Slashdot Mirror
For 20 Years, This Man Has Survived Entirely By Hacking Online Games (vice.com)
An anonymous reader writes: A hacker says he turned finding and exploiting flaws in popular MMO video games into a lucrative, full-time job. Manfred's character is standing still in the virtual world of the 2014 sci-fi online multiplayer game WildStar Online. Manfred, the real life person behind the character, is typing commands into a debugger. In a few seconds of what seems to be an extremely easy hack, Manfred's virtual currency skyrockets up to more than 18,000,000,000,000,000,000, or 18 quintillion. I'm watching this hack in a demo video recorded by Manfred as I stand next to him in a Las Vegas bar on Thursday. Manfred, who asked me not to reveal his real name, says he has been hacking several video games for 20 years, making a real-life living by using hacks like the one I just witnessed. His modus operandi has changed slightly from game to game, but, in essence, it consisted of tricking games into giving him items or currency he doesn't have a right to have. He would then sell those items and currency to other players (for real money) or wholesales them to online gray markets, such as the Internet Game Exchange, that then would sell those goods to individual players. At the current exchange rate, Manfred estimates he has $397 trillion worth of WildStar gold. This is obviously an outlandish number, but, essentially, his income was only limited by the real-life market for the in-game currency. When I spoke to Manfred ahead of his talk at the Def Con hacking conference, he said he wanted to go in, give his demo, and go out "as a ghost," never to be seen or heard from again. He said he wanted to be "invisible," just like he's been for the past two decades. He said he's found more than 100 publicly unknown vulnerabilities in more than 20 online video games, making hacking and trading virtual goods into his full time job.
Yet he holds a SPEECH in front of tons of people?! What? How? Wearing an elaborate mask and voice changer?
It was actually a pretty fun game. Stopped playing it though because of hackers. Every time you tried to gather a resource a hacker would zoom in, immediately harvest it, and fly off. Just got too annoying.
The only thing necessary for evil to triumph is for it to be pitted against a slightly greater evil
did he get 4/4/4/4 guardian jedi on swg before the village?
no he didnt, he is a punk bitch
Regardless of the ethics... This guy is risking his entire livelihood by doing a talk and interview. Amazing what people will risk for a little fame.
They'd hire gamers to accumulate virtual steal, then sell it at a profit.
There are so many software engineering jobs that offer more mental challenge, more reward in terms of mental stimulation. And when he gets older...I doubt he is even saving for retirement.
No shit, Sherlock.
-Dave
...For everything wrong with MMO's these days. This guy is it. Good job, you and your kind have ruined most MMO's for everyone to make a buck.
The really sad part is they are destroying the very thing they're making money off.
No one likes to play an MMO that obviously been hacked numerous times and that game's internal economy has been completely wrecked by this behavior.
In defeating the Kobayashi Maru simulation.
What a waste of a life. He should be designated a mandatory on-demand organ donor.
Manfred's virtual currency skyrockets up to more than 18,000,000,000,000,000,000, or 18 quintillion
Yes, and any game that doesn't have the most basic anti-cheat mechanisms in place to detect such a thing should be summarily abandoned by it's player base.
I can also make the client THINK it got from the server I got 18 quintillion gold, but normally for all sane MMO, the server does not trust the client, and all data are calculated server side then sent to the client. So you may change values in the client like appearing to have lot of gold with cheat engine, but the server still sees you as poor as job. I seriously doubt a MMO as old as wildstar would still have such a flaw, as this is the first thing which get exploited : trusted client data (in today's world usually limited to position, and thus speedhacked). I am extremely doubtful gold values are trusted. I think the interviewer got bamboozled.
C. Sagan : A demon haunted world:
http://www.amazon.com/gp/product/0345409469/
visit randi.org
so who gives a shit about some jackass grinding away with his poopsocks to "survive"?
can we still vote on that? 0% centerers? cease fire stand down,,, there's moms & babys in every town.. that's the spirit..
"Cheatalogist"
Table-ized A.I.
So there are loads of people who seem to find his exploits bad or wrong. But I think - great, go for it. Those MMOs are either overtly or covertly encouraging many people to spend huge amounts of time (and often, hard cash) for a meager award. The games companies are not much more than modern parasites - and 'Manfred' is merely a parasite's parasite.
Who, actually, gets harmed. The gamers want the cash - he can supply it at market rates - and the publishers are already horrendously bloated and fattened on the continual streams of micropayments.
Maybe because his name is a reference to the Prantagonist of Accelerando, but I, for one, am in favour of Manfred's profession.
This comment was written with the intention to opt out of advertising.
