couple quirks of, basically, quirks of decimal numbers, you can cause it to do something it shouldn't. 07:34.500 --> 07:36.780 And that is super useful. 07:36.780 --> 07:42.340 So that particular kind of bug, I'd say, yes, definitely applies in other places. 07:42.460 --> 07:45.840 It's just a matter of looking for it. 07:45.860 --> 07:49.180 And I guess that's it. 07:49.180 --> 07:51.200 I don't know how I was going to end that sentence. 07:51.240 --> 08:00.360 No, I really liked what you showed there, especially the things that we find in other places across security and other types of hacking. 08:00.360 --> 08:03.100 You go, well, okay, let's divide by zero. 08:03.100 --> 08:04.520 Let's use not a number. 08:04.520 --> 08:15.420 Let's use these things that are the outsides of this language that's being used and see what happens when you throw it at the system. 08:15.420 --> 08:23.520 And it's just nice to see, in the niche that you found yourself in, a lot of the same techniques work. 08:24.280 --> 08:36.020 Yeah, I guess one other thing I like about that bug is that it's not something that's fixed by, say, oh, we're going to stop writing things in C and start writing them in Go or Rust or something. 08:36.020 --> 08:42.480 These are bugs that still exist even in, quote-unquote, safe languages. 08:42.500 --> 08:49.340 And I think in more than just video games, that's where this sort of exploitation is going. 08:49.340 --> 08:51.980 And that's why I like that bug so much. 08:53.140 --> 08:56.560 All right, so Hawkeye has another question for you. 08:56.560 --> 09:03.620 He asks, have you noticed any new trends of input validation in high-user games like Fortnite? 09:04.460 --> 09:30.340 Yeah, I mean, I keep going back to the same example, but Unreal Engine 4 uses a really, really robust system for validating user input and specifically user movement in a way that scales really well, but also basically eliminates your ability to manipulate your movement in any significant way. 09:30.340 --> 09:49.360 And so essentially the broad strokes are basically taking authority over your character's location, putting it on the server, and giving the client the possibility to call functions in order to request that you move. 09:49.360 --> 09:54.680 And that way, the server has the context to say, well, you're trying to move too fast. 09:55.760 --> 09:57.400 I'm not going to allow that. 09:57.400 --> 10:01.200 I'm going to limit movement to a specific range. 10:01.200 --> 10:15.320 And so really, I think the entirety of evolutions in the security of game engines recently has just been on giving more context to the server so we can say, well, that's not right. 10:15.320 --> 10:22.000 I'm going to stop that from happening and ensuring that the client doesn't have the trust to just overrule the server. 10:22.000 --> 10:35.820 I can't remember whether you said in your presentation if you've talked to the engine companies about these vulnerabilities and if they have fixed the exploits that you found. 10:35.820 --> 10:46.860 But if they do see somebody trying to send like your NAN, not a number, at the server, what types of things would you think that they should do to that? 10:46.860 --> 10:49.300 Should they kind of just adjust or ban? 10:49.300 --> 10:52.420 What are your thoughts for how people could... 10:52.420 --> 10:53.880 what should happen to them? 10:54.300 --> 10:59.380 Yeah, so three of the four bugs I talk about are fixed. 11:00.540 --> 11:06.000 And the speed hack one, the NAN one, was one of those. 11:06.000 --> 11:07.580 It was actually a pretty easy fix. 11:07.580 --> 11:12.520 They just put a tiny little check in there that says if this is NAN, just abort, get out of there. 11:12.640 --> 11:19.060 But in general, I would say what they should... 11:20.040 --> 11:34.980 I would recommend possibly that if you're a game engine developer or you're working on Unreal and you think, oh, this could be a problem, it's not unreasonable to just say you shouldn't be able to use NAN in any argument. 11:34.980 --> 11:38.040 That's not going to happen under normal circumstances. 11:38.280 --> 11:44.260 And just essentially eliminate that from the serialization and deserialization process. 11:44.260 --> 11:48.780 Unreal doesn't do that because it wants to consider itself sort of impartial to that. 11:48.780 --> 11:53.640 Whatever goes in one end is deserialized on the other end. 11:54.000 --> 12:06.280 But I think it would be a pretty reasonable assumption to say if you're getting certain types of, say, floating point numbers, this is blatantly invalid. 12:06.280 --> 12:10.080 And we can probably just toss it out before we even consider anything else. 12:11.320 --> 12:15.780 Just a general input validation on what's coming in. 12:15.880 --> 12:17.720 Typical boring stuff. 