this post was submitted on 19 Mar 2024
468 points (92.4% liked)

Technology

59607 readers
3417 users here now

This is a most excellent place for technology news and articles.


Our Rules


  1. Follow the lemmy.world rules.
  2. Only tech related content.
  3. Be excellent to each another!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, to ask if your bot can be added please contact us.
  9. Check for duplicates before posting, duplicates may be removed

Approved Bots


founded 1 year ago
MODERATORS
 

Wow it finally happened. So glad I switched to steam running on linux mint last week. I refused to install helldivers because it wanted to install some no holds barred god level permissions anti-cheat software. Windows 11 was the last straw for me. Good times..

The volunteers at the Anti-Cheat Police Department have since issued a PSA announcing, "There is currently an RCE exploit being abused in [Apex Legends]" and that it could be delivered via from the game itself, or its anti-cheat protection. "I would advise against playing any games protected by EAC or any EA titles", they went on to say.

As for players of the tournament, they strongly recommended taking protective measures. "It is advisable that you change your Discord passwords and ensure that your emails are secure. also enable MFA for all your accounts if you have not done it yet", they said, "perform a clean OS reinstall as soon as possible. Do not take any chances with your personal information, your PC may have been exposed to a rootkit or other malicious software that could cause further damage."

top 50 comments
sorted by: hot top controversial new old
[–] [email protected] 201 points 8 months ago (1 children)

...your PC may have been exposed to a rootkit or other malicious software that could cause further damage."

"The rootkit you installed on your pc allowed a rootkit or other malicious software to be installed on your PC."

[–] pivot_root 73 points 8 months ago* (last edited 8 months ago)

"But, it stopped little Aimbot Andrew from successfully using the xProAimb0t2024 program he spent his monthly allowance on! Never mind the rest; it's working as intended. Closed as WONTFIX."

– Anticheat developers

[–] [email protected] 135 points 8 months ago (5 children)

Fyi, it's "no holds barred" as in no type of hold is disallowed. "no holes barred" is a decidedly different sort of event

[–] PainInTheAES 48 points 8 months ago (4 children)

As a nevernude I prefer no holes bared

[–] ummthatguy 22 points 8 months ago
[–] einlander 10 points 8 months ago

No holes Bard.

load more comments (2 replies)
[–] Potatos_are_not_friends 7 points 8 months ago* (last edited 8 months ago) (1 children)

Yeah, the "hole bars" are the ones you wanna go if you're trying to get lucky in the back if you know what I mean ( ͡° ͜ʖ ͡°)

[–] Passerby6497 5 points 8 months ago (1 children)

I thought hole bars were the things you see in JAV or manga

load more comments (1 replies)
[–] [email protected] 6 points 8 months ago* (last edited 8 months ago)

Point taken, grammar updated, but.... since we are talking about basically opening your OS up to anything EA might enjoy doing to it, maybe this is a rare occasion where the mistake fits the context? Just sayin...

load more comments (2 replies)
[–] tabular 128 points 8 months ago

The real cheats are the proprietary software we installed along the way.

[–] db2 71 points 8 months ago

leopards.exe has eaten your face and will continue.

[OK] [Yes] [I deserve it]

[–] [email protected] 68 points 8 months ago

Hacking aside it is funny to me that the anti-cheat made it possible to enable cheats.

[–] [email protected] 60 points 8 months ago (10 children)

There is currently no evidence of an RCE exploit in EAC, and EAC themselves as well as their owner, Epic, have both denied the existence of an RCE in their software.

There's a video from about a month ago in which ImperialHal and Genburten (on separate occasions) are in a match against the person named in the messages sent by the exploit on Genburten's machine.

It's possible that they were in contact with the hacker after that point and that he tricked them into downloading something they shouldn't have.

Otherwise, it's also possible that there is an exploit in Apex/Source that the hacker used. He may have been able to get their IP during the public match a month ago and then use it to target them during the competition.

Beyond what was seen during the competition, the hacker was also able to gift thousands of Apex packs to several players (seemingly without paying for them) and was able to get 40+ "bot" players into a single match and to all target an individual player. He also claimed to be able to open crates on another player's account. These other exploits seem to indicate that he has elevated access to both the server and to multiple APIs, but none of them indicate elevated access to user machines in general.

