20 comments

  • butz41 days ago
    Nice to see anti-cheats working and protecting Linux players from hacks, by preventing them from actually playing the game.
    • Aurornis41 days ago
      These changes are occurring in a server backend database. They’re not client side cheats.<p>The people receiving the credits aren’t even the ones initiating the changes.<p>Also many anti-cheat packages do have Linux versions. The primary reason you’re not getting ports for Linux is because companies don’t want to do the port and support all versions of Linux clients they would encounter in the very tiny number of additional installs.
      • netbioserror41 days ago
        Proton is a single build target, and it&#x27;s just the Windows build target.
        • tpxl40 days ago
          Valve maintains a &#x27;Steam Runtime&#x27;, which is similar to a docker container, to ensure it&#x27;s easy to develop games that run on many distributions.
        • reactordev40 days ago
          Exactly, this argument wasn’t a good one 10 years ago and it definitely isn’t one now.
        • mschuster9140 days ago
          The problem is kernel level cheats, can&#x27;t defend against those from pure userland.
          • seba_dos140 days ago
            Soon: The problem is DMA level cheats, can&#x27;t defend against those from the kernel.
            • jetbalsa40 days ago
              Oh those are already here, Its why Battlefield needs Secureboot turned on so it can use the IOMMU to protect the game kinda
    • cedws41 days ago
      Games using Easy AntiCheat can opt in to Linux support. Arc Raiders runs on Linux (but not in VMs) whereas Fortnite does not, because Epic has chosen not to support Linux. Ironic given Tim Sweeney&#x27;s supposed anti-monopoly stance.
      • brookst41 days ago
        Sweeney isn’t anti-monopoly, he’s pro-Sweeney. He sees an opportunity to let others do the work and investment to build platforms, then selectively swoop in to compete once the risk and investment pay off.<p>It’s not a bad business model if he can get the courts on his side: let others spend billions and take risks, then cherry pick the successful platforms and compete with their distribution using a cost basis that doesn’t have those up-front costs and risks.
        • michaelt41 days ago
          <i>&gt; He sees an opportunity to let others do the work and investment to build platforms, then selectively swoop in to compete once the risk and investment pay off.</i><p>Sure. Just as long as you agree Google and Apple let others do the work and investment to develop new games, apps and media, then swoop in and demand a cut if the risk and investment pay off.
          • EA-316740 days ago
            They don&#x27;t automatically take a cut, they only take a cut when you want to sell to their captive audience, on their hardware, using their distribution system.<p>Wait until you hear about how the entire entertainment industry has always worked!
            • michaelt40 days ago
              <i>Their</i> hardware, huh?<p>You&#x27;re right, customers don&#x27;t really <i>own</i> an iphone, even if they&#x27;ve paid $1000 for it.
              • EA-316740 days ago
                Surely in context, and reading the most charitable interpretation, you understood that the hardware I was referring to isn’t the end user’s device.
        • CamperBob240 days ago
          <i>He sees an opportunity to let others do the work and investment to build platforms^H^H^H^H^H^H^H^H^H apps, then selectively swoop in to compete once the risk and investment pay off.</i><p>If that&#x27;s not a flawless description of a walled-garden app store, I can&#x27;t imagine what would be.
      • reactordev40 days ago
        Tim Sweeney is anti other-people’s-monopoly. He’s happy to support his own.
      • not_a940 days ago
        &gt; because Epic has chosen not to support Linux<p>Because Epic doesn’t want payhack configs to be advertised in whatever leaderboards Fortnite has, like CS2 had for a while.
        • cedws40 days ago
          Fortnite is easy to run in a hypervisor and also cheaters are using hardware DMA to cheat these days anyway. The proposition that Linux enables more cheating relative to Windows is unproven.
      • bhargav41 days ago
        &gt; Ironic given Tim Sweeney&#x27;s supposed anti-monopoly stance.<p>This doesn&#x27;t really make sense. If you are implying he is FOR monopoly, he would want the game on every possible platform right? He loses money by not having more players playing his game.
        • Zambyte41 days ago
          That&#x27;s why it&#x27;s ironic. Maybe you&#x27;re missing the context of the iOS App Store case, which is why he is supposedly anti monopoly.
        • Hendrikto41 days ago
          The person you replied to obviously referred to the Windows monopoly.
    • Thaxll41 days ago
      This hack has nothing to do with client cheats.
    • sylware41 days ago
      &quot;kernel anti-cheat&quot; is actually a re-branding of &quot;anti-(non steamdeck)-linux&quot; software, probably to please msft (since sole beneficiary). We all know they are inefficient and weaponized by hackers.<p>You know on linux there is a feature for a process to snoop into another process, that for the same user (non root), can be use for anti-tampering: with a proper &quot;security&quot; team, as all live-service games should have, you can give hell to hackers without a kernel module...
      • not_a940 days ago
        &gt; We all know they are inefficient and weaponized by hackers.<p>Name an exploit in EAC&#x2F;BattlEye&#x2F;Vanguard&#x2F;FaceIT&#x2F;whatever other big name anticheat middleware (though Vanguard and FaceIT don’t sell their services I think) that has actually been used for anything.<p>Genshin Impact’s driver got used as a vulnerable driver that one time, yeah. EAC had an exploit to inject your own code into processes, but that quickly got patched (<a href="https:&#x2F;&#x2F;blog.back.engineering&#x2F;10&#x2F;08&#x2F;2021&#x2F;" rel="nofollow">https:&#x2F;&#x2F;blog.back.engineering&#x2F;10&#x2F;08&#x2F;2021&#x2F;</a>).
        • Aerroon40 days ago
          ESEA&#x27;s anticheat was used to mine Bitcoin on the players&#x27; computers. They are&#x2F;were a major competitor of FaceIt. They supposedly had to pay a $1 million settlement over it.<p>So not an exploit, but even worse.
        • sylware40 days ago
          Well, I read HN. I did stop counting.<p>Unless you beleive in the conspiracy of AI generated news on HN.<p>You are the same type of guys who is going to try to sell &#x27;computer security&#x27; as a deliverable, thing which does not exist.<p>Please, stop that.
