Wow it finally happened. So glad I switched to steam running on linux mint last week. I refused to install helldivers because it wanted to install some no holds barred god level permissions anti-cheat software. Windows 11 was the last straw for me. Good times…
The volunteers at the Anti-Cheat Police Department have since issued a PSA announcing, “There is currently an RCE exploit being abused in [Apex Legends]” and that it could be delivered via from the game itself, or its anti-cheat protection. “I would advise against playing any games protected by EAC or any EA titles”, they went on to say.
As for players of the tournament, they strongly recommended taking protective measures. “It is advisable that you change your Discord passwords and ensure that your emails are secure. also enable MFA for all your accounts if you have not done it yet”, they said, “perform a clean OS reinstall as soon as possible. Do not take any chances with your personal information, your PC may have been exposed to a rootkit or other malicious software that could cause further damage.”
Apparently the “easy” in EAC means easy like when you call a woman easy…
It ain’t easy being sleazy.
So, lemme get this straight: allowing remote parties to install malware (DRM) on your system results in allowing remote parties to install malware on your system? Wow, who could have known! Certainly not the distributors of the step-one malware, am I right?
I’m certain there’s a couple of lessons to be learned here (install and run games as normal, non-elevated users, people! It’s easy to do on Linux) but I’m also somehow certain Big Corpos are going to stick their heads into the sand regarding such lessons.
Oh well, the pirate way it is.
- This isn’t DRM, but an anti-cheat
- The game is free, there’s nothing to oirste
- The developer has announced that it’s not the anticheat’s fault after all, but a remote execution vulnerability in the game itself
leopards.exe has eaten your face and will continue.
[OK] [Yes] [I deserve it]
There’s a super interesting video by PirateSoftware on YouTube about this too.
The missing context here (not your fault, i think people reporting this are being misleading) is that they were using their personal systems in this tournament. That means whatever dodgy software they’ve installed can’t be monitored in a controlled environment, and claims of it being EAC’s fault is unfounded.
A proper tournament would have controlled hardware and software, even if playing remotely at a professional level. You can’t guarantee these systems haven’t been tampered with, even if the players insist on proper security measures.
deleted by creator
Fyi, it’s “no holds barred” as in no type of hold is disallowed. “no holes barred” is a decidedly different sort of event
Point taken, grammar updated, but… since we are talking about basically opening your OS up to anything EA might enjoy doing to it, maybe this is a rare occasion where the mistake fits the context? Just sayin…
it sounds a bit sus
As a nevernude I prefer no holes bared
No holes Bard.
But then you also need to cover your face
Username. Um, checks out.
Yeah, the “hole bars” are the ones you wanna go if you’re trying to get lucky in the back if you know what I mean ( ͡° ͜ʖ ͡°)
I thought hole bars were the things you see in JAV or manga
Any bar is a hole bar if you’re willing to make a hole and find the right people.
Can you tell me where that kind of event is held so I can avoid it?
…your PC may have been exposed to a rootkit or other malicious software that could cause further damage."
“The rootkit you installed on your pc allowed a rootkit or other malicious software to be installed on your PC.”
“But, it stopped little Aimbot Andrew from successfully using the xProAimb0t2024 program he spent his monthly allowance on! Never mind the rest; it’s working as intended. Closed as WONTFIX.”
– Anticheat developers
The real cheats are the proprietary software we installed along the way.
So about those holes… We gonna bar them?
No, put your bar in my holes
Were gonna go all in for a no holds barred hole barring
“I would advise against playing any games protected by EAC or any EA titles”, they went on to say.
Easy. I specifically blocked all titles with the tags “EA” and “EA Play” on Steam. Never have to worry about it.
removed by mod
Whhaaat they made good games at least until 1998. It was right around the time they switched from using the full Electronic Arts moniker to just “EA” that the quality really tanked.
They must pay the long price, I guess.
Apex runs on Linux though
So does the TiVo
That was a strange path my mind took as I read the title, thinking it was a satire piece about competitors trying to sneak in cheats… Like, the “Anti-Cheat Police Department” couldn’t be anything but a laughingstock.
So glad I switched to steam running on linux mint last week.
Doesn’t EAC work on Linux?
googles
It sounds like it has for two years:
‘Apex Legends’ Now WORKS On Linux With Official EAC Support
I mean, I use Linux myself. But I don’t know if Linux is a fix for “game I use may have vulnerabilities”.
In theory, maybe Linux/Steam could isolate individual games (might be further along with Wayland than Windows is), but that’s not how things work today. If you install software from Steam, it’s got access to act as you, and if it has vulnerabilities that permit for remote compromise, then you’d be vulnerable as well.
Under linux EAC runs as your normal user, so it can’t install system-wide malware but it can read/write your personal data. If you create a dedicated user for gaming you should be safe from this kind of stuff.
What about on Windows? I assumed it would work similarly on there too, even if Windows has a different privilege escalation system to Linux.
On Windows, EAC runs at the kernel level and basically has full access to everything about your system. It only works on linux because newer linux kernels support emulating system calls in user-space (this might not be 100% accurate, but it’s the general idea).
I do not buy this RCE in Apex/EAC rumor. This wouldn’t be the first time “pro” gamers got caught with cheats. And, I wouldn’t put it past the cheat developers to not only include trojan-like remote-control into their cheats, but use it to advertise their product during a streamed tournament. All press is good press. And honestly, they’d probably want people thinking it was a vulnerability in Apex/EAC rather than a trojan included with their cheat.
These 2 pros have performed at lan multiple times and the type of cheats used would have been immediately noticed on any stream.
