Another exploit - Wholly Unsecured Database

**Corrderio** · 2013-10-14 12:51

With how much of a dud V1 was and how much money they put into that and V2 I guess they really didn't want to take any risks in losing customers. I know it sounds retarded, but SE has a lot riding on the game.

**OnlyAura** · 2013-10-14 13:17

Originally Posted by Cutriss

This isn't even an error. That's what makes me skeptical. You have to go out of your way to do something like this.

Why would the client ever say "Oh, by the way, give me money."? It shouldn't! The server should say "Oh, by the way, you just got some money." It'd be *SLOWER* to have the client do this because the client would have to know what the conditions are for each "give me money" request are. Why would the client need to know that at all?

The only things the client should ever be doing are telling the server what buttons the player pushed. It's a waldo, nothing more. All this chatter about people "telling the game to give them money" is just nonsense and screams "debug tools that didn't get turned off" to me.

Ahh, but guess what happens when you stick a bunch of shitty server programmers into a room? Answer: They produce a mess that can't scale. The more stuff the server has to do, and the more decisions it has to make, the more scalability will be a problem. By offloading lots of work to the client, server instantly becomes more scalable. Obvious this is an unacceptable solution to the scalability problem, but just giving one example of why it might happen.

I just really hope that what we're looking at isn't an honest to god sql query, and that instead we're looking at a syntax that is modeled after sql but has much less capabilities. Because if it is sql, and they're actually sending that shit straight to the DB, then god help us when someone says "update character set level = 1" and literally nukes the entire server.

Sadly, I don't see much of a best case scenario here. Even if this isn't direct sql, it's still the case that the client is telling the server when to adjust its stats. that's a fundamental design problem, and there's no fixing that without what is most likely to be a massive refactor.

**Sephiroth** · 2013-10-14 13:22

How would they even know SE's database structure? If they're smart they'd give the tables and columns names that you'd never guess.

Originally Posted by Damane

i am still confused why there wasnt an emergency maintance and why it didnt get fixed immidiatly. Whats SEs Strategy? in 11 they would have shut the servers down and would have opened them when it was fixed. good lord we had their emergency maintances for stuff that werent so grave like this and they took 12 hours to fix. I am really confused and discouraged atm to the point where I am not sure if i still should sub to the game because the dmg is only getting bigger

They must have a good reason. I remember even 1.0 had emergency maintenances for stupid shit like changing the NPC sale price of items and that's a game they had stopped caring about.

**OnlyAura** · 2013-10-14 13:24

Originally Posted by Sephiroth

How would they even know SE's database structure? If they're smart they'd give the tables and columns names that you'd never guess.

They must have a good reason. I remember even 1.0 had emergency maintenances for stupid shit like changing the NPC sale price of items and that's a game they had stopped caring about.

Because they're able to see the JSON queries being sent across in plain text during normal operation of the game. By examining the json queries, they can see the queries SE is sending to the DB, and reverse engineer the table structure from that.

**Cairthenn** · 2013-10-14 13:42

"Sent across in plain text" read "I have no idea what I'm talking about".

**OnlyAura** · 2013-10-14 13:52

Originally Posted by Cairthenn

"Sent across in plain text" read "I have no idea what I'm talking about".

Because they're able to see (the JSON queries being sent across) (in plain text).

You interpreted my statement as:

Because they're able to see (the JSON queries) (being sent across in plain text).

Does that help?

**Titanss** · 2013-10-14 14:03

Still waiting on proof, or poof

**kmexe** · 2013-10-14 14:08

So the game is made on JavaScript? Oh god!

**Fievel** · 2013-10-14 14:08

Originally Posted by Titanss

Still waiting on proof, or poof

Please poof

**OnlyAura** · 2013-10-14 14:22

Originally Posted by kmexe

So the game is made on JavaScript? Oh god!

Err, no I don't think the game is made in JavaScript. where are you getting that from? JSON does not imply JavaScript, it's just a data definition language, like XML or even CSV. Anything can parse JSON, and it's quite common in all manner of applications.

That being said, if the scripting engine portion of the game were written in JavaScript, it wouldn't surprise me (although I think I saw a mention of Lua somewhere), nor would it be that big of a deal.

**Damane** · 2013-10-14 14:45

Originally Posted by Hyan

I don't even want to say this because it's like saying water is wet but....