Hacking online games for a living is say, pentesting, where you make money from finding the hack. What this guys is going is hacking online games so he can steal from them. His livelihood isn't hacking. That's the enabler. What he is doing is simply theft. Compare to a house burglar. House burglars do not make their money by hacking doors, locks, and windows. That just gets them in the house. Their money is made by stealing and fencing the goods, just like this guy. The only real difference here is that he is unlikely to be shot in the act.
Its sometimes tough to keep your mouth shut.
[($)]
Whether he makes it to 21st depends mostly on whether there are MMORPG players in the audience.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Comment removed based on user account deletion
I'm amazed that software engineers work on online games and do not understand that you can never trust the client.
I get that mistakes can be made, but this is generally a software design and architecture problem.
Having said that, today we found a flaw in our server that let someone sneak in number that caused an overflow in one of our APIs for our online mobile game. The net result was a huge positive value in virtual currency. Of course we found it because of rule #2: Make sure you have systems that detect anomalies on anything important. The easiest of which is something like virtual currency spikes, so that stood out like a sore thumb.
Clever game hackers know to fly under the radar, but their impact (even if they get away with it) is therefore limited. But even then you can detect exploits with more mysterious mechanisms, which I will not name. :)
David Whatley
Just wait for the IRS edit and maybe CFAA changes. Each one can lead to hard fed time but at the doctors + room + board are free.
Back in 2003 (or sometime before WoW) I was part of a hacking community that wrote RuneScape bots. I remember the day someone found an item dupe hack. This was actually the opposite, if you attempted to trade 0 of an item that wasn't stackable and you didn't actually have, your recipient would receive the item. Combine this with a spell that turned items into currency and you have a serious problem.
Someone decided to be a complete idiot/ass and did their best to ruin the economy. The devs put a bounty of a lifetime premium subscription on anyone who could tell them of how the hack worked. The person who tried to ruin the economy was the first and only instance I know of that got an IP ban.
As long as he reported the income then the IRS doesn't care about illegality.
Taxation of illegal income
Why is anything in a MMO except maybe basic movement done client-side?
Maybe movement and basic actions are all that is supposed to happen client-side.
How is it that a debugger can affect the currency attached to an account?
The client must interact with the server in some way to increment/decrement the currency in certain accounts. The server-side code that controls those interactions is probably riddled with security vulnerabilities. It's almost entirely custom code.
Think of how often Apache/IIS/PHP/etc vulnerabilities are discovered, and then recall that these products have been hammered by security professionals for years. And, most of the time, those professionals disclose their findings to the developer---something which I doubt is happening with MMO developers.
Shouldn't every transaction be started and logged serverside?
Gold is not the basis of all transactions. Spells use resources, crafting professions use resources, and health pools fluctuate.
Lots of things are happening 24/7, and it can be very difficult to determine what needs to be logged.
You'd think an account that suddenly increases in value by several billion, with no account receiving a similar decrease, would trigger an internal flag of some sort...
I would expect that from a real-world bank. In a random MMO, they have no reason to bother unless there is a noticeable problem.
In most MMOs, you can loot gold from dead NPCs, and you can spend gold to buy things from NPCs. You can often sell useless items to NPCs as well. In those cases, there are probably no accounts to send/receive money. The player's balance is simply credited/debited directly for the value of the transaction.
If Manfred found an exploit in the NPC shop protocol that allowed him to process sales for items he didn't actually have, then he could easily generate a lot of in-game money very quickly.
Banks have rigorous controls to detect this sort of thing, but no one is going to develop SOX-level controls on a whim. That level of auditing is seriously burdensome---in terms of both compute and personnel.
---
According to the latest ruleset, this post should be modded as Vorpal Flamebait +5.
You obviously have never tried breaking a mmo. Triple-A titles leave functions in client-side code for teleport, spawn, etc. (think Planetside, ARK, etc.) that not only break the gameplay, but make sure everything gets legally synced to server side. Most of latest popular titles are so easy to break that doing it for fun gets boring in 20 minutes. The only way to get detected is to use exact same (heuristically) injected binary for 100k+ active clients.
AV scene is bad... but anti-cheat scene is years behind AV scene.
Because the latency will make the game unplayable.
Comment removed based on user account deletion
Comment removed based on user account deletion
> You'd think an account that suddenly increases in value by several billion, with no account receiving a similar decrease...
Yeah, that'd be sensible. However, it's all too easy (and entirely reasonable!) to fail to see the need to create one-off accounts for things like NPC quests from which quest rewards are deducted. Much easier to have the money appear out of thin air. And once you have _one_ way money can be added to a player's account without the source being accounted for...
What's a sanity check? Must be part of some Lovecraft Mmo, no need for such things in my game.
let's not pretend, he's just a fucking WOW gold farmer lol...