[–] merthyr1831 14 points 8 months ago* (last edited 8 months ago)

Cancel my comment about this being a possible 0day or whatever. They were playing this tournament on their personal systems, which makes it way easier for someone to accidentally download malicious software without players' consent.

load more comments (8 replies)
[–] merthyr1831 47 points 8 months ago (1 children)

The missing context here (not your fault, i think people reporting this are being misleading) is that they were using their personal systems in this tournament. That means whatever dodgy software they've installed can't be monitored in a controlled environment, and claims of it being EAC's fault is unfounded.

A proper tournament would have controlled hardware and software, even if playing remotely at a professional level. You can't guarantee these systems haven't been tampered with, even if the players insist on proper security measures.

load more comments (1 replies)
[–] sp6 39 points 8 months ago (1 children)

The clips of the hacks being installed/activated are pretty crazy:

Note that the title has been edited: we do NOT know if this was EAC yet. The article says it "may have been." EAC has claimed it wasn't them (but of course they're going to claim that). Instead, it could have been Apex's source engine. Or, it could have been two individually compromised machines from software completely unrelated to Apex; remember, these are two high-profile targets, after all. We just have to wait and see what the real cause was. Regardless, I wouldn't play Apex for at least the next day or two, just to be safe.

load more comments (1 replies)
[–] cybersandwich 35 points 8 months ago (6 children)

Is there any actual evidence that this was done via an EAC exploit?

These could be two spear phished players with hacked PCs. (2 of the best and biggest audiences making them ideal targets). People have also mentioned r5 potentially being a culprit.

If this was eac related or even a bigger client side hack (RCE), you'd think it'd be more wide spread.

I wish the reporting on this was better all around. At this point I've seen no actual evidence of anything supporting RCE or that it was EAC to blame.

load more comments (6 replies)
[–] [email protected] 29 points 8 months ago

That was a strange path my mind took as I read the title, thinking it was a satire piece about competitors trying to sneak in cheats... Like, the "Anti-Cheat Police Department" couldn't be anything but a laughingstock.

[–] [email protected] 26 points 8 months ago (1 children)

So glad I switched to steam running on linux mint last week.

Doesn't EAC work on Linux?

googles

It sounds like it has for two years:

https://www.forbes.com/sites/jasonevangelho/2022/03/01/apex-legends-now-works-on-linux-with-official-eac-support/

‘Apex Legends’ Now WORKS On Linux With Official EAC Support

I mean, I use Linux myself. But I don't know if Linux is a fix for "game I use may have vulnerabilities".

In theory, maybe Linux/Steam could isolate individual games (might be further along with Wayland than Windows is), but that's not how things work today. If you install software from Steam, it's got access to act as you, and if it has vulnerabilities that permit for remote compromise, then you'd be vulnerable as well.

[–] [email protected] 26 points 8 months ago (2 children)

Under linux EAC runs as your normal user, so it can't install system-wide malware but it can read/write your personal data. If you create a dedicated user for gaming you should be safe from this kind of stuff.

load more comments (2 replies)
[–] [email protected] 20 points 8 months ago (5 children)

Sounds fanciful.

EAC doesn't open up ports into your network as far as I'm aware.

Pretty much the only way to do RCE in games with no direct P2P connection is to send malformed data to the server, and then it sends that to the other clients, relying on things not being checked in two places. We've seen this a few times, in Dark Souls series and GTA Online.

I can't see for the life of me how EAC would cause that.

[–] BURN 12 points 8 months ago

It’s very likely not EAC that’s the problem. Best guess is the hacker has some kind of server side access, be it allowing unsigned/unauthorized operations to be executed from a client or having access to the servers themselves via rce

load more comments (4 replies)
[–] NiPfi 19 points 8 months ago* (last edited 8 months ago) (4 children)

Is Helldiver's anti cheat that bad too? am I at least a little better off running the game through Proton on Linux or am I just providing a compatibility layer to a rootkit?

[–] fannymcslap 8 points 8 months ago (2 children)

Wait who TF is cheating in HD? It's pve?

[–] [email protected] 9 points 8 months ago (2 children)

You would be surprised who will cheat. Watch Karl Jobst and some of the cheaters he has made vids on

load more comments (2 replies)
load more comments (1 replies)
[–] [email protected] 6 points 8 months ago (1 children)
[–] [email protected] 7 points 8 months ago (1 children)

Doesn't the compatibility layer mean its restricted to its own wine prefix? Or am I misunderstanding?

