HackerOne bounty program

[Powerpuff]

Has anyone from the forum participated in HackerOne bounty program to find any problems with R* banning system? They have "Grand Theft Auto Online - Incorrect Ban Bounty" program where people can report reproducible methods to get bans (by not modding etc).

 

After coming out from my suspension (which i still think was undeserved) i'm thinking of proving R* that i am right (but in order to do so i need to be able to reproduce my undeserved suspension).

 

 

 

Edited September 28, 2018 by Powerpuff

[Lonely-Martin]

We already know false bans and suspensions come from an auto.ated system dude, and R* Just don't care.

 

Can't appeal for a reason, sorry. (No clue what this HackerOne stuff is though).

[Spider-Vice]

4 minutes ago, Lonely-Martin said:

No clue what this HackerOne stuff is though

It's R* caring. Since 2016, Rockstar has been running a bug bounty for hackers to find vulnerabilities on their websites/servers, for real money. They've extended this to unfair GTA Online bans on PC, as long as you can repro it without hooks, hacks or anything else that might interfere with the game.

[Lonely-Martin]

25 minutes ago, Spider-Vice said:

It's R* caring. Since 2016, Rockstar has been running a bug bounty for hackers to find vulnerabilities on their websites/servers, for real money. They've extended this to unfair GTA Online bans on PC, as long as you can repro it without hooks, hacks or anything else that might interfere with the game.

Sorry, I'm a little lost now, lol.

 

Does this mean R* are trying to play fair with these things more, this really is way out of my league. But if so and it's made safer so players can't slip, awesome.

 

* Did just have a brief Google, will look to understand more later though.

Edited September 28, 2018 by Lonely-Martin

[Gaffa]

Is it actually Rockstar Games caring though, or a third party? 

I'd go with the latter. https://hackerone.com/rockstargames

[flexcreator]

Someone should try the "AppInit_DLLs". I don't have time or dedication to test it myself

 

I don't have to tell you that you should NOT do it from your primary account and you SHOULD make a footage of all the steps you take.

 

Quote

On the PC where the ban occurs you must not be using:
+    a. custom code
+    b. esoteric software where we cannot verify the author or their (innocuous) intent

 

WTF is custom code? WTF is esoteric software? These conditions are pretty vague.They can use these points as an excuse for not giving you the bounty.

Never trust R* when it comes to money.

 

[Spider-Vice]

3 hours ago, Gaffa said:

Is it actually Rockstar Games caring though, or a third party? 

I'd go with the latter. https://hackerone.com/rockstargames

It's Rockstar. It's literal people from their security team, I found one of them on LinkedIn once (fully disclosed reports reveal names). HackerOne is just a public website where companies can open their own bug bounties. The issues that are reported are fixed, it's not some weird outsourced crap that takes 12 months to fix.

 

People just think Rockstar are completely braindead.

[Fennimoe]

Spider is correct. 100%

[fatdog]

1 hour ago, flexcreator said:

 

WTF is custom code? WTF is esoteric software?

 

 

Some home made sh*t that intentionally mess with GTA process. Your dll injector or w\e it is most likely fits the description.

[Gaffa]

"Meh". I never know what to believe these days, although I do know for sure Rockstar is almost completely braindead, if not already there, if they can't blacklist a day one, well known program from being used, in addition to taking down private mod menus whilst the large companies running cheats get away scot free. 
But yeah that's a different story for a different time to be honest. 

[Sanches]

I think Reddit was trying to do something with that. I mean, people all around tried too, but Reddit was more or less organised.

[Gridl0k]

1. Do a NAT test

2. GIVE GRIDL0K ALL THE MONEYS

 

Seriously though, this is good. Do we know if r* have paid out on any server-side stuff, rather than PC bans?

 

Derp. Yes.

 

 

https://hackerone.com/killr0x33d?sort_type=latest_disclosable_activity_at&filter=type%3Abounty-awarded&page=1

 

Kerching.

Edited September 29, 2018 by Gridl0k

[flexcreator]

8 hours ago, fatdog said:

Some home made sh*t that intentionally mess with GTA process. Your dll injector or w\e it is most likely fits the description.

The PC could be naturally infected with some AdWare/Malware without the user's consent or intention. AdWare programs that target Internet browsers often use this key to launch it's code without relying on autorun.

 

This key is also being used by legitimate software. For example, Symantec is using it to launch their application metering DLLs 

https://support.symantec.com/en_US/article.TECH209077.html

 

As you see, the test could be organized in a way that doesn't look like an attempt to intentially mess with the GTA5.exe

[fatdog]

49 minutes ago, flexcreator said:

For example, Symantec is using it to launch their application metering DLLs 

Now this is worth to investigate. I'm too lazy tho.

[Jimbatron]

On 9/29/2018 at 3:41 AM, Spider-Vice said:

It's Rockstar. It's literal people from their security team, I found one of them on LinkedIn once (fully disclosed reports reveal names). HackerOne is just a public website where companies can open their own bug bounties. The issues that are reported are fixed, it's not some weird outsourced crap that takes 12 months to fix.

 

People just think Rockstar are completely braindead.

This is probably the most encouraging thing I've heard in a while. It seems they've at least implicitly admitted that their anti-cheat is getting false positives. When did they start including unfair bans in this program? (EDIT - looks like it's quite recent - assuming the incorrect ban bounty was added with the 26th Sep update?)

Edited September 30, 2018 by Jimbatron

[Spider-Vice]

1 hour ago, Jimbatron said:

This is probably the most encouraging thing I've heard in a while. It seems they've at least implicitly admitted that their anti-cheat is getting false positives. When did they start including unfair bans in this program? (EDIT - looks like it's quite recent - assuming the incorrect ban bounty was added with the 26th Sep update?)

Yes. Until now it was all website/service related vulnerabilities. 

[Gridl0k]

Does that essentially confirm RDRO is the same mesh f*ckup, or are they investing a couple thousand bucks in being nice to PC players..

[fatdog]

3 hours ago, Gridl0k said:

or are they investing a couple thousand bucks in being nice to PC players..

Preparing for consoles get compromised xD