Changing the clock is hacking now? Really?
A 10-year-old hacker has won the admiration of her adult peers for finding a previously unknown vulnerability in games on iOS and Android devices. The young girl, who has adopted the hacker handle CyFi, discovered the timing related bug after she got bored with the slow progress of a FarmVille-style games. For example, crops …
Yes, setting the clock forward to gain an advantage in online gaming is a (simple) hack. If you can make the program behave in an unintended way, you are hacking it. It is hacking as is setting the clock backward to fool "trial" software into a "forever trial" status, for example. Easy, stupid, but still a hack.
This post has been deleted by a moderator
Yeah, it kinda is.
1) The game is not working as intended. It was intended to, after a set amount of real time, set the crops to be at the next level of growth. They didn't have access to real time, so they used system time, which will be close enough. When you change the system time you are changing how it is intended to function. If they wanted you to be able to fast forward time, they probably would have given you a fast forward button.
2) Cars are not built with hard-coded rules that would deny them from going 71mph, in almost all cases. However, if they were, but you found out that it only prevented you from going above 70 in the top gear (which makes sense, nobody could possibly go above 70 in a lower gear!), but you then realized you could drop it down a gear, rev the engine (much too hard, admittedly, for a low gear) for a second, and then pop it back into the top gear and be clear of the prevention scheme... now that's hacking! Breaking a rule outside the system by hitting a button or stepping on a peddle isn't hacking, but finding a way to bypass a lock that prevents you from hitting the button or stepping on the peddle could be.
3) Your penis wasn't designed to be unable to receive blowjobs (I'd hope, but you had better clean off anyways just in case).
4) Because the system has to trust input from the system time, and there's no technical way to avoid this, any hack involving changing the system time isn't really a hack? No! That just means that the system time is an easy attack vector that is hard to defend against!
5) While it might not be clever for you to change the system time, a child who is but 10 coming up with it is rather clever for her or his age.
Why should we be admonishing this child as not "really hacking" the system. Encourage it is a great starting point and a simple example of game-breaking, hacking, and lateral thinking, so that we can continue to encourage this child to develop these skills into the future, so that when they are 20 they are able to understand the hundreds of different ways to protect, penetrate, or game a computer system to get a desired effect outside of the standard procedural bounds.
It all depends on the meaning of "hack". I think that changing the clock is still a hack, expecially when dealing with internet-connected, part-server and part-client-side software. If the programmes is a fool and trusts the client's clock, then it's a hack. An easy, stupid hack, but still a hack.
Then there are really clever hacks, like takign control of the firmware of a NIC remotely and use it to mess wit OS memory using DMA.
I unserstand that changing the clock is easy and messing with NIC firmware is a truly cool hack, buth I still stand that both are hacks.
This post has been deleted by a moderator
It is a hack, in the true meaning of the word.
What it isn't is a "crack" - This is a tech site - it's expected readers know the difference between the two.
If the word 'hack' was on a tabloid news site, it would appear misleading, because of the 'laymans' mis-use of the term.
You don't have to believe me, just check a dictionary:
hack [very common] 1. n. Originally, a quick job that produces what is
needed, but not well.
"You don't have to believe me, just check a dictionary:
hack [very common] 1. n. Originally, a quick job that produces what is
needed, but not well."
Yep, and the dictionary says a window is a hole cut in a wall to allow light in so I don't know what you're talking about windows on a computer for.
Not sure if you're trolling or just really unintelligent.
Since 'hacking' origionally referred to changing the function of something in a useful (to the haker) but unintended (by the creator) way, but these days it means a specific form of hacking more correctly called 'cracking' to the exclusion of the rest, I think you are a bit late - the 80's called and all that!
"Yes, setting the clock forward to gain an advantage in online gaming is a (simple) hack. If you can make the program behave in an unintended way, you are hacking it. It is hacking as is setting the clock backward to fool "trial" software into a "forever trial" status, for example. Easy, stupid, but still a hack."
No, it is a "bug exploit". Alternatively it is a "clever yet unintended use of game mechanics".
Hacking involves gaining unauthorized access and/or inserting your own code.
Repeatedly changing the clock in small increments so as to circumvent a programmatic method implemented to stop the abuse, yes. Just because it is simple doesn't mean it isn't a hack. In fact, if you go all the way back to the earliest definition as in "an elegant hack" the simpler and more obvious but not thought of, the better.
