PVE Tek Storage Exploit - Element dust stolen

[Oieru]

As you probably are aware, there is a tek storage exploit that enables anyone to access your deposits. We got robbed a first time, together with other tribes on PVE Extinction493 and lost all our dust, over 250k of it. So we moved the tek storage INSIDE our tek house. So today I realized EVERYTHING is gone again. Another 200k dust lost. Two options: meshing or exploiting rendering issues and accessing the storage box through that. It is really disappointing, hours of farming lost and in vain, for the second time.

Just a heads up that  your stuff is not safe inside your base when stored in tek storage boxes. Until the exploit is fixed, I would recommend to not store anything essential inside the tek boxes, especially element dust.

[PreshusRoze]

Pincode them to keep non-tribe from being able to access them.

Tribe Rank will NOT keep tribe members of lower rank from withdrawing either.

Tested this out this past weekend.

Only safe place is in a room behind an Admin Only locked door.

[Oli4]

You must pincode them, other people can still withdraw/deposit 1 stack at a time

[Eglund]

Has the Dev team posted anything on this issue?  This has been happening since their release. Odd we have not had a fix yet.

 

[Oieru]

Q&A is aware of the situation and are working on it. But other than that, no news.

[Oieru]

On 4/30/2019 at 2:56 PM, Oli4 said:

You must pincode them, other people can still withdraw/deposit 1 stack at a time

The problem is, the storage box was INSIDE our base. Tek walls and doors, no access from outside for non-tribe members. I know my 3 tribemates very well, so it was not a problem of them taking the dust (we use the resources collectively anyways). They somehow got inside and outside the room, with everything locked.

[d1nk]

Sorry for your loss man. This has been brought up a few times im honestly suprised a big glitch like this still exists.. they're usually pretty good at fixing these types

[MichaelRichards]

I thought this was fixed? I remember having to pin code when tek storage first came out, is it still bad, is this still a widespread issue? 

[Oieru]

On 4/30/2019 at 2:56 PM, Oli4 said:

You must pincode them, other people can still withdraw/deposit 1 stack at a time

Forgot to mention this. The box was PIN locked! Still useless. I know they can access the radial menu anyways.

[Oli4]

3 minutes ago, Oieru said:

Forgot to mention this. The box was PIN locked! Still useless. I know they can access the radial menu anyways.

If its pincoded they can't access the radial menu. Perhaps they guessed the pincode?

[Lycan187u]

All pincodes are false reality  of security. ..ppl can access pincodes many ways wc just needs fix to prevent non tribe access

[d1nk]

3 hours ago, Lycan187u said:

All pincodes are false reality  of security. ..ppl can access pincodes many ways wc just needs fix to prevent non tribe access

While I do agree with tribe-only access for Tek Dedi I like having boxes allies can access for other things (vaults etc)

Maybe they can make the boxes scan your implant? Box placer can scan implants in an area (like how tek turret does for the creature lists) 

[Lycan187u]

very true I didn't think of the allied tribes access very true with that mod I want to know where the parasaur mesh defence mod went haha was like a weapon really would detect enemiess in the mesh insta ko them an take the bag was genius like a sonic weapon that koed meshers rofl

 

[caleb68]

On ‎5‎/‎1‎/‎2019 at 11:44 AM, Oieru said:

The problem is, the storage box was INSIDE our base. Tek walls and doors, no access from outside for non-tribe members. I know my 3 tribemates very well, so it was not a problem of them taking the dust (we use the resources collectively anyways). They somehow got inside and outside the room, with everything locked.

open windows? people can get in through them with climbing picks

[Cedric]

8 hours ago, Oieru said:

Forgot to mention this. The box was PIN locked! Still useless. I know they can access the radial menu anyways.

Somebody was able to empty your pin coded storage?  There's still an open bug on the locking feature for PVE.

[invincibleqc]

2 hours ago, Cedric said:

Somebody was able to empty your pin coded storage?  There's still an open bug on the locking feature for PVE.

Pin-codes are generally not secure as there have been automated macros to crack them being shared around for ages. There is only 9999 possible combinations, and even with the ~1 minute CD between failed attempts that was implemented, people are still patient enough to run them. If a large tribe see a tek storage that contains hundreds thousands dust, you can be sure that they will come 4-5 players each running different range and crack it in no time. Once they found the pin of this storage, they will use it on other storages around as people usually use the same pin for everything. There is really a need for more secure ways to prevent pin-codes from being cracked. Having the ability to set passwords instead could potentially be the best way. Most people use pin-codes because unlocking structures by accident is way too easy. As soon as there is some sort of obstruction, the option becomes [Unlock] instead of [Access Inventory]. As I posted into a similar thread a few months ago:

On 1/25/2019 at 4:08 PM, invincibleqc said:

To be honest, I don't necessarily think there is an exploit allowing players to access locked vaults. Vaults are known to be accidentally unlocked easily. Especially when people are used to use "E" instead of "F" to access them because as soon as there is some obstruction, the option will be "Unlock" instead of "Access Inventory". For example:

And a few pixels away:

This used to be way more frequent before they fixes the usage of the station in front of a player dismounting a creature but this is still very common. So yeah, while an exploit of some sort might be a possibility, unless there is an actual report of the method used I would rather tend to believe people accidentally unlocked them.

