Home The Bridge

Support for IamPicard App

1910111315

Comments

  • [BL] PShivers[BL] PShivers ✭✭✭
    edited January 2019
    Redacted
  • I don't understand why there is discussion of shuttle functions. I used this app every day until it was shut down, mainly the web version since it came out (and even the .eu site when I had issues during high volume during December). Were these functions perhaps in beta versions of the desktop app? I never saw shuttles on the North American version or the EU web version. Maybe it was only there briefly before being brought down due to a bug being found?
  • pirunapiruna ✭✭✭
    Kanon wrote: »
    Paladin 27 wrote: »
    Fast forward a bit to the part that describes the result of the shuttle part as well as shows a scoring chart from the last event of a certain player.
    Ok, I just watched a bit, and then the chart.

    The shuttle code looks ugly, and that's just it. And as far as I know, it was never operational/available to the users. Why did he use a loop with the 21 iterations? I don't know, there is a chance that he just copy pasted code from dilemmas and that's just it.

    The chart... Says nothing. Some player made a ton of points, wich could be by a lot of legit means in game (as the guy in the video says, it proves nothing). It's exactly the same situation every event when people start asking how the guys in the top manage to do points to quickly (tons of boosts, tons of dillithium speeding up, using requisition shuttles, etc). The only way to actually prove that code does what they suspect, is running it, which I don't see.

    I really wish someone with good experience in JS could step in, 'cause I see a lot of "I don't know but it looks" and some of the assumptions seems to be flat wrong.

    And I would love an answer to the question, if the code in dilemmas was there since July, and it worked getting multiple rewards (not because of changes in 7.0.9, but since July at least), how is it that no one noticed until last week? No one used the random choice button until then? Everyone who used kept the secret? (out of, how many users of the app?)

    I really want an answer there, 'cause that code doesn't require any trickery, it does the 21 calls just by using it as intended (one click/tap). It's impossible that it was there just to be used by one or two people. Either IamPicard was a cheating tool for half a year, or the code was stupid but inoffensive (relying on server behaviour that is the way it's working now) and it only became an issue due to server changes in 7.0.9.

    I used the random choice many times, especially when I knew I had to choose among useless greens. I've never received multiple rewards.
  • edited January 2019
    milamber42 wrote: »
    I see the term "public API" used a lot. Where was it documented? Being a software developer for 20+ years, public APIs are usually documented toolkits for public use. I am not aware of any documentation provided by DB detailing how to call their game API.

    If you buy some flatpack from Ikea, and it has no instructions, is it no longer flatpack?

    I've been developing software for 20 years as well, and writing web-based APIs before they were called that, chucking out comma or pipe delimited values as neither XML nor JSON were a thing back in the very early 2000s.

    A public API is one that allows third parties to interact with it without authenticating the third party, or any collection of endpoints that don't authorize access from said third party.

    Third party authentication is easy enough - from using n items of static data, a timestamp and a shared secret encrypted in a header, all the way to certificate-based calls. From which you can create authorize claims to secure individual endpoints.

    Now, it could be that DB didn't intend the API to be public, however it is.

    NB - the use of user authentication tokens isn't the same thing, as that is account access, not API access.
  • edited January 2019
    [GoT] Gabe wrote: »
    If you didn't get a chance to watch the live Twitch stream yesterday, please take the time to watch the Youtube video about IAmPicard and its creator so that we don't get another 11 pages of mostly nonsensical and erroneous information.

    Is there a breakdown of the video anywhere? I prefer reading to watching, as I can keep referring to bits then rather than rewinding/fast forwarding.

    I'd definitely be curious if IAP exploited any bugs. Might be an idea for DB to do a bug bounty too.

    I'd be very surprised if DB if worked along lines of defensive programming, or even bother with idempotence tokens for POST/PUT/PATCH requests, so imagine the API is as buggy has the client can be.
  • Cranky (SC) Cranky (SC) ✭✭✭✭✭
    Kanon wrote: »
    As stated in the video, my coding experience is below novice with mainly just an understanding of concepts.

