[Dev Update] Exploits and Bans – 10 January 2008

Inde

Site Contributor

Join Date: Dec 2004

All right, so that we can have a controlled discussion on this hot topic:

Quote:
Originally Posted by Gaile Gray
An exploit was recently discovered in Guild Wars that allowed client-hackers to travel to a hidden outpost. From that outpost, they could travel directly into the room containing Mallyx, the final boss in the Domain of Anguish.

This hidden outpost existed strictly for testing purposes and was never accessible through normal play. Only by hacking the client, or partying with someone who had done so, could a player access that outpost.

We eliminated the exploit with a build today. We also conducted a detailed investigation into who accessed this exploit and other hidden outposts. As a result of this investigation, we permanently banned 117 players late Wednesday night, Pacific time, and we will ban more accounts as appropriate as we review additional logs gathered after the initial bans. In our investigation, we took into consideration extraordinary circumstances such as players who might have been transported to the outpost unwittingly and against their will by a party leader who was hacking the game. We chose to permanently ban these 117 accounts because it was clear that the players involved had intentionally exploited a server vulnerability for their personal gain.

ArenaNet gives the highest possible priority to maintaining the security of the game and protecting the game economy. You can assist us by letting us know, via the Community mailbox, if you learn of an exploit. Protect your own account by refusing to use exploits and declining to share information about their uses with others.

http://wiki.guildwars.com/wiki/Gaile...0_January_2008
Please post your thoughts and opinions. Do not add one-liners but if you have something to add to the discussion then please do so. Any insult to an individual or the community as a whole will be deleted. Stay on topic.

---
Update:

http://www.guildwarsguru.com/forum/s...&postcount=351
Quote:
Originally Posted by Gaile Gray
I will share several bits of information, and then will read the other pages in the forum. But let me answer some of the many comments being offered here, all based on the position that was really pretty clearly detailed in today's Dev Update:
  • No one was banned for visiting the hidden outpost once. No one was banned even for going there a few times.
  • No one was banned for entering the mission, killing Mallyx, and taking the loot, even if they did that a few times.
  • In fact, the bar was set higher than a one-time or even few-time occurrence, as the Dev Update states, to avoid banning someone who was pulled there inadvertently or to avoid banning someone who might have thought he was helping by "testing" the exploit.
  • We have had protests saying something like, "But I only did it 4 times!"And the answer is, "You're right: You used the exploit 4 times. And then you used the exploit 20 more times on your other character."
  • There is a massive difference between ferrying someone to a known map and hacking the client to go to an inaccessible map, to take on a hero without having had to fight through four difficult challenges prior to that meeting. For in normal circumstances, by the time a party gets to Mallyx, they've taken damage, acquired DP, and spent a significant amount of time. The DoA mission requires talent, skill, and dedication. What challenge is there in skipping to the end scene? And would anyone honestly think that such a short-cut was allowed or intended?
  • For some, we see a pattern of movement to the outpost (sometimes after selling passage to others), entering the Mallyx room, killing him, then wash, rinse, and repeat. And boy oh boy, did some people repeat it!
  • Yes, we have records, and chat logs, and more. Obviously, anyone who hacked his client needs to be banned, and anyone using this exploit more than a few of times also needs to be banned. Let's not fine-grain this to who did the actual hacking -- the question is, did you benefit from using the hack?
  • The existence of the outpost -- in hidden form -- is required to offer the Domain of Anguish. This was not a "test" and the outpost absolutely could not be "deleted when we were finished with 'testing" or "saved on some storage device." So as directly as I can say it to those offering unfounded opinions: Deleting the outpost disables the entire Domain of Anguish mission. Therefore, let's be fair and not blame ArenaNet because someone hacked his client!
  • This exploit has nothing to do with texture changes or mods.
  • Now, to those who suggest that Support should give a warning before a block or ban, can you please tell me why that would be a good idea? Because I think I can tell you why it would be a poor idea: Giving a warning allows players time to shuffle their items to another account, to create a mule to carry the goods, or to sell them or give them away before they're caught. That means the economic impact remains, and it's the economic impact that we must prevent.
  • This exploit is not in any way a form of "farming." Whether someone used an exploit, or partied with someone who did, he were taken to a hidden outpost, which he could easily verify because (a) it was not on his map, (b) Mallyx, in normal gameplay, has no such outpost, and (c) he was almost certainly told it was an exploit, or told to keep it quiet, or sworn to secrecy. He was not farming, he was using or benefiting from the use of a serious exploit.
  • The length of the UA, or not reading it, is truly not a defense if one chooses to breach it.
  • Saying "They let such-and-such bug/glitch/exploit go, so they should just let everything go" has no foundation in logic. This was a significant exploit, higher in overall concern than someone ferrying another player to a legitimate high-level map. This is hacking the client; this is going to forbidden areas; this is gaining undeserved reward; this is profiting from selling the secret or selling a ferry; this is engaging in activities that can have long-ranging negative effect on the game economy.
We are always very sorry when we have to enact a ban on any account. Although 117 accounts is a very small number when you consider the numbers of those playing every day, it still causes us great distress to be placed in the position of having to enact such bans. After all, the last thing we want to do is turn away people who enjoy our game. I am personally very, very sad to see some names that I recognize involved in this exploit.

