Re:Tool to cheat on any Skillz-based game, including cash games
by jeroenhd on Tuesday February 14, 2023 @11:51PM
(#34800229)
As usual, a simple MitM can accomplish more than you'd expect. Together with a simple Frida script, you can easily intercept traffic for apps with certificate pinning as well; there's no quick fix for a vulnerability like this.
You can't trust data from computers you don't own. Looking at the source code snippet posted, this library simply sends a "score" variable over a POST request and the server just seems to accept it as the real score; that's fine for keeping user-specific high scores, but as soon as you use that data together with any other account, you're going to have a bad time.
This reminds me of the Hive Social security vulnerability (forgetting to implement ACLs on any of their endpoints and doing all the security checks client side).
Re:Tool to cheat on any Skillz-based game, including cash games
by brianhama on Wednesday February 15, 2023 @01:39AM
(#34800792)
Yea I was pretty blown away by their security model. Considering they are dealing with cash games worth hundreds of dollars to the users, it’s negligent.
You can't trust data from computers you don't own. Looking at the source code snippet posted, this library simply sends a "score" variable over a POST request and the server just seems to accept it as the real score; that's fine for keeping user-specific high scores, but as soon as you use that data together with any other account, you're going to have a bad time.
This reminds me of the Hive Social security vulnerability (forgetting to implement ACLs on any of their endpoints and doing all the security checks client side).