Despite its huge financial success, MapleStory Europe has had more than its fair share of problems. Last month, controversy hit MapleStory Europe when double-xp cards lasting for 90 days, instead of the intended 24 hours, were accidentally placed in the cash shop during the new year sale. The latest issue to hit MapleStory Europe has done serious and potentially irrecoverable damage to the game's economy. The exploit involved the Chief Bandit and Shadower classes, which both have a skill called "Meso Guard". This causes them to lose mesos, the game's currency, when hit instead of hitpoints.
Packet-forging exploits have been used for some time to alter the damage players deal to monsters or receive from them. Combined with Meso Guard, hackers were able to fool the game into hitting them for -2,147,483,648 damage (the largest negative value a signed 32-bit integer can hold). Since the damage was a negative value, the Meso Guard skill then granted the player over two billion mesos. Hacking players used their ill-gotten gains to buy up practically everything in players' market stalls, massively inflating the game's economy by pouring untold billions into the hands of random players.
Nexon attempted to patch the exploit last night and responded by permanently trade-banning countless accounts. Reports from players indicate that the exploit is still possible and that many of the offending accounts were not banned. To make matters worse, a large number of legitimate players who were traded ill-gotten currency were also allegedly trade-banned. The follow-up to another meso exploit found last year was similarly lackluster, with no server rollback performed in either instance.
[Update: Scott Yoo from Nexon Europe got in touch with us to provide an update on the story. He had the following to say: "[W]e did 'trade-ban' suspected accounts temporarily in order to conduct an internal investigation but we also had to make sure no-more illicitly gained Mesos (in-game currency) are going out to the in-game market and contained in the meanwhile. We do admit that a certain amount of legitimate players can be included in the trade banned list and that's what we are going to reveal through the investigation carefully. [...] The reason why we didn't perform a rollback on our servers was because we detected the exploit too late which may make the players lose even more of their gains if we were to turn everything back. Another announcement that includes more details on this incident will go up live shortly (either today or tomorrow as the latest)."]
Reader Comments (14)
Posted: Feb 1st 2011 2:17PM cforciea said
The depressing thing is how fundamental a lack of basic design this demonstrates. We learned a long time ago that if you want players to not cheat on your game, you have to assume that all traffic coming from the client is suspect and perform every meaningful calculation possible on the server. There shouldn't have been a packet to forge at all.
Posted: Feb 1st 2011 4:23PM Scuffles said
Or at the very least it would have been smart to have any attack that registers as a negative number resolve as either one or zero dmg.
Regardless it was poor design, you have to assume that some of your users are going to try to exploit something and you need to outflank them.
Step 1) Think of a cool idea that you could implement in the game
Step 2) Think of ways people could potentially explode said coolness
Step 3) Deal with said exploits before they happen.
Knowing that packet forging was an issue they should have seen this coming a mile away. At least it makes an interesting read and possibly demotivational poster fodder.
Reply
Regardless it was poor design, you have to assume that some of your users are going to try to exploit something and you need to outflank them.
Step 1) Think of a cool idea that you could implement in the game
Step 2) Think of ways people could potentially explode said coolness
Step 3) Deal with said exploits before they happen.
Knowing that packet forging was an issue they should have seen this coming a mile away. At least it makes an interesting read and possibly demotivational poster fodder.
Posted: Feb 1st 2011 2:40PM Berzerk said
The fundamental flaw here is that the CLIENT tells the SERVER how much damage was dealt. If the client says "hey I was hit" then the server says "ok, this is how much HP you have" then this would never have been possible.
Also, you have to assume that all of your players are cheating bastards, and will get around any checks you have. The only solution is to not let them make the checks in the first place. (It may cause more lag, but it also won't destroy your entire game).
Also, you have to assume that all of your players are cheating bastards, and will get around any checks you have. The only solution is to not let them make the checks in the first place. (It may cause more lag, but it also won't destroy your entire game).
Posted: Feb 1st 2011 3:23PM cforciea said
@Berzerk
Even that is backwards. Ideally, the only thing your client would tell the server is what direction you are trying to move and whether you are doing anything (attacking, etc). The server would tell your client that you were hit, and it would update your displayed health bar accordingly. Realistically, there are some problems with this (loss of sync, etc) that have to be checked out by other methodology, but the base methodology should be to get the game client as thin as possible so that the only thing it handles is I/O.
Reply
Even that is backwards. Ideally, the only thing your client would tell the server is what direction you are trying to move and whether you are doing anything (attacking, etc). The server would tell your client that you were hit, and it would update your displayed health bar accordingly. Realistically, there are some problems with this (loss of sync, etc) that have to be checked out by other methodology, but the base methodology should be to get the game client as thin as possible so that the only thing it handles is I/O.
Posted: Feb 1st 2011 2:59PM sauceofmagic said
Welcome to Aion!... ah wait
Posted: Feb 1st 2011 9:52PM Skie said
Why Europe? What about the US MS? We had the same thing happen.
Couldn't play at all yesterday, by the time I decided to log in, the game was already down...
Couldn't play at all yesterday, by the time I decided to log in, the game was already down...
Posted: Feb 1st 2011 10:00PM Brendan Drain said
@Skie Reportedly, Maple Global had this problem a long time ago, and they successfully patched it then performed a server rollback.
Reply
Posted: Feb 1st 2011 10:18PM Skie said
@Brendan Drain
It had this problem last night. :P http://forum.nexon.net/MapleStory/forums/thread/6710670.aspx
Same exploit as far as I know.
Reply
It had this problem last night. :P http://forum.nexon.net/MapleStory/forums/thread/6710670.aspx
Same exploit as far as I know.
Posted: Feb 2nd 2011 12:11AM Danieros said
You can't fix this without a rollback. The damage spreads too quick for any attempt of case-by-case analysis and punishment, not to mention the economy corruption will make way too much people become candidates for punishment.
Posted: Feb 2nd 2011 4:00AM pcgneurotic said
Whatever happens, it's another case of a small percentage of players pointlessly wrecking thousands of people's fun. Man, the ego on some people.
Posted: Feb 2nd 2011 5:44AM Fabius Bile said
typical F2P game management
Posted: Feb 2nd 2011 10:09AM Xilmar said
/care