We do understand that some people will be angry about our actions, even if they were not personally involved in the exploit. I think we can all agree it's not a pleasant situation from any viewpoint. But we must put the game community as a whole above the interests of the individual player, when the actions of the individual player can have negative consequences upon all players. And that is what we have done.

Players who were banned may submit an appeal. Each such appeal will be carefully and respectfully researched and I truly hope that your personal situation is such that your account might be reinstated. But in all honesty, for quite a number on the ban list, that simply will not be possible. And as distressing as it is for more than the individual players involved, some players will find their ban must be upheld, for the good of the game.

Thank you to those who support ArenaNet in making this painful decision. And our sincere thanks to those who knew of this exploit and did not use it, or who kindly reported it to us directly, so that we could prevent a major impact upon the game about which all of us care so deeply.
UPDATE:

Quote:
Originally Posted by Gaile Gray
Sorry, but I have to make a correction: Please submit a Support Ticket. Support is gathering and reviewing all appeals. ArenaNet is involved in setting parameters and may be involved in assessing the appeals. But emailing or PMing me is not going to be fruitful -- appeals must go through Support.

Mickey

Mickey

Jungle Guide

Join Date: Feb 2006

Eternal Insight

D/

I guess I am considered one of the lucky 117.

I was taken there without knowing it was an exploit, or 3rd party programs were involved, and I killed Mallyx from there, although I had already defeated the 4 other lords of anguish before beating him. Now I am permanently banned, support has no mercy for me. I don't know what to do. I thought it was just farming. W/e, flame me if you want, that's how the other thread turned out.

You just got tomahawked

You just got tomahawked

Krytan Explorer

Join Date: Nov 2006

H-Town

The Battle Bakery [vPie]

N/

Wow. DoA greens arent worth much though... Last time I checked Mallyx's chest doesnt drop gemstones.

Mickey

Mickey

Jungle Guide

Join Date: Feb 2006

Eternal Insight

D/

Quote:
Originally Posted by You just got tomahawked
Wow. DoA greens arent worth much though...
Gemsets are worth around 18 k.

undeadgun

undeadgun

Forge Runner

Join Date: Nov 2006

US

Its Rainning Fame Hallelujah[伞回伞], also as guild leader

N/

it is a really fair action done by Anet, those who exploit the bug was intended to break the rules, i think the ban is fair.

Rhapsody Shadow

Rhapsody Shadow

Pre-Searing Cadet

Join Date: Jan 2008

R/

why were people banned for this but not exploits like the slave's dungeon or ferrying to the end of nightfall? Surly everyone should be treated the same.

jamal

Ascalonian Squire

Join Date: Dec 2006

E/

my guess is it wasn't about the greens, but the golds. aka the different gemstones and via the stones tormented weps.

if thats what really happend Mickey thats a bummer but i imagin support might eventually help you as they are aware of people unknowingly abusing this.

other wise a well rounded fix and mass-ban. bravo anet

Dropper

Academy Page

Join Date: Dec 2006

This exploit was done by hacking the client/data, which makes it a bit more serious than ferrying. Anet made the right decision to ban the players.

