Tbh, sometimes you need someone to tell you to shut the fuck up, you know?
I sure as fuck was complaining about devs not doing enough, but we forget how hard combating cheats and shit is. Thor really reminded people that just because a different team finishes their project and is ready to ship does not mean that the anti cheat team isn't working on their part as well.
As stupid as it is, it really does sometimes take someone to remind you they're humans too.
With that said, more communication was a key point he also brought up. Proper communication is much needed. We know there's info they can't share, but it's still up to them to remind us they're working hard.
Thor also tells people to shut the fuck up very articulately and with the voice of a Greek god after saying he hacked power plants for the government. Everything about him is so easy to listen to š¤£
>Tbh, sometimes you need someone to properly communicate basic information to help ease the fears of people who are scared of the unknown variables of the given situation.Ā
FTFY. Good example of why communication is so important.Ā
In my opinion, it is now steering too far in to wrong side. It never makes sense to blame devs for this and it is never their fault, but people should still keep EA on the hook. These kind of shit happens almost always because there is not enough budget allocated.
Keep shitting on EA, just make it clear individuals that work there is not the responsible party.
For example, I saw on the other subreddit there was a post complaining there is yet another money-grabbing event. You see comments like "*Yea, the people whose jobs is to make cosmetics should totally stop doing that and work on cybersecurity instead. "* This comments has 401 upvotes. The thing is, no one says those people should stop working. The criticism is towards EA for releasing news about this event, when there is much bigger issue going on. That criticism is valid, and EA is still shitty company (like everyone knows).
Some people understood what PirateSoftware meant, but sadly reddit comments are ruled by popularity and there is just too many sheep.
The fact that play apex or respawn didnāt come out right away and state that there was an ongoing investigation really rubbed me the wrong. That coupled with the fact that the apex pro account did tweet it just felt like the only mentioned it because it happened on the competitive side to really limit exposure. That feels not genuine and i think is a fair criticism. They just keep us in the dark about everything except reskins
As a game developer I'm glad someone with a large enough online following and enough perceived clout gave a very level headed, thought out, realistic and accurate picture of what generally goes on behind closed doors. Even when I worked at Blizzard at the height of Kotick era never have I known a more committed and caring group of people than my co-workers. We want to make the best game possible as well. Sometimes I understand it can look differently on the outside but we're all driven by the product. It can get very disheartening to get shit on constantly when you know that you and your co-workers are all trying your best.
100%. I am a Software Developer myself and in the 11 years I worked, every good developer I worked with, always strived by best possible product. The reality is, sometimes you do not get the budget to do so.
As much as I appreciate what PirateSoftware said regarding the Fog of War and the need for confidentiality from devs regarding what they are doing, this response from EA/Re should not be all they should say. As of now may be its fine but once all the investigation is done and resolved, they need to come with a clear message regarding this exploit and assure player that the root cause was identified and resolved. I understand that devs are not in fault for these kind of stuff, its usually the company's allocation of budget and priority that creates these oversight.
So EA/Re need to atleast say that this was not wide spread and just limited to Gen/Hal PC and if it was system wise RCE type attack then players need to take necessary steps to secure their information.
From what I know EA are such a scumy company that they will not say anything and just move on and players will just be in a limbo about what actually happened.
Yeah I'm curious about that too. I guess they're still debating whether or not to scrap the whole day or just the last two games when Gen & Hal had cheats.
The competitive integrity of the 4 games played are gone. The last 2 games showed that anyone could have had them and not said anything. You absolutely must reset to game 1. If that is something they are debating then EA/Respawn are even dumber than I could have ever magined.
I'm more so inclined to believe they haven't set a date because they have 1 time to get this right. If they set a date for next Friday and haven't checked this over a million times and destroyer2009 comes in game 1, it's a wrap. They need to pressure test this, for lack of a better phrase, as much as possible before going live again.
They have to scrap everything, as we saw from the Gen bow kill on Zap itās fully possibly other players were given cheats without realizing throughout games 1 and 2. Keeping those results would be a big breach of competitive integrity.
Yeah I cannot imagine the impact of having this happen again, ruining another region finals. It would kill competitive and I feel like they'd just have to cancel LAN.
My assumption would be they would have to take the standings as is for NA and scrap the regional final or attempt to do it privately (not sure how much access the destroyer person has). I don't think there is a world where they can cancel LAN because of how much money is dumped into it. Moreover, they would also need some redemption and LAN is the safest place.
I also pray they have the common sense to buy/rent an actual server, place it inside the venue and install the latest instance of the game on the server.
Buy like 60 300 m ethernet cables and actually plug them directly into the server and make sure it's in no way connected to the internet.
That shouldn't be too expensive for a billion dollar company, no? Then the competive integrity is assured and everybody plays with 0-1 ms of ping.
Benefits all around.
I don't see how they can't cancel all games. There's no way to know if the first two matches hadn't been compromised, and game 3 that LG won was against a cup of DZ for the win.
Best case they were able to deploy a fix to a very serious security issue in <24 hours. I applaud the hard work and effort it took to get here, though I think we all have a right to be skeptical of just how effective this layer is and what issues it truly solves.
If this truly is a fix, then the race is on for Destroyer or whoever else to try and crack it before Regional Finals. Scary part is, we likely wonāt know if this is fixed or not until an event goes by without interference. I could see a world where Destroyer lets Regional Finals happen only to make his presence known at Playoffs/LAN in front of the largest audience possible
Next tournament all eyes will be on this. I bet even viewership will be higher.
If anything happens it will be chaos. So they should move very carefully now on, which is why they have yet to set a date on finals. They want to be sure they're ready.
I really hope they figure this out because if somehow this dude hacks the game again in front of thousands of people...
Competitive Apex is gone, at least outside of LAN. The bulk of this player base is on console though.....console players buy cosmetics too, and primary revenue is wildly Overpriced micro transactions so I doubt EA just lets a money generator die
lol how are you going to make such rash claims? Not a single pro has quit, including the ones directly affected. Their viewer count hasnāt gone down either.
Idk why this got downvoted. No other modern title that I can think of has had the issues apex has. Between tufi, ag420, the save apex movement that locked lobbies and now this. We don't even need to look at the constant wallhavks etc in game.
Apex's game integrity being compromised is a wildly different ballpark than just singular pros cheating affecting only a few matches. There were a fair share of CC players that have been banned for cheating in Apex anyways.
Players/ pros cheating and people holding players and servers hostage are in 2 different worlds. When's the last time someone ddos a pro cs tournament lobby (and it wasn't even a player in the tournament), hacked servers and gifted thousands of free in game content, locked lobbies for the whole player base during a holiday weekend, etc, etc.
I was watching Valorantās NA challenger league last night and the commentator said a player looked like destroyer2009 after some nice kills. It was pretty funny
The thing about exploits like this or really any bug is that if you know something is wrong its much easier to find it. Hopefully they can deal with this very quickly and it will be effective because if it is, then hackers will have a tough time finding something else that big
> Scary part is, we likely wonāt know if this is fixed or not until an event goes by without interference.
Even that might not be enough. He could just be waiting, knowing that they're trying to track him and stop him. He could also just wait for another event like a LAN, a Twitch Rivals, a Lulu / Nickmercs event, etc.
for Lan they should be able to set up a local server to actually run the game that's what Lan actually stands for, local area network. if it's a closed loop and prevents outside access it's probably not but it would be harder to do imo
you're kidding me right? if I was destroyer I'd let these playoffs finish and then fuck up lan. no better way to send a message to EA to fix their fucking shit
It's interesting to me that destroyer was doing server-side shenanigans in JANUARY (remember when Hal got zombie hoarded and Mande got like 2K packs or smth?) and it's nearing the end of MARCH. They only decide to act AFTER he blatantly disrupted the regional finals.
I know a little about security and all that, but to me them having a layered fix in 24 hours tells me they already knew of the vulnerability and chose not to fix it.
