Remove your game code

[ItsRalphy]

Hey folks. In case you havent seen the threads, there is a hack happening. I have counted at least six games that have been taken over by "hackedby Luisoos". Players are losing their games, are being reported as out of date when players try to visit, and the alliance I am in (a top 50 alliance) has vanished after 4 of us, including the alliance owner, were expelled. Some expelled players have found themselves in strange or new alliances, I am currently not in any alliance and my alliance tasks have vanished.

One theory is that the hacker is using our game codes to take the games over via the link progress facility. The only places our codes are published is via our signatures and messages on this forum, the facebook page or discord. I have taken my code out of my game sgnature, and I know others have. If you are asking for people to connect or join alliance, ask they private message for the codes, don't publish in open chat.

PLEASE NOTE THE IMPACTS OF THIS INCIDENT ARE GENUINE, AND GROWING. THE HACKING AND USE OF CODES IS A THEORY AND NOT PROVEN, SO WHILST MY ASSUMPTIONS MAY BE INCORRECT, THIS ADVICE IS GIVEN AS A PRECAUTION

 

[Davescharf]

I hope GI is actually trying to do something about this. Your theory about doing it via GI Link is very plausible.

I hope this all gets sorted out very soon for you and the others impacted.

 

[flyhores]

Hey folks. In case you havent seen the threads, there is a hack happening. I have counted at least six games that have been taken over by "hackedby Luisoos". Players are losing their games, are being reported as out of date when players try to visit, and the alliance I am in (a top 50 alliance) has vanished after 4 of us, including the alliance owner, were expelled. Some expelled players have found themselves in strange or new alliances, I am currently not in any alliance and my alliance tasks have vanished.

One theory is that the hacker is using our game codes to take the games over via the link progress facility. The only places our codes are published is via our signatures and messages on this forum, the facebook page or discord. I have taken my code out of my game sgnature, and I know others have. If you are asking for people to connect or join alliance, ask they private message for the codes, don't publish in open chat.

PLEASE NOTE THE IMPACTS OF THIS INCIDENT ARE GENUINE, AND GROWING. THE HACKING AND USE OF CODES IS A THEORY AND NOT PROVEN, SO WHILST MY ASSUMPTIONS MAY BE INCORRECT, THIS ADVICE IS GIVEN AS A PRECAUTION

Before the game was updated to version 8.42, I had sent these game screenshot materials to GI once
The email is also available，I just sent a help request email to GI, hoping they can carefully check my game data
And it can be restored correctly

 

[Sulfe]

Hey folks. In case you havent seen the threads, there is a hack happening. I have counted at least six games that have been taken over by "hackedby Luisoos". Players are losing their games, are being reported as out of date when players try to visit, and the alliance I am in (a top 50 alliance) has vanished after 4 of us, including the alliance owner, were expelled. Some expelled players have found themselves in strange or new alliances, I am currently not in any alliance and my alliance tasks have vanished.

One theory is that the hacker is using our game codes to take the games over via the link progress facility. The only places our codes are published is via our signatures and messages on this forum, the facebook page or discord. I have taken my code out of my game sgnature, and I know others have. If you are asking for people to connect or join alliance, ask they private message for the codes, don't publish in open chat.

PLEASE NOTE THE IMPACTS OF THIS INCIDENT ARE GENUINE, AND GROWING. THE HACKING AND USE OF CODES IS A THEORY AND NOT PROVEN, SO WHILST MY ASSUMPTIONS MAY BE INCORRECT, THIS ADVICE IS GIVEN AS A PRECAUTION

Hi there. I have not lost my game. All AC, Passengers count, Coins, planes and buildings are all okay. I only lost my Alliance and my friends. I chose to select game on "my device" (Sulfe) not "server" (Luisoos) and all seemed okay. I've logged out and back in a couple of times and I no longer get the option to chose. It goes right to Sulfe. Now, I just need to hear back from G! that they can restore my friends list.

