Security

Apex Legends hacker says game developers patched exploit used on streamers

Comment

Concept art for the video game Apex Legends.
Image Credits: Respawn/Electronic Arts

Last month, a hacker wreaked havoc during an esports tournament of the popular shooter game Apex Legends, hacking two well-known streamers mid-game to make it look like they were using cheats.

A month later, it seems like the hacking saga may have come to a close with the game developers patching the bug exploited by the hacker.

Because of the hack, the organizers had to suspend the tournament on March 17. Two days later, Apex Legends developer Respawn said on its official X account that it had “deployed the first of a layered series of updates to protect the Apex Legends player community.” Then a week later, the company wrote that it had “added another update that is intended to further protect our players and ensure the competitive integrity of Apex Legends.”

Respawn’s posts don’t clearly say that the updates patched the bugs exploited during the tournament. But the hacker behind the cheating scandal told TechCrunch this week that Respawn’s patches fixed the vulnerability that he had exploited to hack the two streamers.

“The exploit I’ve used in [Apex Legends Global Series] is fully patched,” the hacker, who goes by Destroyer2009, said in an online chat.

Destroyer2009, who previously told TechCrunch that he had hacked the two streamers “for fun,” said he didn’t want to reveal any technical details of the bug he exploited, even if it is now patched.

“No one likes when severe vulnerabilities in your product are exposed publicly. I asked my friend and we both agreed that we don’t really want to publicly expose what happened from a technical perspective yet,” the hacker said, referring to a friend he worked with to develop the hack.

Contact Us

Do you know more about this hack? Or other video game hacking incidents? From a non-work device, you can contact Lorenzo Franceschi-Bicchierai securely on Signal at +1 917 257 1382, or via Telegram, Keybase and Wire @lorenzofb, or email. You also can contact TechCrunch via SecureDrop.

Referring to an unrelated botched in-game update by Respawn this week, Destroyer2009 said: “[I] don’t think embarrassing them even more is fair.”

Destroyer2009 said he tested his exploit after Respawn’s announcement of the second update on March 26, although he said it’s possible it was patched sooner because he didn’t have a chance to test it before.

Destroyer2009’s hacks were high-profile, disruptive and caused a big stir in the Apex Legends community. The two streamers targeted, ImperialHal and Genburten, collectively have 2.5 million followers on the game-streaming platform Twitch, and several other Apex Legends players and streamers commented on the news of the hacks on their channels.

Yet, Respawn isn’t being forthcoming about the patches it released. TechCrunch asked Respawn and Electronic Arts, the owners of the development studio, to confirm whether the exploit used by Destroyer2009 is indeed patched, and if so, when it was patched.

But neither Respawn nor Electronic Arts responded to TechCrunch’s multiple requests for comment. The two companies did not respond to requests for comment in the last few weeks either.

Meanwhile, Destroyer2009 said he won’t do any more public hacks for now, because “anything more severe than the [Apex tournament hack] accident will be already considered as a real hacking with all the consequences so [probably] will just play the game until it gets boring as usual.”

More TechCrunch

HealthEquity said in an 8-K filing with the SEC that it detected “anomalous behavior by a personal use device belonging to a business partner.”

HealthEquity says data breach is an ‘isolated incident’

Roll20 said that on June 29 it had detected that a “bad actor” gained access to an account on the company’s administrative website for one hour.

Roll20, an online tabletop role-playing game platform, discloses data breach

Fisker has a willing buyer for its remaining inventory of all-electric Ocean SUVs, and has asked the Delaware Bankruptcy Court judge overseeing its Chapter 11 case to approve the sale.…

Fisker asks bankruptcy court to sell its EVs at average of $14,000 each

Teddy Solomon just moved to a new house in Palo Alto, so he turned to the Stanford community on Fizz to furnish his room. “Every time I show up to…

Fizz, the anonymous Gen Z social app, adds a marketplace for college students

With increasing competition for what is, essentially, still a small number of hard tech and deep tech deals, Sidney Scott realized it would be a challenge for smaller funds like…

Why deep tech VC Driving Forces is shutting down

A guide to turn off reactions on your iPhone and Mac so you don’t get surprised by effects during work video calls.

How to turn off those silly video call reactions on iPhone and Mac

Amazon has decided to discontinue its Astro for Business device, a security robot for small- and medium-sized businesses, just seven months after launch.  In an email sent to customers and…

Amazon retires its Astro for Business security robot after only 7 months

Hiya, folks, and welcome to TechCrunch’s regular AI newsletter. This week in AI, the U.S. Supreme Court struck down “Chevron deference,” a 40-year-old ruling on federal agencies’ power that required…

This Week in AI: With Chevron’s demise, AI regulation seems dead in the water

Noplace had already gone viral ahead of its public launch because of its feature that allows users to express themselves by customizing the colors of their profile.

noplace, a mashup of Twitter and Myspace for Gen Z, hits No. 1 on the App Store

Cloudflare analyzed AI bot and crawler traffic to fine-tune automatic bot detection models.