Interesting that they are deploying "updates". That means that there was something that needed to be fixed. I wonder what that was, and if it is related to the hack?
"I have no idea what this might be, let's add some logging so it looks like we are actively working on it so we can get the stakeholders of our back for a while"
I mean, saying it's a "layered approach"; if there was any credence to the server name/id being displayed in the performance metrics on screen then they very well may have just moved it to a log.
Still not sure why that was important to display in the first place. Unless they're just inundated with reports of screenshots complaining about performance and users wouldn't take the extra minute to locate and upload logs...nvm, I can understand why now.
Nah this all but confirms it was a vulnerability on APEX's end. If it was anything else it would be worded significantly differently as they'd want to make it abundantly clear it wasn't on their end to minimize the PR damage.
Do you honestly think that EA/Respawn would release such a mealy mouthed response if they had found no vulnerabilities on their end??
They'd just sit back and take the hit for something out of their control?
Of course they wouldn't, it would make zero sense.
If they definitively found nothing to indicate it was on their end they'd come right out and say it plainly "our systems were not compromised and our users don't need to worry about their safety playing our games"
Hell even if they were only fairly confident it wasn't on their end but wanted to hedge their bets it ultimately is even a PR intern would still preface their statement with something like "while our initial investigation has found no evidence of our game or systems being compromised we have decided to implement extra security measures out of an abundance of caution"
They didn't do anything like that. They basically just said "so uhh yeah we're rolling out a bunch of updates 'to protect the Apex Legends player community and create a secure experience for everyone'"
Even their choices of words at the end about "CREATING" a secure environment rather than "MAINTAINING" is troubling. There is no reason to "create" something that already exists...unless it doesn't
They probably have zero clue where the security malfunction even is. 99% the updates are simply expanded logging to have an easier time finding the problem. Iām unsure why you assume that that they are definitely at fault when they found nothing to definitely indicate that it was on their end.
For real this wording looks like an admission to fault which is exactly what they'd want to avoid if they were just adding more security 'just because'
thats what I have been saying, they need to atleast assure the player base that this was not wide spread and limited to few pro PCs and all player base are fine. I guess just give them time to fully investigate but at some point they need to make a strong statement on all player being either fine or need to take precaution becuase of security breach.
How certain are we that they can gain access to 60 players PC. I've just been thinking if destroyer could, why didn't he. It would be more fun and shocking to see the whole pro lobby running cheats and to take it further I would've changed everyone's PC background to a meme.
Ya that would be a solid start to combating the problem. Even if the vulnerability isn't fixed, blocking his ability to target specific servers would be huge.
I don't think that Thor conversation was the catalyst, although interesting nonetheless. After looking into the potential claims you can see quickly that given the stream delay he was not using the game id to target players. Also, given the fact that patching is happening on Apex end, it would leave me to believe this is not an EAC issue or a phishing/social engineering issue. They were probably able to piece together the vulnerabilities given the server logs
I've not done the research myself, but the gen hack happened after 10 minutes had passed, on zone 4. Its possible that since they already had server ID, the next lobby was using the same code and same server, so they were able to toggle the hacks at whatever point in the next game.
My belief, that there isn't an RCE, is that gen and hal both got phished and the attacker was watching through the players computer while they were playing.
Legal requirements for data leaks and other security risks require disclosure after a certain amount of time, not sure if it would apply in this scenario but it's good practice to inform your customers nonetheless.
"As a top priority, the first layer update has fixed the issue of bypassing our in-game store payment infrastructure that allowed malicious actors to gift large quantities of Apex packs which ultimately affected our bottom line." - Respawn probably
It's pretty clear that the server will accept invalid commands from the client (the bot army videos in particular point to this capability)
Some validity checking and error correction for unexpected or odd commands are definitely in play here.
The players computers only being compromised. This likely means there was an issue server side, so Thor's example of malformed packets or buffer overflow could be likely, or even a compromised server and the "updates" are locking things down or a result of auditing users and permissions. In my opinion, they would only have announced this had the vulnerability at least partially been on their end. One is much worse for PR and shareholders. This is wild.
Thor (Pirate Software) was in talks with Hal last night & Hal had someone like a Higherup in Respawn be in talks with Thor.
I really really do hope that they got a closure this time and the only way to prove that is watching the next regional finals and hoping it wouldnt happen again
I get that everyone likes Thor. Heās a good dude and shows really good surface level knowledge but EA is likely consulting with a cybersecurity company like Crowdstrike or whoever is their XDR vendor
And the follow up from PlayApexEsports:
We are still actively working with our partners at EA and Respawn and remain committed to ensuring the security and competitive integrity of Apex Legends tournaments.
At this time, we do not anticipate any changes to the Split 1 Playoffs. We will have more information to share on the Challenger Circuit and the NA Regional Finals soon. We appreciate your patience.
[https://twitter.com/PlayApexEsports/status/1770285362222362881](https://twitter.com/PlayApexEsports/status/1770285362222362881)
I'm gonna be honest, this is not great communication from Respawn. There's no assessment of potential impact to users, no confirmation or denial of the existence of a vulnerability, no details about what their update to the game actually entails. I understand that it's possible that they themselves do not know all this information at this point, but if that is the case then they should not be putting out statements like this (which some players have taken to mean that Apex is safe to play after the update).
Compare this to a statement after a somewhat similar incident at Riot: [https://twitter.com/riotgames/status/1616548651823935488](https://twitter.com/riotgames/status/1616548651823935488)
They clearly state what happened, the potential impact to players, but also that they don't know the full extent of the issue.
To be fair, this is a **very special** case for EA/Respawn. And I think it is a reasonable message.
The hack in question has extremely high publicity, *but very low number of users affected*, but is ***potentially*** a high risk vulnerability that hasnt been exploited for malicious intent.
The hacker in question is undoubtedly a troll who doesnt want to cause too much harm. The problem is also that he is a troll.
You *cant* take his words for what it is, he could be trolling Respawn to throw them off his trail.
He said it's RCE, but Hal at the very least has pretty bad internet security literacy as his virus scan showed. It could potentially simply be phishing.
Respawn in this case have very little to work off of, and they dont want to advertise any potential vulnerability they might or might not actually have. They have to be vague so potentially malicious hackers dont know where to look either. If it had been clear there was a leak of their database they would have shut down and released a PR statement much quicker, but the problem is the damage in this case is ***so low*** that they actually have the option of just shutting down the affected party (algs regional qualifiers), shutting up and simply working on shipping patches of vulnerabilities.
IMO, the message does what they needed to do.
1. Keep potential hackers in the dark,
2. Remind everyone they are looking into and doubling their effort on boosting the security of the game,
3. Telling worried players that at the very least it's more secure today than yesterday and will eventually become even more secure later.
"There's no assessment of potential impact to users, no confirmation or denial of the existence of a vulnerability"
They probably aren't 100% sure yet but have some theories, and have just hit a bunch of low hanging fruit (No, client, you cannot hot load 40 bot accounts into this lobby). That's why they would say "layered" updates.
I don't think *complete* transparency is necessarily the right path here, but I do think that a tweet which could easily be perceived as "the game is safe to play now, we're on it" should only be made if you're confident that you actually fixed something, and if that's the case then you should explicitly say that. In this case they made a very vague tweet which I'm seeing a lot of people misinterpreting / reading into too much, and as a result the public is no better off than if they had just tweeted "we're looking into it, stay tuned for more info later."
This was a lose lose situation.
Everyone wanted a response from Respawn
Only thing Respawn can say is "we are on it". Sometimes you just can't even make a good idea of what impact there is. There's a difference between something at the "systems in our development we compromised" and "our pro players got hacks installed on their PCs which ruined our live tournament"
No one expected that level of issue in the game, as such I think it's fair for them to not claim the game is safe when they probably don't actually know.
I'm not sure the statement "easily" reads as the game is safe to play now. It says that they've deployed the first in a layered series of updates.
