Recent Roblox Security Incident

Updates Announcements
#22

Internal members of the forums should see this thread as it has some nice information on who is affected and so fourth.

1 Like
#23

Thanks, Iā€™ll ensure that Captivator hasnā€™t been compromised. I always edit my games on a local file on my computer so I can just upload the most recent file to wipe any potential changes the third party could have made.

1 Like
#24

Thanks for the update. I somehow dodged the bullet. no update changes for Flee the Facility on 9/7 or 9/8.

#25

When I got this email I thought it was a scam due to the pure obscurity of this alert (What exactly happened? What kind of edits couldā€™ve been made specifically?) and that it has been delivered from a domain that is not roblox.com.

Anyways, does this mean that the places couldā€™ve been stolen in the process?
If we donā€™t manage to find any edits in literally piles of source code, are we going to get further detailed information of which versions were uploaded by unfamiliar IPs, or is that completely on us from this point?

I have game features that grant items worth thousands of Robux every few weeks (pretty rare) and that code was written to be solid steel. If thereā€™s a malicious code somewhere in there I wouldnā€™t know until itā€™s a bit too late. There are other places in the crafting system where merely changing one number would literally grant you items and not take crafting materials allowing you to ā€œduplicateā€ items indefinetly.

Understanding the nature of this exploit would allow figuring out the key areas of altered game source. Could they edit anything, or just add new instances / scripts to the game?

Noticed that this thread explains a bit about the exploit:
https://devforum.roblox.com/t/additional-carry-on-from-recent-roblox-security-incident/53288

7 Likes
#26

No dates have shown up but my game was stolen recently but the person uploaded it on 8/31/2017. Best guess it was an third party exploit not the servers.

#27

Got a email over one of my places, but it was alright since nothing was modified on those dates.

1 Like
#28

FYI, any diff tool can be used to spot the differences between two XML-format place files. I can vouch for Diffy.

3 Likes
#29

Phew, so glad I havenā€™t programmed anything in 2 monthsā€¦ however.

@LeitrisArcade and @ConfidentCoding might want to hear this.

3 Likes
#30

Glad that this has been caught.

@pauljkl and @ikiled might want to check NUSA games.

1 Like
#31

From what I can tell, my games werenā€™t affected. Ultimate Boxing had an update after the date of this, and I completely override the online version.

#32

As TheNexusAvenger mentioned it was added to try and stop people from stealing assets the best way I could. It doesnā€™t have a setting for it, sorry. The extension can be disabled from the chrome://extensions page and that will stop it from blocking the request.

2 Likes
#33

Already has been checked, Thanks Jason.

(And welcome to the devforums)

#34

Nothing to seems to have changed on my end of any places that I have currently opened. Thanks for the warning. :grinning:

#35

Thanks!

#36

What kind of changes have been made? Iā€™m a little confused as to why people would exploit a Roblox server vulnerability to change a few lines in peoplesā€™ games?

2 Likes
#37

I imagine they changed the server permissions. Also, the guy who discovered the issue wasnā€™t interested in stealing anything.

#38

This topic was automatically closed 120 days after the last reply. New replies are no longer allowed.