voriki wrote: ↑30 November 2021, 11:31
We did get the answer.
Een wrote: ↑23 November 2021, 12:12
We have deployed a new release this morning with a patch for this issue.
What it was NOT:
- it was not an issue with the random number generator (RNG)
- it was not a security issue allowing to inject the desired values.
What it was:
- it was a specific use case where a player could prevent an immediate loss, and allow the player to just re-roll.
- it was pretty specific, and has been limited to Can't stop / Dörte; it seems that Dörte was clever enough to notice this use case, understand how it could be exploited, and use it. In a way, it was really intuitive and clever from her. Ironically, she had found a case where she literally... "Couldn't Stop".
Not sure what happened, as obviously they can't go into too much specifics how they did it. You roll the dice, and when you're supposed to go bust, it sends this message to the server, somehow. And your rolls stop.
But they were able to stop the message to the server that they went bust, and could continue to roll.
I disagree, this wasn't an answer, it was just an update that the issue had been fixed. And since we trust that it had been fixed, I don't think it's "obvious" at all why they can't go into specifics. Obviously they wouldn't want to give instructions on how to exploit the vulnerability while it was still active, but that has gone away if it has been fixed.
Unless of course the same issue might exist in other games (although that possibility seems to be discounted in the last point of Een's message quoted). You see, apart from sheer curiosity, one of the main reasons I want to know what was up here is that, if this issue had lain undetected for years until one player decided to exploit it pretty constantly (who knows how many others might have been exploiting it too, but infrequently enough to evade suspicion), there's probably a fair chance that whatever subtle mistake was made by whoever coded Can't Stop might be repeated, with similar consequences in other games. So I would like to see something shared for the education of the growing BGA developer community as well (although this forum obviously isn't the place for that).
It's common in the online security field, when vulnerabilities are discovered in commonly-used software libraries/frameworks, for these to be publicised once they are fixed. Without understanding the details of how attackers (in this case, unscrupulous players) do things they shouldn't be able to, developers can easily be oblivious of these issues and end up repeating the same mistakes.
As for the technicalities of this particular case, I agree with Ricardo - even with the semi-explanations given so far, I'm completely at a loss to know how this was done. While I haven't looked at the code for Can't Stop, what I am sure happens (and would have been picked up straight away when BGA looked at the code, had this not been the case), is that when the user presses the button to reroll the dice, the server in the space of that one request does all of:
1) rerolls the dice
2) if bust, removes (in the game database) the player's progress and proceeds to the next player's turn
3) sends notifications to the client side about all of this
Notably, 3) would notify all players as well as any spectators, so there's no way a player could manipulate anything here that would keep the other players oblivious of any "funny business". The exploit presumably involves affecting 2) somehow, but I don't see how that could be possible without injecting code into the server side, which we're told it was not. (And, were it possible, would likely be a major security issue across all games, not just this one.)
About the only thing I can think of would be if the developer perhaps put in for debugging purposes an additional request parameter which made the dice always reroll until not going bust, and this was left in the production version somehow and the player concerned here discovered it. That seems unlikely though - it would have come out loud and clear from a casual inspection of the requests, and from how this developed we know that the BGA team initially saw nothing suspicious from looking at the requests.
But the only way to stop me speculating is for the answer to be revealed!
