search

ppy / osu-stable-issues

Report critical osu-stable issues here
61 stars 11 forks source link

Spamming spinners in map causes abnormal total hits growth, leading to an account ban. #1257

Closed astro-angelfish closed 3 weeks ago

astro-angelfish commented 3 weeks ago

Original reproduced by one of the server member when experimenting some dirty stuffs, and they got restircted. This issue could be used to conduct arbitrary account banning by abusing total hits statistic based cheat detection. But phishing is still required.

Any map with similar structure can also lead to this issue. Simply removing the map or this issue tracker would not completely fix the problem.

Please do NOT submit any score on the map following.

Reproducible map: https://osu.ppy.sh/beatmapsets/2260675

peppy commented 3 weeks ago

So don't do this? This is what you call game abuse. If you do this you will be banned.

astro-angelfish commented 2 weeks ago

So don't do this? This is what you call game abuse. If you do this you will be banned.

Ok. But I'm wondering if someone would abuse this in a multiplayer room, and everyone got banned because submitting score of that map and triggered the auto-ban. That's why I open the issue for this. Anyone plays that map would get banned, even if they are not voluntary and not known about the map.

Any malicious actor could craft such map and launch an attack that affects max up to 15 players except themselves. And if they do spread their map and attract some curious players, those players would get affected too.

Not submitting the score might resolve this issue, but not everyone has sense about that.

As I've said:

This issue could be used to conduct arbitrary account banning by abusing total hits statistic based cheat detection. But phishing is still required