Exploit found which can lead cheating

Dave, you know what, if I had known it was going to blow that way I would have posted after the worlds… Now I could not anticipate that Zwift was going to shoot themselves in their own foot like this and make it blow… in reality the thing really blew up after the ban.

1 Like

Not really much to add that hasn’t already been put above just so disappointed ZHQ can’t see the harm they are doing to the community with their lack of response.

How many more influential people from the community do we have to see quit before ZHQ realise they have shot them selves in both feet.

Should be fun when the next post about their inaction on blatant cheating gets puts up. Ps must check if that team is riding in the worlds today.

Silence is only making things worse, is their no PR department at zwift???

2 Likes

Would this be the thing/arguement that kicked off in the premier league a few weeks back?

I saw a few teams call out a specific team but nothing was done and it all died down a bit?

Cats out the bag. DC Rainmaker has reported on it now. That’s a lot of eyes on the subject now.

8 Likes

I’ve pulled up my best Windows Paint tricks for that! :rofl:

16 Likes

If you interested, Ray’s article about it Zwift Bans Cheat Whistleblower: A Deeper Dive Into the Issue | DC Rainmaker

4 Likes

“Regarding WTRL’s post, this was issued without consultation with us, so I am not able to provide a comment on this at this time. I am aware of a two-year claim on the cheat. This claim is something that is currently being investigated however, the only known ticket relating to this bug at this time is the one raised a few days ago. The product team is working on a fix now and I’d like us to provide an update on that fix when we are able.””

This merely confirms spectactularly bad lines of communication within Zwift. They’re persisting with the claim that it genuinely wasn’t known about (or was known, but literally nothing was being done about it) until Luciano’s website appeared, even though their number one/only race organiser say they’ve been aware of it for two years and indeed have detected and acted on it.

This is meant to help their position? ok

4 Likes

It’s a typically well-balanced summary. Could/should Luciano have done things a bit differently? In hindsight I think so, yeah. But the fact is this isn’t a hack, cheat or any sort of security issue. We are all free to do something that literally shouldn’t be possible. The systems provided to the user by Zwift shouldn’t allow manipulation of metrics that affect speed, within races in real time. This isn’t rocket science, it’s an incredibly embarrassing oversight.

Taking out the way it’s been handled from a PR perspective, this whole farce only highlights (yet again) how lacking Zwift’s QC, testing and internal reporting processes still are. At this stage in the company’s life it’s inexcusable for these aspects to remain so poor. It also confirms just how low on the priority list community racing is, because we know for a fact that they take fairness in elite level events very seriously. Despite race participation apparently being low as a proportion of the user base, it’s a massive part of their advertising strategies, and community racers bring lots and lots of eyes onto Zwift as a platform. We’re all paying for this through our subscriptions, whether you race or not.

Zwift have been shamed into action here, it’s as simple as that.

9 Likes

What really gets up my nose is the line of argument that publicizing an exploit for transparency and to get action is somehow worse than leaving it in the shadows (so to speak).

The argument goes, once people know, more people will do it. But that’s a bit like saying crime documentaries will cause people to commit more crime. People who cheat are going to cheat in one way or another and probably already are cheating. Those who don’t cheat are not going to start because of being shown how it’s done, most likely they will be shocked as in this case at how easy it is and ask for a fix.

The insinuation that a large majority of zwift riders are so mindless that if you show them how to cheat they will just start doing it is quite baffling to me.

On the other side of the chain set, transparency means race organisers know of it, what to look out for whilst waiting for a fix, and can address it if it occurs. Certainly if I were organising a race if rather know how to spot an exploit than find out later people were using it to ruin the series.

5 Likes

Just read the road.cc article and the most incredible thing of all was uncovered and has been missed by everyone.

It confirms Zwift actually has a PR department!!

Unless it was set up in the minutes before that article was posted and has been on leave since then i dont know how this is even remotely possible.

3 Likes

I’d like to add, if zwift could actually track it in real-time and were tracking, why wasn’t the bug fixed months ago…
Their BS just doesn’t add up…
The World Champs are gonna be like the middle 1990s…

2 Likes

If it was actually detectable as claimed then Zwift (and WTRL for that matter) could just say, bring it on, all cheaters will be banned from future races. There’s no legitimate use for the exploit so it could just be one strike and you’re out.

Their reaction implies it obviously isn’t actually detectable in practice, which may be because the data are not recorded and it can’t be checked in principle, or else there’s simply too big a mountain of data to look at.

3 Likes

A couple of years ago I reported a whole load of bugs (mainly because I got more than slightly peeved at how many there were). When I was reporting them I asked for some sort of reference number so I could refer to them - they couldn’t/wouldn’t give me one. Not a customer ticket number or a bug reference number. Obviously I (and they) had no idea if they had been raised before either.

The reason I asked incidently was one of the bugs I had previously raised hadn’t been fixed (as promised - PBs not appearing in events as it happens) so if this happened again I wanted a more efficient way for them to find my previous reports than me reading dates from emails. This was 2019.

However earlier reports (June 2016) I did get a reference number an a link to a customer request tracking system (obviously the link is dead but it used Zendesk as the customer service desk system).

Amazing that they actually had a working system and then got rid of it (or at least hid it). Most frustrating.

1 Like

I can’t believe it isn’t detectable. For the change to go from the Companion app to the person in-game, it has to go through Zwift’s systems.

Heck, a trivial fix would be for the game engine itself to ignore weight changes while someone’s in an event. The game already knows when the event has started and finished. Shouldn’t be difficult to add a bit of conditional coding.

if (!rider.inEvent) {
    rider.weight = newWeight;
}

There. I fixed the issue in 10 seconds. Who do I invoice?

6 Likes

WTRL claimed it. Not Zwift. Important distinction as WTRL claims things more often without any foundation. Probably well intended to discourage people from using the ‘feature’ but poor execution as that keeps getting referenced.

Publication of DC is quite good (also stating Luciano’s article was clickbaity but he intended well and does not have a communications department). Just misses that this was mentioned on Zwiftpower forums years ago (corrected: was mentioned, thx Dave). If they had cared about racing they would have fixed it then. I honestly would believe them not knowing/realizing but that’s because they never cared and willingness. Not because the information was not there.

Unfortunately Zwift is mismanaged. This showcases it to a much wider audience then their normal mishaps. All due their own flaws. Shame though as this will stick with that large audience and affects racing on Zwift for a long time. Ah well, something better will come along.

5 Likes

Indeed this has to be fixed in the backend because otherwise people will just be able to use an old version of the companion app. Presumably there is an URI that is used for updating the profile, disable it, zack fertig.

5 Likes

He’s mentioned and linked to it in the article. :+1:

1 Like

If they do not log and time stamp every significant customer interaction with their backend then that is worrying. But they’ve said they can for weight changes, so we will take that as a positive - call it C_WeightChange

They must (surely) be able to tell if a customer is in an event at any given time (C_StartEvent, and C_StopEvent).

Then all you do is look for a C_WeightChange between a C_StartEvent and C_StopEvent (or something like C_Logon to account for connection failures).

I cannot for the life of me see how this is hard unless their system is an unrefactored mountain of spaghetti, which I guess is entirely possible.

3 Likes

It’s a good article from Ray, but sadly I can’t help but think if Zwift were going to do anything more about it then they’d have done it a day or two ago when the head of PR was giving comments for a forthcoming DC Rainmaker article.

3 Likes

First off, I want to make it clear that I love Zwift…However! Zwift has been ignoring the biggest cheat of all and that is riders simply entering the wrong category in races. It’s been going on for years. It’s so frustrating to ride in Cat C put out 3.0 W/kg and then finish 28/35 with 15 of the riders ahead of you putting out more than 3.3W/kg. Does Zwift care? Obviously not.
This “hack” is just the weight doping problem amplified. You might fix this hack but riders are still going to lie about their weight.
The only thing Zwift seems concerned about is their stupid E-racing series. Trust me 99% of Zwift users and 99.99999% of the rest of the world don’t give a crap about professional E-racing.

So Zwift, if you want to fix something, please fix the regular guy/gal racing, because that is what we care about.

7 Likes