Users Spoofing data

[DonTheCrown]

Currently users are somehow able to spoof data into the ranking with no ability to remove/fix it. For example currently the rank 1 of Grobbulus-NA Alliance is listed as "All of " with 420k honor and 133337 RP,

[leothlon]

Interesting idea, but im not sure the extra flooding of the API is that good of an idea, most servers have 15k players online at primetime, ALOT of them use honorspy, on my server we have a standing table of about 30k people because of all the fakes, going through this will be putting strain on the servers.

I think if you run with the idea i had just a lower threshold like 10 people needs to see you and the person sharing the data needs to be lvl 15+, then possibly also adding confirmed people to a whitelist so they are automatically accepted next week will be better. With this many people on every server 10 people will see you by just running from AH to bank in IF, so it shouldn't take long at all for real people to be confirmed.

i spent ~10 min in SW and had already seen 200+ people

and even on lower pop servers it might take maby 1 extra day for 10 people to see you, but because of the whitelist that would still only be an issue for 1 day in the first week.

[leothlon]

Imagine if you have 5 people running from ah in if to bank, they are seen by 1 person, he then broadcasts this over yell and guild channel, that means around 100 players will now do both add and remove friend request on each of thease, thats 5players 2requests 100players, 1k requests to the API done in about a second, now imagine this happening all over the server all the time...

Your basically just making the addon into a giant ddos network.

So if you do like that you absolutly have to create a whitelist for real players that persist through the resets

[Kristoferhh]

there is a permanent whitelist if I'm reading this correctly, in the saved variables when a player is confirmed real

[kakysha]

@leothlon "estimations" about load used to be wrong in about 100% of cases, at least in my experience. Only production testing can show you the real values. Also, there is a limit of 1 friend add/remove per second for each client.

Personally, can't reproduce any bugs by myself. If more ppl can test the linked above version and find any causes for lags / bugs, I'll gladly review them. Thanx.

[PQlse]

So on my server someone has flooded the brackets with "W????????????????????????????" characters. With the version you posted here it scrubs most of them but some of them seems to get through. Also my client is constantly lagging/Freezing/stuttering when its trying to clear these 2k fake entries. It also doesnt seem to scrub actual real players who reported fake honor gained on their real character as you can see in this screenshot by the #1 and #2 standing.

https://i.imgur.com/EQxWt9t.png

While this scrubbing is an improvement (99% of the "W??????..." were removed except 3) it still has critical issues.

[leothlon]

@PQlse its impossible to clean fake data for real players, but this should not be a big problem anyway, say for example i would fake my honor at 12.00 and share this, then at 12.05 i go online to play some, a random player sees me in IF, he automatically inspects me, and as the data he gets is newer than the fake data i sent, the fake data will be replaced by real data.

So you would need to create a bunch of real chars fake their data then make sure to not log in on them

[Kristoferhh]

Ye about 2800 fake players were removed which is awesome but there's still about 30 of them left. I'm gonna try to find out why they're still there

[Streamsnipe]

Should just have used a password protected chat channel in game to communicate. Then you can moderate/ban as neccessary.

[leothlon]

@Streamsnipe thta wont do anything as with the current setup you cant know who falsyfied data from the start, also addons are not allowed to communicate over global chat channels anymore since 1 patch back.

[Streamsnipe]

yeah that's dumb, i thought they only changed it so 1,2,3,4, channels were blocked as means of comms, and not custom chat channels. This addon as it stands is entirely broken and prone to manipulation

[kakysha]

@Streamsnipe whats wrong in the current fake detections algo?

[cyril265]

You can still spoof data if you create a lvl1 char and send fake data for this char. Or am I missing something? Then again there is probably no real fix.

[Streamsnipe]

@kakysha Currently anyone can broadcast to anyone. This allows spoofers to send data directly to someone and have it be integrated into the 'mainstream' of the db. Once its in the system its impossible to scrub. We need to create password protected groups and allow users to construct and create DBs with information provided from other trusted users. Friends lists do not work for obvious reasons. All db updates should come from whispers, and not guild messages/party/raid anymore.

If we allow users to create groups and set passwords, we can have them moderate their own lists. Unfortunately custom global channels would've been ideal for this but it has since been patched

[kakysha]

@Streamsnipe again, asking for the 3rd time: why checking playernames by adding them to friends is not working, except the reason provided by @squallified?

Friends lists do not work for obvious reasons.

is not the answer I'm looking for

[Streamsnipe]

Because you do not know who spoofed the data. The person could be on your friends list. If someone on your friends list, or a friend of friend is spoofing then the database is still corrupted. Once its corrupted it propogates like a virus. Why is this hard to understand?

[kakysha]

What are you even talking about? Are you a developer yourself? Did you read the code I pointed you out? This is not how it works. Addon just adds players from the table, one by one, to your friend list. If player can be added successfully, then its a real one, otherwise its fake and should be removed.

You can spam as much fake data as you want, it will be purged from everyone's databases soon-ish. Fake values for real players also are quickly replaced by honest players inspections.

[rpbailey-dm]

There is currently a problem on Faerlina Horde side where the fake data being input is faster than the removal process. The only way I've found of fixing this, for me atleast, is to take the previous weeks databases and add every player seen to the 'good player' filter, and dump the rest into the 'fake player' filter. While not 100% it does give me a pretty accurate table. The only people who would be false flagged are those who haven't had an honor standing in the past three weeks.

The problem lies in this bit of code @ line 401:

if (distribution ~= "GUILD" and UnitRealmRelationship(sender) ~= 1) then

It appears someone changed the value to accept people from other realms into their database.

Currently there are more people being added, due to this person doing battlegrounds, than the removal feature can keep up with.