Zahr Dalsk

Grotto Attendant

Join Date: Aug 2007

Canada

I think permanent bans for people who didn't actually hack the program to be a little extreme. The actual hackers, sure, but the people who were taken there (some of them by surprise) should not be held as accountable for this.

Quote:
Originally Posted by Gaile Gray
ArenaNet gives the highest possible priority to maintaining the security of the game and protecting the game economy.
I am somewhat doubtful about this given the current state of the game and what ArenaNet is doing to disadvantage human farmers and how they are supporting botters.

Any word on plans from ArenaNet to make it easier for players to gain money (and thus reduce the efficiency of gold selling)?

Lady Raenef

Lady Raenef

Jungle Guide

Join Date: Feb 2007

Oregon, USA.

Zero Mercy [zm]

W/

No wonder I saw gemsets being sold like crazy. I didn't even know about this, man, I'm always slow on recieving the news! At least they fixed it and they're punishing the deserve!

Big_Daddy

Big_Daddy

Lion's Arch Merchant

Join Date: Apr 2006

The Big Daddy Experience [BigD]

N/Mo

Well, Mickey, if you do feel you were taken there without knowing about it, then tell GWSupport.
Quote:
In our investigation, we took into consideration extraordinary circumstances such as players who might have been transported to the outpost unwittingly and against their will by a party leader who was hacking the game.

Bryant Again

Bryant Again

Hall Hero

Join Date: Feb 2006

One of my friends has been for this as well. He said that he "unwillingly" went there as well and mapped back to his GH a few moments after. But if he was telling the truth, he shouldn't have been banned, right?

Now my question is: Does ANet have some sort of tracking record for player status, via chatlogs, travel logs, etc? For "extraordinary circumstances," this seems like where it would be most helpful, because this is pretty serious (well...as serious as PvE can get, really. lol.) Otherwise, a lot of innocent peeps could get wtfbanned.

Nonetheless, if you're banned, send ticket after ticket after ticket after ticket. If you're persistant and thoughtful in your e-mails, they'll let you go. Unless you were one of the hackers, in which case good luck buddy.

Billeh

Academy Page

Join Date: Oct 2007

New York

Crew of the Forsaken[LaZy]

E/

I commend A-Net for discovering and cracking down on this serious issue. I wonder why thisoutpost was never deleted...

Mickey

Mickey

Jungle Guide

Join Date: Feb 2006

Eternal Insight

D/

Quote:
Originally Posted by Bryant Again
One of my friends has been for this as well. He said that he "unwillingly" went there as well and mapped back to his GH a few moments after. But if he was telling the truth, he shouldn't have been banned, right?

Now my question is: Does ANet have some sort of tracking record for player status, via chatlogs, travel logs, etc? For "extraordinary circumstances," this seems like where it would be most helpful, because this is pretty serious (well...as serious as PvE can get, really. lol.) Otherwise, a lot of innocent peeps could get wtfbanned.

Nonetheless, if you're banned, send ticket after ticket after ticket after ticket. If you're persistant and thoughtful in your e-mails, they'll let you go. Unless you were one of the hackers, in which case good luck buddy.
I went ahead and told them the general chat log that me and a friend had, all I can do is hope for the best, it's been a good two years, and I don't want it to end like this. I have been using the same ticket for all my answers/questions, is that bad?

Crom The Pale

Crom The Pale

Furnace Stoker

Join Date: Nov 2006

Ageis Ascending

W/

This was certainly appropriate action on Anets part.

Hacking of any kind should result in more than just a ban, it should be a criminal offence. It is an outright attack upon proprietary property via the internet.

That being said those that were taken to the outpost via a party leader, and had no knowledge of the hack should remain free from any action. Many games are full of "hidden areas" that only a few find a means of entry to. It would be easy to fool even some vertern players into thinking this was a legit location that has remainned either hidden or kept secret by those few that found it.

This is the first I have heard of this outpost, though it certainly makes perfect sense from a programing/debugging aspect, and even I(32+ months of play time) could have been fooled into thinking it was legit.

Neo Nugget

Neo Nugget

Site Contributor

Join Date: Jan 2006

R/

Quote:
Originally Posted by Rhapsody Shadow
why were people banned for this but not exploits like the slave's dungeon or ferrying to the end of nightfall? Surly everyone should be treated the same.
Because that didn't involve hacking the Dat. file.

