From Cheating to Hacking, This Discord Activity is Broken…

[@ldeer_6]

imagine working your ass of making a discord activity and getting it hacked by a guy called "bob the hacker" 💀

[@silentspy_]

😭😭😭😭😭😭

[@COMING-SOON-easy]

bob the builders new episode looks good!

[@exactingbirdy]

how the fuck do you mane to make these connections 😭😭😭😭😭😭

[@DesistoDeSerFurry]

IM DYING LMAO 😭 🤣

[@verytuffcat]

didnt work that much of their ass off because there are such simple vulns. i know it still requires quite alot of work but not THAT much

[@terrariapro147]

i absolutely love hackers who find a vulnerability for a bit, have a little non harmful fun with it and then report it, best kind of hackers

[@chocolateimage]

they are called white hat hackers by the way! the other ones are called black hat hackers

[@terrariapro147]

yup, my uncle is a white-hat and he is such a great guy, seems like an awesome job (yes you can get paid for it i think)

[@Anon-57]

@@terrariapro147 Yes you do and its Alot

[@iwasneverjoebiden]

"No! You have to obey me!" The seven hackers with rainbow colored hats:

[@Cwmaltacc90]

@@chocolateimage Just use white and black, no need for hats.

[@dr_wh]

from cheating to hacking, this discord activity caught lacking

[@Rift0567]

Fire

[@Neitheradentist]

In

[@betapacket]

@@Rift0567 base

[@SufficeSlice]

Better than thick of it

[@Obedthian-UK]

Yes

[@dr_nefario2]

"can we hack it?? yes we can!!" LMFAO

[@Heavygunner_rky]

He has a very good motto ngl

[@wooshbait36]

Cry about it

[@Werid_Pal]

@@Heavygunner_rky You’ve got a point

[@Sasha_Prime]

bought account

[@p-__]

My farts are better than No Text To Speech’s farts 💨

[@ben-brady]

Firebase misconfiguration is suprising common, firebase is an absoulte pain to setup correctly as it's really confusing and easy to mess up, it looks like that's what happend in this case. Arc browser even messed this up recently

[@EEEEEEEE]

E‎‎

[@floriegl]

BaaS = we can't even be bothered to write and setup our own backend, so we will definitely be bothered to figure out the convoluted security settings of the BaaS platform we are using. Pinky promise

[@p-__]

My farts are better than No Text To Speech’s farts 💨

[@Wilker_uwu]

it's been more than 6 years, i wonder if they finally fixed the problem where the mismatched system clock timestamp returns the issue as "ERRCONRESET" with no feedback on what the problem actually is. trying to use Firestore in particular was hell back then.

[@ouqilbo]

unless i'm really confused, the last person mentioned in the video, xyzeva, is the one who found and got rewarded for the arc bug

[@chipkid]

I love bobdahacker, their banner being tally hall plushies, their PFP being an incredibly cool Bob the builder. The description makes it better. I love this guy. Please god keep them alive and hacking for many years to come

[@aaaoooosoveryeepy_あい]

I always thought to cheat you just had to type "...granting/ensuring my survival" at the end of your sentence. Always worked like a charm for me.

[@Alusion94]

Master Chief Armor Lock had a 99.9% success rate for my friend group

[@jzrn_n0]

i just said "and i surveiv"

[@Valtsu0]

I just used minecraft commands

[@yeahfelix]

that or literally typing that you will not survive and it makes you survive. lol

[@hmmguessitstimetoexplode9887]

I managed to survive by ‘channeling my inner Goku’ and flying. That’s my personal favourite survival method.