I think it would be great if the unlock option was requiring to hold for a second or two like it is for the demolish one.

EDIT: 

I just tested to pin-code a storage and leave the tribe in singleplayer and turns out the CD is actually shorter than I thought. I thought it was ~1 minute, but it seems to be ~20 seconds. Which means that a solo player attempting to crack a pin-code would need ~56 hours at most. If they are 5 players, they would crack a pin-code in ~12 hours. Of course, this is the maximum time they would need. For example, if you have a storage pin-coded with 6532, and there is 5 players testing all the combinations from 0000, 2000, 4000, 6000 and 8000, the fourth player would crack your code in 532 attempts which actually means under 3 hours. I knew it was easy, but not that bad. There is definitely a need to make that mechanism more secure. Here is some ideas:

• Remove the temptation by hiding the resource type and amount displayed on the TEK Storage from non-tribe players. If they don't know what is in, they won't be tempted to camp it.
• Make it so that as soon as someone issue the wrong code, nobody can attempt to issue a code for a good minute on that specific storage. That way they cannot go in gang to crack codes in less time.
• Make it so that if the same player fail to enter the right code multiple times on the same day, they are restricted from accessing that specific storage for 24 hours even with the right code. That way you make it so that brute-forcing a code would take them months if not years.
• As previously mentioned, make it so that players can use alphabetical-numerical passwords instead of 4 digits pin-codes.
• Remove the need for pin-code in most cases by adding a per-storage "unlocked for alliances" option.

[arkark]

5 minutes ago, invincibleqc said:

Pin-codes are generally not secure as there have been automated macros to crack them being shared around for ages. There is only 9999 possible combinations, and even with the ~1 minute CD between failed attempts that was implemented, people are still patient enough to run them. If a large tribe see a tek storage that contains hundreds thousands dust, you can be sure that they will come 4-5 players each running different range and crack it in no time. Once they found the pin of this storage, they will use it on other storages around as people usually use the same pin for everything. There is really a need for more secure ways to prevent pin-codes from being cracked. Having the ability to set passwords instead could potentially be the best way. Most people use pin-codes because unlocking structures by accident is way too easy. As soon as there is some sort of obstruction, the option becomes [Unlock] instead of [Access Inventory]. As I posted into a similar thread a few months ago

I'm convinced it is more than that, some ppl found a way to circunvent that protections. Like 1 month ago one guy I trust in my island server told me a [][][] tribe was using his locked teleport even when it is powered off. And days after, he left a giga in the teleport, and that giga dissapeared and was found later in another tp.

[d1nk]

1 hour ago, Cedric said:

Somebody was able to empty your pin coded storage?  There's still an open bug on the locking feature for PVE.

 

20 minutes ago, invincibleqc said:

Pin-codes are generally not secure as there have been automated macros to crack them being shared around for ages. There is only 9999 possible combinations, and even with the ~1 minute CD between failed attempts that was implemented, people are still patient enough to run them. If a large tribe see a tek storage that contains hundreds thousands dust, you can be sure that they will come 4-5 players each running different range and crack it in no time. Once they found the pin of this storage, they will use it on other storages around as people usually use the same pin for everything. There is really a need for more secure ways to prevent pin-codes from being cracked. Having the ability to set passwords instead could potentially be the best way. Most people use pin-codes because unlocking structures by accident is way too easy. As soon as there is some sort of obstruction, the option becomes [Unlock] instead of [Access Inventory]. As I posted into a similar thread a few months ago:

I think it would be great if the unlock option was requiring to hold for a second or two like it is for the demolish one.

This is a very good idea. 

[Oieru]

23 hours ago, caleb68 said:

open windows? people can get in through them with climbing picks

There is not even the smallest crack in the walls. But you can get inside bases with rendering issues (like during a server lag + wyvern flying or a high speed mana dive) or through meshing. Not sure how they got out, but this is the most plausible thing.

[Jemcrystal]

Don't get mad at me just throwing out an idea.  Could you park a pet in front of chests and it's body keep people from being able to get close enough to the hit box to allow for the pin wheel?

[invincibleqc]

10 hours ago, Oieru said:

There is not even the smallest crack in the walls. But you can get inside bases with rendering issues (like during a server lag + wyvern flying or a high speed mana dive) or through meshing. Not sure how they got out, but this is the most plausible thing.