    I had several experienced folks look at it, and walk me through it, having other fleets have their in house folks inspect as well.

    It certainly looks like there is another piece that really makes it ramp up that isnt present in the desktop app but was in the web version. The consensus though was that the script itself is 100% written to allow repetition, there is no other apparent reason to loop to allow 20 promises on one shuttle claim.
    Ok, after reviewing the code, with my limited knowledge, I believe:

    1 - The code featured in the video ("_chooseDilemma" function) is called with one click of the option "Random choice", as well as when you make the choice yourself
    2 - When you choose, the index parameter is your choice
    3 - When "Random" is selected, the third parameter is the negative amount of choices in the dilemma (if there is 2 choices, index is -2, if there are 3 choices, index is -3)
    4 - In that scenario, the for loop creates an array of 21 "promises", divided almost equally among the possible choices (if there 2 choices, 10 of those is one choice, 11 is the other choice)
    5 - all 21 are invoked (call to "resolveDilemma"), errors are ignored
    6 - An aditional call to "resolveDilemma" is made, I presume is invalid 'cause it uses the original index passed as the choice, wich is a negative number.

    Conclusion:
    The 21 calls to resolve the dilemma happen EVERY TIME the user selects random, using the app as intended. No multi taps, or anything weird necessary. Just one click.

    If this code is in the app since a long time ago (since July?), and the problem was detected this week, the logical conclusion is that since then, the server only accepted the first call, and rejected the others (remember errors are ignored), and the update to 7.0.9 removed that restriction, resulting in the bug.

    This would explain why the developer wrote that code: The developer knew this, and when choosing "Random", the app creates 21 requests to solve, with equal amounts of choices,when only one can win (wich one depends of network traffic I suppose), this "race" simulates a random "winner". The develper used this to pick a random choice instead of using a RNG.

    Also, I believe the restriction is back in the server, I'll test it as soon as possible.

    UPDATE: I just tested the code. Only one set of rewards.

    Thank you for the clear explanation of your interpretation. I’ve little knowledge of programming but I do know that sometimes getting a random number can be more difficult than it might sound.

    I’d suggest that people be careful about accepting explanations of how a particular part of code works.

    While the above explanation makes sense to me (and no offence to @Kanon meant at all), it could still be incorrect as far as I know. People shouldn’t build up big claims of what may or may not be exploiting/cheating or of intention, based just on someone else’s interpretation.
  • AMDGAMDG ✭✭✭
    So basically the app is gone, and STT remains buggy and incomplete. Is someone happy?
  • Zombie Squirrel Zombie Squirrel ✭✭✭✭✭
    edited January 2019
    robownage wrote: »
    It will be interesting to see if any of those people who blasted this community for poor treatment of Tekman come back and admit they may have been hasty in making such a critical judgement.

    Let's be clear here: he would absolutely be in the wrong if there was malicious intent, but so would anyone who doxxed him. No one deserves that, and two wrongs do not make a right.

    So far i haven t seen any proof at all that he was doxxed or threatened or anything. Just because someone claims stuff, it doesn t mean it has to be true.

    And considering the hole situation and new reveals about what the app was capable and what was in the code, his good bye message(playing the innocent victim that has nothing done wrong) feels really fishy to me(already did before, but doesn t matter).

    But thats just my personal opinion, and if he really was doxxed or threatened by others, thats of course not ok as well, regardless what he has done with his cheat App.
    •SSR Delta Flyers•
  • First at all thanks to Roonis and Frank, your video was very informative.

    In the end nobody knows 100% what has happened but I am sure that DB did the right thing with to take the sticky down and it is good that the dev of the tool took the tool down.
    Interesting to see that a lot of people, who were screaming loudest in the start, are now very quiet, understandable.......

    I hope that DB can close the holes, but I am afraid that some people out there are still cheating and will ever do.
  • I am still a proponent of the tool, and it earliest functions. If DB released their own version of it, I would switch to that in a heart beat.
    My wallet remains closed until DB makes a statement.
  • KanonKanon ✭✭✭✭✭
    Kanon wrote: »
    As stated in the video, my coding experience is below novice with mainly just an understanding of concepts.