      • firtoz41 days ago
        How trivial is it to pretend to be a steam deck?
        • jdubs198441 days ago
          In what context? To show up at work and convince everyone you’re a steam deck?<p>Thats probably pretty difficult.
          • westmeal41 days ago
            Easy enough with the right costume and plenty of confidence.
      • well_ackshually41 days ago
        Man, even &quot;Area 51 has aliens&quot; is a better and more backed up conspiracy theory than this. Kernel AC isn&#x27;t to please MS, nor is it to shit on Linux&#x2F;Steam Deck. They don&#x27;t matter. They&#x27;re inexistent. They&#x27;re a blip of very vocal users that keep believing that Proton is going to save them from EA making shit games.<p>KACs exist because they want to have higher privileges to not be injected into, closed or otherwise touched by any other process. That&#x27;s also why a bunch of them have started to ask for Secure Boot, so that they can guarantee at least some chain of trust that ensures you&#x27;ve probably not tampered with your machine.<p>Your Linux example 1&#x2F; turns anti cheats into not only something that analyzes what runs on your machine, but actively tries to attack it, which is the textbook definition of malware, but also a gigantic liability should you happen to say, write into word.exe because you fucked up and thought it was a cheat. 2&#x2F; turns it into an infinite game of chasing each others with you injecting into cheats, cheats injecting into you, back and forth. In addition, you&#x27;re running on an actively hostile machine with a hostile user that _wants_ to fuck over your anti cheat.<p>Please do some proper research on the subject.
        • sylware41 days ago
          A user level anti-tampering software (and more with such linux feature) is not a kernel module which is weaponized by hackers.
      • Thaxll41 days ago
        Kernel anti cheat in the client are the strongest form of protection by far, your comment makes no sense, anything userspace is easily spoofed. You can create a driver ( module ) that intercept calls and that is completely invisible to userspace processes.<p>The default security measures on Linux are pretty bad compared to windows, it&#x27;s not even close. People like to bash windows but they have a way better security model.
        • sylware41 days ago
          1 - kernel module from anti-cheats are weaponized by hackers.<p>2 - if I recall properly, that linux feature is a direct mapping of the target user process allowing extreme dynamicity in time, performant, and much more powerfull mechanisms than basic &#x27;calls&#x27;. Namely hell for hackers if a live service game has a proper &quot;security&quot; team, all that without a kernel module.
          • dijit41 days ago
            What are you even talking about?<p>The parent is right.<p>I&#x27;m quite literally the first person to bash Windows for being a shitty operating system, but the requirement for signed modules puts a massive barrier to entry for cheaters, where Linux can load just about anything.<p>If every system call can lie to you, there&#x27;s a few things you can do, but it&#x27;s not many.<p>I know this because I&#x27;ve actually done a lot of due diligence on anti-cheat.<p>One mechanism I attempted to employ was to replay initalisation vectors and determinism of inputs; this means I could replay your session out of band and witness the same outcomes. If there was variation then there&#x27;s a fault. Except as soon as you introduce floating point numbers there&#x27;s no more determinism... Oh well.<p>The other was to watch for &quot;impossible&quot; things, but then you need to run full complex physics simulations for every client. If your game requires you to effectively buy an i7-11700k for every user then you&#x27;d have to sell your game for a lot more money, <i>and</i> limit how long they can play - nobody wants this.<p>The third option was to score our best players and anyone who performs better than that gets their behaviour tracked. The problem is, coming up with a scoring system that&#x27;s server side is much harder than you think.<p>GameDevs don&#x27;t actually like paying a shit load of money for anti-cheat (that also breaks their debugging systems and causes bugs: a wonderful combination)... so if you&#x27;ve got a better way: join the industry and fix it. You&#x27;ll be a moderately wealthy person.
            • mschuster9140 days ago
              &gt; GameDevs don&#x27;t actually like paying a shit load of money for anti-cheat (that also breaks their debugging systems and causes bugs: a wonderful combination)... so if you&#x27;ve got a better way: join the industry and fix it. You&#x27;ll be a moderately wealthy person.<p>I got a better way... just look at the past. Back in ye goode olde UT2004 times, there was no random matchmaking &#x2F; ranking bullshit that removed the social element, game licenses cost money, people ran their own servers, and if you pissed off server mods enough, no matter if you were a cheater, a suspected cheater, or just an asshole, your serial got banned - sometimes, across a fleet of servers that shared ban lists. Cheating had <i>costs</i> associated.<p>But of course, that means you can&#x27;t lure in whales with free to play games and loot them via microtransactions any more...
              • ThatPlayer40 days ago
                This ignores that community servers basically invented client anticheats. Almost all the current 3rd party anticheats started for community servers. Even Quake 3 Arena was updated with Punkbuster at some point.<p>You still see this with modern day servers. Modded GTA V, FiveM, had additional anticheat even before the unmodded game added anticheat. Part of the appeal of CS2 servers, Face-IT and ESEA, is the additional anticheats.
              • mjr0040 days ago
                I played Warcraft 3 competitively in the &quot;goode olde&quot; times. Ladder was full to bursting with maphackers. It was still the way most people played, even though it also fully supported custom lobbies&#x2F;rooms, which were used plenty for DotA, but almost never for random 1v1 matches. It sucked.<p>You <i>don&#x27;t</i> have a better way. You have a nostalgic memory of how games should be played which doesn&#x27;t match what people in a modern audience expect. It&#x27;s like saying the solution to cell phones tracking you is to use a landline, because that&#x27;s how we used to do things.
              • dijit40 days ago
                Thats a cynical take.<p>The truth is that UT2004 sold 234,451 units over its life according to Wikipedia.<p>The Division sold over 10,000,000 copies in the first weekend.<p>The requirements change drastically when you have a larger audience.
