Another exploit - Wholly Unsecured Database

**lilbubbles** · 2013-10-14 16:12

Originally Posted by kmexe

So the game is made on JavaScript? Oh god!

While JSON originated from javascript, it is use by other languages. In the case of ff14, Lua.

There is also nothing wrong with json or having them "in plain text", the server just needs to verify that the queries are legit

**Kelenae** · 2013-10-14 17:48

Originally Posted by lilbubbles

While JSON originated from javascript, it is use by other languages. In the case of ff14, Lua.

There is also nothing wrong with json or having them "in plain text", the server just needs to verify that the queries are legit

But this is SE we are talking about. We must more hard on SE then any other company.

**feardragonx** · 2013-10-14 18:13

This all sounds like an inside job...

**Izzy** · 2013-10-14 18:26

Originally Posted by feardragonx

This all sounds like an inside job...

I feel like I should say something, but the right words aren't coming.

**C_C** · 2013-10-14 19:27

Originally Posted by Titanss

Still waiting on proof, or poof

I have video but I can't post urls yet. If someone wants too do it for me send me a PM.

**Kuishen** · 2013-10-14 19:29

**C_C** · 2013-10-14 19:33

Lol I can't even pm links. I'm an idiot.

**Kuishen** · 2013-10-14 19:35

Anticlimactic.

**Ksandra** · 2013-10-14 19:45

just put a space in the link.

**Tajin** · 2013-10-14 19:46

You can separate the links with spaces and remove the http

**Cairthenn** · 2013-10-14 19:54

You could say it in BG Chat, or do what Ksandra said.

**C_C** · 2013-10-14 20:14

youtu be/eIooSi8PAGg

**Tajin** · 2013-10-14 20:16

http://youtu.be/eIooSi8PAGg

**Day** · 2013-10-14 20:18

who is gill? glad he's not an issue in your life.

**Tajin** · 2013-10-14 20:22

Fucking MMO interface and small phone screen I cant see shit lol

**Ezek** · 2013-10-14 20:25

The item replacement video linked earlier was hotfixed 2~ weeks ago. Just to demonstrate how utterly terrible SE is at security, all you had to do was run something super basic like Cheat Engine and just replace item ids as you bought items (you can easily find said IDs via ffxivdb).

The leve turn in exploit has nothing to do with JSON or the database - that's classic misinformation spread by people trying to cover their exploit so that it lasts longer. If stuff is fixed tonight I'll release more details, but I highly doubt it will be considering how covered up this is + hard to track (you can mask your time stamps via the same method). I have no idea how they would fix this; they'd likely have to recode the entire interaction between server and client to have any effect.

I haven't personally used any of the above, but it's pretty interesting to see how lacking in security FFXIV is. I kind of wish I had though, cause the people that item id swapped Allegan/AF+1 armor before it was hotfixed were never touched by GMs. Seems like SE only went after the people that went full retard and made millions of gil from duped Allegan pieces. Or maybe they're actually tracking them and we're currently en route to Salvage bans 2.0, who knows.

edit: inb4 "lol no screenshot no proof"

**Tajin** · 2013-10-14 20:37

Fucking lol with the timestamps.

**Kuishen** · 2013-10-14 21:02

So that explains the level up picture then, because I assume that's also giving you exp.

**Niiro** · 2013-10-14 22:45

He's wearing ALC AF so he's already 50, so yea it wouldn't show up.

**Heatsink** · 2013-10-14 23:15

Originally Posted by feardragonx

This all sounds like an inside job...

This is so insane, I feel like mangling a proverb in light of your post:

If it were anyone besides SE this would have to be attributed to malice instead of stupidity.

Thread: Another exploit - Wholly Unsecured Database

Thread Tools

Latest Threads

Up & Coming Threads

Hottest Threads