    I had several experienced folks look at it, and walk me through it, having other fleets have their in house folks inspect as well.

    It certainly looks like there is another piece that really makes it ramp up that isnt present in the desktop app but was in the web version. The consensus though was that the script itself is 100% written to allow repetition, there is no other apparent reason to loop to allow 20 promises on one shuttle claim.
    Ok, after reviewing the code, with my limited knowledge, I believe:

    1 - The code featured in the video ("_chooseDilemma" function) is called with one click of the option "Random choice", as well as when you make the choice yourself
    2 - When you choose, the index parameter is your choice
    3 - When "Random" is selected, the third parameter is the negative amount of choices in the dilemma (if there is 2 choices, index is -2, if there are 3 choices, index is -3)
    4 - In that scenario, the for loop creates an array of 21 "promises", divided almost equally among the possible choices (if there 2 choices, 10 of those is one choice, 11 is the other choice)
    5 - all 21 are invoked (call to "resolveDilemma"), errors are ignored
    6 - An aditional call to "resolveDilemma" is made, I presume is invalid 'cause it uses the original index passed as the choice, wich is a negative number.

    Conclusion:
    The 21 calls to resolve the dilemma happen EVERY TIME the user selects random, using the app as intended. No multi taps, or anything weird necessary. Just one click.

    If this code is in the app since a long time ago (since July?), and the problem was detected this week, the logical conclusion is that since then, the server only accepted the first call, and rejected the others (remember errors are ignored), and the update to 7.0.9 removed that restriction, resulting in the bug.

    This would explain why the developer wrote that code: The developer knew this, and when choosing "Random", the app creates 21 requests to solve, with equal amounts of choices,when only one can win (wich one depends of network traffic I suppose), this "race" simulates a random "winner". The develper used this to pick a random choice instead of using a RNG.

    Also, I believe the restriction is back in the server, I'll test it as soon as possible.

    UPDATE: I just tested the code. Only one set of rewards.

    Thank you for the clear explanation of your interpretation. I’ve little knowledge of programming but I do know that sometimes getting a random number can be more difficult than it might sound.

    I’d suggest that people be careful about accepting explanations of how a particular part of code works.

    While the above explanation makes sense to me (and no offence to @Kanon meant at all), it could still be incorrect as far as I know. People shouldn’t build up big claims of what may or may not be exploiting/cheating or of intention, based just on someone else’s interpretation.
    Thanks, I tried to break it down as much as possible so people can see how I got to what I believe it happened, can make their or conclusions, or challenge mine.

