News for hackers. Stuff that matters.

A comment on Data stream hack gets UCI world championship qualifier banned.

Re:Data stream hack gets UCI world championship qualifier ba... by lelag on Thursday December 08, 2022 @01:24PM (#33911241)
My take is that you can't have a serious e-sport cycling scene with the current tech. This guy was caught because he was greedy and the cheat was too obvious. What about all the others that could be doing the same but in a smarter way. There is no way as an honest cyclist to know you were beaten fairly. (Maybe you can be sure you were not).

The protocols (ANT+ in particular) are totally insecure and it's totally possible to MITM them. The obvious solution would be to upgrade those and start sending data over an encrypted channel instead. Still, this is only going to help momentarily and discourage the hobbyist cheaters. People are starting on PC games using very sophisticated setup with dedicated PCI hardware connected to a second computer where the cheat software actually run.

If the devices get secure, people will start cheating at the software level. If the stake are high enough (and there are for those people hoping to get into a World Championship), they will do anything to get an edge.

I think it's hopeless to hope to make those online race as anything serious. It can be a fun hobby and way to exercice but any serious competition will need to take place in person. For cycling, it probably means the old fashion way: on the road.

[ Parent | on HN ]
Re:Data stream hack gets UCI world championship qualifier ba... by madrox on Thursday December 08, 2022 @02:03PM (#33911719)
This is a challenge across all esports and not just cycling. In other esports, competition may be online, but hardware is usually provided by the organizer and overseen in locations where refs can ensure nothing is being done to machines to cheat. Nowadays cheating scandals only tend to come up in competitions where people are playing from home.
[ Parent | on HN ]
Re:Data stream hack gets UCI world championship qualifier ba... by lelag on Thursday December 08, 2022 @03:58PM (#33913304)
Yes but with cycling, the point of the e-sport is to not travel. If you have to travel with your bike to a physical location, there is no point in cycling on a static smart trainer, you might as well race on the road (which is much more fun anyway). It's no longer an e-sport.
[ Parent | on HN ]
Re:Data stream hack gets UCI world championship qualifier ba... by madrox on Thursday December 08, 2022 @04:39PM (#33913889)
The idea would be you would travel without your bike and use one provided by the organizer. That's what other esports do. There's still advantages to the esport, such as not needing to close public roads, design tracks that don't exist or aren't easily accessed, and allow different racing strategy (I imagine they don't simulate pushing wind).
[ Parent | on HN ]
Re:Data stream hack gets UCI world championship qualifier ba... by nradov on Thursday December 08, 2022 @06:16PM (#33915128)
Zwift doesn't stimulate wind. It does simulate drafting, so you can save energy by sitting on another player's wheel, then try to sprint past them at the finish line.

https://support.zwift.com/en_us/drafting-in-zwift-B1ZB6Nxr

[ Parent | on HN ]
Re:Data stream hack gets UCI world championship qualifier ba... by trollied on Thursday December 08, 2022 @02:17PM (#33911920)
> People are starting on PC games using very sophisticated setup with dedicated PCI hardware connected to a second computer where the cheat software actually ru

Have you got a reference for this? I want to read more.

[ Parent | on HN ]
Re:Data stream hack gets UCI world championship qualifier ba... by lelag on Thursday December 08, 2022 @03:54PM (#33913250)
DMA (Direct Memory Access) is the keyword.

They use this type of hardware:

https://www.raptor-dma.com/raptordma-home/

It's been used to cheat in professional CS:GO tournament from what I remember. They can have a second PC where the cheat run which read the memory of the game on the clean computer and can for example display the position of the other players on a second screen.

[ Parent | on HN ]
Re:Data stream hack gets UCI world championship qualifier ba... by Lyrex on Friday December 09, 2022 @04:05PM (#33926444)
Not related to this game, but this has been a thing in the counter strike community for a few years already. This is an example cheat: https://github.com/EngineOwningSoftware/pcileech-webradar And this is the base repo it was forked from that goes into way more technical details: https://github.com/ufrisk/pcileech
[ Parent | on HN ]
Re:Data stream hack gets UCI world championship qualifier ba... by Nextgrid on Thursday December 08, 2022 @03:38PM (#33913007)
Even if you make the bikes 100% secure, nothing prevents a dedicated cheater from strapping a good old electric motor to the bike and do the on-camera ride on a separate, dummy bike that's only there for show (and to provide a reference speed to the electric motor - which then increases it by 20%).
[ Parent | on HN ]
Re:Data stream hack gets UCI world championship qualifier ba... by nradov on Thursday December 08, 2022 @06:23PM (#33915219)
That wouldn't work because Zwift championship races require a separate power meter on the bike in addition to the smart trainer. If you just strap an electric motor to a separate bike then the power meter numbers would be all wrong, especially if it supports ANT+ cycling dynamics. You would need a reciprocating machine that actually pushes the pedals, like what power meter manufacturers use to test their own products. So it could be done, but would be difficult and expensive.

In the end though it's impossible to be 100% certain that the data stream coming in to the server is an accurate representation of a real human effort. The whole thing is kind of silly.

[ Parent | on HN ]