Was your door pin-coded?

10 hours ago, Oieru said:

like during a server lag + wyvern flying or a high speed mana dive

That mainly happens with specifics structures. Especially the ones that were released early development and never polished. Stone Behemoth gates are a good example. Most of their settings are wrong and incorrectly scaled from the dino gateway. From the placement particle effect:

To the snap points (although hard to demonstrate in a screenshot, you can see it is snapping from the size of a small gateway):

And since you can stack unlimited amount of gateway at the same location, as you can see in the following screenshot I placed 63 without moving:

It is safe to assume they are also using the wrong collision size for some aspects of the game. I used to have a large stone base with behemoth gates as walls and we were constantly having wild creatures inside (especially raptors). Once we upgraded to metal ones, we no longer had any issue. Either way, there is also a gap on the right side of the gate because the snap point is not properly centered. This is the right side:

This is the left:

Turrets are also constantly shooting through these cracks, and when a structure is not loaded in, the AI engine along with the client prediction seems to only make minimal detection and if you can move forward in a straight line, you go through no issue. I used to aim for that crack with a wyvern while waiting for the base to render and quite often I was passing through without having to open the gate. For basically the same reason that if you trap a wild creature using pillars and re-render, it will clip out because the minimal ray-tracing detected that it was able to move in a straight line. Some of the regular doors also have that gap and you can easily pass through while rendering especially if you are sprinting with the tek pants. Metal door:

Stone door:

Giant hatchframes are also known to let stuff pass through, even with the trap. If you build a roof using them mixed with ceilings and try to walk on them with a large creature, you will see there is gaps where you seem to fall or walk on uneven terrain where the frames are snapped to the ceilings just like if the collision was slightly off. I know for a fact that I've had to free players from the last floor of my base multiple times because they passed through them. Or you could simply try to land on them with a wyvern and you will see it will attempts to land underneath.

10 hours ago, Oieru said:

Not sure how they got out, but this is the most plausible thing.

If they were more than one player, then this is also possible the one inside simply dropped bags near a wall and another player outside used a whip to collect the bags. Whips are ignoring structures, and players have been using them to steal incubating fertilized eggs that are close to walls and that, since they have been released with SE years ago.

EDIT: This is also possible they simply used cryopods. I've just tested and you can throw pods through the cracks I mentioned above to get dinos on the other side and ride them:

6 hours ago, Jemcrystal said:

Don't get mad at me just throwing out an idea.  Could you park a pet in front of chests and it's body keep people from being able to get close enough to the hit box to allow for the pin wheel?

Yes, if there is creatures covering them then they will be inaccessible.

On 5/2/2019 at 10:58 PM, arkark said:

I'm convinced it is more than that, some ppl found a way to circunvent that protections. Like 1 month ago one guy I trust in my island server told me a [][][] tribe was using his locked teleport even when it is powered off. And days after, he left a giga in the teleport, and that giga dissapeared and was found later in another tp.

The teleporters are a completely different mechanism though, as they are not even using pin-codes.

[Oieru]

The base is with Tek Structures, so Tek Walls, Ceilings, Foundations and Tek Doors. I don't see any cracks in them, but your post with cracks in different structures is enlightening. I will post a screenshot with the location of the box and the house it was inside later. The doors are not pin locked (they are locked), only the tek storage box had a PIN.

To be honest, I started stacking dust in a vault until the exploit is fixed. Can't trust the tek storage anymore.

LE: Here are some pics of the base and the location of the storage box.

 

 

 

[Oli4]

30 minutes ago, Oieru said:

The base is with Tek Structures, so Tek Walls, Ceilings, Foundations and Tek Doors. I don't see any cracks in them, but your post with cracks in different structures is enlightening. I will post a screenshot with the location of the box and the house it was inside later. The doors are not pin locked (they are locked), only the tek storage box had a PIN.

To be honest, I started stacking dust in a vault until the exploit is fixed. Can't trust the tek storage anymore.

There are ways to glitch into bases, even fully made tek ones Vaults seem safest option so far for more important goods

[invincibleqc]

11 hours ago, Oieru said:

The base is with Tek Structures, so Tek Walls, Ceilings, Foundations and Tek Doors. I don't see any cracks in them, but your post with cracks in different structures is enlightening. I will post a screenshot with the location of the box and the house it was inside later. The doors are not pin locked (they are locked), only the tek storage box had a PIN.

To be honest, I started stacking dust in a vault until the exploit is fixed. Can't trust the tek storage anymore.

Do you have an unlocked/pin-coded with the same pin transmitter in the same building? That might be another way out.

[Oieru]

14 hours ago, invincibleqc said:

Do you have an unlocked/pin-coded with the same pin transmitter in the same building? That might be another way out.

No, there is no other way out other than through the doors. Transmitter is outside and also locked.