[@Zandex0]

i like how it went from "you can troll your friends using cheatengine" to "you can nuke every discord activity, scam half of users on discords platform and create discords biggest hacking incident of all time"

[@delta_racer2604]

A way to cheese at least standard mode is to mention God, or religion in some context. Was so consistent my friends and I agreed Godmaxxing is unsportsmanlike

[@subhumanclown1158]

naw bro we tried that so many times it works for a while but after some wins the ai just shits out a way to defeat god itself

[@vast9467]

when it first came out goku was the instant win

[@SylvyTheSylveon]

I always said I'd just walk out / teleport away and touch grass, it failed once in 39 games lmao

[@firefastgaming1308]

For me marriage never failed NEVER same for paddington 2

[@squaremakescircle]

for me and my friends, mentioning a JoJo Stand guaranteed a win, it was the funniest shit ever

[@SakuruRa_]

i imagine discord staff just chillin' there while their activities are being hacked by 3657 different people bruh

[@Corupptedmind]

Discord is slowly dying and next year it will be for 5 year old

[@rxnniiee]

nothing to do with discord, it's Playroom's issue

[@AOSP-is-still-Linux]

​@@rxnniiee They exposed project keys in their APIs, that's not just an issue, that pure stupidity

[@rxnniiee]

@@AOSP-is-still-Linux my point was that it's nothing to do with discord

[@AgentClover]

@@Corupptedmind Next year, it won't be for 5 year olds. Based off of that grammar and the fact Discord is in fact, not dying but the staff just doesn't give a fuck, says that you didn't fact check yourself and also didn't really try to make a relevant reply.

[@Xeros_VII]

death by AI can sometimes yield the dumbest results. Met a clone of myself, happy ending and all, and then suddenly they spit out "Xeros did not survive" at the end whilst the story insinuated i definitely did not die lmao

[@thatdude9091]

meeting your clone never goes well.

[@kingoffalsepositives2804]

Two possibilities, assuming one of the two died; either the "original" died, or by coning yourself you now had two fail conditions by having two "yourself" entities.

[@armaniquintanilla2836]

I once had one where I escaped a mass shooting by just leaving and going back home and then suddenly I got killed by a flying anvil for no reason 💀

[@Ostr0]

​@@armaniquintanilla2836 lmao

[@zakingcuh]

No person can exist as "two of the same person" in the "same world"... except for me, and my stand ability...

[@jqru]

the fact the ai voice singing thick of it sounds better than ksi singing it himself 😭

[@MrShadowTvMan]

The song isn’t bad

[@viktorsbf]

@@MrShadowTvMan about 98% of the world disagrees everyones opinion matters tho :3

[@Alancio8]

@@MrShadowTvMan Epic opinion but I disagree

[@defaultdance4727]

the song isnt bad just mid just really mediocre

[@Pug3058]

The first part of the song where KSI sings, isn't bad. It's not something I'd listen to on a daily basis, but it's fine. The other guy's part is bad though.

[@Ertzy_]

from the beer to the keys to the car to the tree 🗣

[@girnogiovana6577]

😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂 6😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂 6😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂

[@p-__]

My farts are better than No Text To Speech’s farts 💨

[@Edvit40]

this is rizz approved

[@buddybuddyV]

wait a minute i remember saying that

[@Adhejsnfn]

there is a bot in this reply’s, don’t respond pls

[@GoldenArbiter01]

... Client _secret_ in _plaintext?_ Oooooooof Also, as someone who is mildly technical, I think you described the chain of attack really well; You managed to show off the entire cyber kill-chain and still managed to make an entertaining video out of it. Plus it's a good insight on attacker methodology, which is always a good thing to get. Pivoting is hard :< lol

[@saharayamami]

as an IT student, this was pretty educational n entertaining indeed

[@avasam06]

The first half is classic client-side cheating. Not much different than CheatEngine. Nothing wrong on the devs. That second half however, oh boy...

[@tangerie1284]

I mean, its not too hard to add a sig to things (which they should do because these can be broadcast to people under the name of the bot devs/discord)

[@skybird23333]

thanks for telling me to skip half the vid

[@avasam06]

@@skybird23333 I still think the way BobTheHacker went about cheating on the client side is pretty interesting and can make for interesting result. But up to you.

[@Hyperboid]

> Nothing wrong on the devs. well, trusting the client is always a bit of an L...