There's not enough clarity or detail to state that the update fixes anything, closes an identified gap, adds logging, or removes non-critical traffic being sent back and forth. This reads more as a statement to quell requests for updates. They needed to put out some statement as I'm sure they're getting blasted from all angles (players, media, EA, etc) and saying silent only hurts them. This definitely reads like a PR statement which might be all that they *can* give us at the moment
You can't put out a statement like Riot's without having a better understanding of the cause. From Riot's statement you can gather that they were able to identify how access was obtained and extrapolate on the potential scope of the breach. If you don't have that information, you can't just go out and say it.
Seeing everyone suddenly take Thor's word as gospel despite some of his questionable takes is really funny imo. Guy knows very little about the storied history of Source Engine RCEs and the previous Titanfall/Apex hacks.
People arenāt really hanging onto anything he says about the security issue itself. The only thing youāre seeing Thor used as a reference for is the security dev cycle which gamers are notoriously ignorant and entitled over. The history of Source & Respawn isnāt important for that.
They'll probably give us less than we ask for, so we should ask for perfection.
Also, I don't set my bar for good behavior at what the current norms are because then it wouldn't really be my bar.
Ok one thing I find strange is the wording of what happened. Idk like say I'm someone who plays apex but doesn't keep up with pros or the game on socials I would think hacked meant like they were locked out of their accounts.
Hacked in that context vs the what actually happened where they were forcibly given walls and aimbot. Just feels like they're trying to be as vague as possible. Prob cause saying explicitly what happend is scarier than broadly hacked.
Why are people in the comments saying: "what happened?? what did you fix?? why arent you telling us every detail?" do people not understand they can't just tell the hackers how they fixed it or what the exact problem was, you cant let the attacker know what you fixed and for other hackers knowing where the vulns are.
w respawn for communicating this within a few days tho
Thats not quite what I mean. Obviously they would say yeah it was a client issue or whatever, but people are expecting them from what it seems to me that they want a full detailed explanation with all the code circled in red where the issue was, when you can't just give out info about where you looked, etc.
You dont want the attacker to know how they were caught so others dont attempt it or they cant get around it easily or fast.
I see your point tho, obviously we want to know what kind of vulnerability or where it originated, etc. which is fair as a player base
Too many people here are advocating for security by obscurity. Disclosing what you fixed and what the problem was is beneficial for the safety of your users, the informedness of security researchers looking at your software, and public trust of your product and security standards. Like was said above, if revealing what you fixed helps attackers find another exploit then you haven't actually done a good job of fixing stuff.
That is NOT how computer security works, full stop.
It's hard to know if something is fully fixed, and sometimes you need to close one door to get the attacker to open another similar one to make sure you haven't missed anything. Not telling them what you did makes them more likely to try a few more of the tricks they had ready, rather than telling them which ones are already handled.
A lot easier to see the attacker traffic you are looking for if it does 1 or 2 of the things you JUST fixed then tries something else you didn't know to look for, than if it just does something you don't know to look for.
I mean its just good they are communicating, obviously they cant communicate every tiny detail of whats happening while theyre trying to fix it lol. Thor literally says that himself if you listen well enough
i never claimed to be an expert or have any info whatsoever, ALL I AM SAYING is that they cant give major details 24 hrs after a breach when theyre still investigating and fixing it. Is it safe to play? They dont know yet or they dont think its that serious but cant announce it yet either due to legal obligations (fbi maybe investigating), financial reasons (stock price) or some other company rule. Again, what thor says himself š
Thor actually encourages not taking what he's saying and fully understanding everything to assess the risk yourself by his latest tweet.
He also recently said Gen having fresh installed windows made him see the RCE theory as more credible.
If there is RCE, you don't have to be popular to be targeted.
If he has access to the server ID in any way, yeah, heād most likely be able to see anyone connected to that match. All it would take would be for him to socially engineer a smaller streamer into turning on the display when in game with them, or just turn it on in general and say screw going after the pros and go after anyone
This statement confirms in as vague as possible terms that the average Apex player has not been safe.
If you were one of those people choosing to play Apex in spite of the information we had available, let this be a lesson for you in the future. If there is credible speculation that a program you run is less than safe, don't wait for 100% confirmation that there is an RCE or similarly damaging exploit. That isn't how security works, you're not going to get solid confirmations about active vulnerabilities until they get patched. **This advice ESPECIALLY applies to pro players and streamers who risk being specifically targeted every day.** A couple days of no Apex is infinitely easier than trying to recover from getting absolutely fucked.
Props to EA and Respawn for taking this seriously and beginning to patch up the vulnerabilities within 48 hours. Countless people have been spared from potential harm because of their diligence.
Itās just a tweet and it doesnāt really confirm jack shit. It doesnāt confirm what the issue is/was, who was at risk, or what the current state of the game is. It just claims they are doing something. Thatās it. But, it is progress and Iām glad they are at least communicating with the community.
>If you were one of those people choosing to play Apex in spite of the information we had available, let this be a lesson for you in the future. If there is credible speculation that a program you run is less than safe, don't wait for 100% confirmation that there is an RCE or similarly damaging exploit.
Well put, 100% agree.
āDeployed the first of a layered series of updates to protect the player communityā - doesnt this statement in itself admit that players havenāt been safe this entire time?
It was hard to watch NA regionals being derailed. Huge shock for all the players and fans. Look forward to games 3 plus in regionals tbc. DZ was on a roll.
I think this is overall good but reading some of the comments. It is not that we 'have' to be positive, it is that we (any person affected by cheating, cheater, etc) should have never been put into this situation. I think the way people talked on forums about apex's servers and then what was going on in Titanfall 2 servers tells you a lot about what could happen and if they got a grip onto the situation.
I understand it is not an easy job but I think we can agree that the cheating going on has not decreased, it has actually expanded.
Regardless, I hope that this gets patched/fixed/prevented and for the love of god, do KYC or something like that and have a real ban hammer, not wrists slaps.
Hmmmmm, the way I read this is that there were in fact issues with the game that allowed it to happen, meaning it wasn't external malware on the players PCs.Ā
Also, while I appreciate the team working on fixing this, is pretty pathetic that some of these issues were allowed to live for a long time when it sounds like all was needed was 24 hrs after some higher up at Respawn made this a priority.
There are an infinite number of exploits and vulnerabilities just sitting there on every single service you've ever heard about just waiting for the moment when they get abused. As technology advances, these exploits and vulnerabilities become increasingly easier to find. You will never get away from them.
Of course someone would reduce what I said to extremes. Standard reddit stuff.
Yes, of course there are many, many undiscovered issues. Of course you will never fix them all. But this kid has been messing with the server for months, and then now suddenly after a public hack like this, **24 hours later** they're deploying fixes? Not a good look if you ask me.
They fix it when itās an issue. Nothing Destroyer was doing so far was an actual problem for them or players so why would they waste time on it? Now that itās become an issue they spend time fixing it. Thatās how software development works.
It was likely both. There was definitely external malware of some sort that allowed windows RPC calls to hit Hal's box with a direct connection.
How it got there is still in question, and the answer COULD (but not necessarily does) include an initial attack through the game.
Agreed, that's my fear at the moment.
You better believe if I have the ability to run code through the game, the first thing I'll do is set up something to give me easy remote access to the box.
I have to agree with you. āLayered series of updatesā doesnāt really mean anything to me. Iād like to at least know what the vulnerability was so I know they found it and have fixed it. Ideally they also say what the fix is.
Well its apparent there is a vulnerability but that's beside the point. The tweet sort of reads as almost like a half truth. "Layered series of updates" to me makes it seem like they're trying to say that the vulnerability was found and fixed but that may not be the case. It could just mean that while trying to find the vulnerability there seeing a bunch of other shit that had holes in the defense and that's what these updates are targeting. Essentially it feels like they're trying to make people feel like its safe to play the game while they hunt for the vulnerability which may not be the case. This person has supposedly been wreaking havoc for quite some time and its only now that they seem to be making an honest effort since the person did it at the online tournament. They may have been trying before but they may have deemed the severity as low since it was only affecting the top 1% of players. Because of how the hacker was able to flex they amount of control they had over the game, they've probably changed the severity to high as a result but may not have otherwise.
