Shadowbane Hacking Redux - Guild Bannings

Thanks to Shacknews for pointing to a report on Gamerifts.com tracking the results of the investigation into the Shadowbane MMORPG hacking. According to a post on the official Ubisoft forums reprinted there, "..all of the members from the Guild Invictus were banned from Shadowbane for using teleport exploits, many of which culminated during the events of May 27th and 28th. As all members where banned, all money has been removed from their buildings and their Tree of Life, and the city will be left to die." There's no news on whether criminal charges may be filed, as threatened when the original exploit took place.

Comments

Tree of Life

[baloogan]

OMG they have lost all the money in their tree of life! last time they threatened legal action and now they responded with botanical action!!!

This makes sense

[saladpuncher]

A person (or guild) cheating in the game should be punished IN the game. Instead of bringing legal action against the warrior who cheated his way to a +25 Vorpal Sword of Absolute Killing the character should be stripped of his items and banned. Hopefully any characters "harmed" in the exploits will be returned to full status and given a few experience points, or what-not, for having survived the temporal disturbance (or whatever else they are going to call it).

Re:This makes sense

[Anonymous Coward]

There is something neat about having a deserted city. It would be even cooler if the whole thing had been incorporated entirely as an in-game event, with some sort of deity punishing the violators. I kinda hope they turn the city in some sort of haunted grounds, with the lost souls of the guild terrorizing lost wanderers.

Re:This makes sense

[saladpuncher]

Not a bad idea at all. Since this is a role-playing game they should all just role-play the events as though some evil god/deity/demon/Q-Continuum thingy took over for a few hours. Leave the city as a warning to those that attempt to use magic (hacking) for evil.

Re:This makes sense

[secolactico]

And even cooler would be if the could manage to keep the offenders playing, forever doomed to pay $12 monthly and not being able to leave the city or say more than "Ooooooooh".

hah.

[Suppafly]

There's no news on whether criminal charges may be filed, as threatened when the original exploit took place.

Your honor, the accused made use of features available in the game that my clients charged them to play, for this your should lock them up.

Re:hah.

[d3kk]

You're a bit hazy on the concept of a MMORPG. They weren't available features. It's Ubisoft's server that these guys affectively ruined for a few hours. Just like hacking a commercial website, employees had to spend extra hours fixing the problem, and (arguably) customers may have been lost.

Re:hah.

[Anonymous Coward]

i love how his is redundant and it was one of the first several posts for this story... idiots..

legal action my ass

[Tuxinatorium]

Next thing you know they'll be trying to sue every kiddie who cheats in Counter-Strike

Re:legal action my ass

[d3kk]

... Except cheating in Counterstrike doesn't really have any effect except pissing people off. It doesn't cost anything to boot somebody from a Counterstrike server. These kids actually disrupted a server which people were paying to use, and employees who are being paid to work had to spend extra hours fixing it.

Re:legal action my ass

[Terminal Saint]

God Willing.

Re:legal action my ass

[d3kk]

The use of PunkBuster(TM) Anti-Cheat software is optional and has always been provided without direct cost to our users.

They don't have to provide any kind of support. They have no official connection to any of the companies who produce the games they're trying to fix, and they're not even being paid to create their software. Whoever made the game in the first place doesn't need to create a fix either, because they don't run the servers and whoever does can deal with it by booting whoever's cheating.

People don't have that luxery in MMORPGs. They're paying to play on Ubisoft's servers, and they have absolutely no control over others who are doing the same. When a group of people hacks the game and starts running around killing everybody, the producer of the game has to do something quickly or they're quickly going to start losing customers and damage is going to be done to their world. Also, in Everquest for example, if you're high level and you get killed, you can lose hours of time. One doesn't just respawn like they do in an FPS. They can't just run off to a different server like in an FPS either, because your character is bound to the server that's currently being attacked. As a result, they had to pay to send somebody to fix it immediately which shouldn't have been necessary in the first place.

Retarded

[Kethinov]

This is one of the many reasons so many people hate MMORPGs. The makers are usually so anal retentive about the exploitation of bugs. Seems so hypocritical seeing as how its their fault the bug exists in the first place. If they don't want people "exploiting" they should just fix the damn bugs. Furthermore, this mass banning benefits no one. Players are pissed, company looses money, so what's the friggen point?

Enough said.

Re:Retarded

[novas007]

Have you ever written a large-scale game? Or for that matter, any sort of large software program with many many users? Probably not, though I see your subspace zone- after the fall of VIE, I always preferred Trench Wars. :)

Sure, they coded the bug in, so of course it's their fault, right? And you, on the other hand, are perfect? You never make errors? I'll help you a bit- it's not "looses", it's "loses". You made a grammatical error in 6-sentence comment. They made an error in what is probably a 500K+ line program.