Taking advantage of any implementation glitch in a game would be a hack. Changing the system clock to gain advantage in Farmville is not all that different from skipping most of Ravenholm in HL2 with physics tricks or taking advantage of disappearing sprites in Duke Nukem 3D -- something around when I was ten -- to beat the Cycloid Emperor with very little effort. It shows that you've spend plenty of time playing the things, are reasonably intelligent or at least observant and inquisitive, and have some vague idea of how they work. It is a hack in the sense that you are playing the game in a way unintended by its creators, but it hardly makes you a hacker or your "hack" news. Nonetheless, good going for the ten-year-old and good going for DefCon. Maybe their outreach will interest at least a few more kids in considering careers which are vaguely useful.
Previously unpublished perhaps, along with a lot of other trivial things. It's a bad programmer who trusts the user's system to tell the truth about such things as the system time.
Having said that, I have a number of instant messages sat on Skype which appear to be from the future because I reset my PC's BIOS and failed to notice that the clock setting was in 'merkin format (mmddyyyy) until I'd been using it for a few hours. I mean seriously, who came up with that? It's like telling the time with the seconds between the hours and minutes. And honestly, why does Skype not timestamp messages with a server time?
It's because Merkins say a date as "January first" while we Limeys says "The first of January".
The irony of course is that Independence Day is "The Fourth of July".
El Reg readers know that the Americans are right to put month before day, it's just that they have the year position wrong.
"Us 'ere Limeys also say "ten past five" for a time, but we don't write it as "10:17""
<sarcasm> I would hope that we don't write "ten past five" as "10:17". I'm kind of hoping that we write "ten past five" as "5:10". </sarcasm>
Of course, I might have just been doing it wrong all these years.
This is not a new discovery. The wife and her family have been doing this for yonks to cheat this kind of game. Saying a 10 year old discovered it seems a bit late.
Also, this isn't a "vulnerablility". It is a flaw in the game to prevent cheating, but i can't see it as an attack vector.
On the BBC it was implied that this would let arbitrary code be run on the system...
(As for the comment above that it indeed is "hacking" in an online game -- note that its obviously NOT an online game here, as that kind of trickery is checked against... it only worked "if shutting down wifi" etc.)
don't bitch at me for your own idiocy.
Whether this means just blocking the postings like a geek, or unfriending the people who send you the messages is entirely up to you. Or perhaps you should go in and remove yourself from the game settings. Because the last time I checked, I'm limited to 50 messages to people for a given session, and I sure as hell try to make sure I'm getting something back for the messages I'm sending. Which means they only go out to people who are listed in the game as playing the game.
Ah yes... At the same age I was rewiring the joystick port of my TI-99/4A to connect it to under carpet pressure pads I had made from tin foil, bubble wrap and bin liners, so that my intruder detection program could sound the alarm and log entry and exit from my bedroom for when my horrible little brother came to nick stuff off me. lol.
I also "invented" a new limitless power supply for street lights for my toy cars, using bell wire, 1.5v torch bulbs and a mains power cassette recorder lead... this was slightly less successful, as shoving the bare ends of bell wire into 240v mains had the effect of vaporising said torch bulbs instantaneously. You live and learn. Kids eh!? :-D
...but a few years later on an amiga. changed all the planet names etc on frontier:elite2 to humorous words. also the intro credits. that was pretty cool
deksid got me into "hacking" (worked fine as long as the CRC was unchanged), which i very rarely see anymore in my professional life as a contractor. hit the hex dude!!!!! :)
i 'hacked' a football manager game on the spectrum 128 so I had a limitless cash to build my team.
More recently (10 years ago) i created a champions league patch for the PSone emulator on PC playing one of the first versions of PES, using hexedit, I altered all the players, and built new 3d stadia by directly editing the hex to move the 3d polygons around, remember doing a new Villa Park.
I can't have been much older than 10 when I was messing with the clock to speed up the gestation period of virtual cats in the "Catz" PC game.
I also took a hex editor to some of the virtual creatures, but never managed to create anything more interesting than garden variety deformaties.
At least the Petz games had some rudimentary genetics built in. As such they were more stimulating than watching corn grow.... and always ending up with the exact same type of corn.
Corn is a simple thing really, if you're that interested in it, surely you would set asside the space and time to grow some REAL corn? And I did that too when I was 10. Well not corn exactly, but potatoes.
How many of these kids would still be interested in farming if you handed them a shovel?
The hack isn't the story here, the impressive thing is that she notified the developers before posting... at aged 10 I probably wouldn't have given a crap about the software authors and wouldn't have any real idea of how it would affect them had I posted the hack.
