Page 5 of 7
Re: strange games
Posted: 19 November 2021, 13:18
by robinzig
I've been lurking and enjoying reading this discussion - genuinely intrigued to hear what this person was up to. Appreciate why you don't want to reveal it until you've fixed the code so it can't be done again - but excited to hear what the issue was
Also, while we all want to see cheats punished, I'd like to think you go a little easier on this person if their exploits have actually helped you to find - and then fix - an unexpected security hole. But of course not my decision
Re: strange games
Posted: 19 November 2021, 14:14
by 999IF
Een wrote: ↑18 November 2021, 15:40
simonbe wrote: ↑18 November 2021, 13:26
It's clear this player plays very suboptimal, and then winning 2 season in a row that just doesn't happen :p
Please keep the facts straight. She won season 6. Season 7 is ongoing, she is leading at the moment but it's not done, season is only halfway. The second from season 6 is also currently in the top 10 by the way. Should that be impossible too?
Obviously Een is not talking about me. I don't want to say anything about the player in question in this forum. There are sufficient comments elsewhere and it is enough to watch one last move of one specific game. Sorry for that apocryphal statement.
Een might know, how to reach me ; )
Re: strange games
Posted: 19 November 2021, 14:27
by Ranior
Thanks much for taking this seriously and really digging in to it. Thanks all for a civil thread that helped get us here.
I'm glad someone found the issue and I am very much looking forward to hearing what the vulnerability was--simply because one of the most interesting parts in this whole situation was how Dorte was doing it.
Re: strange games
Posted: 19 November 2021, 14:34
by patrober
robinzig wrote: ↑19 November 2021, 13:18
I've been lurking and enjoying reading this discussion - genuinely intrigued to hear what this person was up to. Appreciate why you don't want to reveal it until you've fixed the code so it can't be done again - but excited to hear what the issue was
Also, while we all want to see cheats punished, I'd like to think you go a little easier on this person if their exploits have actually helped you to find - and then fix - an unexpected security hole. But of course not my decision
Ah, the "Can you be lenient on my client for murdering his parents now that he is an orphan" argument!
Re: strange games
Posted: 19 November 2021, 18:14
by wontaketoomuchtime
Een wrote: ↑19 November 2021, 12:06
To answer some comments, we know that people posting here are not random-deniers or random-complotists, and you make a good case. This is the reason why we looked.
I looked at the game first several weeks ago when I noticed this thread, and saw nothing wrong.
Seeing this thread continued, another team member looked at the code this week (actually, discussing it, most team members have looked at some point), and at this player activity patterns, and saw nothing at first glance.
But reading your extra posts about how unlikely this series was, he decided to continue digging and after spending some extra detective hours found the answer in an unexpected place.
So you don't need to compute any more probabilities: you were right. We are discussing how to fix the issue. Once it has been fixed and deployed, we'll post the solution to the mystery.
I am sad to hear this.
Re: strange games
Posted: 20 November 2021, 09:19
by dschingis27
RIP Dörte.
Thanks BGA detective team for being persistent!
Re: strange games
Posted: 21 November 2021, 13:21
by Palapapa
Een wrote: ↑18 November 2021, 15:40
The second from season 6 is also currently in the top 10 by the way. Should that be impossible too?
Canu0n is also a cheater and has been reported several times by different players, a topic was created about it "Cheaters Can't Stop" but moderation chose to ignore it.
https://boardgamearena.com/forum/viewto ... top#p95539
He actually is, contrary to Dörte, a good player and used matchfixing with a friend to go from top 10 to top2/3. His current ranking for season 7 might be legitimate (I did not look at the games for season 7). He said he would not do it again which means that he admitted cheating (see private messages between him and me).
So If you bust Dörte to give the glory and the XP to Canu0n, it really makes no sens.
Would be good to clean the game from obvious cheaters.
That said doing 2 top 10 in a row is not so hard to do for a good player that play a lot. But top 3+ is really tough
Re: strange games
Posted: 23 November 2021, 12:12
by Een
We have deployed a new release this morning with a patch for this issue.
What it was NOT:
- it was not an issue with the random number generator (RNG)
- it was not a security issue allowing to inject the desired values.
What it was:
- it was a specific use case where a player could prevent an immediate loss, and allow the player to just re-roll.
- it was pretty specific, and has been limited to Can't stop / Dörte; it seems that Dörte was clever enough to notice this use case, understand how it could be exploited, and use it. In a way, it was really intuitive and clever from her. Ironically, she had found a case where she literally... "Couldn't Stop".
Re: strange games
Posted: 23 November 2021, 13:27
by robinzig
Een wrote: ↑23 November 2021, 12:12
We have deployed a new release this morning with a patch for this issue.
What it was NOT:
- it was not an issue with the random number generator (RNG)
- it was not a security issue allowing to inject the desired values.
What it was:
- it was a specific use case where a player could prevent an immediate loss, and allow the player to just re-roll.
- it was pretty specific, and has been limited to Can't stop / Dörte; it seems that Dörte was clever enough to notice this use case, understand how it could be exploited, and use it. In a way, it was really intuitive and clever from her. Ironically, she had found a case where she literally... "Couldn't Stop".
Thanks for the summary. I'd be very interested to hear more specifics though - in other words *how* was this player able to "prevent an immediate loss" (which I understand to mean they somehow got the server to be able to not send the notification to all players/spectators that they had busted, but to roll again)? I assume there's no reason not to explain the details now, since you've fixed it to no longer be possible.
If nothing else, if this was a specific issue in the code for Can't Stop, it would be useful for developers to see as a warning as to subtle pitfalls to avoid which may inadvertently allow cheating
Re: strange games
Posted: 30 November 2021, 09:33
by beliwan
Een wrote: ↑23 November 2021, 12:12
We have deployed a new release this morning with a patch for this issue.
What it was NOT:
- it was not an issue with the random number generator (RNG)
- it was not a security issue allowing to inject the desired values.
What it was:
- it was a specific use case where a player could prevent an immediate loss, and allow the player to just re-roll.
- it was pretty specific, and has been limited to Can't stop / Dörte; it seems that Dörte was clever enough to notice this use case, understand how it could be exploited, and use it. In a way, it was really intuitive and clever from her. Ironically, she had found a case where she literally... "Couldn't Stop".
bit of a disappointing response and insight.