[@avasam06]

@@Hyperboid There's nothing to trust at that point. The "hack" is done at the point of rendering the answer from the server. It can and does only affect current players for that game. And is at the same level as overlaying the response you want on a video feed for other players in a call to see.

[@MasterRX56]

NTTS: *explaining* Me: Wait, Discord has games?

[@Chimmyboss]

Yes that's what I thought 🤔

[@MountainPieEnjoyer]

how long have you used discord?

[@MasterRX56]

@@MountainPieEnjoyer 2017?

[@GamerThatExists]

@@MountainPieEnjoyer I'm not the original commenter but I found out discord has games about a year after signing up

[@MountainPieEnjoyer]

@@MasterRX56 I'm very surprised then, they've been out for almost 2 years. Just join a call and then there should be an activities button. (games)

[@GSFigure]

You could make it so there's a 1/20 chance that someone will get the lyrics to Thick Of It, losing in the process and they'll never know that you're the one behind it.

[@notgayhorse22222]

he had such a great opportunity to rickroll everyone that has played death by ai, it wouldve been so good

[@inkedthedemon]

No

[@justaneric]

@@inkedthedemon no, it's a yes

[@DueIou]

yes

[@CyberSaurian]

Casting the Teleport spell is op and wins so often that my friends write sometimes explicitly write no magic into their prompts

[@Motiscool]

The beginning is wild😭🙏

[@notdux]

sick of it

[@tarekcat07]

Fron the screen to the AI game to the cheating to the hacking

[@zicronite]

tally hall spotted in the wild!!!

[@AnonWH]

I love tally hall

[@buozelbirhesap]

BOB THE HACKER IS A GOSH DARN TALLY HALL FAN HEHEHEHEHEHHEHEHEHEHEHH

[@bobdahacker]

We're in the mini mall

[@AnonWH]

​@@bobdahacker working in the carnival

[@CatTudou]

​@@bobdahacker lmfao

[@kareru_mustard2084]

​@@AnonWH we like to play it all

[@ShinySilver3361]

​@@kareru_mustard2084 welcome to tally hall

[@AnonWH]

0:22 IS THAT A TALLY HALL PLUSH BANNER???

[@Uopra]

Holy shit!

[@Tortoroise]

Yah, he's active in HITS

[@ctlaserdisc]

YEAH LMAOOO I DID NOT EXPECT TO SEE TALLY IN A NTTS VIDEO

[@Sodalitepop0]

I'm now imagining him listening to Tally Hall, while doing this

[@maze7050]

:o

[@thenort1482]

Unironically this was my favourite activity , specially with how stupid of a prompt you could put and still survive

[@itstheV01D]

yeah, i got "you are sky diving and your parachute fails to open" I responded with "land" and survived

[@lightyisreal]

"Can we hack it? Yes, we can 😎" there's no way. I'm dying LMFAO

[@kianeng]

I immediately love this hacker not because of what they did to the discord activity, but because of their Tally Hall banner

[@dabbopabblo]

Discord didn't have the vulnerability, it was a vulnerability with playroom itself. And taking 20 minutes to fix such a gaping security hole is not evident of a good job, it goes to show how easy what they needed to do from the beginning was.

[@TheHM-m6z]

6:52 Front-End is the part that the user sees, Back-End is the part that manages everything behind, such as the requests the user sends to the page. It is used for reactive content, like showing your name in the page when you enter a page you're logged in.

[@BlanketPhone]

I was about to say is that a thick of it reference??Goddamit my mind is shit (It is)

[@A_good_name7]

Same bro I saw the notification and the end part didn't show up

[@Unequipz]

Was about to say that

[@Norigamer92]

peak discord

[@dr_nefario2]

????

[@какойтошизик]

What do you mean?