                • mschuster9140 days ago
                  &gt; Thats a cynical take.<p>Primarily driven by my utter disgust for modern monetization mechanics, corporate greed and gambling. Cheaters, IMHO, are an inevitable side effect of combining gamification with gambling, with no barriers to entry, and with removing social barriers of entry.<p>&gt; The requirements change drastically when you have a larger audience.<p>The market has exploded in the 12 years between UT2004 and The Division.
                  • dijit40 days ago
                    &gt; The market has exploded in the 12 years between UT2004 and The Division.<p>Yes, and you can’t assert that it didn’t happen at least in part due to efforts to make games more accessible.<p>You couldn’t release a game like UT2004 today with the same UX and expect competitive sales. Even if you did, the experience would scale very poorly.
            • esseph40 days ago
              If companies have the ability to control the binaries that run on your PC, and prevent you from running the ones you want, you&#x27;re cooked.
            • sylware41 days ago
              What are you talking about?<p>1 - kernel anti-cheats ARE weaponized by hackers. This is not a matter of discussion unless you are into the AI generated HN news conspiracy.<p>2 - this linux feature should provide (if I recall properly) a very complex and flexible (not limited to &quot;calls&quot;), and performant, set of interactions between a set of anti-cheat processes and the set of game processes. All that as being non-root priviledge (I think you must be have the same effective user id). The actual and real parameter is the level of competence and creativity of the &quot;anti-cheat&quot; team which is a requirement of any &quot;live-service games&quot; with frequent updates.<p>3 - for FPS games where aiming skill is critical, anti-cheat are close to useless due to &quot;external&quot; AI based aim assist hardware.
              • Thaxll40 days ago
                1. They&#x27;re not, not sure where you&#x27;ve seen that, not in western games at least.
                • esseph40 days ago
                  &gt; &quot;The researchers investigated the techniques used in online game cheating, as well as those deployed by ‘anti-cheat’ technologies. Most modern anti-cheat engines run in the Windows kernel, alongside applications such as anti-virus, at the highest levels of privilege. Software can only run in the Windows kernel if it has been approved and signed by Microsoft. This makes it more powerful than software run normally by the user. An example of kernel level software is the Crowdstrike system that recently failed, bringing down large parts of the internet.&quot;<p>&gt; &quot;While the anti-cheats are allowed in the kernel by Microsoft, the study also revealed that cheat software commonly uses weaknesses in Windows protections to ‘inject’ itself into the kernel and gain higher privileges. Many techniques mirror what is commonly seen in the domains of malware and anti-virus, with a difference in motivation.&quot;<p>&gt; &quot;This kernel injection technique has previously been observed in advanced ransomware attacks to disable anti-malware protections before the main attack.&quot;<p><a href="https:&#x2F;&#x2F;www.eurekalert.org&#x2F;news-releases&#x2F;1061994" rel="nofollow">https:&#x2F;&#x2F;www.eurekalert.org&#x2F;news-releases&#x2F;1061994</a>
                  • Thaxll40 days ago
                    None of that talk about exploiting anti cheats, nowhere. Not a single concrete example.<p>The goal of cheats is to make money not to hack PCs.
                    • esseph40 days ago
                      <a href="https:&#x2F;&#x2F;www.threatshub.org&#x2F;blog&#x2F;ransomware-actor-abuses-genshin-impact-anti-cheat-driver-to-kill-antivirus&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.threatshub.org&#x2F;blog&#x2F;ransomware-actor-abuses-gens...</a><p>&gt; Ransomware Actor Abuses Genshin Impact Anti-Cheat Driver to Kill Antivirus
                    • sylware40 days ago
                      In the current state of things, YOU have to provide the proof a kernel anti-cheat is not weaponized by hackers (yet...). It is now common knowledge, kernel level anti-cheats are leveraged by hackers.<p>And we all know this is fully hypocrit. &quot;Computer security&quot; does not exist, but for sure, adding a &quot;gaming&quot; _kernel module_ won&#x27;t improve anything there... (irony).
            • transcriptase41 days ago
              I’ve seen so many cases of cheaters online where even the most braindead of checks would neuter most cheats:<p>Are they moving faster than conceivably possible by a real player? Even the most basic (x2-x1)&#x2F;t &gt; twice the theoretical will catch people teleporting or speed hacking.<p>Is their KDR or any other performance metric outside 5 standard deviations from the mean?<p>Here’s one: is everyone they encounter reporting them for cheating along with one of the above? Do people leave their matches constantly?<p>Defining and detecting objectively impossible things is not impossible.
              • dijit40 days ago
                Yeah, we do those things.<p>1) they’re not foolproof<p>2) there is a delay in aggregating the data<p>this has annoying effects when the game has a trial period&#x2F;goes on sale&#x2F;has lots of cheap CD keys floating around.<p>3) if you weren’t delayed then the cheaters get better at adjusting to how you catch them.<p>We actually do a lot of statistical analysis, but it works in tandem with endpoint anti-cheat, and would hardly work at all alone.
                • brightball40 days ago
                  I know when I spent a lot of time dealing with fraud in a different market, the most effective tool was to catch and shadowban the accounts rather than banning them.<p>If we banned them, they just created a new account and kept doing the same things.<p>When we detected them and the isolated them from all other good standing accounts, only allowing them to interact with other shadowbanned users, it virtually solved the problem. Normal users went about their day and the cheaters&#x2F;fraudsters wasted a lot of time never getting through to anyone.<p>In gaming it seems like creating a cheaters purgatory where they are stuck competing against other cheaters forever would probably end up being its own special league after a while. Like when people suggested steroids in pro-baseball should be legal.
                  • sylware40 days ago
                    And to manage this purgatory and detect the accounts which will end up there, a live-service game needs an active, permanent and competent team of honnest people, period. If a game studio is not ready to do just that for its live-service game, it has to stop developping that game and move to another type of game.<p>Give this team server side data, user level &#x27;traps&#x27; and &#x27;pitfalls&#x27; with frequent updates (they do that for dota2 and probably cs2, they don&#x27;t need a kernel module), and you should end up with a rather sane gaming experience.
