• Hey, guest user. Hope you're enjoying NeoGAF! Have you considered registering for an account? Come join us and add your take to the daily discourse.

How hackers broke Pokémon Go's anti-cheat technology in four days

dmr87

Member
When we first wrote about the world of automated Pokémon Go-playing "bot" programs a few weeks ago, we predicted a brewing technological war. Developer Niantic was inevitably going to deploy cheat-detection technology, and hackers would subsequently work to break through that detection. Last week, we saw the first battle in that war, and so far it seems like the hackers are winning handily.

After largely ignoring the growing issues of bots (and related mapping hacks) for weeks, Pokémon Go developer Niantic rolled out a mandatory game update last Wednesday focused on cutting off server access for such unofficial apps. In a blog post last Thursday, Niantic cited "aggressive efforts by third parties to access our servers outside of the Pokémon Go game client and our terms of service." The developer argued these hacks were overloading its servers and its employees, slowing efforts to improve the game and bring it to new markets.

In examining the updated game, hackers quickly focused their efforts on a bit of hidden data called Unknown6 (or U6) in the code. After the update, API requests that didn't send valid U6 data returned a useless empty response (previously, the field could be left blank with no issue, suggesting this anti-cheat protection was present but not activated in the game as it launched).

The U6 data itself seems to be a hashed encryption of data collected from the current state of the actual game client, which changes with each tick of the game's internal "heartbeat" timer. Theoretically, only a valid game client would have that information and know how to use it to generate that U6 hash, leaving bots and other hacks in the cold.

What followed was a multi-day, multi-person effort to decrypt the U6 generation algorithm, organized through the PokemonGoDev subreddit (and livechat) as well as associated discord chat, Wiki, and Github repository. Together, the community traced through hundreds of thousands of lines of compiler-optimized assembly code, looking for the bits responsible for creating that crucial U6 hash.

After four days of tinkering, by Sunday the hackers had apparently managed to untangle and replicate the U6 encryption function. This led to the creation of a new unofficial API, which can generate valid U6 hashes and receive game data from Niantic's servers. That newly working API has been quickly reintegrated into the various bots, hacks, and other third-party applications that had been disabled since Wednesday.

Regardless, the team behind MyGoBot seem relatively confident in their ability to thwart any anti-cheat methods Niantic may lay down in the future. "We have been in the botting industry for a while now, and we have thwarted anti-cheat for years," said Jake. After working on bots for Runescape and Clash of Clans over the past two years, Jake believes that, so far, "Niantic's anti-cheat is very sad compared to some others. Everything they have been adding in, has been easy to thwart (with the help of the community)."

"It probably took [Niantic] hours, if not days, to write the encryption for Unknown6," Jake continued. "It took us three days to crack. This is just a never-ending game." (Niantic has not responded to a request for comment from Ars about its cheat-detection and prevention technologies).

Full article at the jump, http://arstechnica.com/gaming/2016/...ogy-stopped-pokemon-go-hackers-for-four-days/
 
"Thus far, Pokémon Go bots have been focused on single-player Pokémon collection and not on the more competitive gym-battling portion of the game. That could be set to change soon, though. Jake told Ars that automated gym battles are on a list of "some big new features" the team is working on for MyGoBot in the near future.

This new feature has the potential to completely destroy a crucial part of Pokémon Go. A tireless bot could maintain nearly permanent control of a gym, using accumulated potions and hyper-leveled, near-perfect Pokémon teams to recapture a gym minutes or even seconds after it falls. Plus, a GPS-spoofing bot can attack a gym without having to be in the applicable real-world location, potentially taking over far flung locations around the world."

And somehow, Niantic is to blame here right?
 

Social

Member
I'm still shocked that the Yokai Watch Wibble Wobble game hasn't been hacked and seems to be REALLY secure. Maybe they could take some lessons from that game.
 

NCR Redslayer

NeoGAF's Vegeta
"Thus far, Pokémon Go bots have been focused on single-player Pokémon collection and not on the more competitive gym-battling portion of the game. That could be set to change soon, though. Jake told Ars that automated gym battles are on a list of "some big new features" the team is working on for MyGoBot in the near future.

This new feature has the potential to completely destroy a crucial part of Pokémon Go. A tireless bot could maintain nearly permanent control of a gym, using accumulated potions and hyper-leveled, near-perfect Pokémon teams to recapture a gym minutes or even seconds after it falls. Plus, a GPS-spoofing bot can attack a gym without having to be in the applicable real-world location, potentially taking over far flung locations around the world."

