Tweet
[ATTACH=CONFIG]3420[/ATTACH]
The Division beta is currently ongoing and already players have found a severe flaw in the game's design. Apparently, all character stats are stored client side on the PC version of the game. This includes but is not limited to: player health, currency amount, player level, character speed, magazine/clip size, ammo capacity, medkit count, grenade count, and more.This essentially means that anybody playing the beta can, in theory, make themselves invincible killing machines that can run around faster than the Flash. The initial reports seem to have come from a couple of Reddit postings.
I'm a reverse engineer and experienced game developer that specializes in most game securities. I love this game too much to see this game go down in flames.
However, without stating anything specific on how to 'cheat' in this beta. It's scarily simple.
Everything from ammo count, level XP, Dark Zone currency, player speed are all CLIENT trusted, and take time to sync via server time.
For example. Infinite ammo is possible by removing the instruction that's responsible for adding/subtracting ammo into your player structure.
Speedhacking is possible by modifying the delta time used in the game's update.
And the speedhacking is possible for said 'invisible people'. If a player that is speedhacking runs ahead of the position stated on the server, because the client trusts the position of the players, you can very well quickly take out an enemy without them seeing you and reclaim the reward/loot.
Things such as extraction times, rogue times, and respawn times are the only thing that seems to be server side.
In the full game, I highly anticipate some sort of anticheat or method preventing any kind of open handle to the application.
I understand that this is a beta but for it to be this simple and with absolutely no way of reporting or having consequences, I'm scared for the full release.
However, without stating anything specific on how to 'cheat' in this beta. It's scarily simple.
Everything from ammo count, level XP, Dark Zone currency, player speed are all CLIENT trusted, and take time to sync via server time.
For example. Infinite ammo is possible by removing the instruction that's responsible for adding/subtracting ammo into your player structure.
Speedhacking is possible by modifying the delta time used in the game's update.
And the speedhacking is possible for said 'invisible people'. If a player that is speedhacking runs ahead of the position stated on the server, because the client trusts the position of the players, you can very well quickly take out an enemy without them seeing you and reclaim the reward/loot.
Things such as extraction times, rogue times, and respawn times are the only thing that seems to be server side.
In the full game, I highly anticipate some sort of anticheat or method preventing any kind of open handle to the application.
I understand that this is a beta but for it to be this simple and with absolutely no way of reporting or having consequences, I'm scared for the full release.
A few videos were released showing how the information can be modified on the fly and is shown immediately in game. First up is a video showing the unlimited ammo "cheat" and how it can easily be toggled on or off.
Here is a look at how players can modify their character speed.
Finally, here is a look at how rank can be modified in real time.
Right now, it's too early to say just how much of this will be an issue for the final release. If this is something that is deeply rooted in the game, it could take some time for the developers to fix prior to release. Could it result in delays? Possibly. It could also just be something that was left in because this is a beta. It also begs the question as to what sort of anti-cheat measures Ubisoft will use for this game, which can have a very heavy focus on PvP related content. Again, without official word from Ubisoft, there is just no way of knowing for sure at this time.
As it stands, The Division is slated for release on March 8 for the PC, PS4, and XB1.