Cloudflare launches a tool to combat AI bots

Twilio says “threat actors were able to identify” phone numbers of people who use the two-factor app Authy.

Twilio says hackers identified cell phone numbers of two-factor app Authy users

The news brings closure to more than two years of volleying back and forth between some of the biggest names in additive manufacturing.

Nano Dimension is buying Desktop Metal

Planning to attend TechCrunch Disrupt 2024 with your team? Maximize your team-building time and your company’s impact across the entire conference when you bring your team. Groups of 4 to…

Groups save big at TechCrunch Disrupt 2024

As more music streaming apps and creation tools emerge to compete for users’ attention, social music-sharing app Popster is getting two new features to grow its user base: an AI…

Music video-sharing app Popster uses generative AI and lets artists remix videos

Meta’s Threads now has more than 175 million monthly active users, Mark Zuckerberg announced on Wednesday. The announcement comes two days away from Threads’ first anniversary. Zuckerberg revealed back in…

Threads nears its one-year anniversary with more than 175M monthly active users

Cartken and its diminutive sidewalk delivery robots first rolled into the world with a narrow charter: carrying everything from burritos and bento boxes to pizza and pad thai that last…

From burritos to biotech: How robotics startup Cartken found its AV niche

Ashwin Nandakumar and Ashwin Jainarayanan were working on their doctorates at adjacent departments in Oxford, but they didn’t know each other. Nandakumar, who was studying oncology, one day stumbled across…

Granza Bio grabs $7M seed from Felicis and YC to advance delivery of cancer treatments

LG has acquired an 80% stake in Athom, a Dutch smart home company and maker of the Homey smart home hub. According to LG’s announcement, it will purchase the remaining…

LG acquires smart home platform Athom to bring third-party connectivity to its ThinQ ecosytem

CoinDCX, India’s leading cryptocurrency exchange, is expanding internationally through the acquisition of BitOasis, a digital asset platform in the Middle East and North Africa, the companies said Wednesday. The Bengaluru-based…

CoinDCX acquires BitOasis in international expansion push

Collaborative document features are being made available inside Proton Drive, further extending the company’s trademark pitch of robust security.

In a major update, Proton adds privacy-safe document collaboration to Drive, its freemium E2EE cloud storage service

Telegram launched a digital currency called Stars for in-app use last month. Now, the company is expanding its use cases to paid content. The chat app is also allowing channels…

Telegram lets creators share paid content to channels

For the past couple of years, innovation has been accelerating in new materials development. And a new French startup called Altrove plans to play a role in this innovation cycle.…

Altrove uses AI models and lab automation to create new materials

The Indian social media platform Koo, which positioned itself as a competitor to Elon Musk’s X, is ceasing operations after its last-resort acquisition talks with Dailyhunt collapsed. Despite securing over…

Indian social network Koo is shutting down as buyout talks collapse

Apiday leverages AI to save time for its customers. But like legacy consultants, it also offers human expertise.

Europe is still serious about ESG, and Apiday is helping companies comply

Google totally dodges the question of how much energy is AI is using — perhaps because the answer is “way more than we’d care to say.”

Google’s environmental report pointedly avoids AI’s actual energy cost

SpaceX’s ambitious plans to launch its Starship mega-rocket up to 44 times per year from NASA’s Kennedy Space Center are causing a stir among some of its competitors. Late last…

SpaceX wants to launch up to 120 times a year from Florida — and competitors aren’t happy about it

The situation around a data breach that’s affected an ever-growing number of fintech companies has gotten even weirder. Evolve Bank & Trust announced last week that it was hacked and…

Newsletter writer covering Evolve Bank’s data breach says the bank sent him a cease and desist letter

The new bylines go beyond the typical @username references that often accompany link posts from news publications and those pointing to other written content, like a WordPress blog or Substack

Twitter/X alternative Mastodon appeals to journalists with new ‘byline’ feature

code references found in the X iOS app indicate that the company could be considering adding downvotes for replies only to improve how they’re ranked.

X weighs adding a downvote button to replies — but it doesn’t want to emulate Reddit

Evolve, a popular financial institution for fintech startups, announced that a cyberattack affected “the data and personal information of some Evolve retail bank customers and financial technology partners’ customers.” 

Yieldstreet says some of its customers were affected by the Evolve Bank data breach
  翻译: