Not a slight against the code monkey that implemented it that way, because they surely didn't bother to think about complexity consequences when the gamestate was new and the JSON wasn't 10MB yet, but a slight on Rockstar, because the cash cow that GTA:O turned out to be deserves some fuckin' maintenance, doesn't it? Then again, the eye-popping abilities (and prevalence!) of hax0rs in Rockstar games probably ought to signify priorities to even the most casual observer. As others in these comments observe, with what those hackers can achieve, it's not surprising to learn there's RCEs too.
[0] https://github.com/tostercx/GTAO_Booster_PoC
[1] https://nee.lv/2021/02/28/How-I-cut-GTA-Online-loading-times...
Aimbots, a buzzkill, but I can play around it. Remotely spawning a cage on my player and lighting me on fire every time I spawn is unplayable. Teleporting everyone on the server to one location and blowing them up, over and over again, unplayable. Etc. You just have to quit. There are so many hackers that every server eventually succumbs to one.
Cheaters have been rampant for many years, with people using apparently purchased cheat tools that allow them to choose to do server-side things like drop unlimited money and spawn vehicles anywhere, rapidly cycling through weather changes, and locking people permanently in cages.
But get on the bad side of a cheater and they can crash the games of people in the server they want to kick.
It's very sad, because despite the immense flaws of the game, the game play loop can be very engaging.
Then again, nowadays you can play the game without restrictions in invite-only and friends sessions, too.
First I ever played with friends, we were driving down a highway, stopped by spikes that killed our tires, and someone spawned bags of money in front of us. I took a few million, logged out, and did not touch GTA till many years later. I remember I also bought cars and apartments with my friend, I figure we didnt have impossible amounts of money, so Rockstar would never ban us, sure enough, we were fine.
I played a year back with the same friend, but despite there being less hackers, I hate not being able to do gameplay more isolated to just friends, even if you lock out some missions.
Spawning money and vehicles sound like pretty harmless cheats you'd expect in a game like grand theft auto.
This doesn't surprise me at all. There seems to be zero validation that other people's actions. How was netcode even designed to players allowed to teleport and unlock collectable for one another? How does the client accept actions from other players in a singleplayer game?
This doesn't seem to be just standard peer2peer issues, it seems like Rockstar went out of their way to design the least secure netcode possible.
client send new origin to server -> server checks if everything is in bounds with the simulation/world -> tells other clients ur new position
Every once in a while I feel like playing one of the older Call of Duty games on my steam library again, but then I remember that they all have known unfixed RCE exploits.
* This post claims an RCE being exploited and warns people not to play.
* It links to Rockstar forums where people are warning about the game being exploited but provide no details on the attack vector or indicators of compromise.
* It links to a screenshot of a tweet of some random person again warning not to play but doesn't provide any useful detail.
* The _original source_ linked in this post is a tweet with some screenshots of a mod that clearly indicates some game modifications but says nothing about an RCE.
Can anyone point to an authoritative source with real technical details?
I believe it's likely real, and we'll see more details soon enough.
If you look hard enough I'm quite sure most of them do
Yes, it is better to have the server parse, validate and reserialize messages from other players to add another layer of defense in front of the client. But the client shouldn't be trusting the server anyways so going peer-to-peer shouldn't be an issue. The fact is that server pricing isn't going to catch everything anyways.
Probably the biggest problem with P2P these days is that it shares your IP which can be used for tracking or DoS attacks.
If there's things like durable money between matches, etc: without someone in the loop to validate what happened you can't really solve this problem peer to peer. (If we define security to encompass "secure game state" and not just "safety from remote code execution")
But seriously, one of the reasons games should maybe be less C++ and more memory-safe languages, if not Rust then languages like C# or JavaScript. And maybe incorporate formal methods into game-dev. The code which handles server responses should be sufficiently isolated from any of the unsafe code (e.g. rendering), so that you can ideally prove (or non-ideally, at least be very confident) that a server response cannot cause arbitrary code execution.
Maybe it still won't be sufficient against state actors, but it would mean that you can reliably play an old game like you can reliably view a webpage.
I would not be surprised if COD and GTA have remote-code exploits, though.
So for the new version of Flight Simulator, they divided it into core game engine and "content packages" that fill the rest (airplanes, landscape, missions, other assets). Packages get loaded into a virtual file tree[2]. Packages may contain custom code, usually compiled from C++ to WASM, but the code is executed in isolated containers and it does not have access to the underlying file system. It only sees contents of its local package within the virtual file system.
As a result, the shiny airplane you bought from some online marketplace can't read your documents folder and send its contents to remote servers anymore. It remains an issue with many other games where third-party modifications ship as unrestricted DLLs, even on authoritative-looking platforms like Steam Workshop. For example, a pathfinding fix for Command & Conquer on Steam is just a DLL swap[3] - this should make security-concious people very uneasy.
[1] https://docs.flightsimulator.com/html/Programming_Tools/WASM...
[2] https://docs.flightsimulator.com/html/Developer_Mode/Menus/T...
[3] https://steamcommunity.com/sharedfiles/filedetails/?id=21371...
https://www.cvedetails.com/product/15031/Google-Chrome.html?...
oh and muh rust magic safety https://github.com/Qwaz/rust-cve
If there's anything that consoles absolutely blow PCs out of the water with, it's multiplayer gaming for that exact reason, and I say that as someone with a pretty serious gaming PC
Most validation that the server does can be run on clients just as easily. (The main issue is what information is visible to clients. But if you are doing mostly P2P you usually end up making tradeoff that the client gets most information)
(And then you go meta and write a mod that compiles and loads source code at runtime: https://www.nexusmods.com/mountandblade2bannerlord/mods/1651)