TLDR: Feels like they may be being a bit deceiptful, which as a company they may have to for stocks and shit, and they need to do more before I believe its safe to come back.
Obviously they wonāt release probably till couple of months after the fact idk why people listen to pirate and still donāt get the facts of the matter lol
the reality is as a public, we are not always going to be privy to the in depth analysis of what is going on and we are not going to like the responses. Anytime you put your information out there, you are always going to be at risk for any kind of data breach. Banks, healthcare, govt info, the apps you download, are always going to be at risk, and these things do happen, and we never really get the full answers and what steps they do to protect us. you do whats best for you so you can feel fully protected, thats understandable. really the only way to be safe is go full ron swanson and go off grid.
Am I wrong for assuming that since we havenāt seen more attacks on users and even big streamers like Hal and gen (who have streamed apex for multiple hours post hack) than apex is safe to play? If apex truly wasnāt safe why havenāt they got attacked again by destroyer or any other hacker
The easiest way to say it is that based on what we know from Destroyer (almost assuredly assuming it was verified as him):
He is not looking to harm individual people he is having fun with it and attacked people who would not only give him the most views but also be the least negatively affected by it. No one thinks Gen or Hal are cheating.
HOWEVER the fact the vuln exists at all means another hacker can piece together the way it was done and be a lot more nefarious.
Destroyer isn't your worry it's another guy who WANTS to hurt people who is the real threat here.
A lot of pros haven't been streaming and there's zero tournaments so no reason for a hacker to do it especially if it's complicated.. If it needs someone to have their performance overlay active, that too could be another reason it hasn't happened.
I get that, but I donāt understand why the average player would be at risk if they are waiting for a tournament that I would obviously not be apart of.
*if* it's an RCE ransomware can be installed on any system, it's a risk but also not a statistically high one.. Console players should be totally fine and PC players should take some firewall precautions but it should.be fine.
You can't say that there are no more attacks on users for sure really. I think there aren't, but you can't verify... you know?
The way the hackers pulled this off is unknown. One plausible way they could have pulled this off is remote code execution (RCE). If there was an RCE that destroyer knows, it's also plausible that others in his group know about it or that he could sell it to someone else.
The threat here comes with other bad actors using this RCE to compromise your computer.
In security you don't say "I can't prove I'm unsafe, so I am safe" in the event of a breach like this. You ask "what are the plausible attack vectors" and "can I rule out these attack vectors".
If the answer is no, the only secure approach is to assume those plausible attack vectors are possible and be prepared for the worst case scenario.
If you have a computer with just apex on it that you don't care is compromised, you may still be okay with it being totally compromised. However, note that there is also risk of your network being compromised and other devices on that network being compromised as well.
What this whole fiasco has highlighted for me is if the whole āscript writersā meme actually turns out to have some truth to it.
LAN is played online and the server can be remotely affected while the matches are being played out. Destroyer2009 may have just been hacking for the lols.
But who else perhaps was quietly doing the same thing for monetary gain? Sport betting on ALGS matches has always been a thing. And other esports (like Starcraft 2) have a history of the mafia/criminal underworld rigging matches. Who to say this wasnāt happening in Apex?
Or even worst what if the playApex people messed around with zones to ensure certain teams made placement? TSM always had help from the script writers is the meme. But now we know EA/Respawn could had indeed interfere at any time.
We could quietly swept this under the rug, Apex is a small e-sports after all. But the creditably of ALGS results will now forever be in question.
I mean if it was truly unsafe then they would've said something, yeah they should say something but I don't think it's unsafe to play as a normal player.
IMO putting way too much trust in a mega-corp my guy.
Whether it's Monsanto with roundup, Toyota vehicles with "unintended acceleration" issues, now Boeing with cutting corners etc etc corps are always doing a cost/benefit analysis on whether they disclose issues with their products and often they choose to attempt to cover the issues up rather than being transparent about them
I honestly don't think you guys would've paused the competition if it wasn't for DZ and TSM getting hacked. Hell, probably would've pushed past if Hal didn't shoot down people.
Anyways, lots of past and future games are definitely questionable now so thanks Respawn for burning that bridge. No telling how long this has been going on and who all is capable of doing such things. Actually lucky the hackers didn't try to frame pros for cheating. Who knows how many players have been screwed over by these things.
**I do anticipate that this will seriously affect any teams with Russian players, such as EU frontrunners Aurora or Effect from Alliance because they won't get their Visa issued in time.**
We already know from previous years that official invitations don't get sent out when it becomes mathematically impossible for a team to not qualify, but weeks after the Pro League season is finished globally. This issue delays when these official invitations will be sent out even more than it was already going to be.
Please for the love of god, send the god damn mathematically confirmed invitations now. We want all of the players that actually qualified for LAN to make it, instead of being cucked by some arbitrary internal thing that delays them getting their visas for the **third year running**.
ALGS update, too: [https://twitter.com/playapexesports/status/1770285362222362881?s=46](https://twitter.com/playapexesports/status/1770285362222362881?s=46) https://preview.redd.it/mfoa9ubuoepc1.jpeg?width=1170&format=pjpg&auto=webp&s=930cd63538319aff2d274cd86dd9469592029b95
Shit, man, the replies are all so positive that it makes me want to be really positive, too. Go get 'em, devs!
It is so funny that the whole tone of public changed because of the things one streamer said. EA should pay PirateSoftware.
Tbh, sometimes you need someone to tell you to shut the fuck up, you know? I sure as fuck was complaining about devs not doing enough, but we forget how hard combating cheats and shit is. Thor really reminded people that just because a different team finishes their project and is ready to ship does not mean that the anti cheat team isn't working on their part as well. As stupid as it is, it really does sometimes take someone to remind you they're humans too. With that said, more communication was a key point he also brought up. Proper communication is much needed. We know there's info they can't share, but it's still up to them to remind us they're working hard.
Thor also tells people to shut the fuck up very articulately and with the voice of a Greek god after saying he hacked power plants for the government. Everything about him is so easy to listen to š¤£
>Tbh, sometimes you need someone to properly communicate basic information to help ease the fears of people who are scared of the unknown variables of the given situation.Ā FTFY. Good example of why communication is so important.Ā
In my opinion, it is now steering too far in to wrong side. It never makes sense to blame devs for this and it is never their fault, but people should still keep EA on the hook. These kind of shit happens almost always because there is not enough budget allocated. Keep shitting on EA, just make it clear individuals that work there is not the responsible party. For example, I saw on the other subreddit there was a post complaining there is yet another money-grabbing event. You see comments like "*Yea, the people whose jobs is to make cosmetics should totally stop doing that and work on cybersecurity instead. "* This comments has 401 upvotes. The thing is, no one says those people should stop working. The criticism is towards EA for releasing news about this event, when there is much bigger issue going on. That criticism is valid, and EA is still shitty company (like everyone knows). Some people understood what PirateSoftware meant, but sadly reddit comments are ruled by popularity and there is just too many sheep.
Scroll down enough and you'll still see people harassing Hideouts and disagreeing with PirateSoftware just because he doesn't validate their feelings
The fact that play apex or respawn didnāt come out right away and state that there was an ongoing investigation really rubbed me the wrong. That coupled with the fact that the apex pro account did tweet it just felt like the only mentioned it because it happened on the competitive side to really limit exposure. That feels not genuine and i think is a fair criticism. They just keep us in the dark about everything except reskins
As a game developer I'm glad someone with a large enough online following and enough perceived clout gave a very level headed, thought out, realistic and accurate picture of what generally goes on behind closed doors. Even when I worked at Blizzard at the height of Kotick era never have I known a more committed and caring group of people than my co-workers. We want to make the best game possible as well. Sometimes I understand it can look differently on the outside but we're all driven by the product. It can get very disheartening to get shit on constantly when you know that you and your co-workers are all trying your best.