                  • dijit40 days ago
                    Yeah, we actually discussed doing something like that.<p>That&#x27;s what GTA5 did (though, they marked you with a dunce cap)...<p>.. even though it&#x27;s a good idea (and we nearly implemented it actually), there&#x27;s probably a reason that GTA5 is <i>still</i> plagued with cheaters.
              • Thaxll40 days ago
                Scoring ect ... is kind of useless because it&#x27;s not a proof, basically it means nothing tangible to be able to ban with 100% confidence. That&#x27;s why ML is not good for detecting cheaters.<p>It gives a score that is hard to use.
              • Aerroon40 days ago
                &gt;<i>Are they moving faster than conceivably possible by a real player? Even the most basic (x2-x1)&#x2F;t &gt; twice the theoretical will catch people teleporting or speed hacking.</i><p>This is how I imagine Amazon ended up banning a large amount of players for speedhacking. The players were lagging. I&#x27;m guessing their anti-lag features ended up moving them faster than the anti-cheat expected.<p>But I agree that a combination approach would probably work.
  • petterroea41 days ago
    Hard to have sympathy for Ubisoft the company as they are regularly used as an example of the most anti-consumer practices out there. But the whole situation is a mess, and if anything, it is probably the consumers that will end up suffering the most for this.
  • dvh41 days ago
    It&#x27;s not random bans, the nicknames are words from longer text. It&#x27;s lyrics from Shaggy - It wasn&#x27;t me.
    • vogtb41 days ago
      The line &quot;How could I forget that I had given her an extra key?&quot; comes to mind. Maybe someone left an API key laying around somewhere? Although I could be giving the hackers too much credit...
      • super25641 days ago
        Maybe the mongo db exploit from two days ago?<p><a href="https:&#x2F;&#x2F;github.com&#x2F;joe-desimone&#x2F;mongobleed" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;joe-desimone&#x2F;mongobleed</a><p><a href="https:&#x2F;&#x2F;beta.shodan.io&#x2F;host&#x2F;212.104.194.153" rel="nofollow">https:&#x2F;&#x2F;beta.shodan.io&#x2F;host&#x2F;212.104.194.153</a>
        • mrklol41 days ago
          Somebody else said some Postgres dumps are available, not sure if they are even using mongo. But maybe mongo was the start of the chain.
        • croes41 days ago
          Seems so<p><a href="https:&#x2F;&#x2F;x.com&#x2F;vxunderground&#x2F;status&#x2F;2005008887234048091" rel="nofollow">https:&#x2F;&#x2F;x.com&#x2F;vxunderground&#x2F;status&#x2F;2005008887234048091</a>
          • Modified301941 days ago
            Copy of post:<p>&gt;@vxunderground<p>&gt;Clarification post, previous post about Ubisoft lead to some confusion. That&#x27;s my fault. I&#x27;ll be more verbose. I was trying to compress the information into 1 singular post without it exceeding the word limit.<p>&gt;Here&#x27;s the word on the internet streets:<p>&gt;- THE FIRST GROUP of individuals exploited a Rainbow 6 Siege service allowing them ban players, modify inventory, etc. These individuals did not touch user data (unsure if they even could). They gifted roughly $339,960,000,000,000 worth of in-game currency to players. Ubisoft will perform a roll back to undo the damages. They&#x27;re probably annoyed. I cannot go into full details at this time how it was achieved.<p>&gt;- A SECOND GROUP of individuals, unrelated to the FIRST GROUP of individuals, exploited a MongoDB instance from Ubisoft, using MongoBleed, which allowed them (in some capacity) to pivot to an internal Git repository. They exfiltrated a large portion of Ubisoft&#x27;s internal source code. They assert it is data from the 90&#x27;s - present, including software development kits, multiplayer services, etc. I have medium to high confidence this true. I&#x27;ve confirmed this with multiple parties.<p>&gt;- A THIRD GROUP of individuals claim to have compromised Ubisoft and exfiltrated user data by exploiting MongoDB via MongoBleed. This group is trying to extort Ubisoft. They have a name for their extortion group and are active on Telegram. However, I have been unable to determine the validity of their claims.<p>&gt;- A FOURTH GROUP of individuals assert the SECOND group of individuals are LYING and state the SECOND GROUP has had access to the Ubisoft internal source code for awhile. However, they state the SECOND GROUP is trying to hide behind the FIRST GROUP to masquerade as them and give them a reason to leak the source code in totality. The FIRST GROUP and FOURTH GROUP is frustrated by this<p>&gt;Will the SECOND GROUP leak the source code? Is the SECOND GROUP telling the truth? Did the SECOND GROUP lie and have access to Ubisoft code this whole time? Was it MongoBleed? Will the FIRST GROUP get pinned for this? Who is this mysterious THIRD GROUP? Is this group related to any of the other groups?<p>&gt;Find out next time on Dragon Ball Z<p>&gt;12:12 PM · Dec 27, 2025
            • dplgk40 days ago
              Sweet, can we open source Rainbox 6 Raven Shield?
            • squigz40 days ago
              If they do, would this be the first time source code from a major game publisher has been leaked?
              • esseph40 days ago
                Not remotely.<p>Why would you think that?<p>Witcher 3 &#x2F; Cyberpunk 2077 &#x2F; Gwent &#x2F; GTA 5&amp;6 &#x2F; FIFA 21 &#x2F; Watch Dogs: Legion &#x2F; etc.
          • nhinck341 days ago
            lol leakier than a sieve.
    • purkka41 days ago
      Per the tweet linked in the article there were <i>also</i> random bans in addition to the ban feed shitposting.<p><a href="https:&#x2F;&#x2F;x.com&#x2F;KingGeorge&#x2F;status&#x2F;2004902566434668686" rel="nofollow">https:&#x2F;&#x2F;x.com&#x2F;KingGeorge&#x2F;status&#x2F;2004902566434668686</a>
      • Modified301941 days ago
        Copy of tweet:<p>&gt;@KingGeorge<p>&gt;Seems like R6 is completely fucked. It’s unreal how bad.<p>&gt;Hackers have done the following.<p>&gt;1. Banned + unbanned thousands of people.<p>&gt;2. Taken over the ban feed can put anything.<p>&gt;3. Gave everyone 2 billion credits + renown.<p>&gt;4. Gave everyone every skin including dev skins.<p>&gt;5:09 AM · Dec 27, 2025
    • ZeWaka41 days ago
      Global game messages being used to meme - reminds me of Team Fortress 2 rings.
