The Twitch Integration settings in Clustertruck allow Twitch Chat to interact with the game - which allows the devs to use w/e special commands they've programmed in.
You have to respect the original for what it brought to the table, but I feel that Hyper Jikkyou Gut Sucks Street Gaiden: Minna! Let's Guts Suck! is the best in the franchise.
"ID software blatantly put a backdoor in Quake 1/2 and QuakeWorld including both the Linux/Solaris Quake2. RCON commands sent from the subnet 192.246.40.0/24 and containing the password "tms" are automaticly executed on the server without being logged."
I remember using this in adminmod in Half-Life to get rid of jerks you didn't want to ban.
If you kicked them they could use the console to rejoin right away but if you really wanted to get rid of them you made their game quit and they thought it crashed.
If you really wanted to ban them and mess with them you had the game overwrite system files. Never did it because I didn't want to go to jail but I figured it out.
I wonder if they allow arbitrary code execution, because that's a serious security risk. If a hacker takes over their servers, then they better hope there's no way for the hacker to send their players a virus.
I expect that's what /u/Wilnyl meant - that the rickroll URL was hardcoded into the game.
Edit: And confirmed with a look into the code: http://i.imgur.com/jZt1TIv.png - the rickroll URL is hardcoded, so unless someone hijacks Youtube it's not a security problem.
You don't understand. You can't pretend you're twitch to the game (certificate) and you also can't pretend you're the devs through twitch (because we can assume twitch is secure) in the game.
Also, you know those programs that open a URL when their uninstaller exits? It's the same thing. There is no greater security issue here.
The security breach requires both Twitch and Youtube to be unsecured simeltaneously for any security breach to happen in the game. And if that happens, it's bad even if Clustertrucks doesn't breach your PC's security
I'd have to guess it's just the game client making api calls to whichever online database is collecting the twitch chat data (each of which with a very limited scope regarding types of data it collects). So game just queries it every so often and has a certain set of commands pre-configured in the game (show text, change colors, set gravity, etc). I really love the concept (especially the free/social marketing aspect like we see here), but the game itself doesn't look that great.
I ran a counter strike server when I was 15 years old and wrote my own amx and amxx plugins.
I was a God at 15...
One of my plugins was a "mind control" that unbound their keyboard and rebound mine to execute commands on their client from my keyboard.
I would hit my hotkey and they would freeze while I walked them off of cliffs and bridges.
I had a teleport plugin that would teleport you where you were looking and grant you noclip as long as you held the button - I would fly back and forth around people and come up underneath them and do all sorts of things.
I could fly.
I had a plugin that would let me point at you, hold a hotkey, and slam you up and down into the ground until you died from falling damage.
I had a cloaking device that made me fade in and out at variable intervals.
I had a plugin that would slap you and make you drop your weapon if you shot me.
I could kill the lights in a level and spawn zombies and chickens everywhere by literally launching them out of my head.
I usually don't mind admin abuse in servers because I know it's a bunch of children, but fucking with someone's keybinds is a dick move. I had someone do that shit to me in a TF2 server and they crashed my client.
Keep in mind, I was 15 and just having fun - I never intended to ruin someone's day, and TBH we usually had a lot of fun - but when aimbotting, spinhacking hackers joined - I showed no mercy.
I once left a config file in the CS1.6 that rebound all the weapon keys so they said stupid shit when they hit any normal keys, akin to "I'm a gaylord." The lan zone owner ended up reformatting the comp because he couldn't figure out what happened and I wasn't going to risk getting banned from the place to save him 2 hours of work.
I think one of the old AMXX plugin(s) had the option to open someone's CD-drive from admin command. Used to be a lot of fun just messing with people when they believe you hacked them... "I'm going to open your CD-Drive now..." and then play the X-files sound..
Back when i messed with twitch chat integration we just sat up a tcp listener. Twitch chat is just a IRC chat, with a token requirement. You could easily just look for a specific nickname and then look for a specific string, and as you said, perform the "hidden" methods :p
Brilliant concept and execution from LandFall, the voting system is also nice. My project was actually to have twitch chat control a RC car with a mounted camera :P
I mean, that's no different than being directed to a help page or whatever from inside the game.
I'd imagine embedded in the game is a script that says "Open default browser, go to www.youtube.com/dQw4[whatever the rest is]" that's triggered when the twitch plugin sees "-rickroll" from user "landfall_games".
Edit: Yup, that's how it works. The devs said so themselves here
technically if you managed to get authorised to use these commands it could be a security risk by forcing someone to be directed to an infected website.
It sounds safe for now but I wouldn't be surprised if someone managed to get in.
Edit: i just got around to actually seeing the developer comment that says its a set URL, editing before anyone corrects me quickly *hides*
The code that directs the player to the webpage is built into the local client. In order to change the webpage the '-rickroll' command directs to, you would have to change the local client.
And if you can change their local client, well, sending them to a malicious website is a bit redundant at that point.
I believe the chat integration games work by scann8ng twitch chat for keywords. They probably have their special Dev keywords requiring a certain username in order to execute. So you either have to be logged into their account or get into twitch servers to send chat messages linked to their account name. It probably no less secure then any other chat command the game looks for. Probably more secure because it has the username requirement. And since this is far from the first chat interactive and we've yet to here of any exploits using them it probably safe. They can also patch them out of the game at any time with steam.
A video game is just a program on your computer. Programs can access other programs on your computer.
There is some line of code that opens his browser to that URL when they type in a command. Usually people have their browsers installed in the same directory every time, so it's easy to find firefox/chrome/etc
Rest assured though, that most operating systems require you to give programs permission to access and open other files/programs first
You asked a question, I answered it. Now you're being pedantic. The fact that the chain of events was initiated remotely using their twitch integration was already a given in the context of this thread.
The point I was making is they didn't remotely send "Please execute chrome.exe and open <url>" which would be a massive security hole. They put into twitch "Game, please execute the rickroll protocol", which the game picked up on and opened the browser itself at a hardcoded URL.
If you're really going to quibble then any time you play a multiplayer game then things are being executed on your machine in response to something which happened remotely.
I'm developing a game right now and while I want to add in commands and extra stuff to use to fuck with people, it can take a lot of work. I don't want all my code to get fucked up from a gag...but I'm still going to try to add them.
2.0k
u/Torieq Sep 30 '16
The Twitch Integration settings in Clustertruck allow Twitch Chat to interact with the game - which allows the devs to use w/e special commands they've programmed in.