Another exploit - Wholly Unsecured Database

[Ksandra]

Did someone bug something up? Perhaps. By what's being claimed to be going around? Skeptical.

Ya the best solution to a website bug is to ban the player ingame.

Really, this is the kind of tin foil hat I am talking about.

[arus2001]

Sorry I'm looking for the difference between a theory and a hypothesis, then. If the latter's good enough for you, cool.

[Kincard]

It depends on how technical that D3 duping bug you're mentioning is. For someone like me who has 0 programming experience I'm sure even figuring out something like this that people are calling "simple" would probably be tons of trouble for me (I didn't know what JSON even was until I looked it up). You bring up a good point though I suppose, I'm a bit surprised there isn't someone with programming knowledge that's feeling mischievous enough to just buy everything off the market boards and throw his entire server into chaos. Apparently there's a few people here with first-hand experience though, and it's not the random 5-post chucklefucks that are obviously trolling.

Your avatar horrifies me.

Yeah, Steve Buscemi is pretty scary sometimes.

[Darkmagi]

All I'm giving you guys is that this is 100% actually a thing. I will not provide pictures, you'll have to take my word for it.

[Kincard]

Please pass message to your friend
1. Generate 10 trillion billion gil
2. Buy every single item off the Market Boards
3. Walk around town giving away gil for no reason
4. Take screenshots
5. Wait 1 month
6. See everyone on the server get suspended and gil confiscated
7. Post screenshots on OFF
8. ???
9. Profit!

[Fievel]

All I'm giving you guys is that this is 100% actually a thing. I will not provide pictures, you'll have to take my word for it.

Will you just tell me how many PM's you've received?

[Eanae]

And those are the ones that I think are being idiots. Eanae is a reddit mod, it was all over the place in there when people found the link.

Again, iono how to make this clearer. I really don't care if you wanna debate the how. Even if people figured it out, I probably wouldn't understand the specifics because I am not technical like that. So if you wanna sit there and go off about SQL/HTML/AOL.com/whatever the fuck the lingo is, more power to you. I am not even remotely going to step into that convo, because I fully admit I don't know anything related to that.

I do however, think people are tin foil for thinking this didn't happen/isn't happening at all.

Nothing other than the pictures in the OP have popped up on reddit.

[Darkmagi]

Will you just tell me how many PM's you've received?

lol strangely none so far

[Fievel]

lol strangely none so far

Wow, I'm seriously shocked lol

[Anton]

Nothing other than the pictures in the OP have popped up on reddit.

The post I put in the OP described a cheat by means of packet editing, as the SE database does not verify what clients tell them to. I played XI and lived through all the garbage that was wrong with that game - they adjusted En-spells once and broke totally unrelated things. AFAIK, it's within the realm of possibility that SE cannot code properly.

The game is rife with bots and it's not even month 1 yet, something that shouldn't be possible unless SE's security standards are lax.

That ownedcore website threatening Kincard? They've got about 5 do-anything FFXIV bots already up and running.

I saw the Chocobo Roegadyn's lodestone page when someone made a mention of it on the OF - funny how we're now saying "too bad he's banned".

No fewer than three people in this thread have confirmed that this is real, and have either used/tested it or known people who did.

The post linked in the OP also describes an item-swapping hack using the same overall methodology - it's not a separate issue.

I suppose it's possible that I've been completely, utterly, bamboozled by all this, but based on what we've seen and known how can you doubt it?

--------------------------------------------

Why was so much gil removed from the game within the first month, but people who had their gil adjusted were mostly allowed to walk away? If they were criminals, why not ban them? Based on what I've seen so far (and this is now entering opinion/speculation stage), I have a hypothesis - as mentioned in the OP, to catch these guys requires a thorough search of the server logs. Also, if you use the same script that the game uses, the legitimate and illegitimate requests look alike. I think SE saw the gil bubble, maybe even caught the dummies with the "Requesting: 3,000,000,000 gil" logs, but couldn't prove the majority of people suspended had used the exploit. Their response to suspend people with oodles of gil, simply removed the "fake gil" bubble, and then let the people play makes more sense in this context.

Either way, FFXIV still has to deal with this crap:
http://www.tault.com/wp-content/uplo...FXIV-Radar.jpg

[arus2001]

It depends on how technical that D3 duping bug you're mentioning is. For someone like me who has 0 programming experience I'm sure even figuring out something like this that people are calling "simple" would probably be tons of trouble for me (I didn't know what JSON even was until I looked it up). You bring up a good point though I suppose, I'm a bit surprised there isn't someone with programming knowledge that's feeling mischievous enough to just buy everything off the market boards and throw his entire server into chaos. Apparently there's a few people here with first-hand experience though, and it's not the random 5-post chucklefucks that are obviously trolling.