Maybe this isn't a problem that can be fixed in 12 hours?

So in other words the game is doomed?

**Eurell** · 2013-10-14 14:50

Originally Posted by Damane

I am really confused and discouraged atm to the point where I am not sure if i still should sub to the game because the dmg is only getting bigger

I know this is a big problem and agree it needs to be fixed. But honest question, if you hadn't seen this on forums, would you even know it was going on? Has it actually had an impact on you in game, that it makes you so worried about the "dmg only getting bigger"?

Again, I do agree this shit needs to be fixed asap. But I havent noticed anything about this in game that has affected me or anyone I know at all.

**Raldo** · 2013-10-14 14:51

I do wonder if they fixed the issue during the bannings, and didn't even want to admit it to avoid the PR bungle.

**shepardG** · 2013-10-14 15:01

Some of the issue was fixed (item Id swaping) etc. the general security of the Dbase on the other hand is still ... Questionable.

**Damane** · 2013-10-14 15:02

Originally Posted by Eurell

I know this is a big problem and agree it needs to be fixed. But honest question, if you hadn't seen this on forums, would you even know it was going on? Has it actually had an impact on you in game, that it makes you so worried about the "dmg only getting bigger"?

Again, I do agree this shit needs to be fixed asap. But I havent noticed anything about this in game that has affected me or anyone I know at all.

its more psychological, with this exploit i kind of lost my drive to play the game serious and competitiv at all. Its like something tells me that the achievements/competition is worthless in game because everyone can just cheat their way up with this on basicly anything, from lvling, to gil ,to gear. I am barely loging in every 3 days just because I think now its a waste of time (which basicly is poopshit because every MMO is a waste of time) and I am running against windmills. The fact that I am not playing on the same server as my friends adds even more to that. :/
The game is/was fun and now yet not so, because I feel like all the competition and achievement part got riped out of it due to the exploit. Thats how I feel/think about it atm.

**Hyan** · 2013-10-14 15:05

Originally Posted by Damane

So in other words the game is doomed?

I don't know how long it takes to fix. What I do know is that had I not heard of this shit happening I would not have noticed a difference in-game to this day.

I'm sure many people will get away with this (those who don't abuse it enough to show in SE's radar), but so far I don't see the game being ruined because of this. Who knows what happens in the future.

Doomed to you personally? Only you can know that.

**Sho** · 2013-10-14 15:08

Originally Posted by Fievel

Please poof

http://www.ffxiah.com/player/Fairy/Poof

http://www.bluegartr.com/threads/457...e-was-Poof-(bc)

?

I hope you're happy.

Also, I think you guys are taking this hacking stuff too seriously. It's just one month in. I'd say panic at 6 months or something if things aren't being resolved. This is the typical MMO cycle, post 2008.

**Fievel** · 2013-10-14 15:13

Originally Posted by Sho

http://www.ffxiah.com/player/Fairy/Poof

http://www.bluegartr.com/threads/457...e-was-Poof-(bc)

?

I hope you're happy.

Also, I think you guys are taking this hacking stuff too seriously. It's just one month in. I'd say panic at 6 months or something if things aren't being resolved. This is the typical MMO cycle, post 2008.

I am not appeased

**OnlyAura** · 2013-10-14 15:17

Originally Posted by Sho

http://www.ffxiah.com/player/Fairy/Poof

http://www.bluegartr.com/threads/457...e-was-Poof-(bc)

?

I hope you're happy.

Also, I think you guys are taking this hacking stuff too seriously. It's just one month in. I'd say panic at 6 months or something if things aren't being resolved. This is the typical MMO cycle, post 2008.

It's the nature of the hack that's more troubling than anything else. I admit that to a non-technical person this doesn't look any different than any other hack, but it is. It implies such a complete lack of technical oversight and/or technical competence that I think it's safe to say that hacks will be fairly rampant for the game's entire life. It doesn't matter if they fix this one. The fact that it exists tells us everything we need to know.

**Izzy** · 2013-10-14 15:17

Originally Posted by Titanss

Still waiting on proof, or poof

BG mod asking for proof, when posting proof would get you banned from BG.

IT'S A TRAP

Thread: Another exploit - Wholly Unsecured Database

Thread Tools

Latest Threads

Up & Coming Threads

Hottest Threads