And somehow, Niantic is to blame here right?
Team instinct is stepping up their game.
 

Ridley327

Member
It hasn't been a good week for Niantic. A lot of it they've brought upon themselves, like the alleged "bug" for catching, but they had to have expected this in the wake of their awful PR regarding the third-party tracking block and their relative lack of words on what they were actually planning on doing to fix theirs.

That being said, proudly explaining how this new bot program is going to make the gym experience more terrible than it already is is not something to praise.
 
"Thus far, Pokémon Go bots have been focused on single-player Pokémon collection and not on the more competitive gym-battling portion of the game. That could be set to change soon, though. Jake told Ars that automated gym battles are on a list of "some big new features" the team is working on for MyGoBot in the near future.

This new feature has the potential to completely destroy a crucial part of Pokémon Go. A tireless bot could maintain nearly permanent control of a gym, using accumulated potions and hyper-leveled, near-perfect Pokémon teams to recapture a gym minutes or even seconds after it falls. Plus, a GPS-spoofing bot can attack a gym without having to be in the applicable real-world location, potentially taking over far flung locations around the world."

And somehow, Niantic is to blame here right?

i fucking hate these people
 

Trace

Banned
i fucking hate these people

Blame Niantic's anti-cheat. There's going to be cheaters in every popular game ever, it's up to the developer to stop them.

Also they should probably design the game in such a way that there is literally ANY HUMAN INVOLVEMENT NEEDED.
 

Kinsei

Banned
Fuck these people. They should do something productive with their time instead of making the game worse for people that actually want to play instead of cheat.

I'm still shocked that the Yokai Watch Wibble Wobble game hasn't been hacked and seems to be REALLY secure. Maybe they could take some lessons from that game.

I'm pretty sure it's because it's not popular. If the thing was as successful as Pokemon Go it would be cracked wide open.
 
I'm still shocked that the Yokai Watch Wibble Wobble game hasn't been hacked and seems to be REALLY secure. Maybe they could take some lessons from that game.

From Google Play:
Yokai Watch Wibble Wobble
Installations 100 000–500 000

Pokémon Go
Installations 100 000 000–500 000 000
 

dave is ok

aztek is ok
Can't they automatically detect someone traversing X amount of miles instantly and just ban them? I wouldn't worry about gym bots being a huge problem unless they only stick to one or two gyms each
 

Meier

Member
There is probably already some sort of bot functionality in use for gyms I believe. My buddy mentioned a week or two ago that there were a few gyms on UT's campus that were capped by a few poke with trainer names that were like LyuBot1 LyuBot2, etc. and they were all level 35 which at the time seemed absolutely insane to me.
 

Dystify

Member
As you can tell by my posts I'm kinda salty at how hard Niantic has fucked up everything related to Pokemon Go.

Did you know that Niantic hasn't been able to implement features as they like due to the enormous amount of people on the game, which put a lot of stress on the servers?

Did you know all these third party apps & botters put even more stress on the servers, making it even harder for Niantic to actually make the game better?
 

Jeffrey

Member
You paint a huge target on your back once your popular. Surprised they didn't account for this with less shoddy security.

Pokemon go was gonna be huge at announcement.
 
As you can tell by my posts I'm kinda salty at how hard Niantic has fucked up everything related to Pokemon Go.

While I somewhat agree, I really question why Niantic has had so many issues with this game.

This is from an uneducated point of view but the game has been ultra-successful.

Why aren't they instantly reinvesting and reinforcing their product with the resources an app of its popularity deserves.

On that note, have any of the Clan or other mega popular mobile games been majorly hacked? If so and these hackers are just that good, its a little more forgivable, but from the surface it seems like Niantic isn't taking the state of the games security and development as seriously as its popularity/size demands.

Did you know that Niantic hasn't been able to implement features as they like due to the enormous amount of people on the game, which put a lot of stress on the servers?

Did you know all these third party apps & botters put even more stress on the servers, making it even harder for Niantic to actually make the game better?

To me this is hardly an excuse. They are making millions a day with this app. They should have all the necessary resources to strike back and meet the demand. Early launch issues are absolutely to be expected. But once it continues for months post release, I think its absolutely fair for the end user to question why things aren't being solved.
 
