Oct. 18 (Portaltic/EP) –
Activision has indicated that he has disabled “an alternative solution to a detection system” found in the video games Modern Warfare III and Call of Duty: Warzone, which caused some players were wrongly banned through the Ricochet anti-cheat system, due to a ‘exploit’ in signature scanning method.
Ricochet is an anti-fraud system that the developer Activision implemented in some titles of its Call of Duty war video game saga in December 2021, with a view to intercept applications that try to interact with the video game to cheatfor example, facilitating a mission in order to complete it. In this way, Ricochet is able to detect these activities and disable offending accounts.
In this sense, Activision has indicated that the anti-cheat system Ricochet ha identified and disabled an “alternative solution to a detection system“in deliveries Modern Warfare III and Call of Duty: Warzonewhich has affected “a small number of legitimate players”, since it caused the suspension of their accounts incorrectly.
That is, the developer has disabled an alternative method to the Ricochet system that wrongly identified users who were supposedly using ‘software’ to cheat in the video game, when They were actually legitimate players.
After disabling this “workaround” and examining its systems “for security reasons,” Activision restored all affected accounts of innocent playersas he has shared in a post on X (former Twitter)through the Call of Duty Updates account. Likewise, he has assured that They will continue to monitor their systems.
ATTACK ON THOUSANDS OF PLAYERS THROUGH AN EXPLOIT
After this announcement by Activision, the developer and owner of the store that provides cheat software for Call of Duty and other games Phantom Overlay, called Zebleer, has published a article in where he points out that a ‘exploit’ in Ricochet’s signature scanning system has been the cause of these erroneous bans, and that has affected thousands of players.
Specifically, the publication is based on the explanation of the creator of the ‘exploit’ in question, known as Vizor. Thus, as detailed, one of the methods used by the Ricochet anti-fraud system is signature scanninga mechanism that allows analyze the computer’s RAM to look for traces of cheating software and, if related code is found, ban the user’s account, understanding that they are cheating.
For the signature scanning system to work correctly, Vizor has noted that the Anti-cheat developers must create a unique signature related to each identified cheat software. This signature is used to recognize the use of this ‘software’ on other computers, so that, when performing a scan, the signature should only appear in RAM when the trap in question is active.
With this in mind, Vizor has indicated that earlier this year it analyzed the memory allocations of the Ricochet kernel module and identified many strings of cheat-related code.
Specifically, it was a list of signatures associated with cheating software to be used in a signature scanning routine, among which found the signature ’54 72 69 67 67 65 72 20 42 6f 74 (Trigger Bot)’. After that, Vizor understood that any user who had the sequence ‘Trigger Bot’ in your device memory would be recognized as a cheater.
Furthermore, it must be taken into account that, as specified, the messages sent via in-game chat remain stored in game memory. The same happens with the names of friend requests.
Therefore, Vizor has pointed out that “for some time” it is possible attack players causing the suspension of your account, simply by sending them a friend request or posting a message signed ‘Trigger Bot’ in the chat from the Call of Duty game.
Through this ‘exploit’, Vizor has ensured that “several thousand random Call of Duty players were banned.” He also said that he “planned to attack more users”, but when the ‘exploit’ began to affect players ‘streamers’, Ricochet deactivated the ban system and began to investigate.
“This is the result of a major oversight on the part of the Ricochet team in using improper signatures“said Vizor.
With all this, some Call of Duty streamers have shared on X their complaints about the suspension of their accounts due to said ‘exploit’, lor that has caused their playing ability to be questioned, in case they had really been banned for cheating.
Add Comment