Security Exploits Datamined, Endanger Licensed Projects

SBFord

Security Exploits Datamined, Endanger Licensed Projects

In its original incarnation, Aventurine's Darkfall was known to have more than a few exploits. Those exploits have remained in the code even after closing the game and licensing it to a pair of new developers to bring it back to life. The Rise of Agon team recently released the game to alpha where the same code being used by it and Darkfall: New Dawn has been datamined, thereby endangering the hack-free environment of both games.

Read the full story here

SpottyGekko

A rather inauspicious start for these DF Revival projects, speaks volumes about their professionalism.

Of course they will press-on regardless, they need to recoup their investments, I doubt Aventurine gave them the code and licenses for free. People will still pay for early access, etc., because no matter how many hacking scandals there are, some always manage to convince themselves that "it won't be that bad"...

Octagon7711

What is this? Is open world full loot PvP the Holy Grail for Devs? Is it their dream to have an MMO more successful than WoW but based on PvP alone? I really don't understand this drive towards PvP and those who include PvE only use it because they know it will increase their player population or because it's part of a template for MMO's.

Do Devs go to sleep at night dreaming of creating an MMO that's open world PvP with zero griefers, bots, and gold sellers, or I'm I missing something?

kdchan

Will play only Darkfall: New Dawn, since is more close to my UO sandbox tastes, unfortunately the exploit used in RoA affect New Dawn too since they share the same code, but i'm happy that they decided to do hack weeks to gather more data and fix at least the more blatant cheats before the official launch.

Slapshot1188

Ouch. They threw BPG right under the bus. Then ran over them. Backed up. Ran over them again... And for good measure tossed them off a cliff.

Aethaeryn

That really sucks  I really wanted to give these a go. . who knows people were hacking in DF anyway so I guess it won't change my experience much  

Borluc

Octagon7711 said:

What is this? Is open world full loot PvP the Holy Grail for Devs? Is it their dream to have an MMO more successful than WoW but based on PvP alone? I really don't understand this drive towards PvP and those who include PvE only use it because they know it will increase their player population or because it's part of a template for MMO's.



Do Devs go to sleep at night dreaming of creating an MMO that's open world PvP with zero griefers, bots, and gold sellers, or I'm I missing something?

You are too thin skinned to understand. A lot of what you call griefing is just fun gameplay to others. I understand your point of view as I fall in the middle, but please stop using the same old pvp bashing rhetoric that we hear over and over. Call it what it is. You don't like the stress/rush and or you can't compete on that level.

On the topic, darkfall has always been a mess of coding and bad management. They should have never allowed 2 separate companies to develop their dead game. Hacking has been going on since it was released.

Astropuyo

Haw I don't like the game (because well we who played know) but the way the writer of the post is taking responsibility "It could of been avoided".. Really makes me wanna play Darkfall again.

Lokero

It's the beginning of the end of the beginning after the end of the beginning that followed the previous beginning's end.

Ub3rgames

@Torval
The issue had nothing to do with the code itself or what Aventurine has provided.
What happened is that a good part of the source code has been delivered with RoA's client installation, which you can imagine lowers the barrier of entry for hackers by a great deal.

SBFord

Ub3rgames said:

There is a slight mistake in the article. Both statements here are from the New Dawn team.

@Torval

The issue had nothing to do with the code itself or what Aventurine has provided.

What happened is that a good part of the source code has been delivered with RoA's client installation, which you can imagine lowers the barrier of entry for hackers by a great deal.

It's been corrected.

In addition, BPG issued the following statement via their forums:

https://forums.darkfallriseofagon.com/threads/alpha-the-security-breach.3089/#post-56612

Greetings.

We regret to announce that we have taken our Alpha down due to security concerns. The server will remain offline until we have investigated and addressed all security risks associated with recently released information. As we are so close to the end of Alpha, this will mean the end of our initial testing phase.

Security concerns such as these must be approached with great caution and investigated fully. We apologize if we have been unable to explain the situation to you until now, however we have been working tirelessly and with the full support of our licensor to get the facts on this matter.

We regret the actions of some individuals to spread awareness of these exploits as this causes a considerable universal threat for both projects. This is directly responsible for the decision to suspend access to our servers.

This is no small task, but one we were committed to from day one. For the Darkfall IP to be successful, these issues must be addressed to reach a launch grade product and we will continue to work closely with Aventurine and our friends at New Dawn to prevent hacking and exploitation in Agon.

We fully expect to make serious headway in this regard before we enter our next testing phase and we will keep you informed on our progress every step of the way. This will also include implementation of our Improved User Interface and our Early Development Roadmap. Information on our next phase of testing will will be made available as we get closer!

