Another exploit - Wholly Unsecured Database

[Rocl]

pls dont misuse that horse gif

[Ksandra]

Yeah I dont see how ANY of you fucks can justify SE banning legit players for anything (anything not involving them), something seriously wrong with ya'll.

To be fair, banning and temporary suspension is not the same thing. afaik no legit players were permabanned. And more than likely there are players that got away with it, if they kept things in small amounts.

Three days to try and sort things out isn't exactly the end of the world.

[Waraji]

Damnit, just when I started having fun in that one thread.

[Tajin]

The suspension-gil-removal action makes a lot more sense if the database exploit has been ongoing and SE truly has no current, effective method of tracking and reversing its effects. Since the most harmful effect of the exploit is the generation of gil, they just ban the most egregious offenders and divide everyone else's wallet by 100, and probably will do so again until a real fix comes along.

Yeah I guess once you accept the fact SE is full of lazy fucks, it does make sense...

[Anton]

There goes another thread. If only their mods were this active replying to things and they are combing these threads out of their forums

[Corrderio]

Three days to try and sort things out isn't exactly the end of the world.

Wasn't it actually longer? I think some people were suspended for nearly a week.

[Tajin]

To be fair, banning and temporary suspension is not the same thing. afaik no legit players were permabanned. And more than likely there are players that got away with it, if they kept things in small amounts.

Three days to try and sort things out isn't exactly the end of the world.

Funny you use 'fair' in your post.

[Ksandra]

Funny you use 'fair' in your post.

Ya we should just exaggerate like crazy instead of talking about what actually happened.

[edit] I am not even saying I agree with how SE handled it, but I don't like the river of tears people have over it, either.

[datkoops]

I've heard responses varying between "This is a quick adjustment to how the server handles packets, shouldn't be a problem" to "This is such a gigantic programming blunder, FF14:ARR will be piss-easy to hack for its entire lifetime due to its coding and would need a full rebuild - again"

I'm no programmer

I program APIs and junk. It really depends on how modular their code is.

One would reckon that all database calls in the game are handled by one client module. You'd have to update the module to at least pass along some sort of live authentication (session ID), and you'd have to update the API (server-side listener guy) to accept this new authentication. The thing that worries me is that, according to the other thread mentioned earlier, they are not retiring their session IDs in any kind of timely manner (if at all?). This means that, as of now, the session ID is about as secure of an authentication you're going to get, and it's not secure at all. So simply passing along the user's session ID is adding one more step to a hacker's process... get session ID (already outlined as very easy).

I'm not really into security, it kinda bores me. But yeah, they need an entire new process for client/server authentication so we have more secure sessions. Game code wise, it's very minimal to update the client to pass a session ID to the server, assuming (big assumption?) they have a nice modular piece for calling the API. Implementing a whole new client/server authentication piece? I'm not sure how much effort that takes, I get sleepy just thinking about it.

[Raineer]

/golfclap

Have no idea how I feel about it. You're stealing, but it's not from SE. It's from RMT fucktwats that you have spent years (11 for me) fighting across a legion of MMOs.

lawyers be lawyerin' ... SE could probably make a powerpoint showing how they were damaged, except that they really weren't. If they just added a fucking "blacklist person" to the right-click action on a name in chat, 99% of us would not have given two shits in the early weeks of the game. Over time this would get out and break things, but again some programming skills could have corrected that as well.

This is truly fantastic though. Everyone claiming a moral high ground here needs to step back a sec. This is likely 6-figure money that doesn't have a whole lot of legal precedence, combined with the fact the people you're ripping off likely don't live in the same country as you. I wouldn't be too worried about INTERPOL or the UN getting up in my shit. /golfclap again I say

edit: Thinking about it again, it's only slightly different from what all the RMT do in the first place. Teleport bots are sending modified packets back to the server. This hack sends modified packets to the server. You think SE is prosecuting all those RMT organizations? Pretty damn sure I would have done this on a smaller scale were I clever enough to look into it and try it.

[Rocl]

There goes another thread. If only their mods were this active replying to things and they are combing these threads out of their forums

pretty sure their modsquad on the OF doesnt program the game

[Waraji]

Anyone want to start talking about the exploit in this thread?

http://forum.square-enix.com/ffxiv/t...ot-be-restored.

See if we can get it Deleted too? Dumb thread is dumb, not that I give a shit what goes on OF, but it would be kind of fun to watch.

[The Blackrose]

Anyone want to start talking about the exploit in this thread?

http://forum.square-enix.com/ffxiv/t...ot-be-restored.

See if we can get it Deleted too? Dumb thread is dumb, not that I give a shit what goes on OF, but it would be kind of fun to watch.

This is what is known as pissing in the popcorn. Please refrain from doing so.

[Waraji]

I have enough with watching Spider-Dan and Elcura ripping each others throats out in that other one thread. Who needs OF when you have that unadulterated, ongoing content.

[Anton]

pretty sure their modsquad on the OF doesnt program the game

I just wish they made actual posts to topics at the rate they're deleting posts and threads. The 90 page lag thread was visited all of once by a guy who A. unlocked the thread cause another mod locked it, B. said "please enjoy talking about endgame!" and missed the whole point of the thread.

Also, the and was supposed to be a than

[Carth]

Forgive my ignorance, but is RMT even illegal in the first place? It is against the Terms of Service, but that only goes against SE's policies.

[blythe]

Because all the OF threads keep being deleted - what has been SE's official response to this?

I know they were banning high gil accounts earlier, but I thought that was related to RMT - is it rather that they think they were duping?

[Korialstrasz]

Because all the OF threads keep being deleted - what has been SE's official response to this?

Sweep it under the rug and pretend it isn't happening until after they fix it. Can't blame them, as the more people that learn how to do this, the more damage that will be done until it is "fixed".

[solracht]

Because all the OF threads keep being deleted - what has been SE's official response to this?

official response

[Ksandra]

Forgive my ignorance, but is RMT even illegal in the first place? It is against the Terms of Service, but that only goes against SE's policies.

You're profiting off their product without permission, so I would imagine it is. Though, I equate it to a music company sending you cease and desist letters for making a youtube video with one of their songs in it. Ultimately, it's against the law, but for the most part it's not worth the effort for these companies to sue.