Another problem with this is that a lot of people on other realms share names with other people. It is not removing a lot of fake entries do to a character existing with that name actually on the server.

The only way to fix things like this is second party verification, no one person should be able to add to the database or these problems will continue. A second person should verify and then an entry can be added.

Also, self broadcasting your own honor should not be possible either. Another party should have to see you in order for yourself to be added to the database.

Lastly, if the database file in the saved variables folder cannot be obfuscated somehow, all of these changes are for naught. This file can be edited directly and used to change values as well.

[Godmatik]

"The only way to fix things like this is second party verification, no one person should be able to add to the database or these problems will continue. A second person should verify and then an entry can be added.

Also, self broadcasting your own honor should not be possible either. Another party should have to see you in order for yourself to be added to the database."

Yes, quoted for truth.

[leothlon]

Agreed, and that issue would be solved with the solution i suggested, that would require more than 1 person sharing the same names (like 5+ atleast), when a player is confirmed add them to a permanent whitelist, that way people will be added confirmed superfast and easy, there realy wont be an issue where it takes to long to add people, be online for 10min a week and you are guaranteed to have been inspected by atleast 5 people. and ones people have their whitelists there will be no issue what so ever with people not getting added instantly

[leothlon]

the solution i posted is ready to be rolled out, its without a whitelist tho but should be possible to add fast enough.

also you get rid of the risk that someone logs off in the middle of adding + removing someone and over time end up with afew people in their friendlist they dont even know

[Doodahdoodoo]

Just wondering. Is there a way to make a part of the code check for modifications of the .lua and deny it functinality ingame? Or would that check also be editable? Any way to have encrypted files somehow? Idk just brainstorming.

[leothlon]

@Doodahdoodoo you might be able to check a checksum of the file, but i doubt it... either way that would also be editable as all wow plugins are unencrypted opensource.

the latest version you linked here works verry well kakysha, except for the risk i stated above about getting random people on your friendlist, and in those cases where there is a real char at like lvl 1 that share name with someone from other server (as on earthshaker-eu its the same problem as above where someone removed the check if data is from x-server or not to flood the database)

[Doodahdoodoo]

Is there any way for this addon to connect to an external MYSQL database? I see other addons have the ability to inform you if the version is out of date or not. I assume this is using the internet somehow to check. If the addon could send its data to a secure server and back out to clients would stop the people from editing in their own values. But Im not sure if the API for this game has that capability. As for hosting the server, im sure plenty of us would happily pay for a dedicated sql server.. Just more brainstorming sorry if annoying you xD

[kakysha]

There is no way to do network requests. Other addons know about new versions just by receiving messages from other players with new version

[kakysha]

I cba doing anything so complex like that. P2P, blockchain, distributed ledgers or any other consensus solutions will fix the problem totally 100%, but I will leave implementation of blockchain inside WoW addon to someone else crazy enough to even start thinking of that.

I don't plan anything else on this problem. Fake rows already got eliminated by "friends check", wrong values got fixed automatically by fair player inspects sooner or later.

HonorSpy heavily relies on community, it can be called "community-driven" in terms of data it is showing. There always be some smart guy who can fuck up all the data, this cats and mice game will never end. You can hope there is another honest smart guy who "fix" those tampers, like I do on my server across my faction I play for, when players ask me to do it.

[Streamsnipe]

Yes. You'd need blockchain. OR. A single master in game where everyone points to to get their list and that list can be controlled by them. (E.g they have the authority to remove entries/modify out the bad ones). The latter is an easier solution

[Sahkay]

On arugal i get one or 2 of these guys at least every other week. Surely it wouldnt be hard to have a check for honor values this high that should be impossible to achieve normally. (everyone else only seems to go up to a max honor of 6 digits)

[Doodahdoodoo]

On arugal i get one or 2 of these guys at least every other week. Surely it wouldnt be hard to have a check for honor values this high that should be impossible to achieve normally. (everyone else only seems to go up to a max honor of 6 digits)

I have the same issue on my server. Keeps setting himself as 14 which is obviously not possible. I don't know how this effects the estimated calculations but it sure is annoying to see.

[Goldpaw]

This has been answered previously in this discussion actually: https://github.com/kakysha/HonorSpy/issues/58#issuecomment-561353897

Setting limits won't prevent hackers of creating 1000 "valid numbers". They won't be at the top, but still be in the table. No difference. "Remove entries" button won't fix your table either, as malicious person can create 500 entries that look valid to you and you won't even know that such players do not exist. As I said before, its a cats and mice game, in which there is no guaranteed way of defending against it. I don't want to overcimplicate addon, just to make "spoofing" a bit harder.

[Streamsnipe]

This is why you create a whitelist where the source of the information is controlled and not the data. I have no idea why this is so hard for people to understand here or why I've had to say it 4 times for people to understand.

1. Let there be a person who creates a table, become the owner of it, and can white list names who can broadcast entries into this table. They are whitelisted by the master and only whom the master trusts (E.g a guildmaster)
2. The person can see the source of all entries/all inputs to its DB because this app requires a message to be received from someone with a name.
3. The person can janitor their own DB.
4. Players who want to join the 'source' DB are invited by the master. They broadcast information to the master and also have the same whitelist as the master.
5. Suspicious information from a suspected player will have them removed from the whitelist and all will be filtered out from each subsequent player in the group as their copies are taken from the master list.

[kakysha]

This is why you create a whitelist where the source of the information is controlled and not the data. I have no idea why this is so hard for people to understand here or why I've had to say it 4 times for people to understand.

I don't want to overcomplicate addon

If you want to implement some crazy complex syncing schemas with some "masters" people who control and push the data (which, obviously, won't work, as to cover the whole playerbase, you have to rely on as much data collectors as possible), go for it.