Everyone here at BPG would like to say a huge thank you all for your continued support and understanding. We’re looking forward to taking the next step on our journey with you.

Dullahan

While I kind of doubt there are many people banging down Aventurine's door to purchase a license to host yet another Darkfall server, this incident probably renders their code worthless to anyone in the future. Unless they are really a bunch of nice guys, I can't see how they won't end up suing Big Picture Games for negligence.

Then on the other front, I would imagine that this leak nullified some part of Ub3rgames agreement with Aventurine. Surely there was some clause or assurance that the code would be safeguarded. If so, Aventurine would be liable and that would almost force them to take legal action to compensate Ub3rgames.

All speculation of course, but I really can't see how this doesn't end up in court.

ceratop001

Bad news and if I'm understanding it right it will be players that hack things and tell them? So they can fix it? Seems like a no win situation if I'm understanding it.

Dullahan

ceratop001 said:

Bad news and if I'm understanding it right it will be players that hack things and tell them? So they can fix it? Seems like a no win situation if I'm understanding it.

The best case scenario without literally recoding everything, is that they'd be able to determine exactly what is compromised and fix those exploits. They are basically at the mercy of the good will of Darkfall players. If they don't come forward and work with the devs revealing hacks or potential vulnerabilities, I'd say New Dawn is probably screwed. I would say both companies are screwed, but I don't think Big Picture Games is going to survive this debacle.

ceratop001

Dullahan said:

ceratop001 said:

Bad news and if I'm understanding it right it will be players that hack things and tell them? So they can fix it? Seems like a no win situation if I'm understanding it.

The best case scenario without literally recoding everything, is that they'd be able to determine exactly what is compromised and fix those exploits. They are basically at the mercy of the good will of Darkfall players. If they don't come forward and work with the devs revealing hacks or potential vulnerabilities, I'd say New Dawn is probably screwed. I would say both companies are screwed, but I don't think Big Picture Games is going to survive this debacle.

I hope they can resolve it somehow.

Kilrain

"some" of the client code was revealed, but not all of it. Like @Torval mentioned, obfuscation only makes it more difficult to read the code, but does not encrypt it in any way.

The real blunder here is that instead of discussing the findings with BPG, the individual posted it in a blog with examples of what he had done with it, and some things that he could do with it.

Most of the things he had done are already being done in every game ever created. So it's not really anything new, but the public display of it is what has really caused the damage. I feel I'm repeating myself, so I'll stop lol.

Dullahan

Kilrain said:

"some" of the client code was revealed, but not all of it. Like @Torval mentioned, obfuscation only makes it more difficult to read the code, but does not encrypt it in any way.

The real blunder here is that instead of discussing the findings with BPG, the individual posted it in a blog with examples of what he had done with it, and some things that he could do with it.

Most of the things he had done are already being done in every game ever created. So it's not really anything new, but the public display of it is what has really caused the damage. I feel I'm repeating myself, so I'll stop lol.

I think it was pretty obvious he felt they didn't demonstrate the capacity for fixing the game or running the RoA project. If you read what the blogger and Ub3rgames said about the situation with BPG, it seems everyone has attempted to help them and yet they disregarded the warnings before and again after the breach occurred.

jesteralways

Octagon7711 said:

What is this? Is open world full loot PvP the Holy Grail for Devs? Is it their dream to have an MMO more successful than WoW but based on PvP alone? I really don't understand this drive towards PvP and those who include PvE only use it because they know it will increase their player population or because it's part of a template for MMO's.

Do Devs go to sleep at night dreaming of creating an MMO that's open world PvP with zero griefers, bots, and gold sellers, or I'm I missing something?

I would use the term "PvP" very loosely here since PvP is about competition and what goes on in these FFA full loot game is not competition.

Xyire

Very sad that BPG has hurt darkfall.  I hope New Dawn can somehow manage to rewrite the sections of code that were leaked (not sure how much was given out).  It seems that BPG doesn't know what they're doing and is so headstrong in moving forward they're just adding insult to injury. I hope BPG is held accountable for their misdeeds.  From what I understand BPG were given instructions by Aventurine on how to not do exactly what they did when they acquired the code.  Frustrating. 

jesteralways

Xyire said:

Very sad that BPG has hurt darkfall.  I hope New Dawn can somehow manage to rewrite the sections of code that were leaked (not sure how much was given out).  It seems that BPG doesn't know what they're doing and is so headstrong in moving forward they're just adding insult to injury. I hope BPG is held accountable for their misdeeds.  From what I understand BPG were given instructions by Aventurine on how to not do exactly what they did when they acquired the code.  Frustrating. 