"The 10-year-old presented her findings last weekend in Las Vegas at the very first DefCon Kids, the new pint-sized campaign conference to DefCon. "
Methinks some adult/s may have been involved, as not many 10 year olds would be able to get themselves to a conference like this...
As mentioned, it's not a hack. It's also not something that can ever be defended against really, unless you have a network time server for the game to check against (which this apparently doesn't). The host device's time settings are gospel.
Unfortunately, I can't say I'd have done this when I was 10. But only because my C64 didn't have a real time clock that I could manipulate like this. Do creating my own Action Replay codes to search for the "number of lives" register count??
I have several programs running on my server that crash if the clock changes by more than a small amount when it checks. That even means that I can't just synchronize the clock with a time server suddenly. Unfortunately, it does require the ability to approximately track the passing of time instead of absolute time. Which would mean that the game would either need to have a timer running in the background or make the user actually play for that time instead of just walking away. Alternatively, the system could provide a function that only counted clock tics and didn't care about the absolute time.
Though, really, I find it odd that the phone lets you change your system time willy nilly like that in the first place. The clock is just too important to a number of standard functions for that to be sensible.
Zynga games could be hacked to allow you to do stuff without having hundreds of "friends" actively playing the games, or requiring you to part with vast amounts of real money to do anything useful.
Those limitations quickly turned me off the "freemium" "social games", as to make significant progress requires you to have oodles of "friends", all of which are (a) online 24/7, and (b) are willing to throw real money at the games in order to buy stuff with "cash". Oh, and (c) trying to direct the output to Friend Lists is annoying - click the padlock, select customise, select Specific friend, type in the name of the friend list, click OK, click Post. G+ is soooo much easier to send stuff to specific groups of people - and if (when) they develop an apps platform, they can ensure only people who already play that specific game get spammed, that could encourage Zynga addicts away from FB. Although it would be much nicer if Zynga and any games company that either spams contacts mercilessly or runs a "freemium" service are barred from G+ :)
Meanwhile, installing Skype on mum's Windoze box tries to persuade you to install a games platform - anything to do with their Facebook tie-up?
It's using a vulnerability to make a program behave in a way that it shouldn't. So it's a hack. Sure it's not a hugely difficult one, or a desperately important one. But these games are networked, so being able to spoof this will push you up the rankings on the server. This makes the game less fun for other players. So players stop playing, and the company running it loses money.
Maybe not such an issue for Farmville. But consider one of the many strategy-type games on Facebook. If you can spoof this such that 10 minutes of automated stuff will immediately land you at level 1000 and you can then go and stomp the map, that instantly destroys the fun for everyone else. Bad news for players, worse news for the company.
Plus all these games are still at a very primitive level as far as connectivity goes. It's only a matter of time before someone ports WoW or similar to iPad, Android or some other future platform. In WoW, items *do* have monetary value, and farmers *do* make actual cash money from them. If you can spoof this so that crafting takes much less time, say, that's a big deal.
...wait - no I don't. It's bloody good to see a youngster actually using their brain for once. My faith in humanity is restored...
They'll need their brains too, if they're gonna sort out the worlds problems which we haven't been able to (population, peak oil, deforestation, biodiversity, overfishing, poverty etc etc).
Mind you resetting the clock back 50 years would be a good way of expiring almost everyone over the age of 50, thus solving the first problem...
Some months ago I did exactly this in a particular iOS game in which you are supposed to earn a very tiny drip feed of credits over time with which to buy ingame stuff or, as most of these games do, exchange not inconsiderable sums of real money for in game credit. After setting the iOS clock to it's highest possible date (which is the year 2038), I had 1.3 million credits. I'll refrain from mentioning the game :)
I tried it after seeing various Youtube videos for several other iOS game which reacted the same way, so this girl certainly isn't the first to find them. Possibly she's the first for this particular game, but then the article doesn't reveal which it is, for presumably the same obvious reasons I'm not.
You know how you're always saying how back in the day computers used to be gadgets that you could play and tinker with, instead of locked-down devices for the mindless consumer? And how hours spent exploring in your basement gave you the curiosity to explore and learn?
This is how kids do it these days. Celebrate it, don't knock it. We all share curiosity and drive but express it in different ways.
Now get orf my lawn.
Good on her.
I wish I could get my 11 year old to try this sort of thisng.
