Improper coding of Chinese characters let players weaponize copy-pasted text strings.
Read the whole story
Read the whole story
Bungie shuts Destiny 2 text chat to stop malicious exploit
- Thread starter JournalBot
- Start date
It's prolly not due to lack of input sanitation, but not handling multibyte characters properly (like using byte semantics instead of char semantics).
Upvote
66
(67
/
-1)
I've made the exact same stupid mistake before. Didn't notice until four years later. Can't say I learned anything from the experience: every programmer knows (or ought to know) that multibyte characters require more than one byte, right?
Memory corruption sucks.
Upvote
59
(60
/
-1)
Curious, what is the state of game for New World, havent heard much about it in any news source for awhile now?
Upvote
4
(7
/
-3)
Idk, its pretty fucking amazing for awhile now, and I only dip in and out like a casual
Upvote
16
(25
/
-9)
Judging from Steamcharts, it's been somewhat stable with 15-20k players in the last couple of months. It just received a big update, so the numbers are currently higher than that average.
Upvote
2
(5
/
-3)
They merged a bunch of servers. There's been some qol updates, and it's still fun to play. But I'm not certain they know where they're going with it or if it's going anywhere. I'm hoping Amazon let's them fiddle with it and maybe in a year or so it'll be awesome again like it was till you realized there's nothing to do end game. It's definitely in that weird spot many new MMO's fall into after launch where all the hype is gone and it just needs time.
Upvote
10
(11
/
-1)
Just two weeks ago, I went back and downloaded Destiny1 on PS5, apparently Im curious, but I wanted to see how it played and looked on the new console. Meh, its the same game. What I was surprised to discover is just how much the rest of the games biz only ever looked at it in terms of new ways to make moneeeyyy, and not actually the immense investment behind the netcode, gameplay, art and story.
I deleted my highest level Warlock, started from scratch, ran through all the story campaigns, and its a treat, even its modern infancy its still a sci-fi dream of a game.
Upvote
7
(12
/
-5)
Wouldn't it be great if someone could devise a similar exploit that weaponizes any kind of micro-transactions in games? Purchasing anything other than cosmetic add-ons would infect and lock your game or delete your character or something. That would be awesome. 
Note: I'm not encouraging anyone to actually do that... I just think it would be wonderful to live in a world where games could be played for fun instead of being turned into a parasitic financial platform.
Note: I'm not encouraging anyone to actually do that... I just think it would be wonderful to live in a world where games could be played for fun instead of being turned into a parasitic financial platform.
Upvote
-11
(9
/
-20)
I wish these bugs were not talked about as sanitisation issues. Sanitisation means removing potentially problematic characters from data. In this case, the problematic characters are multi-byte characters. So sanitisation would prevent the usage of Chinese characters, along with almost anything that isn't in the Latin character set. Likewise, for the HTML injection, sanitisation would prevent users from using the less than sign < in their chats.
Talking about this as a sanitisation issue masks the real problem; that programmers need to understand encodings, and always have them front of mind when working with strings.
They need a deep understanding that characters and bytes are not the same thing. Preferably, they use a programming language and/or code patterns that protect them from this kind of buffer overflow. They need to understand how strings behave and the paradigms to encode them when placing them in contexts such as HTML or database commands. Preferably they are using languages and frameworks that make doing the right thing easy (such as Rails making you explicitly mark strings as HTML safe to avoid HTML encoding).
IMO, string sanitisation may sometimes be appropriate, but treating issues like this as sanitisation issues is hurting our handling of these issues, because the discussion needs to be about encoding.
Talking about this as a sanitisation issue masks the real problem; that programmers need to understand encodings, and always have them front of mind when working with strings.
They need a deep understanding that characters and bytes are not the same thing. Preferably, they use a programming language and/or code patterns that protect them from this kind of buffer overflow. They need to understand how strings behave and the paradigms to encode them when placing them in contexts such as HTML or database commands. Preferably they are using languages and frameworks that make doing the right thing easy (such as Rails making you explicitly mark strings as HTML safe to avoid HTML encoding).
IMO, string sanitisation may sometimes be appropriate, but treating issues like this as sanitisation issues is hurting our handling of these issues, because the discussion needs to be about encoding.
Upvote
43
(49
/
-6)
I agree that they labeled this incorrectly. This is almost definitely from counting characters vs bytes and has nothing to do with sanitizing/changing what was sent by the user.
BUT, your post about sanitization being equivalent to removing is wrong. Changing a raw less than character < to something that can't be used to inject html is absolutely sanitization. Sanitizing is cleaning, and removing is only ONE way to clean the user input. In this case maybe the discussion needs to be more about encoding, but that definitely isn't true for all types of malformed inputs.
Upvote
25
(25
/
0)
Wtf are you even talking about? Not only have Bungie been delivering the goods when it comes to their story-based content (The recently released Witch Queen being regarded by many as Destiny 2's best DLC and they've been cracking down on cheaters), but Bungie themselves have been out in front on a number of issues concerning their employees (like abortion and working from home, and access to healthcare along with acknowledging heinous acts that employees may relate to to cover some recent events) when most other game devs/studios couldn't be arsed.
You want to criticize Bungie for content vaulting, have at it (yeah, it's shit), but Bungie has been speaking up when most of their peers (including Sony, oddly enough) refuse to, and that should be both acknowledged and encouraged.