Malice Black

Site Legend

Join Date: Oct 2005

Quote:
Originally Posted by Billeh
I commend A-Net for discovering and cracking down on this serious issue. I wonder why thisoutpost was never deleted...
Clearly stated in the OP. Don't start with the conspiracy theories, well not until I've grab a drink and some popcorn.

Harrier's haste

Harrier's haste

Frost Gate Guardian

Join Date: Jun 2007

ViLE

R/P

Quote:
Originally Posted by You just got tomahawked
Wow. DoA greens arent worth much though...
They are there for the gemstones, which in turn can be transferred for the Torment Weapons/Shields, currently around 100k 28e. (does my post gets deleted for naming the price? ) So, as you see, they're quite valuable.

But I totally agree with the actions Anet take. Imo, even getting banned permanently is too light a punishment for these hackers. Dam bastards, at least they won't be around for some time.

pochoWICKED

pochoWICKED

Ascalonian Squire

Join Date: Feb 2007

[GoA]

Mo/

Yea I got banned too. Not Happy about it. A lot of 1337 people got banned for this. And I think we should have at least got a warning or something before a straight-up permanent ban. Whatever though, I just don't think it's right, because pretty much everyone involved in this has been playing for like 2 years and has spent a lot of money buying expansions, char slots, etc....

Pariah Hellfire

Pariah Hellfire

Frost Gate Guardian

Join Date: May 2006

N/Mo

I am left thinking why they have left these "hidden outposts for testing purposes" active in the game..would it not be so easy to remove them when content is finally added with a new build?

I am also a little concerned for my account status,I have just purchased a few things from the GW store and if these ingame exploits are apparently easily hacked,what's to stop people from obtaining my Mastercard information through "client side hacking in the GW store?"

I think it's great Anet has jumped on rectifying the situation,and on the whole I feel this is still the single most secure and well maintained "online" franchise in terms of security.

It's still an inconvienient fact that people will try and exploit video games.

freaky naughty

Krytan Explorer

Join Date: Sep 2007

Mo/N

The people who exploited this definitely deserve a ban. There's a difference between discovering a bug and hacking GW servers.

Mickey I don't mean to be a cynic but I don't think you'll get your account returned. You probably knew that you acccessed the Mallyx mission from DoA outpost not from the hacker one. Yet you do the mission anyway even though the existence of this outpost has only been discovered a year after DoA was released?

Servant of Kali

Servant of Kali

Jungle Guide

Join Date: Jan 2006

Me/

Quote:
Originally Posted by Big_Daddy
Well, Mickey, if you do feel you were taken there without knowing about it, then tell GWSupport.
That's highly unlikely.

He would havo to say:
1) how many times he killed Mallyx and wasn't the whole process strange.
2) having defeated 4 other lords of anguish would surely not indicate a noob, thus, getting to Mallyx by some weird way and participating - isn't quite an accident.

Correct me if I'm wrong.

saopaulo

saopaulo

Ascalonian Squire

Join Date: Oct 2005

Im one of the ''lucky'' 117 too. I knew there was something fishy when i joined a team saying its not deeded to have beaten the 4 lords for killing Mallyx

3 years GW gameplay gone 4 campaignes ( bought each 50 euro) down the toilet

Im trying to reach support but no respons yet, guess i have to play a new game now.

I say GOODBYE to my ign characters ''I Cant Kill U'' ( 54 million xp) , ''None Shall Pass'' (36 Million XP)

IlikeGW

Jungle Guide

Join Date: Aug 2005

If they were sitting there farming 100's of armbraces a week (and it's somewhat confusing how they got the quest rewards and the quest to work right for test content I guess that was just luck) well they pretty much deserve the ban. I wonder if this includes some of the filthy rich people in high end ... probably, sadly.

I pwnd U

I pwnd U

God of Spammers

Join Date: Oct 2005

in the middle of a burning cornfield...

Scars Meadows [SMS] (Officer)

So thats what all the fuss was about. Geez seriously, Mallyx isn't that tough if you have a good team. Yes it takes a long time but it's worth it. They deserve their ban.

Bryant Again

Bryant Again

Hall Hero

Join Date: Feb 2006

Quote:
Originally Posted by Mickey
I went ahead and told them the general chat log that me and a friend had, all I can do is hope for the best, it's been a good two years, and I don't want it to end like this.
Given how mature and calm you've been about it, things are probably going to look in your favor.