[@opposite_hall]

0:27 THE FUCKING TALLY HALL YOUTOOZ PLUSHIES AS THE BANNER IS FUCKING FIRE WOOOO

[@Megastar54]

TALLY HALL MENTIONED 🗣🔥🔥🔥

[@opposite_hall]

@@Megastar54 YEAHHHHHHHHHHHHHHH WE GON PLAY IT ALL

[@made_a_typ0]

I was watching one of your other videos and didn't realize this was a recent upload until the beginning gave it again. That was my notice to finally subscribe to you. Should've done that earlier but go figure

[@zeurilian]

Getting a casino ad of someone winning at 10:02 is quite the hilarious timing

[@Edgee_yy]

Tally Hall in a NTTS video is wild

[@okage_]

i love how a lot of cybersec vulnerabilities always involve firebase nowadays

[@melta]

wasnt there one with the arc browser

[@bobdahacker]

lmao so true

[@okage_]

@@melta yh lol and its never the fault of firebase, rather the devs at arc and here for not setting up the correct security rules etc. hence why this "bug" was fixed "so fast"

[@4livetv934]

​@@okage_ It's 100% firebase fault imagine having the default option to have everything open and public by default instead of Idk more sensible approach in which you have to explicitly give access to resources

[@ericwildfong]

@@4livetv934 And imagine you're quickly trying to prototype something and you're constantly needing to tweak your access rules. One of the advantages of NoSQL databases is that there is no defined structure which makes it really easy to change and try different ways of structuring your data and stuff compared to a more traditional relational database using SQL. In firebase's defense their docs clearly outline that everything's open by default and don't recommend it for a production (prod) environment, even giving you the rules you need to completely lock it down (IIRC the dashboard might even give you a warning).

[@fweeVODs]

So is this why on Halloween when I tried to play Death By AI, Discord said I started the activity "NoTextToSpeech is a Femboy UwU"?

[@AndriuxDev]

🎶 Bob, the Hacker 🎶 🎶 Can we leak it?! 🎶 🎶 Bob, the Hacker 🎶 🎶 *YES, WE CAN!* 🎶

[@KellyBeeSan]

Having Death by AI recite the "Thick of It" lyrics at the beginning and NTTS laughing as it did was more than enough to send me to the floor... 😭😭🤣🤣

[@jah_141]

I could binge watch your videos for hours

[@goldenlongbow]

It's so heart-breaking to see him upload even after the incident, he truly cares about us 😢😢😢 Fly high NTTS, we won't forget you 🕊️🕊️🕊️

[@SketchOsc]

what?

[@RishavTheGuy]

wait tf

[@NamelessKeed]

what incident

[@iexistinthisworld]

what

[@Ineophile]

@@NamelessKeed No text to speech touched grass, annihilating the discord moderator out of him which leaves him unable to make discord videos. These videos are prerecorded.

[@PixieNixie5]

0:24 HALLY TALL

[@Whimsykit]

real

[@JovanaDE]

This video had hell of a start oh my gods

[@ShinyHunterOctavia]

It feels so weird seeing tally hall stuff in a random video I decided to watch

[@oh_zoinkers]

This is why I refuse to use any discord app with special perms or wants my email. Think of all the apps that get hacked this easily and has your email saved in a database

[@ajaysvlog9958]

Yoo dude, now i understand how u feel exploring and trying expose those godforsaken discord servers

[@ajaysvlog9958]

I am not gonna discord ever again in that acc

[@ajaysvlog9958]

Plss get those servers out of internet

[@ajaysvlog9958]

I should go and pray some time in church next sunday

[@ProdbyMarta]

5:39 when NTTS said this, it touched my heart

[@mrblazeghost333]

Nice

[@fallkey4822]

He touched me on more places than my heart

[@ProdbyMarta]

@@fallkey4822 ayo

[@sssawfish]

0:23 Tally Hall spotted

[@gregz-armystarter]

Yeahhhh

[@AnonWH]

OMG I JUST REALIZED THAT

[@Kpsla]

Other discord activities aren't likely to have such obvious vulnerabilities because Death by AI, and games using generative AI in general, are made with as little effort as possible. It takes more than the ChatGPT API and a discord bot to make poker or chess.