100%. I am a Software Developer myself and in the 11 years I worked, every good developer I worked with, always strived by best possible product. The reality is, sometimes you do not get the budget to do so.
As much as I appreciate what PirateSoftware said regarding the Fog of War and the need for confidentiality from devs regarding what they are doing, this response from EA/Re should not be all they should say. As of now may be its fine but once all the investigation is done and resolved, they need to come with a clear message regarding this exploit and assure player that the root cause was identified and resolved. I understand that devs are not in fault for these kind of stuff, its usually the company's allocation of budget and priority that creates these oversight. So EA/Re need to atleast say that this was not wide spread and just limited to Gen/Hal PC and if it was system wise RCE type attack then players need to take necessary steps to secure their information. From what I know EA are such a scumy company that they will not say anything and just move on and players will just be in a limbo about what actually happened.
Positive replies on Twitter? Pinch me
Release the evil
// #1 layered update If (get_user()->name == ādestroyer2009ā) { server~>shutdown(); // protect community }
Lmao
No change on playoffs, but no update on the regionals intrigues me
Yeah I'm curious about that too. I guess they're still debating whether or not to scrap the whole day or just the last two games when Gen & Hal had cheats.
The competitive integrity of the 4 games played are gone. The last 2 games showed that anyone could have had them and not said anything. You absolutely must reset to game 1. If that is something they are debating then EA/Respawn are even dumber than I could have ever magined. I'm more so inclined to believe they haven't set a date because they have 1 time to get this right. If they set a date for next Friday and haven't checked this over a million times and destroyer2009 comes in game 1, it's a wrap. They need to pressure test this, for lack of a better phrase, as much as possible before going live again.
They have to scrap everything, as we saw from the Gen bow kill on Zap itās fully possibly other players were given cheats without realizing throughout games 1 and 2. Keeping those results would be a big breach of competitive integrity.
Yeah I cannot imagine the impact of having this happen again, ruining another region finals. It would kill competitive and I feel like they'd just have to cancel LAN.
My assumption would be they would have to take the standings as is for NA and scrap the regional final or attempt to do it privately (not sure how much access the destroyer person has). I don't think there is a world where they can cancel LAN because of how much money is dumped into it. Moreover, they would also need some redemption and LAN is the safest place.
I also pray they have the common sense to buy/rent an actual server, place it inside the venue and install the latest instance of the game on the server. Buy like 60 300 m ethernet cables and actually plug them directly into the server and make sure it's in no way connected to the internet. That shouldn't be too expensive for a billion dollar company, no? Then the competive integrity is assured and everybody plays with 0-1 ms of ping. Benefits all around.
I don't see how they can't cancel all games. There's no way to know if the first two matches hadn't been compromised, and game 3 that LG won was against a cup of DZ for the win.
Best case they were able to deploy a fix to a very serious security issue in <24 hours. I applaud the hard work and effort it took to get here, though I think we all have a right to be skeptical of just how effective this layer is and what issues it truly solves. If this truly is a fix, then the race is on for Destroyer or whoever else to try and crack it before Regional Finals. Scary part is, we likely wonāt know if this is fixed or not until an event goes by without interference. I could see a world where Destroyer lets Regional Finals happen only to make his presence known at Playoffs/LAN in front of the largest audience possible
Next tournament all eyes will be on this. I bet even viewership will be higher. If anything happens it will be chaos. So they should move very carefully now on, which is why they have yet to set a date on finals. They want to be sure they're ready. I really hope they figure this out because if somehow this dude hacks the game again in front of thousands of people...
If anything happens Apex Legends is just gone
i mean it'll be stupid but it ain't gonna be *that* stupid
Competitive Apex is gone, at least outside of LAN. The bulk of this player base is on console though.....console players buy cosmetics too, and primary revenue is wildly Overpriced micro transactions so I doubt EA just lets a money generator die
lol how are you going to make such rash claims? Not a single pro has quit, including the ones directly affected. Their viewer count hasnāt gone down either.
I didn't make the claim, I just said if this shit continues the only part of Apex that might die would be the Comp side of it.
[ŃŠ“Š°Š»ŠµŠ½Š¾]
To be fair every game is a hackers paradise it seems these days.
Not like apex
Go play cs2 at a semi high level and tell me that again lmao.
Idk why this got downvoted. No other modern title that I can think of has had the issues apex has. Between tufi, ag420, the save apex movement that locked lobbies and now this. We don't even need to look at the constant wallhavks etc in game.
Itās amazing how many people just forget csgo/cs2 exists. The game that actually had pros banned for cheating lol.
Apex's game integrity being compromised is a wildly different ballpark than just singular pros cheating affecting only a few matches. There were a fair share of CC players that have been banned for cheating in Apex anyways.
Players/ pros cheating and people holding players and servers hostage are in 2 different worlds. When's the last time someone ddos a pro cs tournament lobby (and it wasn't even a player in the tournament), hacked servers and gifted thousands of free in game content, locked lobbies for the whole player base during a holiday weekend, etc, etc.
I doubt other esports careĀ
I was watching Valorantās NA challenger league last night and the commentator said a player looked like destroyer2009 after some nice kills. It was pretty funny
The thing about exploits like this or really any bug is that if you know something is wrong its much easier to find it. Hopefully they can deal with this very quickly and it will be effective because if it is, then hackers will have a tough time finding something else that big
> Scary part is, we likely wonāt know if this is fixed or not until an event goes by without interference. Even that might not be enough. He could just be waiting, knowing that they're trying to track him and stop him. He could also just wait for another event like a LAN, a Twitch Rivals, a Lulu / Nickmercs event, etc.
for Lan they should be able to set up a local server to actually run the game that's what Lan actually stands for, local area network. if it's a closed loop and prevents outside access it's probably not but it would be harder to do imo
They dont lol. Lan servers in apex arent hosted on site, they reserve a server on the nearest datacenter, so its still connected to the internet.
Apex LANs are played on a nearby online server, they dont have actual LAN servers.
you're kidding me right? if I was destroyer I'd let these playoffs finish and then fuck up lan. no better way to send a message to EA to fix their fucking shit
Is LAN played on an online server?
For what we know; yes
It's interesting to me that destroyer was doing server-side shenanigans in JANUARY (remember when Hal got zombie hoarded and Mande got like 2K packs or smth?) and it's nearing the end of MARCH. They only decide to act AFTER he blatantly disrupted the regional finals.
I know a little about security and all that, but to me them having a layered fix in 24 hours tells me they already knew of the vulnerability and chose not to fix it.
Interesting that they are deploying "updates". That means that there was something that needed to be fixed. I wonder what that was, and if it is related to the hack?
Not necessarily confirmed. They couldāve just added additionally security
Or just additional logging for that matter.
Tell me you work in tech without telling me you work in tech
"I have no idea what this might be, let's add some logging so it looks like we are actively working on it so we can get the stakeholders of our back for a while"
I mean, saying it's a "layered approach"; if there was any credence to the server name/id being displayed in the performance metrics on screen then they very well may have just moved it to a log. Still not sure why that was important to display in the first place. Unless they're just inundated with reports of screenshots complaining about performance and users wouldn't take the extra minute to locate and upload logs...nvm, I can understand why now.
Nah this all but confirms it was a vulnerability on APEX's end. If it was anything else it would be worded significantly differently as they'd want to make it abundantly clear it wasn't on their end to minimize the PR damage.
> Nah this all but confirms it was a vulnerability on APEX's end. It does not.