    I would love if someone with more experience (mine is almost null) in JS/Angular/Vue/Npm/whatever it was used, and server-client architecture could shed some light about this (My question to an expert would be "is there a way, as invoked via the random choice in the UI, that the code doesn't call multiple time to the server, thus it should have been giving multiple rewards since July if the server didn't change its behaviour?")
  • KanonKanon ✭✭✭✭✭
    1. I really appreciate Frank and Roonis taking the time to research and share
    2. Per @Kanon ‘s line of thinking, I agree it is dangerous to read intent into a snippet of code that is not fully understood. The loop in question jumped out at me as odd even before they started narrating it in the podcast, but odd in a what does that do sort of way, not a sinister one. There are other Occam’s Razors than “a bit of code I don’t understand must be an intentional hack”. Such as, hypothetically, “the dang server doesn’t respond as its supposed to all the time and must be hammered until it does.” I have no evidence for that, and didn’t review the whole code base, and am not offering it as an alternative, but coders having to kludge in fixes is not unheard of and kludges usually don’t make walking around sense unless documented. Just, be really careful about ascribing intent. A third Occams Razor would say that putting a hack into the public domain for all to see is a dumb idea. And a huge unanswered question is why all IAP users weren’t getting multiple rewards all the time, or why those that stumbled in via multi tap didnt always get multiple, or 21, rewards. That for loop is very deterministic. My outcome: I take the second half of the podcast with a grain of salt w.r.t. implications of malintent, and I really don’t care, because:
    3. the intent argument is obscuring the much more important and, I think, irrefutable point made in the first half of their podcast, which is that allowing more than read only access was a slippery slope that created a vulnerability, or rather, exposed a built in vulnerability to further exploit. Days ago I thought the slippery slope argument was unnecessary hand wringing; I was wrong and I appreciate Frank and Roonis for helping me understand why I was wrong. I really don’t care who the bad people were. In-app gameplay, rather than in-app read only crew/item management, was a step too far, but not for the reason that it gave good faith users some microscopic advantage at hunting for lottery tickets in gauntlet or whatnot, but because it amplified a risk of exploit. That risk dwarfs all the angels dancing on a head of a pin debates, IMHO.
    The problem with 3 is that this is not A public API, is THE public API. To remove all "write access" methods would break the game (it would make the game read only was well). The problem is that DB made the server calls available to third party apps. It should have secured the client (the game) - server communication, and provide a different way (a true public, documented API) to access it, to tone down efforts to break that security. God only knows what else is available to do on the server that the IamPicard developer didn't allow (I'm 100% sure with very little effort that he could have made a tool that solves entire space battles with the click of a button)
  • Paladin 27Paladin 27 ✭✭✭✭✭
    edited January 2019
    You guys are also missing the fact there were two web iampicard urls and that as far as I know the voyage multitap exploit reports were in the lesser known beta.iampicard.com one not www.iampicard.com most people used.
  • Cranky (SC) Cranky (SC) ✭✭✭✭✭
    Paladin 27 wrote: »
    You guys are also missing the fact there were two web iampicard urls and that as far as I know the voyage multitap exploit reports were in the lesser known beta.iampicard.com one not www.iampicard.com most people used.

    There was also eu.iampicard.com which was setup to offer better performance for European players.

  • furyd wrote: »
    milamber42 wrote: »
    I see the term "public API" used a lot. Where was it documented? Being a software developer for 20+ years, public APIs are usually documented toolkits for public use. I am not aware of any documentation provided by DB detailing how to call their game API.

    If you buy some flatpack from Ikea, and it has no instructions, is it no longer flatpack?

    I've been developing software for 20 years as well, and writing web-based APIs before they were called that, chucking out comma or pipe delimited values as neither XML nor JSON were a thing back in the very early 2000s.

    A public API is one that allows third parties to interact with it without authenticating the third party, or any collection of endpoints that don't authorize access from said third party.

    Third party authentication is easy enough - from using n items of static data, a timestamp and a shared secret encrypted in a header, all the way to certificate-based calls. From which you can create authorize claims to secure individual endpoints.

    Now, it could be that DB didn't intend the API to be public, however it is.

    NB - the use of user authentication tokens isn't the same thing, as that is account access, not API access.

    Even though the API is public facing, no where did DB state is was for public use. My college has an API exposed to the internet for use by 3rd party integration services. It is exposed to the public, but it is not a public API. There is a difference.
  • KanonKanon ✭✭✭✭✭
    Paladin 27 wrote: »
    You guys are also missing the fact there were two web iampicard urls and that as far as I know the voyage multitap exploit reports were in the lesser known beta.iampicard.com one not www.iampicard.com most people used.
    If that is correct, it makes all analisys of the code in question, useless. That function with the for loop, wich is the closest thing to evidence, is inconsequential as it is part of the main app since July. That is, until there are reports that the bug ocurred also on the main app. It would explain the behaviour though, and prove that the initial analysis (the video) doesn't understand what it does and its intent.
  • Data1001Data1001 ✭✭✭✭✭
    There's also a piece about the suspiciousness of developer choosing a certain point in time to finally opt out.

    Since I don't know when to shut up, allow me to share a personal anecdote...

    <snipped for space>

    So, projecting my own experiences, I would be very, very, very, very cautious about spotting black helicopters flying around the developer's opt-out timing. Walk a mile. Could it have been malintent and CYA? Sure. Could it also have been other factors. YES. I'm reserving judgment.