    • Levitz41 days ago
      Saw a video earlier today with the lyrics of Billie Jean by Michael Jackson too.
  • navigate831041 days ago
    It&#x27;s a shame this game has to pander to eSports fanatics rendering it into a completely hollowed out soulless experience. From the early days of Operation Chimera to selling half of your stake and IPs to Tencent, Ubisoft has seen it all.
    • bob102941 days ago
      &gt; It&#x27;s a shame this game has to pander to eSports fanatics rendering it into a completely hollowed out soulless experience.<p>There have been many victims of the eSports neuroticism. League of Legends is probably the most extreme example I can come up with. You will eventually get <i>banned from the game</i> if you choose the &quot;wrong&quot; play style. You don&#x27;t even have to cheat or play poorly. Overwatch suffered a very similar fate - They removed a player slot to force it to fit the &quot;5 man&quot; meta. In the case of OW, the changes proved so unpopular they had to literally delete the original title from everyone&#x27;s PC to force use of the only remaining option.
      • morshu900141 days ago
        Not much good happens where people are treating video games like a hobby or even job. Last time I played that type of game was csgo in college, never again.
    • reactordev41 days ago
      Ubisoft kept making garbage and sacrificed their IP’s for the sake of keeping the company alive…<p>It was doomed.
      • Insanity41 days ago
        +1. Can’t believe how they held amazing IPs and then milked them to death while lowering the quality game over game. Whether it’s far cry or assassin’s creed, all the later iterations are worse than the series start.
        • chatmasta41 days ago
          I’m still bitter at them for canceling XDefiant… it wasn’t a COD killer but it filled a comfortable niche and had potential.
          • Insanity41 days ago
            Oh wow, they cancelled it? I played it for a bit on release. Kinda fun, didn&#x27;t stick with it, but surprised it&#x27;s already cancelled so short after release.
            • reactordev40 days ago
              &gt;”too far away from reaching the results required to enable further significant investment”<p>That’s the statement they said when they shut it down. Ubisoft only had one goal all of 2010s, to turn item shop marketplace micro transactions into their primary business. They failed. They failed because they forgot why they existed. So let’s all make them remember.
    • newsclues41 days ago
      This game was amazing at launch, recently tried it again and it’s become trash
  • Scaevolus41 days ago
    <a href="https:&#x2F;&#x2F;x.com&#x2F;vxunderground&#x2F;status&#x2F;2005008887234048091" rel="nofollow">https:&#x2F;&#x2F;x.com&#x2F;vxunderground&#x2F;status&#x2F;2005008887234048091</a><p>Here&#x27;s the word on the internet streets:<p>- THE FIRST GROUP of individuals exploited a Rainbow 6 Siege service allowing them ban players, modify inventory, etc. These individuals did not touch user data (unsure if they even could). They gifted roughly $339,960,000,000,000 worth of in-game currency to players. Ubisoft will perform a roll back to undo the damages. They&#x27;re probably annoyed. I cannot go into full details at this time how it was achieved.<p>- A SECOND GROUP of individuals, unrelated to the FIRST GROUP of individuals, exploited a MongoDB instance from Ubisoft, using MongoBleed, which allowed them (in some capacity) to pivot to an internal Git repository. They exfiltrated a large portion of Ubisoft&#x27;s internal source code. They assert it is data from the 90&#x27;s - present, including software development kits, multiplayer services, etc. I have medium to high confidence this true. I&#x27;ve confirmed this with multiple parties.<p>- A THIRD GROUP of individuals claim to have compromised Ubisoft and exfiltrated user data by exploiting MongoDB via MongoBleed. This group is trying to extort Ubisoft. They have a name for their extortion group and are active on Telegram. However, I have been unable to determine the validity of their claims.<p>- A FOURTH GROUP of individuals assert the SECOND group of individuals are LYING and state the SECOND GROUP has had access to the Ubisoft internal source code for awhile. However, they state the SECOND GROUP is trying to hide behind the FIRST GROUP to masquerade as them and give them a reason to leak the source code in totality. The FIRST GROUP and FOURTH GROUP is frustrated by this<p>Will the SECOND GROUP leak the source code? Is the SECOND GROUP telling the truth? Did the SECOND GROUP lie and have access to Ubisoft code this whole time? Was it MongoBleed? Will the FIRST GROUP get pinned for this? Who is this mysterious THIRD GROUP? Is this group related to any of the other groups?
    • dijit41 days ago
      I used to work for Ubisoft, though not on Siege- I have met and had detailed conversations with their lead architect though; truthfully I remember little of those conversations.<p>Regarding the second group and access to source code; this is unlikely for a combination of four reasons.<p>1) The internal Ubisoft network is split between “player stuff” (ONBE) and developer stuff.<p>2) The ONBE network is deny by default, no movement is possible unless its explicitly requested ahead of time, by developers, in a formal request that must be limited in scope.<p>3) ONBE to “developer network” connections are <i>almost never</i> granted. We had <i>one</i> exception to this on the Division, and it was only because we could prove that getting code execution on the host that made connections would require a long chain of exploits. Of course that machine did not have complete access to all of the git repos.<p>4) Not a lot of stuff really uses git internally. Operations staff and web developers prefer git strongly; so they use Git. But nearly every project uses Perforce. Good look getting a flow granted from ONBE to a perforce server. That will never happen.<p>Siege, like The Division, worked against Ubisoft internal IT policies to make the product even possible. (IT was punishingly rigid) but some contracts were unviolatable.<p>The last I heard, Siege had headed to AWS and had free dominion in their tenant, but it would need Ubiservices (also in AWS) and those would route through ONBE.<p>I’m not sure if much changed, since a member of the board is former Microsoft and has mandated a switch to Azure from the top… But I am certain that these policies would likely be the last to go.