12:18.560 --> 12:20.480 Isn't it that way? 12:20.540 --> 12:39.060 Well, so I don't really want to give away the punchline to your presentation because it fits so well, but we'll just kind of hand wave that and say, so when you've been doing this, how often do you get booted from whatever game you're playing? 12:39.060 --> 12:42.760 Or how many times have you had your accounts banned? 12:43.920 --> 12:48.820 When you're building your own stuff, you get banned less than you might expect. 12:48.820 --> 12:53.260 I did a talk last year on hacking, basically, browser games. 12:53.300 --> 12:58.440 And for one of the demonstrations, I took a game. 12:58.440 --> 12:59.580 I don't want to say its name. 12:59.580 --> 13:01.260 I've done enough to them. 13:01.560 --> 13:12.780 But I took this game and it has a global scoreboard and I just set my score to 1, 3, 3, 3, 3, 3, 3, 3, something, 7, and username to HiDefCon. 13:12.780 --> 13:14.600 And they banned me pretty quickly. 13:14.600 --> 13:16.760 I think that was pretty obvious. 13:16.840 --> 13:23.240 But in general, if you're building your own game hacks, there is a pretty good chance you're going to get away with it. 13:23.240 --> 13:25.520 So I get banned pretty rarely. 13:28.100 --> 13:30.620 So congratulations or I'm sorry. 13:30.940 --> 13:32.940 However you feel about that. 13:33.160 --> 13:34.540 It's a mixed bag. 13:35.560 --> 13:52.720 Where do you also often kind of see the line here along the same, I guess similar to what Fallible was just talking about, where the old question about research versus going over the line, because essentially you are affecting other users, potentially, 13:53.260 --> 13:54.960 as well as that game engine. 13:54.960 --> 13:59.300 So where is kind of your line on how far you'll go with your research? 13:59.360 --> 14:03.620 Or is it because it's in the name of research, you'll just go all the way with it? 14:03.620 --> 14:12.540 I mean, I won't do anything that's, I think, directly affecting someone spending money or someone or anything like that. 14:12.540 --> 14:15.860 I'm not stealing items from people in online games. 14:15.860 --> 14:17.660 That certainly crosses the line. 14:17.660 --> 14:28.720 But, you know, if someone's in a lobby of a first person shooter and someone wall hacks through and, you know, no scopes them in the head, I don't think they've been significantly harmed in any way. 14:28.720 --> 14:34.980 So I think that is within moral bounds for me. 14:34.980 --> 14:36.000 Excellent. 14:38.200 --> 14:46.360 Can you explain some of the technical setup that you have in order to capture the data that you're sending across? 14:46.360 --> 14:48.360 And what tools are you using? 14:48.360 --> 14:50.440 What's your lab look like? 14:50.440 --> 15:05.920 Yeah, so working with Unreal Engine especially, I needed to actually buy a new desktop to do because on the laptop I was working on, it took most of the day to compile Unreal from source. 15:05.920 --> 15:09.660 And I was doing that several times a day. 15:09.660 --> 15:13.660 So that was not good math working out there. 15:13.660 --> 15:22.780 So essentially, I do all of my Unreal development on Linux, which is a little less supported, but it's just more comfortable for me. 15:22.780 --> 15:39.340 And the other, I guess the other thing that's really a challenge is the specifically Unreal source is so big that trying to open it in most like project editors is, it does not work. 15:39.340 --> 15:55.520 VS code gets by just a little bit, but even then it gets tripped up when you try to go to this function or something like that, it'll end up, it'll spin its wheels for five minutes and say, yeah, couldn't find it, even though you know it exists. 15:55.520 --> 15:58.700 So I wish I had a better setup. 15:58.700 --> 16:05.060 I'm sure people who do actual video game development have better experiences with building Unreal from source. 16:05.060 --> 16:21.160 But I guess my lab is just, it's a system 76 desktop with the highest boxes checked on everything, just so that I can compile Unreal as many times as I want and it doesn't take me all day. 16:22.600 --> 16:28.960 So in that way, you're looking at the guts of the code, you're really building it each time. 16:28.960 --> 16:35.840 It's not a situation of you're just capturing everything in Wireshark and modifying it somehow. 16:36.400 --> 16:39.440 No, I wish it was a little easier. 16:39.440 --> 16:45.960 With Unet, you can get away with just looking at the traffic in Wireshark. 16:45.960 --> 16:55.080 Unreal is pretty difficult because everything is like bit aligned, so you'll have a string that starts four bits in and just looks like gibberish. 