It might not be new, but it is in an original context. I doubt if she knew of previous exploits like this, and even if she did - she got off her arse to present it!
Hacking starts with simple first steps - I, for one, welcome our pint sized overlords!
about 8 years old, I figured out a procedure for working out a square root on a calculator. Nowadays of course a square root is just a single button press, but I'm talking of when calculators were hand-cranked mechanical things that could only really add and subtract. The procedure was clumsy but it worked.
So yes, kids can come up with some brilliant ideas sometimes.
10 year old lass?? She must be as bright as a button. If she thinks like that, she's a good future ahead of her, especially as the BOFH will be retiring about the time she graduates ;-)
Yep, certainly made me feel old and withered. Think another glass of tramp-juice is in order. Or two.
Yes it's a "real hack". It's not original, but as long as she came up with it on her own, it's still a accomplishment. And because she circumvented an attempt to detect it, I'd say that even qualifies as a security weakness. Unfortunately, none of the articles I've read make it totally clear if these are multi-player games or not. If they are, then this is actually significant, and should be fixed. If not, it's harmless, but still an amusing discovery.
I discovered that if the metalising on either the frequency changer or IF valves broke away from the drain wire it would cause instability. The cure was to straighten out the drain wire, scrape a bit of the red paint off (not necessary with the older grey valves) and bind the wire to it with rubber bands... OK you had to keep replacing the rugger bands.
Was I hacking the radios? Dunno, but it was fun and got me some pocket money.
I assume by the reference to iOS and corn taking 10 hours to grow that this little one was playing Smurfs. If you Google 'Smurf cheat' you will immediately find that every man and his dog has been playing with the clock since the day it was released (and for years prior on other games and systems). My six-year old asked me if we could use Google to make the game faster and what do you know, the answer was right there waiting for us. Not really a discovery, or a hack, is it? Regardless of her age...
No, just some over zealous parents wanting to promote their child for their own failings and the 'news' jumping on any old story. It certainly doesn't sound good if the story was some large sweaty middle aged man discovers flaw and posts the information on a wiki. Apologies to the man who posted the 'hack' I read about months ago. You may be neither large or sweaty.
RTFA to all the knockers saying it's not a hack, she went further "changing the time by small increments or disconnecting devices". I don't know if she had adult help - suggesting new approaches, preparing the presentation, but she's showing a good problem-solving approach, and that is worth celebrating.
Take extreme pride for your truly PROFESSIONAL handling of your discovery. Most people who fined these types of FAILS just post to their gaming buds or hack sites and don't give the honest system developers a chance to fix or mitigate the potential for system harm.
Live long and .... (what can I say) When I was your age STAR TREK wasn't on yet, and a computer was a PERSON who calculated data. For real.
Whether or not changing a systems time is hacking is besides the point, A 10 year old girl hacked a game!
What the hell is a girl doing playing with computer games let alone hacking?
Doesn't her parents have any shame!
dogs and cats getting married?
Men working as nurses?
Ladies commanding war ships?
It's a world gone mad I tell you
Putting your clock back on a windows system isn't difficult for anyone to do, but is helpful in providing odd results. I get some emails dated in the year 1601, or 1980, 1901. UK social security gives some dates of birth out as January 1st, 1852 (system default, apparently).
Surely it can't be difficult to obtain time strings from time servers such as time.nist.gov or ntp1.npl.co.uk (as time.windows.com has been no more for years now). As these are down for maintenance on occasion, this isn't totally foolproof either. I remember when my motherboard battery went flat and replaced it - forgetting to reset the time - then sending an e-mail dated 2004 in 2006. If this were to be used for criminal activity - how would they go on in court?
When I was in my very early teens, I realised I could add a joystick port to my ZX Spectrum by simply soldering some wires and a 9-pin D socket to the base of the Spectrum motherboard, where the keyboard connector was mounted. It was trivial to make a joystick that was compatible with the 'Interface 2' standard. Although less successful was the hole I made in the front of the spectrum case, which was carved very badly using a dinner knife heated up over my mum's cooker. Ruined the knife, and the hole was ghastly.
A few years later on, still a teenager and proud owner of an Amiga 500, I was, out of pure curiosity of course trying to reverse engineer the image format of the image frames in the game 'Hollywood Strip Poker' After failing at that, it suddenly dawned at me that if you renamed the files such that inga01 became inga08, inga02 became inga07 etc... then if you played the game really well, naked Inga would start to put her clothes back on.
Biting the hand that feeds IT © 1998–2020