I'll just principally say the D3 incident was "easier" by virtue of not needing a third party program or a modicum of code know-how. Pretty much just an easier follow Steps A, B, C kind of deal. And understandably Blizz had the servers down within 12 hours of that patch. On the XI front, I can't recall how swiftly SE reacted to the Tav NPC resale glitch, but you can bet that once word got out things went down, too, bans/suspensions to follow. Botting aside, that was probably the most dramatic issue XI faced on the economic end. Well, maybe duped kclubs, too.


People picking the game apart like the above doesn't surprise me, either. Though I'm not sure it's much of an argument to fault XIV for having bots in week 1 when every MMO seems to get them in one iteration or another, even if it's just some dude multi-boxing with log parsers.

[Cairthenn]

You can't really "do" anything about that sort of thing, unless you specifically mean pos hacking.

[Kelenae]

Honestly, I fully expect people to make bots the first week of a new mmo. There is no escaping that.

[Hyan]

I'm guessing that they're working on it, they're apparently scared enough of hack that they decided to ban one of the guys here off their forums for posting it as a bug report, as well as deleting multiple threads about it (Why would they keep deleting these threads specifically instead one of many "SE is still shitty after 10 years so i'll keep buying their games" threads)

Yeah I got temp banned from the forums for posting a thread that vaguely mentioned "hacking" in the op. lol got a mail with made-up bs "reasons" for why I was banned.

[OnlyAura]

As someone who worked on the server for an online game, things like this make me sad. I mean this is literally the most idiotic and basic error you can make, and it implies that the server programmers are literally the worst of the worst.

Still waiting for someone to try "update character set gil=0" (note the lack of a where clause)

[Ceelo_Mage]

Yeah I got temp banned from the forums for posting a thread that vaguely mentioned "hacking" in the op. lol got a mail with made-up bs "reasons" for why I was banned.

I got a similar ban from forums and never even got the email regarding why i received the temp ban

[Cutriss]

As someone who worked on the server for an online game, things like this make me sad. I mean this is literally the most idiotic and basic error you can make, and it implies that the server programmers are literally the worst of the worst.

Still waiting for someone to try "update character set gil=0" (note the lack of a where clause)

This isn't even an error. That's what makes me skeptical. You have to go out of your way to do something like this.

Why would the client ever say "Oh, by the way, give me money."? It shouldn't! The server should say "Oh, by the way, you just got some money." It'd be *SLOWER* to have the client do this because the client would have to know what the conditions are for each "give me money" request are. Why would the client need to know that at all?

The only things the client should ever be doing are telling the server what buttons the player pushed. It's a waldo, nothing more. All this chatter about people "telling the game to give them money" is just nonsense and screams "debug tools that didn't get turned off" to me.

I'm not saying the hacks didn't happen, it's plainly evident they did, but the idea of anyone leaving a control panel like that accessible to the outside world is just ridiculous.

As far as the sessionID thing goes, they probably just never got around to implementing a session hand-off system so that a session could be replaced and the old one expired. Easy to do that on zone, treat both as valid until the client acknoweldges receipt of the new one and then all traffic changes keying to the new session. Again, solved problem, IM platforms have been doing that for years.

The timestamps all happened within a 1 second timeframe, the game is probably hard-wired to give the level up message regardless so it gave them all to him. There's nothing weird about that.

I don't remember, did it work that way in Beta when you got your level bumped up or you unlocked Gladiator? I don't think it did.

[Sephiroth]

I don't remember, did it work that way in Beta when you got your level bumped up or you unlocked Gladiator? I don't think it did.

It did, because the NPC gave you say 600000 EXP and that would just roll through the levels until the 600k or whatever was used up.
It's possible that the leveling hack is a case of changing the EXP values for a trade in rather than "give me level 50".

[Damane]

i am still confused why there wasnt an emergency maintance and why it didnt get fixed immidiatly. Whats SEs Strategy? in 11 they would have shut the servers down and would have opened them when it was fixed. good lord we had their emergency maintances for stuff that werent so grave like this and they took 12 hours to fix. I am really confused and discouraged atm to the point where I am not sure if i still should sub to the game because the dmg is only getting bigger

[Hyan]

I don't even want to say this because it's like saying water is wet but....

Maybe this isn't a problem that can be fixed in 12 hours?