 

[flyhores]

嗨，大家好。我的游戏并没有丢失。所有AC、乘客数量、金币、飞机和建筑都一切正常。我只是失去了我的联盟和我的朋友们。我选择在“我的设备”（Sulfe）上进行游戏，而不是“服务器”（Luisoos），一切看起来都没问题。我已经登出并重新登录了好几次，现在再也看不到选择选项了。它直接发给苏尔菲了。现在，我只等G!回复，确认他们能恢复我的好友列表。

Yes, I also entered the game, disbanded the alliance illegally formed by the invaders, re-added some neighbors and sent them gifts.
Most of them might be added later. There was an unknown interruption in the game, and when I logged in again, I couldn't see the previous two progress options

 

[flyhores]

Hi there. I have not lost my game. All AC, Passengers count, Coins, planes and buildings are all okay. I only lost my Alliance and my friends. I chose to select game on "my device" (Sulfe) not "server" (Luisoos) and all seemed okay. I've logged out and back in a couple of times and I no longer get the option to chose. It goes right to Sulfe. Now, I just need to hear back from G! that they can restore my friends list.

Yes, I also entered the game, disbanded the alliance illegally formed by the invaders, re-added some neighbors and sent them gifts.
Most of them might be added later.
There was an unknown interruption in the game, and when I logged in again, I couldn't see the previous two progress options

 

[Sulfe]

Yes, I also entered the game, disbanded the alliance illegally formed by the invaders, re-added some neighbors and sent them gifts.
Most of them might be added later.
There was an unknown interruption in the game, and when I logged in again, I couldn't see the previous two progress options

Fortunately, my game doesn't seem to be as corrupted as yours. It's been good except for missing friends and Alliance. My biggest question now is, should I re-add friends or wait? Any input is welcome. Thanks.

 

[flyhores]

Fortunately, my game doesn't seem to be as corrupted as yours. It's been good except for missing friends and Alliance. My biggest question now is, should I re-add friends or wait? Any input is welcome. Thanks.

I just chose to play the game on my phone, and there are still two progress options: one is the Google Cloud progress, and the other is the GI progress on my computer from an hour ago
I chose the latter, but it prompted a server error, preventing me from logging in and playing the game. Ten minutes later, I tried again using the GI version on the computer
There are two progress options to choose from: one is the local progress (i.e., the game progress from an hour ago), and the other is the game progress on Google's cloud server
I chose the latter, but there was some loss. The progress is from a week ago, which means I barely got anything from clicking on the green Christmas event
I still haven't formed any alliances or made any neighbors. I'm in the process of re-adding some friends from the top 100 alliances with whom I've been exchanging gifts for many years
It seems that GI only modified the game progress link server path at the first time, and provided what they considered to be safe and reliable game progress

 

[ItsRalphy]

So I am holding fire as I don't want to lose alliance progress - we were a top 100 alliance, around 60th I think. I only play on Aiport City GI, not the my device version, so I don't get the choose option. At one stage I had both, and had all sort of issues with my weekly codes etc, which vanished when I chose the GI version and deleted the my device game completely.

My game is playing fine, and I am sending and receiving gifts. I have lost the alliance completely, and the alliance tasks, and 6 neighbours - including @Tim Shutters, @Sulfe and @uk_crunch , 2 of whom were in the alliance. Neighbours are telling me that get the "your game is outdated" message when they try to visit me, and visitor and gift numbers are indeed down. One of these changed in my list to "hacked by Luisoos" but has now gone from my list.

GI are investigating, but they keep asking further questions around who is impacted and who has the "hackedby" message.

We have talked about starting a new alliance, but I am waiting to see what they do!

 

[GermanDuck]

I'm studying computer science, and I investigated this a little bit (however, I did only test this on my own account) and it's bad. Like VERY BAD.

First of all, @ItsRalphy is right: remove your friend code from your profile IMMEDIATELY.
Also, this wouldn't really be enough, because of massive security flaws on GI's side.

So how do you get someone's GI link code?
You will need their user ID, which is different from the friend code. To acquire the user ID from the friend code, you can simply make a friend request. It doesn't even have to be accepted, because GI's servers will return the ID no matter what. You can also get the user ID from alliance member lists, event scoreboards, top 100 lists etc., basically everywhere where your profile can be seen by others.

Because the GI Link system isn't secured properly, you can create requests to the GI server on other users behalf, and everything you need is the user ID which can be seen by anyone.

