Skip to content
TORNLIFE More

item duplication exploits

Started by Madz [2035318] on in General Discussion.

45 replies · 1.24k views · thread synced · 7 days ago · View on torn.com
About this thread

Posts archived: 46 / 46 posts (100%) · the total is Torn's reply count + the opening post at the last fetch

Counted by TornLife from the archived posts.

Archived posts
46
Discussion span
→
Authority score
61 / 100
Historical score
38 / 100
Story score
61 / 100
Engagement score
79 / 100

People posting, likes and official posts are not counted for this thread yet: on threads longer than one page they come from a periodic pass over the archive, which has not covered it.

Most-liked replies

Mentioned in this thread

Bacurau [2245633] ×1

Madz [2035318]

Patch list #440

Fixed item duplication exploit involving travel inventory and display cases - confirmed not abused by anyone 💰

 

there are a couple games out there that even years after still has a market affected by item duplicate exploits, 2 known examples are the old versions of Diablo 2 LoD and Runescape 

 

reading the latest patch made me wonder, has there been any item duplication exploits in torn's history?

or maybe another similar bug exploit

 

YouTube video UqUcwM66Y8o

credit

 

Mentions: Bug bounty program · item duplication exploits · Patch list #440 : Attack logs 2.0, New level 8 chain scenario, Travel arrival log, 6 new item models

Avery [2765920]

I wasn't around for it so can't speak to the extent, but long term effects seem mostly limited.

 

Kapten_Klitoris perma fedded

 

My understanding of how Torn handles punishments for bug abuse (whether intentional or not) and action logging would lead me to believe that, even in extreme cases, there would be "minimal" effects felt. They're pretty proactive with removing illicit gains, from the looks of the linked thread including from those that accidentally stumbled into the bug without knowing what happened.

Mentions: Kapten_Klitoris perma fedded

Mactastys [1694752]

Imagine adding a completely shit update like flying 2.0 l. Then nearly breaking the game XD.

 

 

Edit: I don't trust that nobody abused it. I don't trust the staff are even capable of checking 

 

bogie [148747] Admin Staff

reading the latest patch made me wonder, has there been any item duplication exploits in torn's history? or maybe another similar big exploit

 

 

Yes, the one you just listed? 

 

 

We've had a few major exploits come up over the years, the famous one above from KK that was abused extensively is one such example.

 

It's why we have our generous bug bounty system, we've awarded over $100,000 USD to players and security researchers for their findings here if you are interested in what else has been reported and found:

https://www.torn.com/forums.php#/p=threads&f=1&t=16141356&b=0&a=0&to=20012605 

 

 

 

Our tracking for such things is significantly better than it was years ago. We've had a few times where players have attempted to duplicate something only to be caught and banned almost immediately, when they could have made a few thousand USD...

Mentions: Bug bounty program

Madz [2035318]

if you have time to share a story more in-depth i would greatly appricate it, anything that stands out, small or big

bogie [148747] Admin Staff

There's not really any exciting tales to tell unfortunately, although admittedly it may just be me that finds it less exciting as I can peer behind the curtain. 

 

Some that stand out being... 

 

The time a player found a way to generate infinite money in poker by depositing negative cash, the system just automatically jailed him, they never reported it as a bug and just made multis to try and exploit it - which also got auto jailed.

 

We quickly patched that embarrassing bug and confirmed there was no further abuse. 

 

KK/Reformer's bug obviously a notable example, they found you could duplicate donator packs by depositing them into your bazaar/display case twice, since they were listed under supply packs and special items, if you listed from both areas simultaneously it duped them. This went on unnoticed for years with much of that being before I was even an admin. It was quite a mess to untangle and correct the cash involved there as much had entered the economy.

 

One bit of drama that came from that was the fact that they dropped a dirty bomb using illegal cash, I was in the hospital at the time for the birth of my first child so I was understandably not available at work, but once back had to work on reversing and resolving that - some more reading on that all here: https://www.torn.com/forums.php#/p=threads&f=1&t=16082307&b=0&a=0 

 

That all came about after I had only been on the job for a month so that was a fun time. 

 

Whilst disappointing as we expect QA to catch most things it's overall not unusual for exploits on newer systems to be discovered, as that's when they're going to be most vulnerable. Even with all the QA in the world its possible for some things to slip through when releasing a new update, which is why we are glad to have the bug bounty program and are as generous as we are with it, because the alternative in our view is less preferable for both our sake and the players'. 

Mentions: Bug abuse and consequences

Mactastys [1694752]

I get stuff slips through but duplicating items..... Lol 

 

Glad this one didn't get abused like the company issue which happened recently

bogie [148747] Admin Staff

I mean, it's not like we add a means to intentionally dupe items. With a game like Torn where there are so many systems old and new sometimes a niche and unintended interaction might happen to come up that causes the possibility. 

 

In the case of the travel situation it required some specific requests whilst travelling after buying items and using specific requests for items into the display case.

Regeneration [1757073]

Quick question though: if I did become interested in the Bug Bounty Hunter Program, how would I know if the exploit exists without testing it? I get that “testing” needs to be unequivocally understood as such, and not have even the semblance of “trying to abuse”, but it sounds like the system recognizes certain instances of duplication and immediately bans the player.

bogie [148747] Admin Staff

We accept there would be limited testing. Safe disclosure and terms are listed here: https://www.torn.com/forums.php#/p=threads&f=1&t=16141356&b=0&a=0&to=20012605 

 

Assuming you are disclosing what you would find if you do indeed come across an exploit then it would be rewarded.

 

At the end of the day there's a fairly clear difference between testing and verifying and outright abuse following non disclosure.

Mentions: Bug bounty program

Mactastys [1694752]

So they essentially forgot about the display case?  

 

I play the game a lot and use this regularly when my inventory is full.

 

Madz [2035318]

bugs/exploit wise, i think you guys are doing a phenomenal job - 2 thumbs up 👍👍

 

specially if you compare to the games like Diablo 2 / Runescape who never really recovered from their exploits

thanks for sharing aswell, very interesting read

Marijuana [2400689]

OSRS has never had a full reset. They have rolled the game back a few times but not very far only a day or few hours.

 

cestlatimmy [2107631]

I'm sure I've seen the necklace issue reported more recently than that. I think that's one of the most widespread and widely reported bugs that's not been fixed yet. 

 

I assume that's probably because the fix is the inventory rebuild...