BPG did not leak anything, it was an emulator builder who did that. He totally reverse engineered client and datamined all the loopholes and then published them on his website to "help the community and developers". He particularly target BPG, called them amateurs and also said that Ub3rgames are doing better job, you can imagine where he is coming from. 

jesteralways

Borluc said:

Octagon7711 said:

What is this? Is open world full loot PvP the Holy Grail for Devs? Is it their dream to have an MMO more successful than WoW but based on PvP alone? I really don't understand this drive towards PvP and those who include PvE only use it because they know it will increase their player population or because it's part of a template for MMO's.



Do Devs go to sleep at night dreaming of creating an MMO that's open world PvP with zero griefers, bots, and gold sellers, or I'm I missing something?

You don't like the stress/rush and or you can't compete on that level.

Please tell me where is the competition in attacking a lone player with group or attacking someone who is severely weaker than you who die in one hit? Don't use the term PvP for what you do, it is an insult to PvP.

Dullahan

jesteralways said:

Xyire said:

Very sad that BPG has hurt darkfall.  I hope New Dawn can somehow manage to rewrite the sections of code that were leaked (not sure how much was given out).  It seems that BPG doesn't know what they're doing and is so headstrong in moving forward they're just adding insult to injury. I hope BPG is held accountable for their misdeeds.  From what I understand BPG were given instructions by Aventurine on how to not do exactly what they did when they acquired the code.  Frustrating. 

BPG did not leak anything, it was an emulator builder who did that. He totally reverse engineered client and datamined all the loopholes and then published them on his website to "help the community and developers". He particularly target BPG, called them amateurs and also said that Ub3rgames are doing better job, you can imagine where he is coming from. 

So you contend that they did follow the recommendations that were provided to them for client packaging and they did not simply rush to release? Do you think Ub3rgames is lying about the information and tools provided by Aventurine and that the problem was not avoidable?

I'd sincerely like to know what you know.

jesteralways

Dullahan said:

jesteralways said:

Xyire said:

Very sad that BPG has hurt darkfall.  I hope New Dawn can somehow manage to rewrite the sections of code that were leaked (not sure how much was given out).  It seems that BPG doesn't know what they're doing and is so headstrong in moving forward they're just adding insult to injury. I hope BPG is held accountable for their misdeeds.  From what I understand BPG were given instructions by Aventurine on how to not do exactly what they did when they acquired the code.  Frustrating. 

BPG did not leak anything, it was an emulator builder who did that. He totally reverse engineered client and datamined all the loopholes and then published them on his website to "help the community and developers". He particularly target BPG, called them amateurs and also said that Ub3rgames are doing better job, you can imagine where he is coming from. 

So you contend that they did follow the recommendations that were provided to them for client packaging and they did not simply rush to release? Do you think Ub3rgames is lying about the information and tools provided by Aventurine and that the problem was not avoidable?

I'd sincerely like to know what you know.

What do you mean what i know? Did you not create a thread with a link to emulator site yourself? The emulator himself claimed he did all that.

thinktank001

jesteralways said:

What do you mean what i know? Did you not create a thread with a link to emulator site yourself? The emulator himself claimed he did all that.

The emulator's site just showed what was possible because the ROA developers didn't follow adventurine's instructions. 

Dullahan

thinktank001 said:

jesteralways said:

What do you mean what i know? Did you not create a thread with a link to emulator site yourself? The emulator himself claimed he did all that.

The emulator's site just showed what was possible because the ROA developers didn't follow adventurine's instructions. 

This.

@jesteralways I just thought by your response that you were defending BPG and that maybe what we read from the emu blogger and ub3r was not entirely true. You said they didn't leak anything, but while it wasn't intentional, there was a breach.

Sorry if I misunderstood.

jesteralways

Dullahan said:

thinktank001 said:

jesteralways said:

What do you mean what i know? Did you not create a thread with a link to emulator site yourself? The emulator himself claimed he did all that.

The emulator's site just showed what was possible because the ROA developers didn't follow adventurine's instructions. 

This.

@jesteralways I just thought by your response that you were defending BPG and that maybe what we read from the emu blogger and ub3r was not entirely true. You said they didn't leak anything, but while it wasn't intentional, there was a breach.

Sorry if I misunderstood.

I was defending them partly, they indeed did no leak anything, i mean what kind of publisher would leak a hole in coding to players so that they can cheat? But of course it is their fault, there is no defending their idiocy.

But the main culprit is not them, it is aventurine. Sure they told BPG to package the client in a manner that it "hides" their abyssmal coding but for how long? Sure they could avoid the current situation but the core of the problem remains. It is the same as korean mmog using Xigncode or gameguard crap. Fix the core issue, don't try to hide it with layers of other codes, that kind of half assed shit did not work with game before and it is not going to work now, hackers/cheaters will find their way to hack.