      • jacquesm41 days ago
        I wonder how many times former Microsoft people demanding switches to MS infrastructure are still actually working for Microsoft.
        • dijit41 days ago
          I mean, I worked for Nokia in 2011..<p>.. you don&#x27;t have to tell me.
          • jacquesm41 days ago
            Yes, that was a particularly dirty episode. I wrote about it when it happened.<p><a href="https:&#x2F;&#x2F;jacquesmattheij.com&#x2F;microsoft-just-bought-nokia-for-0&#x2F;" rel="nofollow">https:&#x2F;&#x2F;jacquesmattheij.com&#x2F;microsoft-just-bought-nokia-for-...</a><p>I think I got one prediction wrong but the rest stuck.
    • azalemeth41 days ago
      Nothing highlights how pointless e-sports items are more than a real dollar value for a player base of all of them. The entire global GDP is as an order of magnitude roughly $100 trillion. So this $340 trillion figure is 3.4 times planetary total economic output - meaning the theoretical value of Rainbow Six cosmetics exceeds what the entire human civilisation produces in a year. Multiple times over. You&#x27;d be valuing pixelated gun attachments higher than annual agricultural output across all nations, all manufacturing, all services, everything.<p>I bet it appears unchallenged at some point in a court (or insurance) document though.
      • RHSeeger41 days ago
        While I understand what you&#x27;re saying, it&#x27;s pretty clear what is meant is &quot;$X worth at the price they currently sell for&quot;. When there&#x27;s a story about an object in space made of gold worth 100s of trillians of dollars, nobody believes it would really sell for that much if we captured it and mined all the gold; because the value of gold would plummet based purely on it&#x27;s existence.<p>But I agree with you that it would be put into a court document as &quot;it cost us this much&quot; for the full amount, vs the amount they were likely to ever be able to sell (and can&#x27;t, now that everyone got it for free, so the value is $0)
        • chii41 days ago
          and yet, most people use this same measure for market capitalization of companies.
          • smallnamespace41 days ago
            The market cap is unambiguous, a more correct estimate of &quot;how much to buy all the shares?&quot; is situational and would just distract from getting the point across.
          • Aurornis41 days ago
            Not really. If a company were to manufacture a substantially large number of shares out of nothing (no additional investment money or other value entering the company) then the market cap would not go up. It would stay the same and per-share value would go down.<p>The market is mostly reasonable about who can and will sell their shares. If a big mover does sell a lot of their shares at once, the price will fall. Most big holders will slowly sell off shares for this reason.<p>In the other direction, it’s also understood that the cost to acquire all shares of a company is more than the market cap of a company. This is why you see acquisition prices being significantly higher than the last funding round valuation, or public shares popping on announcement of an acquisition attempt.
      • andersa41 days ago
        You could achieve a similar sum by adding balances out of thin air to random bank accounts, which is comparable to what happened here.
      • nkrisc41 days ago
        The valuation is based on them hypothetically selling the same quantities that the hackers gave away at their retail prices, which of course no one believes they would ever actually sell that much.
    • pjc5041 days ago
      This has the air of a parody spy caper where the various people who have broken in keep tripping over each other.<p>The source leak is really interesting, though. We don&#x27;t often get to see game source, and it often has surprises in.
      • RHSeeger41 days ago
        &gt; Will the SECOND GROUP leak the source code? Is the SECOND GROUP telling the truth? Did the SECOND GROUP lie and have access to Ubisoft code this whole time? Was it MongoBleed? Will the FIRST GROUP get pinned for this? Who is this mysterious THIRD GROUP? Is this group related to any of the other groups?<p>This read to me like the end of a soap opera. Tune in tomorrow to find out!
    • Group_B41 days ago
      Can’t help but laugh a bit. Not a great day for Ubisoft. Hopefully this didn’t ruin the holidays for too many employees. That would absolutely suck to get a call in for this.
    • adzm41 days ago
      &gt; Will the SECOND GROUP leak the source code? Is the SECOND GROUP telling the truth? Did the SECOND GROUP lie and have access to Ubisoft code this whole time? Was it MongoBleed? Will the FIRST GROUP get pinned for this? Who is this mysterious THIRD GROUP? Is this group related to any of the other groups?<p>Find out in the next episode of... Tales from Cyberspace!
    • bombcar41 days ago
      At least it&#x27;s webscale.
    • fainpul41 days ago
      &gt; Players across PC and console are being urged by the community to stay offline, as reports continue to surface of accounts receiving billions of in game credits, rare and developer only skins, and experiencing random bans.<p>Regardless if this is true or not, and how it works exactly, I find it an interesting scenario.<p>For players: should I go online to maybe get gifted tons of ingame valuables while risking a ban? It turns playing into a gamble.<p>If I take on the hackers&#x27; view, I would find it exciting to dish out rewards and punishment at random on a large scale.
    • The_President41 days ago
      The attackers better hope they fully hid their tracks - this is a bold hack, and such an level of overt cybercriminality with financial damages will result in a decade in prison if caught.
    • sznio41 days ago
      Four attackers present in a system at the same time?<p>How?
      • sureglymop41 days ago
        Misconfigured database that was publicly accessible, vulnerability&#x2F;exploit dropped around the same time.
    • throwatdem1231141 days ago
      [dead]
  • runtimepanic41 days ago
    This is the nightmare scenario for live-service games: once the integrity of progression and bans is compromised, trust evaporates fast. Rolling back “billions of credits” is easy compared to undoing random bans.
  • miohtama41 days ago
    It is Mongo<p><a href="https:&#x2F;&#x2F;x.com&#x2F;vxunderground&#x2F;status&#x2F;2005008887234048091?s=20" rel="nofollow">https:&#x2F;&#x2F;x.com&#x2F;vxunderground&#x2F;status&#x2F;2005008887234048091?s=20</a>
  • MattDaEskimo40 days ago
    My heart goes out to the devs forced to return to work to solve these issues. Numerous groups claiming numerous exploits - mostly MongoBleed.<p>One has to wonder: why didn&#x27;t anyone anticipate this happening? Surely the moment this exploit was discovered the team would&#x27;ve locked it down immediately?