16:55.120 --> 16:59.840 So you really do have to be looking at it at the low level to really make any sense of it. 17:01.020 --> 17:02.320 That makes sense. 17:02.320 --> 17:05.440 And how does somebody get started with that kind of thing? 17:05.440 --> 17:09.520 Because this sounds extremely technical and you have to know quite a bit. 17:09.560 --> 17:21.060 How does somebody, where would be the entry point if somebody was interested in this kind of research in order to start figuring these kinds of things out, or if they wanted to just even look at how games work? 17:21.640 --> 17:36.200 Yeah, well, I mean, all the code is out there for Unreal Engine, but I don't think that's something you should just jump straight into, especially if you're not pretty familiar with C++, because it is a complicated code base. 17:36.200 --> 17:43.300 I think the best thing you can do to understand hacking video games is to build them. 17:43.400 --> 17:49.500 It's sort of a, I don't know, cliche answer, but that is what teaches you, oh, this is how that works. 17:49.500 --> 17:50.740 This is how I'd write it. 17:50.740 --> 17:55.420 This is probably how it looks on the back end. 17:55.540 --> 18:12.680 Also, I would say if you're going to look at games written in a particular engine, Unity games are pretty good because they're usually built, well, they're built with C Sharp and they're typically easy to decompile back to C Sharp with something like DN Spy, 18:12.680 --> 18:14.720 if I'm pronouncing that correctly. 18:14.720 --> 18:16.320 However, that's verbalized. 18:16.320 --> 18:30.920 So you can actually look at the code of the game, modify it, see what happens, and basically hack games without too much actual binary reverse engineering or anything like that. 18:31.620 --> 18:40.200 So we got a question from Jay that I'm going to obscure this a little bit. 18:40.200 --> 18:50.420 The question is way too specific, so let's go more along the lines of where else would be interesting to look? 18:50.420 --> 19:02.340 If you were done with the research that you've done so far and you were looking for a new product, what would be the things that would draw you to a new product? 19:03.900 --> 19:14.360 Yeah, so one thing I would say is that when you look at Unity, there are a lot of different multiplayer solutions. 19:14.360 --> 19:22.460 So I looked at UNet, which is sort of the... it's provided by Unity, but there are third-party solutions that are pretty common. 19:22.820 --> 19:31.320 Photon, Mirror, I haven't looked at those at all, and I think that there's a pretty solid chance that the same kind of bugs apply there. 19:31.460 --> 19:42.160 And then I think most of the research I did, obviously I'm just looking at the core engines for games, but looking at specific games, you can find these exact same bugs. 19:42.160 --> 19:46.880 They just may not apply to other games. 19:46.880 --> 19:49.180 So I think most of this research still applies. 19:49.180 --> 19:55.980 It just needs to be targeted either at different games or different multiplayer protocols, even different game engines. 19:55.980 --> 19:58.380 Game Maker, there are... 19:58.380 --> 20:00.900 Well, I think I've looked at the two more common game engines. 20:00.900 --> 20:02.960 There are other engines out there. 20:04.100 --> 20:09.780 In other words, just find another big target and play, or just go and learn something. 20:09.780 --> 20:13.240 If you happen to be using a game, then this might be a good opportunity. 20:14.540 --> 20:24.820 Hawkeye Dank asked another question about the outcome of your work, and he wants to know if you've managed to pull any bounties for this. 20:25.720 --> 20:30.500 Yeah, I turned down bounties for a few things because I wanted to talk about them. 20:30.500 --> 20:37.300 If I was really min-maxing it, I probably would have accepted bounties for a few more, but you never know. 20:37.760 --> 20:43.860 So yes, Unity and Epic Games were both really good about this. 20:45.400 --> 20:48.640 Epic has HackerOne program. 20:48.640 --> 20:55.380 Unity, you want to just go straight to their security at unity3d... whatever, I don't want to give you the wrong email. 20:55.380 --> 20:57.440 Security at email address. 20:57.440 --> 20:59.800 But both were awesome to work with. 20:59.800 --> 21:06.380 I would highly recommend it, and yes, there is definitely money to be made. 21:07.120 --> 21:10.700 And you've looked at the Unreal and Unity engines. 21:10.700 --> 21:14.200 Are there any others that you've looked at or found bugs with? 21:15.660 --> 21:25.900 I have done a fair amount of reverse engineering on GameMaker, which is one of the more common engines, certainly less than Unity or Unreal. 21:26.200 --> 21:36.040 Not from a security perspective, just from a how do I hack this game or how do I mod this game aspect. 