I am by no means defending the declining quality of newly-released games, but at the same time I am willing to cut them slack- I know what it's like. Tight deadlines do not do good things for code quality. At the same time, MMORPGs are pretty close to a worst-case game scenario. Millions of users, very large world, and a dev team nowhere near the size of the user base. Cheating results in very real advantages over other players- instead of a good record (ie, cheating in CS), cheating MMORPG players can even go as far as selling their ill-gotten gains for real money.

As for the benefits of the mass banning- think on this. Some people do not cheat. How do you think they feel when they see people cheat? Pretty bad, I'd think. That's the sort of situation that one would not pay to be in. So you lose some non-cheaters due to cheaters. So, you lose the kind of people you'd like to play with due to the people who have no respect for those around them. Does that sound good to you?

Re:Retarded

[Kethinov]

Actually as a matter of fact I am currently involved in a large scale software project (currently two years in the making) and I know exactly what it's like. Bugs are inevitable, but its not the user's responsibility to take the heat for the programmer's screw ups. That'd be like you going to jail for taking Advil yesterday because the drug was made illegal today.

As far as I'm concerned, the SB players who exploited the bug were well within their right to do so. Deadline or not, software should be released functional not early. I'll gladly wait for a game to be released an extra year if it is guaranteed to be quality. Developers never seem to take the time to test for this crap. The very fact that a bug existed in their public release so large that any old user could wiggle his way into "god mode" is shameful.

If I were in charge over there, I'd have a good laugh with it, fix it, revert the server, and move on. Treating this retarded exploitation of an in-game bug like some kind of evil crime is silly, and so is anyone who actually takes crap like that so seriously.

Re:Retarded

[novas007]

>Bugs are inevitable, but its not the user's responsibility to take the heat
>for the programmer's screw ups.

The user is not taking the heat for the programmer's screwups- the user is
taking the heat for EXPLOITING the screwup- an important difference.

>That'd be like you going to jail for taking Advil yesterday because the drug
>was made illegal today.

I'm sorry, but that analogy makes no sense. This is not retroactive
enforcement of a law, this is a bunch of users violating the terms of their
agreement and being nailed for it. They knew the outcome wouldn't be pleasant
if they were caught

>As far as I'm concerned, the SB players who exploited the bug were well
>within their right to do so.

Don't mention their "right" to do so- it doesn't support you at all. They had
the right to exploit it, and ubisoft had the right to ban them. End of story.

>Deadline or not, software should be released functional not early. I'll
>gladly wait for a game to be released an extra year if it is guaranteed to be
>quality.

This shows that you are very naive about how the whole process works. You (and
even I, sometimes) would be willing to wait, but the game's producer will
_not_. If developers had their way on this, you'd see a release schedule like
Blizzard's. They produce their own games, so they can wait as long as they
want to release them. This is why Blizzard games are always delayed, and why
their initial releases are almost always more polished than most other games.
However, most producers are not so forgiving, and eventually the game reaches a
point where the publishers just say "ship it- you can fix it with the first
patch." No coder wants an unfinished product of theirs to go out- just look at
Carmack's reaction to the leaked Doom3 pre-alpha.

>Developers never seem to take the time to test for this crap. The
>very fact that a bug existed in their public release so large that any old
>user could wiggle his way into "god mode" is shameful.

In fact, developers don't usually do serious testing at all- instead, QA does
it. Then they send this report back to the developers. The QA team is usually
made up partially of QA from the developers' company, and partially from the
producer's company. This is not always the case, but it is often enough. As I
said above, the producer makes the final call. They paid for it, they call the
shots.

>If I were in charge over there, I'd have a good laugh with it, fix it, revert
>the server, and move on. Treating this retarded exploitation of an in-game bug
>like some kind of evil crime is silly, and so is anyone who actually takes crap
>like that so seriously.

Murder is an evil crime. Cheating is not. Murder can get you the death penalty.
Cheating can get you banned from the game. If they just had a "good laugh"
about this, they would have shown that they don't mind cheating that much.
Instead, they've shown that they will not tolerate it, and in the future
cheaters will have to weigh this with their need to cheat.

Re:Retarded

[analog_line]

Furthermore, this mass banning benefits no one.

I disagree. It benefits the honest players a great deal. What people like you don't seem to understand is that when people like the guild that was banned and those like you (who feel that exploiting is fine and dandy and it's their fault for leaving the bugs in there) get pissed and leave MMORPG X, Y, or Z, the game company is HAPPY and so are the majority of other players. Your $13/month, and the 13$/month of everyone that act like this isn't worth it to the people that run these things. It's like kicking someone out of a store who believes they have the right to be an obnoxious prick to everyone in the store because they bought something there.