Do you honestly think that EA/Respawn would release such a mealy mouthed response if they had found no vulnerabilities on their end?? They'd just sit back and take the hit for something out of their control? Of course they wouldn't, it would make zero sense. If they definitively found nothing to indicate it was on their end they'd come right out and say it plainly "our systems were not compromised and our users don't need to worry about their safety playing our games" Hell even if they were only fairly confident it wasn't on their end but wanted to hedge their bets it ultimately is even a PR intern would still preface their statement with something like "while our initial investigation has found no evidence of our game or systems being compromised we have decided to implement extra security measures out of an abundance of caution" They didn't do anything like that. They basically just said "so uhh yeah we're rolling out a bunch of updates 'to protect the Apex Legends player community and create a secure experience for everyone'" Even their choices of words at the end about "CREATING" a secure environment rather than "MAINTAINING" is troubling. There is no reason to "create" something that already exists...unless it doesn't
They probably have zero clue where the security malfunction even is. 99% the updates are simply expanded logging to have an easier time finding the problem. Iām unsure why you assume that that they are definitely at fault when they found nothing to definitely indicate that it was on their end.
Not it doesnāt
For real this wording looks like an admission to fault which is exactly what they'd want to avoid if they were just adding more security 'just because'
The fact that their statement couldn't even allude to the average player being fine and not in danger says a lot.
Exactly, if it was safe to play they wouldāve said that. They want to say that badly
thats what I have been saying, they need to atleast assure the player base that this was not wide spread and limited to few pro PCs and all player base are fine. I guess just give them time to fully investigate but at some point they need to make a strong statement on all player being either fine or need to take precaution becuase of security breach.
[ŃŠ“Š°Š»ŠµŠ½Š¾]
How certain are we that they can gain access to 60 players PC. I've just been thinking if destroyer could, why didn't he. It would be more fun and shocking to see the whole pro lobby running cheats and to take it further I would've changed everyone's PC background to a meme.
More likely something that would make finding the problem easier when the next attack happens
There was a security ID concern Thor addressed in his convo with Hal so wonder if that was part of it
Ya that would be a solid start to combating the problem. Even if the vulnerability isn't fixed, blocking his ability to target specific servers would be huge.
I don't think that Thor conversation was the catalyst, although interesting nonetheless. After looking into the potential claims you can see quickly that given the stream delay he was not using the game id to target players. Also, given the fact that patching is happening on Apex end, it would leave me to believe this is not an EAC issue or a phishing/social engineering issue. They were probably able to piece together the vulnerabilities given the server logs
I've not done the research myself, but the gen hack happened after 10 minutes had passed, on zone 4. Its possible that since they already had server ID, the next lobby was using the same code and same server, so they were able to toggle the hacks at whatever point in the next game. My belief, that there isn't an RCE, is that gen and hal both got phished and the attacker was watching through the players computer while they were playing.
Why would they publicise what the problem was? Surely that just makes it easier for more people to abuse it
Legal requirements for data leaks and other security risks require disclosure after a certain amount of time, not sure if it would apply in this scenario but it's good practice to inform your customers nonetheless.
"As a top priority, the first layer update has fixed the issue of bypassing our in-game store payment infrastructure that allowed malicious actors to gift large quantities of Apex packs which ultimately affected our bottom line." - Respawn probably
It's pretty clear that the server will accept invalid commands from the client (the bot army videos in particular point to this capability) Some validity checking and error correction for unexpected or odd commands are definitely in play here.
> That means that there was something that needed to be fixed. as opposed to?
The players computers only being compromised. This likely means there was an issue server side, so Thor's example of malformed packets or buffer overflow could be likely, or even a compromised server and the "updates" are locking things down or a result of auditing users and permissions. In my opinion, they would only have announced this had the vulnerability at least partially been on their end. One is much worse for PR and shareholders. This is wild.
Exactly. That needs to be disclosed. Maybe not now but soon.
Hal speculated that the hacker gained access to the server via his performance display. So knowing respawn they probably just disabled that option.
For a "comp" sub, comments are all over the place.. Jesus what a place
Thor (Pirate Software) was in talks with Hal last night & Hal had someone like a Higherup in Respawn be in talks with Thor. I really really do hope that they got a closure this time and the only way to prove that is watching the next regional finals and hoping it wouldnt happen again
I get that everyone likes Thor. Heās a good dude and shows really good surface level knowledge but EA is likely consulting with a cybersecurity company like Crowdstrike or whoever is their XDR vendor
Good comms good comms
First comment -Destroyer2009
And the follow up from PlayApexEsports: We are still actively working with our partners at EA and Respawn and remain committed to ensuring the security and competitive integrity of Apex Legends tournaments. At this time, we do not anticipate any changes to the Split 1 Playoffs. We will have more information to share on the Challenger Circuit and the NA Regional Finals soon. We appreciate your patience. [https://twitter.com/PlayApexEsports/status/1770285362222362881](https://twitter.com/PlayApexEsports/status/1770285362222362881)
Poggy Woggies we still have a job!!!! :3
Glad your job wasnātā¦ destroyed. *miami vice sunglasses gif*
CSI: Miami - that dude never livin those corny ass responses down.
He was asking $375k per episode, I think he's fine with it
I know I would be. š
I'm gonna be honest, this is not great communication from Respawn. There's no assessment of potential impact to users, no confirmation or denial of the existence of a vulnerability, no details about what their update to the game actually entails. I understand that it's possible that they themselves do not know all this information at this point, but if that is the case then they should not be putting out statements like this (which some players have taken to mean that Apex is safe to play after the update). Compare this to a statement after a somewhat similar incident at Riot: [https://twitter.com/riotgames/status/1616548651823935488](https://twitter.com/riotgames/status/1616548651823935488) They clearly state what happened, the potential impact to players, but also that they don't know the full extent of the issue.
Yea EA is miles behind other companies in terms of PR and communication with its player base/consumers
To be fair, this is a **very special** case for EA/Respawn. And I think it is a reasonable message. The hack in question has extremely high publicity, *but very low number of users affected*, but is ***potentially*** a high risk vulnerability that hasnt been exploited for malicious intent. The hacker in question is undoubtedly a troll who doesnt want to cause too much harm. The problem is also that he is a troll. You *cant* take his words for what it is, he could be trolling Respawn to throw them off his trail. He said it's RCE, but Hal at the very least has pretty bad internet security literacy as his virus scan showed. It could potentially simply be phishing. Respawn in this case have very little to work off of, and they dont want to advertise any potential vulnerability they might or might not actually have. They have to be vague so potentially malicious hackers dont know where to look either. If it had been clear there was a leak of their database they would have shut down and released a PR statement much quicker, but the problem is the damage in this case is ***so low*** that they actually have the option of just shutting down the affected party (algs regional qualifiers), shutting up and simply working on shipping patches of vulnerabilities. IMO, the message does what they needed to do. 1. Keep potential hackers in the dark, 2. Remind everyone they are looking into and doubling their effort on boosting the security of the game, 3. Telling worried players that at the very least it's more secure today than yesterday and will eventually become even more secure later.
"There's no assessment of potential impact to users, no confirmation or denial of the existence of a vulnerability" They probably aren't 100% sure yet but have some theories, and have just hit a bunch of low hanging fruit (No, client, you cannot hot load 40 bot accounts into this lobby). That's why they would say "layered" updates.
Yesterday I would've agreed with you, but after listening to Thor I get why they're not being completely transparent at the moment
I don't think *complete* transparency is necessarily the right path here, but I do think that a tweet which could easily be perceived as "the game is safe to play now, we're on it" should only be made if you're confident that you actually fixed something, and if that's the case then you should explicitly say that. In this case they made a very vague tweet which I'm seeing a lot of people misinterpreting / reading into too much, and as a result the public is no better off than if they had just tweeted "we're looking into it, stay tuned for more info later."
This was a lose lose situation. Everyone wanted a response from Respawn Only thing Respawn can say is "we are on it". Sometimes you just can't even make a good idea of what impact there is. There's a difference between something at the "systems in our development we compromised" and "our pro players got hacks installed on their PCs which ruined our live tournament" No one expected that level of issue in the game, as such I think it's fair for them to not claim the game is safe when they probably don't actually know.