I've created a proof-of-concept, which does not include the critical parts and game-specific details for obvious reasons so no one should be able to use this, that's why there are 240 lines missing:

So I used the script to create a GI link for myself, only using my friend code.

And it exactly matches the one the game gives me when I want to link another device:

GI needs to fix this ASAP. No one is 100% safe, even if you have removed your friend code from your profile. Don't accept server changes and only use the local game until this issue is resolved.

The script only needs ~200ms to get the GI Link code from your friend code, and you wouldn't even notice.

 

[MartAlex]

GI are investigating, but they keep asking further questions around who is impacted and who has the "hackedby" message.

Theoretically, they have full access to the games' database. Why do they need to ask such questions of a player? They could be answered with a simple SQL query.
Unless the whole IT structure is compromised, of course...

 

[BobbinsPilot]

I'm studying computer science, and I investigated this a little bit (however, I did only test this on my own account) and it's bad. Like VERY BAD.

First of all, @ItsRalphy is right: remove your friend code from your profile IMMEDIATELY.
Also, this wouldn't really be enough, because of massive security flaws on GI's side.

So how do you get someone's GI link code?
You will need their user ID, which is different from the friend code. To acquire the user ID from the friend code, you can simply make a friend request. It doesn't even have to be accepted, because GI's servers will return the ID no matter what. You can also get the user ID from alliance member lists, event scoreboards, top 100 lists etc., basically everywhere where your profile can be seen by others.

Because the GI Link system isn't secured properly, you can create requests to the GI server on other users behalf, and everything you need is the user ID which can be seen by anyone.

I've created a proof-of-concept, which does not include the critical parts and game-specific details for obvious reasons so no one should be able to use this, that's why there are 240 lines missing:
View attachment 77674

So I used the script to create a GI link for myself, only using my friend code.

View attachment 77675

And it exactly matches the one the game gives me when I want to link another device:

View attachment 77676

GI needs to fix this ASAP. No one is 100% safe, even if you have removed your friend code from your profile. Don't accept server changes and only use the local game until this issue is resolved.

The script only needs ~200ms to get the GI Link code from your friend code, and you wouldn't even notice.

Really nice script, I have been a games developer for 26 years now and am absolutely flabbergasted that GI has zero protection on their API's. I have just done some testing myself (Will not post the script here) and in under 10 seconds I was able to get facebook details of 274 players out of the 1000 random players I tested against.

Getting random player details isn't that hard either as the API's for this forum are wide open once you have logged in and don't seem to be rate limited either, although the user key provided when you login does expire quite regularly. However you don't even actually have to login as you can generate a guest key which gives you access to the same information.

We are now in a world where unless you know exactly what you are doing, there will always be someone who can get information using basic Knowledge!

 

[GermanDuck]

However you don't even actually have to login as you can generate a guest key which gives you access to the same information.

The "auth key" they're using is 100% useless and does not work at all, I can generate a random string and it's a valid key. They're not checking the key at all, and as far as I've seen in the network traffic, the key is fully generated by the client, which itself is bad too.

 

[uk_crunch]

wondering if this is how *cheaters* get their resources... we've always wondered how an alliance/pilot manages to fly billions of px a week, by not even really hacking...

what we need is someone to steal the code fix it and we'll all come to you!

 

[GermanDuck]

Automation should be 100% possible, although I haven't tried this yet. And I won't, because honestly don't want to get banned.

AFAIK it's very easy to get any item, greenies, coins, passengers and fuel for free just by editing the savegame that gets sent to the server.

 

[ItsRalphy]

ok, my latest update from GI:-

 

[flyhores]

Automation should be 100% possible, although I haven't tried this yet. And I won't, because honestly don't want to get banned.

AFAIK it's very easy to get any item, greenies, coins, passengers and fuel for free just by editing the savegame that gets sent to the server.

I don't know, but I'm familiar with an older version of this game. It's been around for a long time and can still be downloaded online. The green version has the most content, including game coins. However, it can't be played online. You can play it on a computer without an internet connection. Of course, you won't have features like alliances, neighbors, adventure map flights, alliance map flights, or weekly alliance mission flights that are updated