[–] [email protected] 6 points 8 months ago

In theory. However, wine was not designed as a security sandbox, and it might be possible (or even trivial) for something to intentionally break out of it. This gets more likely when considering the growing market share of linux.

load more comments (2 replies)
[–] ramielrowe 19 points 8 months ago (10 children)

I do not buy this RCE in Apex/EAC rumor. This wouldn't be the first time "pro" gamers got caught with cheats. And, I wouldn't put it past the cheat developers to not only include trojan-like remote-control into their cheats, but use it to advertise their product during a streamed tournament. All press is good press. And honestly, they'd probably want people thinking it was a vulnerability in Apex/EAC rather than a trojan included with their cheat.

[–] [email protected] 16 points 8 months ago (1 children)

Mmmm I’ve not done any digging, but the likelihood of a large number of streamers all using cheating software and a large number of them literally announcing it and leaving the game is quite slim.

Think of it this way, assuming they were cheating, the streamers would not want to get caught right? So they would be using cheats that aren’t being broadcast over their streaming software. To then announce “oh no I’m cheating” and quit would be silly, what would be the point of this even joining the tournament at that point? On the other hand, if the cheats were visible on their streams… that seems like a glaring issue a streamer wouldn’t make, never mind a large number of them.

[–] [email protected] 11 points 8 months ago (1 children)

I think their hypothesis is that the streamers had installed and used cheats outside of the tournament and that the cheat suppliers enabled them remotely to advertise on the big stream.

load more comments (1 replies)
load more comments (9 replies)
[–] [email protected] 16 points 8 months ago* (last edited 8 months ago) (5 children)

sadly it's been posted to Xitter, but I enjoy this 5 second clip of ImperialHal (one of the affected players):

https://twitter.com/babyducksss/status/1769541847829913925

yeah, totally not a compromised PC

[–] [email protected] 15 points 8 months ago (3 children)

There's something deeply worrying about the fact that especially here on Lemmy people are so acutely aware of the audience they're speaking to that we need to preface our messages with "I'm really on your side on this issue BUT.." because we know how easy it is to say the wrong thing and then be mobbed for it.

One shouldn't have to worry about any of that. Especially on anonymous internet forum. If someone comes at you for posting a twitter link then that's their issue, not yours.

[–] [email protected] 9 points 8 months ago (1 children)

I mean, I despise Twitter myself and wish I didn't drive traffic to their website, but this clip is just too good not to share.

load more comments (1 replies)
[–] [email protected] 7 points 8 months ago* (last edited 8 months ago) (2 children)

By number of users, Lemmy is the worst forum for mobbing I've ever come across. You'd get similar mobbing on Reddit but there were 500x the number of users.

I assume it's because a mass of people came here for a staunchly idealistic reason simply because it was the alternative to reddit.

[–] T156 6 points 8 months ago

Also that the people who don't care about that kind of thing wouldn't have bothered moving from Reddit in the first place, or be bothered enough to interact with the post.

load more comments (1 replies)
load more comments (1 replies)
load more comments (4 replies)
[–] [email protected] 14 points 8 months ago (2 children)

So about those holes... We gonna bar them?

load more comments (2 replies)
[–] [email protected] 12 points 8 months ago (1 children)

So, lemme get this straight: allowing remote parties to install malware (DRM) on your system results in allowing remote parties to install malware on your system? Wow, who could have known! Certainly not the distributors of the step-one malware, am I right?

I'm certain there's a couple of lessons to be learned here (install and run games as normal, non-elevated users, people! It's easy to do on Linux) but I'm also somehow certain Big Corpos are going to stick their heads into the sand regarding such lessons.

Oh well, the pirate way it is.

load more comments (1 replies)
[–] [email protected] 10 points 8 months ago* (last edited 8 months ago) (2 children)

I imagine their surprise came across kind of like this

“what is this? I bought a xbox card! what is this? i don’t even know what that is!”

load more comments (2 replies)
[–] [email protected] 9 points 8 months ago (3 children)

“I would advise against playing any games protected by EAC or any EA titles”, they went on to say.

Easy. I specifically blocked all titles with the tags "EA" and "EA Play" on Steam. Never have to worry about it.

load more comments (3 replies)
[–] unreasonabro 7 points 8 months ago* (last edited 8 months ago) (1 children)

Apparently the "easy" in EAC means easy like when you call a woman easy...

load more comments (1 replies)
[–] [email protected] 6 points 8 months ago

There's a super interesting video by PirateSoftware on YouTube about this too.

[–] Mango 6 points 8 months ago

Hahahaha fuck them enabling customers.

load more comments
view more: next ›