Upvote
38
(40
/
-2)
We could have a disagreement of definitions here. My take is that sanitisation is taking a string as you *receive* it and make it "safe", whereas encoding focuses the other side, as you then *present* a string you've received in a context; encoding HTML, SQL, etc.
The problem with encoding a string upon ingestion as sanitisation, say making it HTML safe, is when you go to put the string in a different context. Hence you end up with text messages and instant messages with < in them and the like.
Once you start talking about encoding rather than sanitization, you start talking about the context you are using a string in, and the appropriate presentation for that context, rather than this idea you make a string "safe" at ingestion. Because there is no single sanitised representation. What is safe for HTML is different to what is safe for SQL is different to what is safe for Javascript. Once you are talking about encoding, then you're talking about what is appropriate in a particular context.
Upvote
11
(11
/
0)
The only people who think that are dogshit programmers.
Upvote
22
(27
/
-5)
Obligatory xkcd:
ETA: damn, ninja’d!
I often wonder how the caller pronounced ‘);
Upvote
12
(13
/
-1)
"Single-quote End-parenthesis Semicolon"Obligatory xkcd:
ETA: damn, ninja’d!
I often wonder how the caller pronounced ‘);
Upvote
13
(16
/
-3)
Yeah, number 10 on Steam's peak players for today. Mostly behind the other juggernaut online games, but ahead of 90 other games and about double Rocket League, which seems to be a favorite of many that doesn't slagged as a dead game. Considering this is the end of season doldrums where many have already got their seals, weapons and armor and are taking it easy doing other stuff, it is probably a little lower than its average activity.
Yeah, Destiny is here for the duration.
FWIW, Solstice doesn't do much for me, so I reloaded Destiny (1) on the PS5. I am amazed how full that game still is. Granted I'm just running the campaign missions, but getting strike teams together is no trouble and they still charge $60 for the base game and all the addons. I was expecting like $20 all in. Go figure.
Upvote
13
(13
/
0)
I was surprised too by the premium pricing. Nice if they remastered it for console and PC.
Upvote
3
(3
/
0)
If they remastered D1 with all contents, I'll gladly rebuy it.
Upvote
1
(1
/
0)
Seems I'm the only one that prefer to be completely destroyed in the crucible.
It made the matches ends quickly so I can get the weekly rewards quicker
Upvote
1
(1
/
0)
About every negative article about gaming for the last few weeks on Ars has been about Destiny 2.
Frankly, everything I've seen of the game on Steam and elsewhere makes me think it's the opposite of fun.
Upvote
-13
(1
/
-14)
the main story/campaign is fun. the repeating doing the same thing again and again ad infinitum is not fun.
since they are divorced from activision, the amounts of content you get from the money you pay also drops down substantially.
Upvote
2
(3
/
-1)
Should probably be "encoded in UTF-8", an encoding where one character can require anything from one to four bytes. Counting characters as a way to determine number of bytes used seems really sloppy in this day and age.
See "What's the difference between encoding and charset?"
Upvote
2
(2
/
0)
Quite likely an unlawful name. Countries that don’t operate lists of allowed names will often still require that names are to be non-obscene and made from Aa to Zz or the equivalent in the local languages, no numbers or weird punctuation*. Real-life name sanitisation is already implemented."Single-quote End-parenthesis Semicolon"Obligatory xkcd:
ETA: damn, ninja’d!
I often wonder how the caller pronounced ‘);
*Technically this wouldn’t allow double-barrelled names or apostrophes (O’Sullivan) or numbers (Jim Robertson III)** but hey these are ‘familiar’ so they go unchallenged.
**Technically still letters that represent a number. He’s the third of his line, not the one hundredth and eleventh.
Upvote
-9
(0
/
-9)
Can it still be played solo? I mean, with Destiny (v1), I was able to play the campaign, along with having a few friends jump in with me. We'd help at events. Then the loot cave fiasco tainted it all. (look, call it cheesing, call it fun, but for the devs to openly mock their flaw ... people want to grind...they will grind).
Then D2 came out, and that crucible, along with (yes, I couldn't do the Vault of Glass or any lengthy Raid. Not that kind free time.) raids and events and just the pain of waiting for some weapon part to be sold at some random location by Xur.
Wonder how it plays in the PS5...?
Upvote
0
(0
/
0)
Sanitization wouldn't prevent the use of <, this site sanitizes the inputs and allows the typing of < and [.
If you are printing user text back into something capable of printing html, you need to sanitize that text and output < instead of <.
Upvote
1
(1
/
0)
You are thinking of escaping, covering a < into < is escaping a character. Encoding is deciding that "a" is going to be saved by a byte value of 0x61. And that á is either 0xE1 or two bytes one with the value 0x61 and another indicating the "’" (not the right character I couldn't find the correct one in my phone keyboard)
Upvote
3
(3
/
0)
While we are at it, if I had to guess what the bug is, is probably a byte array one byte too short. If the max length of a user string is 200 chars, the byte array is 400 bytes, when it should had been 401 for the null terminator.
Upvote
-1
(0
/
-1)
There's been only 3 articles featuring Destiny in the last month. This is the only one that's actually about the game, though it in fact it's only about a bug in the chat system not the game as a game.
The other two were not about the game at all, but problem players, and in one, Destiny shared billing with Minecraft.
Upvote
6
(6
/
0)
Upvote
0
(0
/
0)