from Hacker News

Hacking GTA V RP Servers Using Web Exploitation Techniques

by hazebooth on 8/29/23, 6:35 PM with 35 comments

• by serf on 8/29/23, 9:12 PM

  it's nice seeing someone open with telling everyone that GTA V is some of the most poisoned online gameplay with regards to cheating.

  I don't agree with the conclusion that it's because it's peer-to-peer. that's not why -- it's because of lazy developer methods and a lower prioritization of security effort.

  the biggest genuine effort that Rockstar puts into anti-cheat effort is an occassional memory-structure shuffle to kick sand into cheat-engine users eyes, and the occassional honey-pot that bans a few hundred people -- and these efforts come after begging Rockstar for years to do something, and the most it accomplishes is selling additional copies of the already dirt-cheap game.

  These ban cycles and 'enforced ignorance' to the problem nets them more profit than it would otherwise; disenchanted players play less, reducing infrastructure costs -- and banned players buy another 2 dollar copy of the game -- but it kills user experience outside of single player entirely.

  They don't care. I get it, but it sucks -- and it's not some GTA6 thing, they never cared.

• by Jerrrry on 8/29/23, 8:48 PM

  I miss these kinda posts, so rare now.

  I know XSS is dying due to CORS and DLL injection is mooted by ALSR, that API's are usually authenticated and authorized, but damn...

  I wish there was a more collective place to showcase modern exploits, they just hit nice in the feelies.

• by curiousgal on 8/29/23, 8:40 PM

  That was a very nice write-up!

• by padjo on 8/30/23, 8:18 AM

  A bit off topic but I played a bit of GTA online recently after not playing for years, was really amazed at how little it had developed in terms of core gameplay. Lots of new weapons and vehicles but very little to make a compelling game.

• by Alifatisk on 8/31/23, 3:10 PM

  They misspelled “amount”

  “amountt: $('#transferval').val()”

  But great dive into FiveM! Had no idea it came bundled with Vue.

• by mgl on 8/29/23, 11:32 PM

  The „good news” is that code injections are still widely popular in a form of supply chain attacks.

  And this is also our fault, e.g. due to the explosion of dependency hell in npm libraries.

  This is probably the best intro to modern supply chain attacks and detection techniques, just shared with my team this week:

  https://youtu.be/3pLfkutz1x8

  (edit: removed youtube tracking)