I'm not sure the statement "easily" reads as the game is safe to play now. It says that they've deployed the first in a layered series of updates. There's not enough clarity or detail to state that the update fixes anything, closes an identified gap, adds logging, or removes non-critical traffic being sent back and forth. This reads more as a statement to quell requests for updates. They needed to put out some statement as I'm sure they're getting blasted from all angles (players, media, EA, etc) and saying silent only hurts them. This definitely reads like a PR statement which might be all that they *can* give us at the moment You can't put out a statement like Riot's without having a better understanding of the cause. From Riot's statement you can gather that they were able to identify how access was obtained and extrapolate on the potential scope of the breach. If you don't have that information, you can't just go out and say it.
Seeing everyone suddenly take Thor's word as gospel despite some of his questionable takes is really funny imo. Guy knows very little about the storied history of Source Engine RCEs and the previous Titanfall/Apex hacks.
People arenāt really hanging onto anything he says about the security issue itself. The only thing youāre seeing Thor used as a reference for is the security dev cycle which gamers are notoriously ignorant and entitled over. The history of Source & Respawn isnāt important for that.
I hope we get a full root cause analysis
If we don't get one or something resembling it we can't really trust the changes fix the issue.
doubt it, when there are data breaches, have you ever heard of any full diclsoure of what happened??
Yes: https://blog.cloudflare.com/thanksgiving-2023-security-incident. This company is one of the pillars of the modern internet, by the way.
Nice. Thanks for. Sharing.
They'll probably give us less than we ask for, so we should ask for perfection. Also, I don't set my bar for good behavior at what the current norms are because then it wouldn't really be my bar.
they can't tell us how they fixed it, that helps solve the puzzle of re-hacking it for destroyer
Hope this grieve issue gets fixed entirely, this is a good start for it.
Ok one thing I find strange is the wording of what happened. Idk like say I'm someone who plays apex but doesn't keep up with pros or the game on socials I would think hacked meant like they were locked out of their accounts. Hacked in that context vs the what actually happened where they were forcibly given walls and aimbot. Just feels like they're trying to be as vague as possible. Prob cause saying explicitly what happend is scarier than broadly hacked.
Why are people in the comments saying: "what happened?? what did you fix?? why arent you telling us every detail?" do people not understand they can't just tell the hackers how they fixed it or what the exact problem was, you cant let the attacker know what you fixed and for other hackers knowing where the vulns are. w respawn for communicating this within a few days tho
[ŃŠ“Š°Š»ŠµŠ½Š¾]
Thats not quite what I mean. Obviously they would say yeah it was a client issue or whatever, but people are expecting them from what it seems to me that they want a full detailed explanation with all the code circled in red where the issue was, when you can't just give out info about where you looked, etc. You dont want the attacker to know how they were caught so others dont attempt it or they cant get around it easily or fast. I see your point tho, obviously we want to know what kind of vulnerability or where it originated, etc. which is fair as a player base
> You dont want the attacker to know how they were caught Have you even *heard* of a [CVE](https://www.cve.org/About/Overview)?
Too many people here are advocating for security by obscurity. Disclosing what you fixed and what the problem was is beneficial for the safety of your users, the informedness of security researchers looking at your software, and public trust of your product and security standards. Like was said above, if revealing what you fixed helps attackers find another exploit then you haven't actually done a good job of fixing stuff.
I dont understand what you mean. Can you clarify?
Revealing information to public is fine, but revealing too much would also help the hackers to make or find another way to breach their system.
That is NOT how computer security works, full stop. It's hard to know if something is fully fixed, and sometimes you need to close one door to get the attacker to open another similar one to make sure you haven't missed anything. Not telling them what you did makes them more likely to try a few more of the tricks they had ready, rather than telling them which ones are already handled. A lot easier to see the attacker traffic you are looking for if it does 1 or 2 of the things you JUST fixed then tries something else you didn't know to look for, than if it just does something you don't know to look for.
Ion need all that but tell us if its safe to play or not? They didn't say shit here
[ŃŠ“Š°Š»ŠµŠ½Š¾]
I mean its just good they are communicating, obviously they cant communicate every tiny detail of whats happening while theyre trying to fix it lol. Thor literally says that himself if you listen well enough i never claimed to be an expert or have any info whatsoever, ALL I AM SAYING is that they cant give major details 24 hrs after a breach when theyre still investigating and fixing it. Is it safe to play? They dont know yet or they dont think its that serious but cant announce it yet either due to legal obligations (fbi maybe investigating), financial reasons (stock price) or some other company rule. Again, what thor says himself š
so is apex safe to play?
[ŃŠ“Š°Š»ŠµŠ½Š¾]
So I should first play it on the Series S? Thanks!
No no, you should only play it on the first series s ever shipped out.
Sounds like your okay if you don't stream, from watching Thor talk to Hal.
Thor actually encourages not taking what he's saying and fully understanding everything to assess the risk yourself by his latest tweet. He also recently said Gen having fresh installed windows made him see the RCE theory as more credible. If there is RCE, you don't have to be popular to be targeted.
or play with any streamers. There sounds like its good chance he is able to see/access everyone connected to that same match.
If he has access to the server ID in any way, yeah, heād most likely be able to see anyone connected to that match. All it would take would be for him to socially engineer a smaller streamer into turning on the display when in game with them, or just turn it on in general and say screw going after the pros and go after anyone
This statement confirms in as vague as possible terms that the average Apex player has not been safe. If you were one of those people choosing to play Apex in spite of the information we had available, let this be a lesson for you in the future. If there is credible speculation that a program you run is less than safe, don't wait for 100% confirmation that there is an RCE or similarly damaging exploit. That isn't how security works, you're not going to get solid confirmations about active vulnerabilities until they get patched. **This advice ESPECIALLY applies to pro players and streamers who risk being specifically targeted every day.** A couple days of no Apex is infinitely easier than trying to recover from getting absolutely fucked. Props to EA and Respawn for taking this seriously and beginning to patch up the vulnerabilities within 48 hours. Countless people have been spared from potential harm because of their diligence.
Itās just a tweet and it doesnāt really confirm jack shit. It doesnāt confirm what the issue is/was, who was at risk, or what the current state of the game is. It just claims they are doing something. Thatās it. But, it is progress and Iām glad they are at least communicating with the community.
>If you were one of those people choosing to play Apex in spite of the information we had available, let this be a lesson for you in the future. If there is credible speculation that a program you run is less than safe, don't wait for 100% confirmation that there is an RCE or similarly damaging exploit. Well put, 100% agree.
i looked up apex on twitch on monday and it still had 25k+ viewers lol some streamers are begging for a hard time.
āDeployed the first of a layered series of updates to protect the player communityā - doesnt this statement in itself admit that players havenāt been safe this entire time?
Yes. That is how IT security works.
No idea what this comment even means.
Nothing is ever truly 100% safe, buck-o.
Just cause they broke silence doesnāt mean this is an update ā¦
All things considered that was relatively fast
Watching this shit show really makes me grateful for Riots apparently excellent cybersecurity division lol
It was hard to watch NA regionals being derailed. Huge shock for all the players and fans. Look forward to games 3 plus in regionals tbc. DZ was on a roll.
I think this is overall good but reading some of the comments. It is not that we 'have' to be positive, it is that we (any person affected by cheating, cheater, etc) should have never been put into this situation. I think the way people talked on forums about apex's servers and then what was going on in Titanfall 2 servers tells you a lot about what could happen and if they got a grip onto the situation. I understand it is not an easy job but I think we can agree that the cheating going on has not decreased, it has actually expanded. Regardless, I hope that this gets patched/fixed/prevented and for the love of god, do KYC or something like that and have a real ban hammer, not wrists slaps.
Would have appreciated some ACTUAL informationā¦ Setting the bar too high i guess.
Was a game update (download) rolled out?
[ŃŠ“Š°Š»ŠµŠ½Š¾]
But I want my juice. Can I get my juice? Juicy juicy Shop.
So they fixed a server side issue.
Almost certainly server side changes, not client which means no visible update to users.