Can't they automatically detect someone traversing X amount of miles instantly and just ban them? I wouldn't worry about gym bots being a huge problem unless they only stick to one or two gyms each

Currently they soft-ban for teleporting too far too fast, but it just makes it so you can't catch pokemon for a set time limit. However hackers found an easy way to unban an account in seconds.
 
While I somewhat agree, I really question why Niantic has had so many issues with this game.

This is from an uneducated point of view but the game has been ultra-successful.

Why aren't they instantly reinvesting and reinforcing their product with the resources an app of its popularity deserves.

It doesn't work like that. Hiring more developers doesn't speed up development, it slows it down (initially, it can pay off maybe a couple of months down the line).
 

Jebusman

Banned
Why aren't they instantly reinvesting and reinforcing their product with the resources an app of its popularity deserves.

Oh I'm sorry, let me walk over to the programmer vending machine and just buy myself a few new couple hundred employees, this should only take a sec.... wait what do you mean hiring practices can takes weeks at a time?

To me this is hardly an excuse. They are making millions a day with this app. They should have all the necessary resources to strike back and meet the demand. Early launch issues are absolutely to be expected. But once it continues for months post release, I think its absolutely fair for the end user to question why things aren't being solved.

It's a good thing you prefaced this post with "uneducated point of view". I know it's rough to understand how it works on the other side but at least do some basic fact checks.

Considering the initial (official) release date was July 6, 2016, it has been literally a month and two days. Not exactly "months" of problems.
 

Uthred

Member
Thanks for ruining the game guys

Are you thanking Niantic or the "hackers"? Not sure how being able to actually locate Pokemon i.e. the main purpose of the game, and the one crippled by Niantic first breaking and then removing in-game tracking, ruins the game
 

Natiko

Banned
Can't wait until they use this as an excuse for continuing to not deliver significant fixes or updates to their shoddy game.
 

Dystify

Member
To me this is hardly an excuse. They are making millions a day with this app. They should have all the necessary resources to strike back and meet the demand. Early launch issues are absolutely to be expected. But once it continues for months post release, I think its absolutely fair for the end user to question why things aren't being solved.

Months? This game has only been out one month. Recruiting new staff also usually doesn't happen over night. I don't get why people keep complaining when the game clearly has gotten better already in the past weeks (no server issues and some QoL things). But of course not everything is perfect right now (3 step removal). Some people (especially on the PokemonGo subreddit) act like this game is totally ruined now.
 
Its something to keep in mind that the same communities that birth the bots like the Pokemon GO Dev subreddit are also where the creators of the unofficial trackers and other sites like Pokeadvisor (see pokemon stats) collaborate. The applications that do the same thing as Pokevision did (track pokemon in lieu of it working in game) are back to working as well as a result of this effort. I like the stat and tracking apps, but would never bot - maybe that means I have double standards?

Edit: I say this and now Niantic has taken PokeAdvisor down. Ugh.
 

Squishy3

Member
Months? This game has only been out one month. Recruiting new staff also usually doesn't happen over night. I don't get why people keep complaining when the game clearly has gotten better already in the past weeks (no server issues and some QoL things). But of course not everything is perfect right now (3 step removal). Some people (especially on the PokemonGo subreddit) act like this game is totally ruined now.
Well, there's no point to actually playing it like they intended it to play with in-game tracking not being accurate whatsoever.

Go on walks to hatch eggs, catch whatever stray Pokemon you come aross (good luck hunting down that undiscovered Pokemon that's on your radar) or just go around looking for Pokestops that people set lures up at and stay in one place while the Pokemon come to you. Oh wait, except escape rates are bugged and Pokemon are all around more difficult to catch now!
 

goodfella

Member
People basically need to understand that software development is hard as fuck.

Also, on the comments on hiring more developers, as has already been stated, this takes a long time.

Coupled with the fact that hiring developers costs money. Just because you have one success doesn't mean that you suddenly want to start hiring like crazy. You could end up with a huge wage bill, and suddenly when your success peters down, ya fucked.
 

topplehat

Member
People basically need to understand that software development is hard as fuck.

Also, on the comments on hiring more developers, as has already been stated, this takes a long time.

Coupled with the fact that hiring developers costs money. Just because you have one success doesn't mean that you suddenly want to start hiring like crazy. You could end up with a huge wage bill, and suddenly when your success peters down, ya fucked.

Also new developers don't instantly start on Day 1 fixing and improving everything. There is a rampup time associated with new devs.
 