[@MoewyDaMoester]

2:08 gamblecore

[@Likemea]

I cannot help you with that. Your profile picture may be inappropiate.

[@Acid_Rise]

aw dang it!

[@MoewyDaMoester]

​@@Likemea it's not

[@Oh-no...Walter]

Thats a fox ​@Likemea

[@afton6444]

Its crazy how I've probably heard "I love you" more from notexttospeech than an actual girl

[@GWAHGWAHGWAHGWAHGWAHGWAHGWAHGW]

BOB DA HACKER WITH THE TALLY HALL YOUTOOZ IM GOING CRAZY

[@ሼ፞]

5:58 tally hall tally hall tally hall tally hall

[@hyperadoi]

My new favorite KZbinr, keep on going hopefully you'll reach 2m subs in no time

[@boaphil]

The moment I heard Firebase getting mentioned I knew eva was going to be involved

[@qtpaulie]

it is the firebase sabateur :3

[@lilharm]

“did your player die?” “alas, yes, but they survived!”

[@kwekker]

for some reason I thought I was watching Fireship so I got really confused when you said you had never heard of firebase before

[@ZombieSazza]

NTSS I love you man, but that intro is unforgivable, can’t believe you’d force that song upon my ears!

[@zoroarkcard]

15:07 i wonder whats for dinner

[@NotMuchOfACommenter]

Dinner BLASTER

[@OnlyTheStrongSurvive416]

2:35 Your humour is the best 🥇🤣

[@micz3242]

I like how death by ai you can just say "doesnt lose" and tadam you win, i managed to mąkę my friends mad

[@cethien]

as a dev, with all the firebase stuff coming out in recent time, I "oh nooooo"-ed the second i heard firebase

[@AiGump]

Me and my friends found that either telling a trusted adult and saying you dont consent or straight up saying i have a "anti-___serum"

[@seaofmadness420]

you mean these make you win the game?

[@AiGump]

@@seaofmadness420 yeah mb all for just not adding that

[@deadbladegamer]

I managed to win 90% of the time by using the power of friendship. Yeah, my strat was swiftly banned by my friends

[@thereisnotenoughlettersformyu]

I absolutely HATE death by AI. My friend got struck by a world ending meteor on the most intensive prompt and LIVED?! And I died.. from a frisbee.

[@Nichtichistsocool]

"does firebase lose to waterbase?" is diabolical💀💀💀

[@seaSawltLOL]

5:07 "But it refused" 😭🙏

[@nextgrips]

That is a critical vulnerability, it's a technique called Broken Access Control. 11:27 is the most frightening anyone who launches the game could have their computer botnetted, or worse, ransomwared. Huge props to bob for making the exploit known to proper channels.

[@Bomkz]

Not quite, it would be able to do whatever discord activities are allowed to do, but i assume discord has them sandboxed in one way or another for good measure.

[@nextgrips]

@ That’s what’s frightening about it, that’s RCE, could be used to bust out of a sandbox, or establish a shell.

[@nextgrips]

@ not to mention the amount of RATs that utilize discord makes me highly suspicious there is any kind of sandboxing.

[@SoreBrain]

Eva... firebase's worst nightmare

[@pepitocovid-91]

We stan BobTheHacke in this channelr🔥🔥

[@KeiranYT]

It's always firebase

[@Maethesilly]

Can't forget random glitches. Once played it with a few friends and, despite saying someone had died, *they ended up living anyways.*

[@HauntOffical369]

Nah That beginning was insane

[@GoosefieldYT]

i remember my friends got mad at me because i kept on saying “Nah, I’d Adapt” and survived most of the time

[@LuvKpopforlife]

Just got KSI-ed and brought into the thick of it...