21:36.400 --> 21:44.920 I guess one of the problems is that some of these smaller engines don't provide you the same tools. 21:44.920 --> 21:51.400 They may not have an entire networking solution, so there's less places for bugs to be hiding. 21:51.460 --> 21:55.680 That's why I think Unity and Unreal were such good targets. 21:55.680 --> 22:00.100 But I do think there is opportunity for bugs in those other engines. 22:00.100 --> 22:03.100 I just really haven't done the work in that context. 22:03.100 --> 22:06.980 And have you also looked at the individual games itself? 22:06.980 --> 22:13.540 And what's really the difference between trying to find vulnerabilities in the game engine and a specific game? 22:14.300 --> 22:20.500 I guess usually the difference is whether or not you're going to have an easily accessible source. 22:20.640 --> 22:29.200 So Unreal Engine games, like reverse engineering an actual released Unreal Engine game can be pretty tedious because you're not looking at the source. 22:29.200 --> 22:32.320 You're not typically even looking at something with symbols. 22:32.320 --> 22:36.720 You're just looking at a gigantic blob in Ida or Ghidra. 22:37.120 --> 22:39.820 But I have had some success there. 22:39.820 --> 22:43.720 I don't want to burn bridges, so I'm just going to leave it at that. 22:44.320 --> 22:53.740 But I guess the main difference is just how much effort goes into reverse engineering. 22:56.540 --> 23:00.160 This sounds like a pretty specific question, but we'll toss it out there. 23:00.160 --> 23:05.040 So thoughts on cheat engine or memory scanners as a toolkit from beginners? 23:05.040 --> 23:07.080 That's from Ethics. 23:08.460 --> 23:09.960 Cheat engine is awesome. 23:09.960 --> 23:11.620 It's how I started learning. 23:11.620 --> 23:21.180 My talk last year was on essentially applying a lot of the methods and techniques of cheat engine to WebAssembly, so games in your browser, basically. 23:21.180 --> 23:23.060 So I think cheat engine is great. 23:23.080 --> 23:31.800 It is a problem that as game engines get more secure, those techniques don't work as well. 23:31.800 --> 23:44.600 To give a general example, what cheat engine generally does, what you're usually doing with it, is you look for something like your health and you say, OK, I'm looking for something in memory that's 100. 23:44.600 --> 23:51.980 Then I take some damage and say, OK, of all those values that used to be 100, which one is now 87 or something like that? 23:51.980 --> 23:56.620 And that helps you find the value in memory that corresponds to your health. 23:56.620 --> 23:58.940 And then you can manipulate that. 23:59.360 --> 24:01.900 Give yourself more health, whatever. 24:02.200 --> 24:07.400 But as games take trust away from the client, that process doesn't work anymore. 24:07.400 --> 24:14.320 You can manipulate your health client side, but the server still knows you have 87 health, not 10,000 or whatever. 24:14.400 --> 24:23.520 So, I do think if you're looking at the right games, that is a great way to get into game hacking and understand those basic concepts. 24:23.520 --> 24:38.060 But it's not going to work on PUBG or something where someone has put a conscious effort into making it secure and something that's come out in the last five years, a decade, something like that. 24:38.060 --> 24:58.500 And how much now are the developers trying to go with more, I don't know if it's the right term for it, the thin client, so that people can't really make changes in the client side or in their mobile device phone and give myself a million lives or a million gems or coins or anything like that and trying to keep all of that on the server. 24:58.500 --> 25:03.360 How much of that do you kind of see with the games and the servers? 25:03.980 --> 25:10.580 In my experience, it's really just whatever the engine does, the developer will follow. 25:10.720 --> 25:20.740 Unreal sets you up really well to build an architecture where those game hacks don't work or are exceptionally difficult. 25:20.740 --> 25:23.960 And so you see developers doing a pretty good job. 25:24.460 --> 25:36.060 Unity does not set you up quite as well from the start, and so you'll see the majority of those, I guess we'll call simple attacks, do often work. 25:36.320 --> 25:40.620 That's not to say that you can't build a secure architecture on Unity. 25:40.620 --> 25:50.780 It just means that Unity's not doing the work for you, and like I said, developers will typically follow what the engine does. 25:50.780 --> 25:57.280 So as the core software, as the water level rises, developers get better at it as well. 25:57.360 --> 25:58.240 Cool. 25:58.340 --> 26:10.800 Is there anything that you didn't get a chance to put into your presentation that is additional research that you might have done, or are there any kind of other areas that you think other people might be able to add on to the research that you've done? 26:11.320 --> 26:14.080 Yeah, so a couple things come to mind. 26:14.080 --> 26:17.600 The first is the floating point bugs I talked about. 