Normal person: I wish I could catch a Zapdos

Hacker: *puts on sunglasses* who says you can't

PedoFM6.gif
 
While I somewhat agree, I really question why Niantic has had so many issues with this game.

This is from an uneducated point of view but the game has been ultra-successful.

Why aren't they instantly reinvesting and reinforcing their product with the resources an app of its popularity deserves.

On that note, have any of the Clan or other mega popular mobile games been majorly hacked? If so and these hackers are just that good, its a little more forgivable, but from the surface it seems like Niantic isn't taking the state of the games security and development as seriously as its popularity/size demands.



To me this is hardly an excuse. They are making millions a day with this app. They should have all the necessary resources to strike back and meet the demand. Early launch issues are absolutely to be expected. But once it continues for months post release, I think its absolutely fair for the end user to question why things aren't being solved.

someone else here who knows nothing what they are talking about

armchair developers ftw
 

Chaos17

Member
Really can't they use their skills for something more usefull for community instead for bunch of lazzy couch ass ? That stream their bot play and people watch them ??
Good stuff like Pokeadvisor was good for community and it got blocked because of those idiots.

Niantic should ban wave them, I know they can, they have the script for it since Ingress.
 
Niantic is following down GameFreak's path at this point. None of them realizing that the only reason people are hacking is because of BS hurdles that prevent the game from being fully enjoyed (taking away trackers, etc).

Now the gym stuff is absolute bullshit, and warrants a ban. But the real question is are they going to do something about it? GF does jack shit in their own games.
 

Lionheart

Member
Niantic is following down GameFreak's path at this point. None of them realizing that the only reason people are hacking is because of BS hurdles that prevent the game from being fully enjoyed (taking away trackers, etc
Uh no. This shit happens in all competitive / popular games, even if the developers have done nothing 'wrong'. You could only argue that people were extra motivated, but you could also argue that it's also got more to do with the huge popularity than with the way Niantic has treated the game so far.
 

Rush_Khan

Member
This is quite sad, to be honest. It's just ruining the game for other players knowing that some hackers have made it easier for people who pay for their services. Fair enough in a single-player game, but not in an online game.
 
Niantic is following down GameFreak's path at this point. None of them realizing that the only reason people are hacking is because of BS hurdles that prevent the game from being fully enjoyed (taking away trackers, etc).

Some are doing it for financial gain. Like there's programs that allow you to run run several hundred instance of the game at once, and get them to level 20 in an afternoon. Then they sell the accounts for a couple bucks a piece.
 

Jarsonot

Member
I'm no developer, but I'm guessing if the problem were as easily solved as some are suggesting, then Niantic would have solved it.

It must not be so easily solved? And this whole "people hacking your game" problem seems to have been around for decades, still not solved, but Niantic should just spend some of that pokécash and hire some people to solve it, right?
 

Mugsy

Member
Currently they soft-ban for teleporting too far too fast, but it just makes it so you can't catch pokemon for a set time limit. However hackers found an easy way to unban an account in seconds.

Wait, hackers can unban themselves? How is that even possible?
 

hesido

Member
I haven't played the game but from what I understand, a hacker can ruin the game for anybody around the world, right? Is the game world connected in one piece?

So this is not like people hacking in a COD game, which is isolated in that space for 12 - 18 people and for that match only, but someone on pokemon can take over the world, no?

Edit: Is there a denuvo mobile? :)
 
Wait, hackers can unban themselves? How is that even possible?

I don't know if it's changed but the soft-ban was only in effect until you spun poke stop signs like 30-40 times. So the bot just jumps to a pokestop and spins the sign to quickly unban itself.
 

Oxn

Member
While I somewhat agree, I really question why Niantic has had so many issues with this game.

This is from an uneducated point of view but the game has been ultra-successful.

Why aren't they instantly reinvesting and reinforcing their product with the resources an app of its popularity deserves.

On that note, have any of the Clan or other mega popular mobile games been majorly hacked? If so and these hackers are just that good, its a little more forgivable, but from the surface it seems like Niantic isn't taking the state of the games security and development as seriously as its popularity/size demands.



To me this is hardly an excuse. They are making millions a day with this app. They should have all the necessary resources to strike back and meet the demand. Early launch issues are absolutely to be expected. But once it continues for months post release, I think its absolutely fair for the end user to question why things aren't being solved.

Never worked a day in your life have you?
 
Top Bottom