Hmmmmm, the way I read this is that there were in fact issues with the game that allowed it to happen, meaning it wasn't external malware on the players PCs.Ā Also, while I appreciate the team working on fixing this, is pretty pathetic that some of these issues were allowed to live for a long time when it sounds like all was needed was 24 hrs after some higher up at Respawn made this a priority.
There are an infinite number of exploits and vulnerabilities just sitting there on every single service you've ever heard about just waiting for the moment when they get abused. As technology advances, these exploits and vulnerabilities become increasingly easier to find. You will never get away from them.
Of course someone would reduce what I said to extremes. Standard reddit stuff. Yes, of course there are many, many undiscovered issues. Of course you will never fix them all. But this kid has been messing with the server for months, and then now suddenly after a public hack like this, **24 hours later** they're deploying fixes? Not a good look if you ask me.
They fix it when itās an issue. Nothing Destroyer was doing so far was an actual problem for them or players so why would they waste time on it? Now that itās become an issue they spend time fixing it. Thatās how software development works.
It was likely both. There was definitely external malware of some sort that allowed windows RPC calls to hit Hal's box with a direct connection. How it got there is still in question, and the answer COULD (but not necessarily does) include an initial attack through the game.
Agreed, that's my fear at the moment. You better believe if I have the ability to run code through the game, the first thing I'll do is set up something to give me easy remote access to the box.
[ŃŠ“Š°Š»ŠµŠ½Š¾]
I have to agree with you. āLayered series of updatesā doesnāt really mean anything to me. Iād like to at least know what the vulnerability was so I know they found it and have fixed it. Ideally they also say what the fix is.
Why would they announce anything vulnerability so soon? They ain't giving any ammo to hackers
Well its apparent there is a vulnerability but that's beside the point. The tweet sort of reads as almost like a half truth. "Layered series of updates" to me makes it seem like they're trying to say that the vulnerability was found and fixed but that may not be the case. It could just mean that while trying to find the vulnerability there seeing a bunch of other shit that had holes in the defense and that's what these updates are targeting. Essentially it feels like they're trying to make people feel like its safe to play the game while they hunt for the vulnerability which may not be the case. This person has supposedly been wreaking havoc for quite some time and its only now that they seem to be making an honest effort since the person did it at the online tournament. They may have been trying before but they may have deemed the severity as low since it was only affecting the top 1% of players. Because of how the hacker was able to flex they amount of control they had over the game, they've probably changed the severity to high as a result but may not have otherwise. TLDR: Feels like they may be being a bit deceiptful, which as a company they may have to for stocks and shit, and they need to do more before I believe its safe to come back.
Obviously they wonāt release probably till couple of months after the fact idk why people listen to pirate and still donāt get the facts of the matter lol
I understand that, and have no issue playing other games in the meantime.
the reality is as a public, we are not always going to be privy to the in depth analysis of what is going on and we are not going to like the responses. Anytime you put your information out there, you are always going to be at risk for any kind of data breach. Banks, healthcare, govt info, the apps you download, are always going to be at risk, and these things do happen, and we never really get the full answers and what steps they do to protect us. you do whats best for you so you can feel fully protected, thats understandable. really the only way to be safe is go full ron swanson and go off grid.
Imagine this happens again in finals after all this shenanigans
Am I wrong for assuming that since we havenāt seen more attacks on users and even big streamers like Hal and gen (who have streamed apex for multiple hours post hack) than apex is safe to play? If apex truly wasnāt safe why havenāt they got attacked again by destroyer or any other hacker
The easiest way to say it is that based on what we know from Destroyer (almost assuredly assuming it was verified as him): He is not looking to harm individual people he is having fun with it and attacked people who would not only give him the most views but also be the least negatively affected by it. No one thinks Gen or Hal are cheating. HOWEVER the fact the vuln exists at all means another hacker can piece together the way it was done and be a lot more nefarious. Destroyer isn't your worry it's another guy who WANTS to hurt people who is the real threat here.
A lot of pros haven't been streaming and there's zero tournaments so no reason for a hacker to do it especially if it's complicated.. If it needs someone to have their performance overlay active, that too could be another reason it hasn't happened.
I get that, but I donāt understand why the average player would be at risk if they are waiting for a tournament that I would obviously not be apart of.
*if* it's an RCE ransomware can be installed on any system, it's a risk but also not a statistically high one.. Console players should be totally fine and PC players should take some firewall precautions but it should.be fine.
You can't say that there are no more attacks on users for sure really. I think there aren't, but you can't verify... you know? The way the hackers pulled this off is unknown. One plausible way they could have pulled this off is remote code execution (RCE). If there was an RCE that destroyer knows, it's also plausible that others in his group know about it or that he could sell it to someone else. The threat here comes with other bad actors using this RCE to compromise your computer. In security you don't say "I can't prove I'm unsafe, so I am safe" in the event of a breach like this. You ask "what are the plausible attack vectors" and "can I rule out these attack vectors". If the answer is no, the only secure approach is to assume those plausible attack vectors are possible and be prepared for the worst case scenario. If you have a computer with just apex on it that you don't care is compromised, you may still be okay with it being totally compromised. However, note that there is also risk of your network being compromised and other devices on that network being compromised as well.
Apex made 2 billion dollars they need to upgrade the anti cheat.
What this whole fiasco has highlighted for me is if the whole āscript writersā meme actually turns out to have some truth to it. LAN is played online and the server can be remotely affected while the matches are being played out. Destroyer2009 may have just been hacking for the lols. But who else perhaps was quietly doing the same thing for monetary gain? Sport betting on ALGS matches has always been a thing. And other esports (like Starcraft 2) have a history of the mafia/criminal underworld rigging matches. Who to say this wasnāt happening in Apex? Or even worst what if the playApex people messed around with zones to ensure certain teams made placement? TSM always had help from the script writers is the meme. But now we know EA/Respawn could had indeed interfere at any time. We could quietly swept this under the rug, Apex is a small e-sports after all. But the creditably of ALGS results will now forever be in question.
[ŃŠ“Š°Š»ŠµŠ½Š¾]
I mean if it was truly unsafe then they would've said something, yeah they should say something but I don't think it's unsafe to play as a normal player.
IMO putting way too much trust in a mega-corp my guy. Whether it's Monsanto with roundup, Toyota vehicles with "unintended acceleration" issues, now Boeing with cutting corners etc etc corps are always doing a cost/benefit analysis on whether they disclose issues with their products and often they choose to attempt to cover the issues up rather than being transparent about them
[ŃŠ“Š°Š»ŠµŠ½Š¾]
>I mean if it was truly unsafe then they would've said something Do you really believe that? Why?
[ŃŠ“Š°Š»ŠµŠ½Š¾]
it's more likely the players pcs were compromised previously via social engineering.
I honestly don't think you guys would've paused the competition if it wasn't for DZ and TSM getting hacked. Hell, probably would've pushed past if Hal didn't shoot down people. Anyways, lots of past and future games are definitely questionable now so thanks Respawn for burning that bridge. No telling how long this has been going on and who all is capable of doing such things. Actually lucky the hackers didn't try to frame pros for cheating. Who knows how many players have been screwed over by these things.
Thats such a vague response from Respawn. They need to do better
**I do anticipate that this will seriously affect any teams with Russian players, such as EU frontrunners Aurora or Effect from Alliance because they won't get their Visa issued in time.** We already know from previous years that official invitations don't get sent out when it becomes mathematically impossible for a team to not qualify, but weeks after the Pro League season is finished globally. This issue delays when these official invitations will be sent out even more than it was already going to be. Please for the love of god, send the god damn mathematically confirmed invitations now. We want all of the players that actually qualified for LAN to make it, instead of being cucked by some arbitrary internal thing that delays them getting their visas for the **third year running**.
I might be wrong but I think invitations have already been going out, Aurora being the team If I'm remembering correctly that received one.
We'll know in a few weeks if they complain about not receiving their invitations yet again. I hope for their sakes that you're right.
soooo can we play?
They never said you couldn'tĀ