If that's your attitude, yeah, I'd stay away from MMORPGs from now until eternity. No one is ever going to appreciate cheating in them. Sorry to burst your bubble.

Re:Retarded

[ceejayoz]

That'd be like you going to jail for taking Advil yesterday because the drug was made illegal today.

It's more like getting arrested for smoking crack you found left on the sidewalk. You know you're not supposed to do it, but you did it anyways.

Re:Retarded

[battlemarch]

Please tell us what this large scale software project is and the company you work for is?

So that we may stay away from it.

let me be the first to say...

[kurosawdust]

"..all of the members from the Guild Invictus..."

Straight outta Ye Olde Compton?

Re:let me be the first to say...

[dasunt]

[comment type="grammical" degree="anal"]
"The Olde Compton", not "Ye Olde Compton".

There used to a letter that represented the 'th' sound named thorn in the English language. A stylized version of it looked similiar to 'y', and that's why old signs often appear to have 'y' on them. (When the printing press came over from Germany, 'y' was used instead of thorn since thorn is a Scandanavian letter, absent from the Germanic languages - thus printing presses didn't have the letter.
[/comment]

Except...

[JazzManDRP]

Except you're wrong.

Half the point of any MMO game is community... Is sharing a game... Is a bajillion people sat on a server sharing an experience - either competitively or as part of a team.

So, it's okay to foul in football while nobody's looking? Okay to cut corners in a race when you're not being watched? I think not.

Whatever the bug was, as part of the MMO community the players involved had a moral duty to report the bug to the devs - and help to fix the game they are supposed to be a part of. Abusing an exploit to the detriment of other players is no different to using an aimbot in *insert FPS here*. Do you condone aimbots too?

The fact that the exploit was there is moot - bugs will happen in that size program regardless of testing. Any programmer worth his salt knows that - and also knows that the exact manifestation of those bugs could be anything. It might just be that a tree appears blue instead of green; in this case it was more serious.

All I see are selfish, cheating people who thought they could get away with it. If this exploit gave them advantage over other players, I doubt those other players have much sympathy. Why should the game admins be any different?

The attitude of the parent post ("players who exploited the bug were well within their right to do so") is exactly what leads to the kind of degenerative community that's becoming prevalent in online games - cheat because you can; complain when you get your dues.

Anyway, it was a hacked client

[swmccracken]

I'm unfamilar with this game and set up, but presumably people paid for these accounts. Are all the members of this Guild Invicitus guilty of abusing such features? I can imagine that various members are innocents that thought they were just joining a powerful team.

If there's no reasonable evidence that all of that guild are guilty, it seems harsh (no comeback?) (Perhaps they are and I'm just ignorant - I can't tell.)

Anyway, the servers were not attacked. "UPDATE: It has been brought to my attention that the Shadowbane servers were not compromised in any way. The "hack" was only client side, our fears regarding the security issues for our Credit Cards and accounts have been put at ease." states the updated report. Good greif, is this another game depending on client security? (Design flaw - the client will be hacked by somebody in this kind of game and your game should be designed to cope.)

I *hope* for the players of this game that there was a bug in the server side validation of what the clients were sending, rather than a blatent design flaw.

Re:Anyway, it was a hacked client

[MrWa]

Good greif, is this another game depending on client security? (Design flaw - the client will be hacked by somebody in this kind of game and your game should be designed to cope.)

This is the mantra of every armchair game designer out there. Thanks to Raph everyone thinks they could be a better designer.

Yet every online game that comes out has a hack in the client! I promise you that SWG will have one as well - despite the fact that Raph works on it.

Can you go see it?

[Asprin]

Cool - a real virtual wrath of God ghost town. I Like it. Can you still go there in the game and see it now that it's all dead and stuff? They should put up some signs there to warn people why it's a bad idea to cheat. Maybe they could even turn it into a folk tale or urban ledgend in the game that mothers tell their children to keep them from cheating. Maybe even build a ghost-town spook story quest around it.

Re:Can you go see it?

[Anonymous Coward]

yea, i can see a virtual tour of the ghost town that once was full of outlaws....

mama's don't let your babies grow up to be cheaters...

Re:Can you go see it?

[zonker]

actually, i really like this idea. one of the problems with mmorpg's is that there is no real tracking of history. if i enter a game that started 1 year ago, it would be interesting to know the major events, if any, that occured in the storyline since then. it is kind of like playing a 3d shooter that makes all the bodies disappear after a run and gun...

NO WAY

[dbretton]

Taking the actions and turning them into some kind of in-game element would only encourage that kind of behavior in the future.