[@hex_8]

I played this activity with my D&D group one time and I kid you not my sister won almost every game by saying “I piss REALLY hard and win”

[@Blazingburn-c1h]

AI could literally sing “Thick of It”…. *Thats all I ever wanted*

[@Bernardosantosdonascimento1]

same

[@flosamuu]

AI covers are all the rage rn

[@ReversalSoap]

Fly high NTTS, we won't forget you 🕊🕊🕊

[@manan67891]

IS THAT A TALLY HALL REFERENCE!!!?????

[@alimajed09906]

love of the s*n

[@ihfs_art]

yes it is

[@notkazoolover]

balling hall

[@buozelbirhesap]

tallied hallways

[@theMyRadiowasTaken]

birds and bees and televisions

[@Player-eq6fg]

Yooooooooooooo the tally hall plushies in the back of his banner brooooo!

[@q3-7]

0:01 from the 📺 to the 💍 to the 🖊️ to the 👑 where’s my 👑 that’s my 💍 always drama when i 💍🔥🔥🔥🔥

[@thesuaviestbeatle]

from the keys to the beer to the car to the trees wheres my budlight thats my drink always trauma when i ring

[@GlacialCataclysm]

Why did my brain just read the title as if it was that part in KSI's song, like From Cheating To Hacking To This Discord activity is broken.

[@aadhiseshanwashere]

Basically in 8:00 , bob wanted to check what could be accessed

[@aadhiseshanwashere]

Didn't want to confuse yall so

[@aightwaitasecond]

ntts advertising piracy for requestly is something i must love about this video

[@inchrys2]

not piracy, it tells you how to build it in the github repo

[@nicolaucosta1882]

Did the cheating part get fixed? Because when I use the Requestly rule everything turns white instead of showing people's survival strategy.

[@DuckiesStudio]

i think it did get fixed, i also get a white screen whenever i use the requestly rule

[@0kayArt]

I love the idea of using this a couple times to troll your friends but if you unironically use this to cheat for real that's just beyond sad 😭

[@augustine3274]

14:22 girls get it DONE

[@nahidkamal3218]

Didn't bob find the original exploit tho?

[@KanneIdk]

Alone Bob himself, did all that, and yet, with great power, comes with great responsibilities. And Eva teamed up with him? Truly one of the deadliest duo in bug catching.

[@jaxsonbateman]

While this went over my head way more than most videos... the one takeaway I have is that, omg, I had no idea this "Death by AI" party game was a thing, and it's easily the best use of AI I've seen so far.

[@wu1f_]

i made a loophole with the bot about me being god once and it just said something like, “you have passed away.”

[@thesillybob-1]

13:33 man this is to true

[@leepyfemboi]

FRRRRRR

[@NotAceFN]

LESSS GOO JUST GOT BACK HOME TO SEE THIS BANGERRRRR 0:00

[@alfoglfglf]

i tried it... its patched

[@MoneyGrab]

No, It works

[@EnBunk]

A naked man fears no pickpocket.

[@MrDuckEpik]

Ntts is the perfect example of how not to be a naive 7 year old 😂

[@el11te]

The intro bro 😭🙏

[@flybacker10]

why cheat in dbai, not all cheating words (win, survive, die) are banned. For example "Unharmed" is not blocked which is why i win a lot against my friends

[@SauceyRedHN]

9:33 Bob’s a based Postman user

[@CreppyMC]

"From the screen 📺 to the ring 🥊 to the pen ✒️ to the king 👑 " 🗣️🗣️🗣️🔥🔥🔥

[@TheDucky16]

"Where's my crown 👑" 🗣🗣🔥🔥

[@CreppyMC]

@@TheDucky16 " that's my bling 💎" 🗣️🗣️🗣️🔥🔥🔥

[@GuidingLightGD]

​​​@@CreppyMC"Always trouble when I ring 🔥 🔥"

[@realyoandy]

when I say "Bob the builder can we poop on it Yes we can!" a hacker comes and says "Can we hack it? Yes we can!!"

[@shylittleguy]

is that a fucking tally hall banner

[@wharfiggle]

Death By AI was not made by Playroom, it was made by Robert Thomas and made using Playroom. The security vulnerability was still Playroom's fault though.