Quote:
Originally Posted by Mickey
I have been using the same ticket for all my answers/questions, is that bad?
That's exactly what I've done the past four times, so ya.

Arkantos

Arkantos

The Greatest

Join Date: Feb 2006

W/

Personally I'd like to know why some of you are trying to say you were unaware that this was an exploit. Not trying to be rude or anything, but don't you think if people are being ferried directly to mallyx from a prophecies outpost sounds a little bit fishy? I mean surely you must've not of been thinking that this was normal.


Anyways I do believe ANet did the right thing here. Exploiting a bug with a third party program resulting in a permanent ban.

Mickey

Mickey

Jungle Guide

Join Date: Feb 2006

Eternal Insight

D/

Quote:
Originally Posted by freaky naughty
The people who exploited this definitely deserve a ban. There's a difference between discovering a bug and hacking GW servers.

Mickey I don't mean to be a cynic but I don't think you'll get your account returned. You probably knew that you acccessed the Mallyx mission from DoA outpost not from the hacker one. Yet you do the mission anyway even though the existence of this outpost has only been discovered a year after DoA was released?
I had already beaten the Four Lords, I went into Mallyx to try and beat him, from GoA, my team failed, my buddy said, let's go with my team. I get a guest invite, go to Guild Hall, taken to outpost, no Keeper to go to Mallyx, then the little, Enter Mission thing pops up at the top, with the countdown, I'm thinking, wtf, and then we jump back to the Mallyx place, in the Ebony Citadel Place or w/e, so I'm like...ok....were here, let's just do it. So I finish the quest from the outpost that is exploited apparently.

Oh, btw, I am a noob at DoA. I took 2 other guildies, and we ursanned with heros all 4 areas, with Consumables, it was hard, but we made it, and I pugged foundry, god knows how, but we did it, with Ursan.

freaky naughty

Krytan Explorer

Join Date: Sep 2007

Mo/N

Quote:
Originally Posted by I pwnd U
So thats what all the fuss was about. Geez seriously, Mallyx isn't that tough if you have a good team. Yes it takes a long time but it's worth it. They deserve their ban.
/yes they do deserve their bans, but being able to just redo Mallyx mission for free gemsets? You don't see any problem in that? Even though the Mallyx quest is required to enter the Citadel?

Meta4ik

Ascalonian Squire

Join Date: Jan 2008

Border City Bandits

N/

Im one of those 117 as well. I've never done DoA at all before my friends told me they were farming Mallyx. I was told to just complete the DoA quest before i was allowed to farm with them. Just the 4 quests and Mallyx once. Ive never used the map hacks or any third party programs including the third party ones supported by Anet ie. Texmod. I farmed this like how I did the deep way back when someone kept the outpost did the deep sold our stuff and came back to GH. I never found anything wrong with it the deep or urgoz warren they like this outpost never had a map marker. I never knew how anyone i went with got there but all of the partys i had gone on went from the GH any non allies got guest invites. As far as I know I'n no hacker I've never hack anything in my life. I seriously dont believe that this was a hack. I know alot of people who have been banned no raw numbers but a garunteed 1/4 -> 1/3 of the banned accounts we all are close friends after all. Ive accepted that my account for the most part is probably gone or im gonna have to go through hell to get it back but I know that a vast majority of people are and were never hackers. They were just like me a hard core player of 2+ years wanting to make some easy money.

Bryant Again

Bryant Again

Hall Hero

Join Date: Feb 2006

Quote:
Originally Posted by Arkantos
Personally I'd like to know why some of you are trying to say you were unaware that this was an exploit. Not trying to be rude or anything, but don't you think if people are being ferried directly to mallyx from a prophecies outpost sounds a little bit fishy? I mean surely you must've not of been thinking that this was normal.
Friend said that he got a whisper asking if he wanted to go kill Mallyx. He said "ya I got time", met them in DoA and a-mappin'-they-go. Instantly he figured out he shouldn't be there and mapped away.

The possibility of innocent people may be slim, sure, but that doesn't mean you should take that out of the equation.