The hacker (destroyer2009) also gifted in excess of $8k worth of lootboxes to multiple streamers, suggesting that they have access to some remote APIs they shouldn’t.
On top of that a few months ago there was a widespread issue with top players being targeted in lobbies where they’d drop and then 57 bots would drop and zombie rush, all named the same thing and controlled by some kind of rudimentary script.
Pretty much everything together has ruled out the possibility of either of the players involved being the ones who are purposefully cheating.
I’m not saying they were purposefully cheating in this or any tournament, and I agree cheating under that context would be totally obvious. But, it is feasible that a pro worried about their stats might be willing to cheat in situations where the stakes are lower outside of tournaments.
What I also don’t understand is, if this hacker has lobby wide access, why was it only these two people who got compromised? Why wouldn’t the hacker just do the entire lobby? Clearly this hacker loves the clout. Forcing cheats on the entire lobby would certainly be more impressive.
PS. This is all blatant speculation. From all sides. No one, other than the hacker and hopefully Apex really knows what happened. I am mostly frustrated by ACPD’s immediate fear mongering of a RCE in EAC or Apex based on no concrete evidence.
There is an RCE exploit in EAC which has been confirmed by their twitter account; but they didn’t confirm of it being exploited anywhere.
My belief is that the people responsible into it hacked these people months ago; as a few months ago the same hacker did attack ImperialHal while on stream with botted zombie accounts that follow him to kill him. On that stream’s highlights all those bots were named (number)destroyer2009fan; which is the same as the person that spammed the chat at the time of the hack.
This is not an advertisement for cheats. Searching the hacker’s name in cheat forums doesn’t point to any specific program. I suspect that this is openly calling out Respawn to fix their anticheat, which has been a laughing stock.
There is an RCE exploit in EAC which has been confirmed by their twitter account
really? because all I’ve seen was them saying the exact opposite: https://twitter.com/TeddyEAC/status/1769725032047972566
Afaik nothing has been confirmed besides that tweet from EAC
The tweet says they’ve seen the reports of a potential RCE, if they acknowledge this that pretty much means there is something that could achieve it. (or am i reading into it incorrectly?)
But they also state that this hasn’t been exploited.
Mmmm I’ve not done any digging, but the likelihood of a large number of streamers all using cheating software and a large number of them literally announcing it and leaving the game is quite slim.
Think of it this way, assuming they were cheating, the streamers would not want to get caught right? So they would be using cheats that aren’t being broadcast over their streaming software. To then announce “oh no I’m cheating” and quit would be silly, what would be the point of this even joining the tournament at that point? On the other hand, if the cheats were visible on their streams… that seems like a glaring issue a streamer wouldn’t make, never mind a large number of them.
I think their hypothesis is that the streamers had installed and used cheats outside of the tournament and that the cheat suppliers enabled them remotely to advertise on the big stream.
Doubtful. Unless the cheats popped up and said “buy cheats at [cheat website]” then it’s not even really advertising. They’d also be shooting themselves in the foot by showing their cheats are remotely controlled.
Don’t get me wrong, I absolutely believe it’s possible. But it’s much more likely that a “fuck you” hack was pulled, rather than the majority of streamers all cheating by coincidence.
They probably didn’t randomly guess what happened. There would be pretty obvious clues as to how it happened. The network traffic for tournaments like this is monitored. Because they have to be done online. If they had no idea what actually happened, they would have at least been suspicious of the players at first. No matter what messages were playing in chat at the time.
This isn’t a statement from Apex or EAC. The original source for the RCE claim is the “Anti-Cheat Police Department” which appears to just be a twitter community. There is absolutely no way Apex would turn over network traffic logs to a twitter community, who knows what kind of sensitive information could be in that. At best, ACPD is taking the players at their word that the cheats magically showed up on their computers.
PS. Apparently there have been multiple RCE vulnerabilities in the Source Engine over the years. So, I’m keeping my mind open.
deleted by creator
There is currently no evidence of an RCE exploit in EAC, and EAC themselves as well as their owner, Epic, have both denied the existence of an RCE in their software.
There’s a video from about a month ago in which ImperialHal and Genburten (on separate occasions) are in a match against the person named in the messages sent by the exploit on Genburten’s machine.
It’s possible that they were in contact with the hacker after that point and that he tricked them into downloading something they shouldn’t have.
Otherwise, it’s also possible that there is an exploit in Apex/Source that the hacker used. He may have been able to get their IP during the public match a month ago and then use it to target them during the competition.
Beyond what was seen during the competition, the hacker was also able to gift thousands of Apex packs to several players (seemingly without paying for them) and was able to get 40+ “bot” players into a single match and to all target an individual player. He also claimed to be able to open crates on another player’s account. These other exploits seem to indicate that he has elevated access to both the server and to multiple APIs, but none of them indicate elevated access to user machines in general.
Cancel my comment about this being a possible 0day or whatever. They were playing this tournament on their personal systems, which makes it way easier for someone to accidentally download malicious software without players’ consent.
removed by mod
Some people just dont like bots lmao, weird effect of reddit users migrating over.
Any bot that isn’t explicitly summoned is spam.
I do love the abbreviation bots though, they should be automatically summoned the first time a new abbreviation is used in a comment tree
That one is actually nice.
I think it should be required to get manually added to a community by moderators still though. Or respond to a summon to a specific thread.
Because it’s super annoying, clogs comment feeds and is unnecessary to be a giant wall of text comment for something ~50% of people don’t care about.
And yes, I use the default YouTube app because it works.
We can always downvote piped bot posts.
removed by mod