26:17.600 --> 26:19.720 I think that can apply a lot. 26:19.980 --> 26:26.400 I very briefly mentioned this, but that attack does actually apply to Unity. 26:26.400 --> 26:30.200 The difference is that you don't need to speed hack Unity. 26:30.200 --> 26:37.460 You can just, or at least by using the core components that are provided for you, you can just tell it, I'm at x, y, z. 26:37.600 --> 26:45.620 And if you tell it I'm at nan, nan, nan, you get teleported to this weird dimension where everything is infinitely small. 26:45.620 --> 26:46.400 It's kind of cool. 26:46.400 --> 26:47.680 It's not very useful. 26:47.920 --> 26:55.280 So I think that kind of attack applies to a lot of things, and I'd like to see where else it goes. 26:55.340 --> 27:08.560 Something else that I feel like I wanted to do, but I didn't quite find all the pieces, was I found a number of memory corruption bugs, like buffer overflow, stuff like that. 27:08.560 --> 27:25.180 And a lot of those seemed like they would be good for turning something into remote code execution, but the problem that I was always running into is I couldn't imagine a situation where you were looking at a game server and you knew what it looked like on the back end. 27:25.180 --> 27:36.180 So a memory corruption exploit requires some knowledge of memory, of the layout of memory, where code is, gadgets, stuff like that. 27:36.180 --> 27:40.000 And while you may have a copy of the client, you don't have a copy of the server. 27:40.000 --> 27:55.220 And so even if you can bypass all those difficult protections, ASLR, stuff like that, I just couldn't imagine a scenario where I could turn one of these into an RCE exploit on an actual server. 27:55.220 --> 28:08.540 And so that's why I felt a little disappointed in myself, because I had what felt like good bugs, but it didn't feel practical to turn them into an exploit that would work in the real world. 28:08.660 --> 28:11.560 So I would love to see someone actually pull that off. 28:12.380 --> 28:16.760 So we are right down to the bare end of this thing. 28:16.760 --> 28:17.720 So two questions. 28:17.720 --> 28:26.320 One is, would you be willing to post places that people can find you later, whether that be an email or a website or Twitter? 28:26.340 --> 28:29.780 We can do that in the TrackOne channel at the end of this. 28:29.780 --> 28:37.600 And two, if you were to leave us with a call to action, something you would like us to consider as we're moving forward. 28:37.600 --> 28:38.880 I've been asking this of everybody. 28:38.880 --> 28:40.180 I kind of like this question. 28:40.180 --> 28:44.120 What should we take away from this and in our own work? 28:44.120 --> 28:47.220 And how can we translate your stuff into ours? 28:47.220 --> 28:48.660 What would you want us to do? 28:49.240 --> 28:50.700 Yeah, so absolutely. 28:50.700 --> 28:52.420 I will post my GitHub. 28:52.420 --> 28:55.420 It is on the slides as well, but I'll post it again. 28:55.420 --> 28:57.600 My email address is there too. 28:57.600 --> 28:58.200 Hit me up. 28:58.200 --> 28:59.780 I've already had a few people. 28:59.780 --> 29:05.360 I've had a couple of really interesting conversations, so I really appreciate it when people reach out. 29:05.360 --> 29:06.420 And I don't know. 29:06.420 --> 29:16.680 If I could ask for anything, it would be that if you're a security person, you work pen testing or whatever, try hacking video games. 29:16.680 --> 29:17.760 It's fun. 29:17.760 --> 29:22.020 I know you probably like video games because you're a nerd and you're at DEF CON. 29:22.020 --> 29:23.340 So am I. 29:23.340 --> 29:24.500 Try it. 29:24.500 --> 29:26.380 It's rewarding. 29:26.740 --> 29:28.860 It gets your adrenaline pumping. 29:28.860 --> 29:31.080 And getting banned is fun too. 29:31.100 --> 29:33.520 So that's my recommendation. 29:33.520 --> 29:37.440 If you haven't ever gotten banned from a video game, give it a shot. 29:37.720 --> 29:38.540 Awesome. 29:38.580 --> 29:40.560 Well, thank you so much for doing this, Jack. 29:40.560 --> 29:44.840 Appreciate you taking the time to be with us and really enjoyed your presentation. 29:44.840 --> 29:47.760 Hopefully everybody else goes and checks that out. 29:47.760 --> 29:49.280 So thank you so much. 29:49.480 --> 29:50.300 Yeah, thank you guys. 29:50.300 --> 29:51.280 This was fun. 29:51.920 --> 29:52.660 All right. 29:52.660 --> 29:56.280 We will be back in about 30 minutes with another speaker.