    • computerfan49440 days ago
      If this is a result of that vulnerability, Ubisoft only have themselves to blame. Our support contacts ensured that we knew about the vulnerability as early as possible and gave us a clear guide to remediation for our self-hosted clusters. Our Atlas clusters were automatically patched before this was announced publicly. You&#x27;d have to be running your database open to the internet (already a mistake), ignore the advice to simply turn off zlib, and ignore the fixed versions that have been available for over a week.<p>If you&#x27;re going to be in the business of running your own critical infrastructure, you better have spent a lot of effort planning for these situations, because they are inevitable. Otherwise, it&#x27;s easier to just pay a vendor to do it for you.
  • mlacks40 days ago
    It appears to be from the mongo db exploit. Sort of like Heartbleed from a few years ago.<p><a href="https:&#x2F;&#x2F;github.com&#x2F;joe-desimone&#x2F;mongobleed" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;joe-desimone&#x2F;mongobleed</a><p><a href="https:&#x2F;&#x2F;beta.shodan.io&#x2F;host&#x2F;212.104.194.153" rel="nofollow">https:&#x2F;&#x2F;beta.shodan.io&#x2F;host&#x2F;212.104.194.153</a>
  • kjkjadksj40 days ago
    I remember when gta5 was getting hacked left and right when it was released. People would just hand you millions in in game currency and you’d get to unlock all the hypercars and military vehicles. Really made the game fun removing the grind and pay to win and allowing everyone to do anything. And it gave people a chance if someone was dominating a lobby with something broken or overpowered to actually fight back fire with fire.
  • pjmlp41 days ago
    This is why security actually matters in game development.
  • jay_kyburz41 days ago
    I wonder if they could push out an update. That would be super scary.
    • jacquesm41 days ago
      That depends, they might just fix some bugs and call it a day. There would have to be a trial of the pyx for sure to figure out what got changed and by who.
      • afdbcreid41 days ago
        I think GP is saying that if the <i>attackers</i> can push an update it will be scary.
  • Surac41 days ago
    Ubislop, Ubislop never changes. Never trust a Ubislop
  • luxuryballs41 days ago
    Rainbowhood
  • rldjbpin40 days ago
    poured way too many hours into this game long back before it became too painful to play. this almost made me go back and check on the madness but unfortunately the servers are taken offline.<p>while i don&#x27;t agree with how devs and the publisher works on community feedback, it is still miles better than what EA does. not that it is a high bar to clear.
  • SAMUKE3440 days ago
    [dead]
  • 47639264728241 days ago
    [dead]
    • mananaysiempre41 days ago
      Streamer[1,2], formerly pro gamer[3]. “Creator” here is a clipping of “content creator”, an overtly ad-industry term that makes me a little sad(der) each time I hear it but is unfortunately universal nowadays, especially for people making videos (as we don’t really have another umbrella word for that).<p>[1] <a href="https:&#x2F;&#x2F;www.youtube.com&#x2F;channel&#x2F;UCsHlla-bq0C_2OtEy8s2_Sg" rel="nofollow">https:&#x2F;&#x2F;www.youtube.com&#x2F;channel&#x2F;UCsHlla-bq0C_2OtEy8s2_Sg</a><p>[2] <a href="https:&#x2F;&#x2F;www.twitch.tv&#x2F;kinggeorge" rel="nofollow">https:&#x2F;&#x2F;www.twitch.tv&#x2F;kinggeorge</a><p>[3] <a href="https:&#x2F;&#x2F;liquipedia.net&#x2F;rainbowsix&#x2F;KingGeorge" rel="nofollow">https:&#x2F;&#x2F;liquipedia.net&#x2F;rainbowsix&#x2F;KingGeorge</a>
    • leetbulb41 days ago
      &quot;Prominent&quot; being sub 1000 views on YouTube?
      • nixgeek41 days ago
        A million subscribers on Twitch?
        • leetbulb40 days ago
          Fair. Didn&#x27;t check Twitch.
  • sammy225541 days ago
    [flagged]
  • prmoustache41 days ago
    &quot;That wording has been met with heavy backlash from players, many of whom believe Ubisoft is attempting to downplay the severity of the situation.&quot;<p>Come on it is just a game (◔_◔)
  • lysace41 days ago
    A 9 year old random FPS game.<p>WTF happened to non-shooter games? I am so bored of these FPS variations.
    • phantasmish41 days ago
      This is like complaining all modern movies are superhero movies. It’s hard to think that unless you’re hardly looking at all, or have fairly narrow taste and aren’t counting most of the medium.
    • comrh41 days ago
      We&#x27;re currently in a golden age of Indie games catering to hyper specific niches. Ignore all AAA games and you&#x27;ll find absolute gems.
    • bavell41 days ago
      Some very fun indie games I&#x27;ve been playing this past year (lots of early access):<p>- Hexarchy &#x2F; Rogue hex (Civ-like)<p>- The Last Caretaker<p>- Captain of Industry (factorio-like, was posted here on HN by dev awhile back)<p>- 9 kings<p>- Super Fantasy Kingdom<p>- Manor Lords<p>- Astronomics<p>- Heart of the Machine
      • lysace41 days ago
        Those games have 100x to 500x smaller budgets than the AAA-games. Yes, they often have cute ideas, but, like a blockbuster movie, 99 times out of 100 you need a solid budget to make a solid movie&#x2F;game.