Simple. Bad/lazy/desperate programming. Most game houses are sweatshops, especially the so-called "free-to-play" games. Pushing out the next big money maker is much more important than fixing/designing solid code. Something seems to be slowing the server down? Push it on the client. After all, how many people know how to...wait, how did that guy manage to get a gajillion gold?
And it's not just the Asian trash MMO's either. Home grown MMOs have this problem as well. For example, Elder Scrolls Online at one point was hackable using the PC equivalent of a game genie. Talk about trivial.
~X~
He was probably exploiting some item dupe bug. Most mmo's are server apps that sit on relatively slow databases so a lot of caching is involved. The exploit fools the app server into depositing some amount into a bank while retaining your existing currency or whatever.
Probably an easier way to handle this long term is simply run reports on how much currency people actually have in game and where its going and close accounts based on that.
Well obviously things are different in the modern age, but I can share a story on this principle from the world of an ancient AOL game, CyberStrike. Your score was controlled server side, so modifying that in the client didn't do anything. But as a young teen, eventually I discovered that a variable that effected your score (multiplier) was indeed trusted from the client. Years and years into the game, the highest legitimate score was IIRC 800,000 something that took hours of play a day for like 5 years, but adjusting this multiplier allowed you to get arbitrarily high in seconds-- and you have to be careful, because around 2.4m it actually overflowed and the server said you had points in the negative millions, and you couldn't come back positive ever. :)
Fun times, but it was certainly an oversight that this piece of score data unlike all others was trusted; your # of kills, shield level, upgrades, etc were server managed. I still remember that memory address two decades later... x45baf0:74b. If anyone here played it, you might recognize my username
Vice is crap. So sensationalist. It is likely this guy can't do one thing he claims. He likely proved it by changing the memory values on his local client. I'd bet money Vice didn't really look into this guy's claims.
Real money trading is a black market by virtue of the fact that your account, character, and all of its possessions are property of the online game's owner. At no point are you granted actual property.
Capitalism at work.
Those who do not learn from commit history are doomed to regress it.
I hope that people do realize that the person is a criminal, he does not use a gun or a crowbar, but he does steal from others. Elevating such a behavior into a celebrity status is not a right thing to do.
Someone posted that he is going legit now - is he also going to return all the stolen money? I doubt so.
If Manfred found an exploit in the NPC shop protocol that allowed him to process sales for items he didn't actually have, then he could easily generate a lot of in-game money very quickly.
This point is a possible case. If he somehow edited the value of an item which could be sold back to a NPC, then the NPC will give the money to the client and this could be done on the client side. The information of selling and gaining money would then be sent to update on the server data.
I agree with you that the server usually does not monitor every transaction from clients because it is MMO. If a server has to verify every transaction, the game server could be easily overloaded which could cause lags and even crash. The optimization could be to verify at the login and only certain events/requests. Simple transactions with NPC are too common and/or frequent to be verified.
That sounds like he's just using something like Cheat Engine to change the clientside display
If the developer is really stupid, then maybe this is the case.
Or he could be using it to tamper with the client communication in order to exploit the underlying protocols.
Given those two options, I assume the latter. My assumption ascribes the developers a modicum of competence, and therefore imples a greater degree of respect for the attacker's skill.
It should be trivial to write the client to never really even understand transactions, just requests.
I use the term transaction loosely, not necessarily in reference to SQL. I.e., a client submits an action, the server processes that action, and then server returns a status update to the client.
Regardless of the underlying architecture, people have had trouble doing that for applications with real-world consequences. Do you seriously expect higher integrity from the MMO server?
Maybe he just pulled up a debugger to just make a show for a clueless reporter, and that it wasn't the actual hack.
This is possible, but he must be acquiring in-game goods and currency somehow. Legitimate acquisition is usually too slow to make a living, at least in the West.
He refused to do the hack in front of camera, which could indicate he is a fraud. It could also indicate he is very smart, as I wouldn't do that on camera either.
---
According to the latest ruleset, this post should be modded as Vorpal Flamebait +5.
...something which I doubt is happening with MMO developers.
If the MMO is even paying developers any more, and if they have some bug reporting mechanism. Lots are largely abandonware, with a small core of players religiously still playing, trying to reach whatever goal they've set for themselves. Doesn't mean that those players wouldn't be willing to shell out some $$ to achieve that goal. And even if there are active developers, there's a good chance that they're being asked to develop more DLC/microtransaction stuff ahead of bug-fixes, because that's where the money is.
Velociraptor = Distiraptor / Timeraptor
See today's Washington Post's headlines. That is all.
> Why is anything in a MMO except maybe basic movement done client-side?
this sounds like he ends up having 2^64-1 coins, so I suppose he convinced the server that he had just spent / dropped / wasted all his coins + 1.