Re:NO WAY

[metalpet]

Trust me, anyone that finds another way to teleport himself or anyone else at will in a world, will NOT need any encouragement to use it.
The second way you could mean it is that other people are going to be looking for similar flaws because of it. Again, I'm certain that's happening now, not because of the aftermath, but because they realize if the coders let one slip through, there are probably others waiting to be found.
The players got a taste of blood, and they're going to spend a lot of time trying to get more.

Making it all fit into the in-game world is just a way to make some good lemonade with the whole thing.

From school yard to server

[frode]

Does this strike anyone one else as the online equivalent of a nerd slap fight?

Oh no don't take my tree of life, what ever shall I do without it. I realize the game is a business and needs to be protected from exploiters or it will die (see Counter Strike) but the self important tone which permeates the post makes me want to push them down and kick cyber sand in their eyes.

If it was a hack ban them, if it was an exploit demote the project manager. Prosecuting/banning players(the customers) that use loopholes in the rules is like taking the ball away and going home.
Hell hire the exploiters as testers cause it sounds like they need better ones.

Ug.

We now return you to Fox's "When Nerds Attack"(tm).

Maybe they took the red pill

[Anonymous Coward]

I can't help thinking that maybe these characters realized that their lives were a computer simulation and this revelation allowed them to manipulate the laws of the matrix. The shadowbane admins sound a lot like agents hell bent on destroying zion.

A forum post from the link....

[zoobaby]

"Oh no! Banned from other ubi.com games! Shadowbane is such a flaming pile of poop that Ubi is in fact doing these people a favor."

Just about sums up what I have heard about UBI's games and about Shadowbane.

Re:A forum post from the link....

[resignator]

lol my thoughts exactly. I was a beta tester for SB and I didnt even give .0000001 seconds of thought about buying this game post release. Funniest part is banning players for life...how they plan on enforcing it? (1) ask freind for credit card (2) pay friend money you took off his card (3) open new account. (4) grief every single player you can find for getting "banned" and stink up the game as much as possible. At least that is what I would do if I actually gave a shit. I wonder how many that were "banned" are actually playing right now....my guess is all of them.

Hack details

[Henry V .009]

It seems these hackers were actually pretty cool. Wired has the story on what they did:

Late Tuesday evening, little things suddenly started to go very wrong in the virtual world of Shadowbane, a popular online multiplayer game.

Some players noticed that their money and weapons had suddenly vanished. A few whispered that tonight the monsters somehow seemed slightly bigger and meaner.

And then all hell broke loose.

Shadowbane had been hacked by several of its players. But unlike standard game hacks, where players gift themselves with super strength, health or wealth, these hackers managed to completely alter the rules of Shadowbane -- turning a suddenly wrathful game loose on its players.

"At first, players started speculating that there was a really bad bug in the game code," player Tim Wheating said. "Then we realized that somehow an insane god had taken control of our world and was out to kill us all."

In a statement posted on the Shadowbane website shortly after the hack, Wolfpack Studios and Ubi Soft Entertainment (the developers of Shadowbane) acknowledged that a "serious attack" had occurred and assured players the companies were "working with law enforcement and we promise all of you that these individuals will be prosecuted to the full extent of the law."

The population of an entire Shadowbane town was forcibly moved to the bottom of the sea, where they drowned. City guards turned feral and attacked town residents. Mobs of never-before-seen superpowerful creatures, seemingly spontaneously spawned from the ether, began to prowl the streets unchecked, killing characters in the most painful way possible.

This punishment will work...

[Anonymous Coward]

I saw a few comments saying "Big deal, so they are banned from shadowbane and all future ubi games.." It really will be a big deal to them though. Think about it, they cared enough about Shadowbane to actually spend the time to figure out this bug so they will be pissed they are banned. Plus, on top of that they wont be able to play the matrix online, etc. I'm sure if they are hardcore gamers (which the hackers/cheaters tend to be) they won't be happy. How exactly ubi will enforce this ban, I'm not sure.

Maybe these online RPG makers should start offering some rewards for finding bugs in their code. Nothing big, maybe just a few levels up, so maybe that on top of a lifetime ban will be enough to discourage sending newbies to a watery grave in the future.

Pretty cool?

[Anonymous Coward]

What in the world is "cool" about being a complete asshat?

Wrong

[Anonymous Coward]

You MUST be young, very young (of very life-inexperienced)

Only the young think they have zero social responsibility. Even if there was a hole, anyone that exploits it is doing something WRONG. Just as it is WRONG to enter my house and steal things because I accidentally left the door unlocked. Having a bug does not give anyone the RIGHT to exploit it. You obviously don't have much of a history in gaming/exploits either. No one that did would think like that (Unless they were the perps)

So you just keep thinking that till first time you get your car stolen, house broken into, or when you get YOUR game hacked into. See if you can maintain your "Everyone has the right to do anything possible" philosophy then.