    Thanks for that, 5Q. And for your previous post, which stated in part:
    I agree it is dangerous to read intent into a snippet of code that is not fully understood. The loop in question jumped out at me as odd even before they started narrating it in the podcast, but odd in a what does that do sort of way, not a sinister one. There are other Occam’s Razors than “a bit of code I don’t understand must be an intentional hack”. Such as, hypothetically, “the dang server doesn’t respond as its supposed to all the time and must be hammered until it does.” I have no evidence for that, and didn’t review the whole code base, and am not offering it as an alternative, but coders having to kludge in fixes is not unheard of and kludges usually don’t make walking around sense unless documented. Just, be really careful about ascribing intent. A third Occams Razor would say that putting a hack into the public domain for all to see is a dumb idea.

    There's been just as much (if not more... and more precarious) speculation going on recently from certain people who believe they have "all the facts" as there was from many of us who weren't initially aware of some of those additional facts. The only thing we know for sure are that the code could potentially be used for some pretty severe exploits — exploits which only a small percentage of the tool's users took advantage of, or were even aware of, but which still were obviously problematic.

    It's actually pointless to publicly speculate about the intentions of the author of the tool at this juncture. It does nothing but impugn someone based on suppositions — and besides that, it does not move us forward at all. I agree that there is still value in certain parts of what was created, and that proceeding in a manner which abides more clearly by rules that DB can easily live with is the most prudent and desirable course of action. However, any public statements accusing the author of nefarious intent are just reckless and spiteful. Let's focus on the future here, not the past, yeah?


    Could you please continue the petty bickering? I find it most intriguing.
    ~ Data, ST:TNG "Haven"
  • Capt. ChaosCapt. Chaos ✭✭✭✭✭
    They use a web service that doesn't authenticate the client and doesn't encrypt the data. It will take actual programming on DB's part to fix the API. There is no other way to prevent similar exploits.
  • 5000 Quatloos5000 Quatloos ✭✭✭✭✭
    @Data1001 agree completely. And to be clear, i’m not trying to throw Roomis and Frank under the bus by saying that’s what they were trying to do. I take their stated intent of researching and providing facts for the community good at face value, because I nor anyone else I know has a +10 on my Remote Mind Meld roll. Somewhere on the road from stated intent to execution to my perception, I was left with a sense that that could be implied, but that’s on me and I wouldn’t assume or impugn intent, because I want to live in a world where folks like them put the time and energy into creating things for the greater good, and questioning intent greatly inhibits the desire to volunteer.
    Accepted. Mark them, Galt.
  • Data1001Data1001 ✭✭✭✭✭
    Data1001 agree completely. And to be clear, i’m not trying to throw Roomis and Frank under the bus by saying that’s what they were trying to do. I take their stated intent of researching and providing facts for the community good at face value, because I nor anyone else I know has a +10 on my Remote Mind Meld roll.

    Understood — and you'll forgive me if it sounded like I was putting words in your mouth. My words are my own, even though occasionally they have to share mouth space with the foot I've also put in there. ;)



    Could you please continue the petty bickering? I find it most intriguing.
    ~ Data, ST:TNG "Haven"
  • Althea BiermontAlthea Biermont ✭✭✭✭✭
    AMDG wrote: »
    You might change that view when the full extent of the exploits become apparent.

    Double taps are possible even now in the game. The main problem remains - DB is unable to fix flaws and not interested in giving the customers what one man did for free.

    May I remind everyone that the Star TREK licence expires next year ?


    So, you’re saying it’s a good time stop spending money then. Good info to have.

    It expires every year with the option to renew another year. I don’t see them giving up this license when it’s the only game they have and their only source of revenue

  • Cranky (SC) Cranky (SC) ✭✭✭✭✭
    edited January 2019
    The quality of comments and discussion on this has been steadily improving and I’ve really enjoyed the conversation today. Thanks everyone!
  • S31S31 ✭✭✭✭✭
    I don't like videos or documentaries because it's usually one-sided arguments and facts are hard to check.

    There is a reason why books are still a thing.
Sign In or Register to comment.