        • Broken_Hippo41 days ago
          If you want AAA games, you are going to have a safe game. You get the same with movies - Bigger budgets cause safer behavior with less risk taking. You wind up with a pretty game, a somewhat safe story (that they think will sell) and gameplay they think is just good enough to keep you going.<p>It isn&#x27;t that the other games are bad, though. It isn&#x27;t like we are talking &quot;handheld camcorder student-written movie&quot; vs &quot;polished hollywood blockbuster&quot; but more.... Beautiful painting by a mostly unknown artist vs beautiful large, publically displayed and privatly funded artist. Big budgets get you more assistance and more&#x2F;better tools and more space and more human help and more connections.<p>It is probably important to remember that a large portion of a blockbuster&#x27;s budget is advertising. Advertising is often 50-100% of the production budget and I&#x27;m guessing AAA games have similar advertising budgets. I&#x27;m not sure how a large advertising budget gives you better products, though it might get you more folks if your game is online.<p>Of course, I&#x27;m guessing if you limit your search to FPS games, your experience might be a different.
        • egypturnash41 days ago
          Wikipedia has a list of the most expensive video games to develop, with a lower limit of $50mil. <a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;List_of_most_expensive_video_games_to_develop" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;List_of_most_expensive_video_g...</a><p>The top of the list is Genshin Impact, although it&#x27;ll probably be displaced by GTA6 soon - that one&#x27;s estimated to come in at $1.5-2 million. There&#x27;s multiple FPS games on there but there&#x27;s some pretty expensive open-world games too.
          • FarmerPotato40 days ago
            I love that E.T. from 1982 stays on the list because of inflation. Adds some perspective.
          • Hendrikto41 days ago
            &gt; $1.5-2 million<p>You mean billion?
        • handoflixue41 days ago
          &gt; 99 times out of 100 you need a solid budget to make a solid movie&#x2F;game.<p>Sure, but 1 in 100 still gets you dozens of games a year now. There&#x27;s plenty of genres where the top titles are nowhere near an AAA budget: Hades 2, Silksong, and Claire Obscura all being popular examples from this year, and Factorio being another well known example around here. Even simpler games like Balatro and Vampire Survivor are plenty of fun for some people.<p>The biggest studios have rarely been the ones producing the best work - budget gets you fancy cinematics and a beautifully rendered 3D world, but it doesn&#x27;t make level design go any faster. It could plausibly buy better writing, but that requires all the executives to back off and trust the creatives.<p>And for what it&#x27;s worth, the big studios are all happy raking in money on mindless remakes - it keeps working for them.
          • reyqn41 days ago
            I would argue clair obscur is actually a shooter game seeing the variety of op builds
        • Fargren41 days ago
          If 1% of indie games are solid, and all AAA game are solid, and there are 100 times more indie games than AAA games, then there would still be the same amount of solid indies as there are solid AAA games. As it is, I think for every good AAA game, there are somewhere between 50 and 500 great indie games.<p>Finding them is slightly harder, but absolutely worth it.<p>In any case, complaining about how many games there are out there that are not your thing is a waste of time. Much better to define what you like and look for recommendations from people who like similar games. Who care how many FPSs are released if you don&#x27;t like FPSs? If you like RPGs, find RPG gamers and ask them what&#x27;s good. Substitute for any genre; there is no genre out there that&#x27;s not getting more releases than you could possibly play.
        • bavell41 days ago
          I&#x27;ve played the above games at least 100x more than I&#x27;ve played any AAA titles this year :)
        • malka198641 days ago
          Hopefully, AAA games era is coming to an end.
        • ch202641 days ago
          [flagged]
          • jdironman41 days ago
            I think he is saying where is the creativity in the AA+ space. Which still might be a lack of depth &#x2F; breadth of search, or platform exclusive content. Not everyone can own all the consoles.
    • cortesoft41 days ago
      I play non FPS video games almost every night. There are so many great games available.
      • amanaplanacanal41 days ago
        Yes. I tend to lean to MMOs, ARPGs, and survival&#x2F;building games.
    • tyre41 days ago
      Play Hades 2!
    • dmbche41 days ago
      Maybe check out game awards finalists
      • Akronymus41 days ago
        IMO the vidya gaem awards [0] are far superior to the game awards.<p>[0] <a href="https:&#x2F;&#x2F;www.youtube.com&#x2F;watch?v=mXMcq_LJ8ro" rel="nofollow">https:&#x2F;&#x2F;www.youtube.com&#x2F;watch?v=mXMcq_LJ8ro</a>
        • waffleiron41 days ago
          Maybe you can give a bit of context why you feel that way? Dropping a 2+ hour, &lt;2000 views, 4chan video without context isn’t really the type of comment HN is looking for as far as I can tell
          • navigate831040 days ago
            <a href="https:&#x2F;&#x2F;vidyagaemawards.com&#x2F;previous-years" rel="nofollow">https:&#x2F;&#x2F;vidyagaemawards.com&#x2F;previous-years</a>
      • lysace41 days ago
        I checked them out. I guess I just miss a time when Falcon 3.0 and <a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Stunt_Island" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Stunt_Island</a> sold really well.
        • xioxox41 days ago
          Stunt Island was pretty good. However, there are more unusual games out there with reasonable budgets, like Death Stranding, The Talos Principle, The Outer Wilds, Portal and X4:Foundations. Even games involving shooting like Control or Alan Wake 2 are driven by unusual story telling.
        • ThrowawayTestr41 days ago
          We&#x27;ve come a long way in the past 30 years
          • lysace41 days ago
            Yeah, 1000 variations later, the latest Doom&#x2F;Quake iteration looks great.
            • manytimesaway41 days ago
              Summing up the entire FPS genre as Doom-like is unfair and discredits you more than anything else. Heck, even Doom and Quake are wildly different.<p>FPS haven&#x27;t been under the spotlights for a while, these days it&#x27;s mostly MOBAs.
            • dmbche41 days ago
              I do like Dusk (and most New Blood releases) if that&#x27;s what you mean
              • bigyabai40 days ago
                Ultrakill is better than every DOOM campaign combined.
        • happosai41 days ago
          Miss falcon 3.0? Go with Falcon BMS. For any genre of games there is a modern remake and community these days.
          • iamacyborg41 days ago
            I literally discovered a completely free and open source Total Annihilation&#x2F;Supreme Commander remake last month which is great for nostalgia’s sake.<p><a href="https:&#x2F;&#x2F;www.beyondallreason.info&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.beyondallreason.info&#x2F;</a>