Re:VRchat bans mods, embraces EAC
by _mb2v on Monday July 25, 2022 @11:41PM
(#32233994)
The comment I replied to got flagged so my reply to it’s hidden too, but here are some details on the crashers, malicious mods for sale, and DDoS groups I mention above:
——
Crashers, many of which are Quest-specific, some of which are world or avatar-based and sone of which are built into mods, are common and extensively documented:
I know about the DDoS services because I followed the Discord links in the profiles of users affiliated with them, some of whom crashed me for sport in public worlds. I pulled their usernames from the logs and looked up their public game profiles. For example (sketchy link warning, may be NSFW):
IP addresses of other users could previously be extracted due to VRChat’s old P2P netcode. This is a security design flaw in an MMO with a community as toxic as VRChat’s. This has now been mostly but not entirely patched (if you join a world with an older type of video player, any user in-world can submit a video URL that your client will directly fetch).
——
To be clear, banning mods and enforcing EAC won’t fix these problems. Improving moderation and patching the holes exploited by malicious mods will fix the problem.
——
Crashers, many of which are Quest-specific, some of which are world or avatar-based and sone of which are built into mods, are common and extensively documented:
https://youtu.be/tm0qVevUMJU
https://youtu.be/NW1XvhCzlts
https://youtu.be/Eeuf3EGgYJI
I know about the DDoS services because I followed the Discord links in the profiles of users affiliated with them, some of whom crashed me for sport in public worlds. I pulled their usernames from the logs and looked up their public game profiles. For example (sketchy link warning, may be NSFW):
https://photon-gods.cc
http://svh.natt.pw/
IP addresses of other users could previously be extracted due to VRChat’s old P2P netcode. This is a security design flaw in an MMO with a community as toxic as VRChat’s. This has now been mostly but not entirely patched (if you join a world with an older type of video player, any user in-world can submit a video URL that your client will directly fetch).
——
To be clear, banning mods and enforcing EAC won’t fix these problems. Improving moderation and patching the holes exploited by malicious mods will fix the problem.