Big_Daddy

Big_Daddy

Lion's Arch Merchant

Join Date: Apr 2006

The Big Daddy Experience [BigD]

N/Mo

Quote:
Originally Posted by Servant of Kali
That's highly unlikely.

He would havo to say:
1) how many times he killed Mallyx and wasn't the whole process strange.
2) having defeated 4 other lords of anguish would surely not indicate a noob, thus, getting to Mallyx by some weird way and participating - isn't quite an accident.

Correct me if I'm wrong.
Well, he does say that he only did it once and he had beaten the other 4 lords.

Arkantos

Arkantos

The Greatest

Join Date: Feb 2006

W/

Quote:
Originally Posted by Bryant Again
Friend said that he got a whisper asking if he wanted to go kill Mallyx. He said "ya I got time", met them in DoA and a-mappin'-they-go. Instantly he figured out he shouldn't be there and mapped away.

The possibility of innocent people may be slim, sure, but that doesn't mean you should take that out of the equation.
If he was ferried to the outpost and left immediately, I do think it's unfair that he was banned. I'm talking about the people who went to the outpost and went on to kill mallyx.

Commander Ryker

Site Contributor

Join Date: Jun 2005

R/

Quote:
Originally Posted by pochoWICKED
Yea I got banned too. Not Happy about it. A lot of 1337 people got banned for this. And I think we should have at least got a warning or something before a straight-up permanent ban.
The EULA was your warning.

Quote:
Originally Posted by pochoWICKED
Whatever though, I just don't think it's right, because pretty much everyone involved in this has been playing for like 2 years and has spent a lot of money buying expansions, char slots, etc....
You only have yourselves to blame. You shouldn't have done it, you knew it was against the rules. I have no sympathy for you at all.

Cobalt

Krytan Explorer

Join Date: Aug 2005

Mo/W

Quote:
Originally Posted by Pariah Hellfire
I am left thinking why they have left these "hidden outposts for testing purposes" active in the game..would it not be so easy to remove them when content is finally added with a new build?
I heard about hidden outposts but thought they were like the alleged admin island in WoW, most likely a myth. I guess they left them in and active to use as their own private outposts perhaps to have in game meetings and such.

freaky naughty

Krytan Explorer

Join Date: Sep 2007

Mo/N

Quote:
Originally Posted by Commander Ryker
The EULA was your warning.



You only have yourselves to blame. You shouldn't have done it, you knew it was against the rules. I have no sympathy for you at all.
QFT this post should govern the way Anet handles banning.

I pwnd U

I pwnd U

God of Spammers

Join Date: Oct 2005

in the middle of a burning cornfield...

Scars Meadows [SMS] (Officer)

Quote:
Originally Posted by freaky naughty
/yes they do deserve their bans, but being able to just redo Mallyx mission for free gemsets? You don't see any problem in that? Even though the Mallyx quest is required to enter the Citadel?
I never said I didn't have a problem with it, I do that is why I think they deserve their bans. It's not fair to the rest of the community for some hackers to get free gemstones, basically, to other players and have them incoporated into the economy. It is wrong. That is why they are banned and why I agree with it. They breached the EULA, they could of ruined the economy even more and it was basically dupers all over except they had to have a little more work to do.

zerulus

Jungle Guide

Join Date: Oct 2005

If the person didn't map out immediately after being taken to the outpost they deserve what they got. I really don't see why any of them are pleading their case on here though, for all we know everything they are telling us is complete bullshi t. They can cry to anet through support all they like and if they truly are innocent they will have the action reversed. As for people saying they should have been given a warning before being banned permanently, why? It really should be one strike your out. You don't want your account banned? Don't do stupid shit.

Rexion

Rexion

Wilds Pathfinder

Join Date: Aug 2007

[Luck]

E/

they left the outpost open, they should have closed it when they were finished. it is ANets fault for even keeping it there... there will always be a person to use something that the Devs didn't get rid of... ANet should unban all of these people, or I will have lost respect for all they have done (not like I haven't already... since the game is getting boring as it is)

Servant of Kali

Servant of Kali

Jungle Guide

Join Date: Jan 2006

Me/

I feel glad that greed is punished at last and virtue reigns supreme.

Quote:
Originally Posted by Rexion
or I will have lost respect for all they have done (not like I haven't already
So what's your point exactly? You have no case.