From Cheating to Hacking, This Discord Activity is Broken…

[@ldeer_6]

imagine working your ass of making a discord activity and getting it hacked by a guy called "bob the hacker" 💀

[@silentspy_]

😭😭😭😭😭😭

[@EXPOSED-3920]

bob the builders new episode looks good!

[@exactingbirdy]

how the fuck do you mane to make these connections 😭😭😭😭😭😭

[@DesistoDeSerFurry]

IM DYING LMAO 😭 🤣

[@verytuffcat]

didnt work that much of their ass off because there are such simple vulns. i know it still requires quite alot of work but not THAT much

[@terrariapro147]

i absolutely love hackers who find a vulnerability for a bit, have a little non harmful fun with it and then report it, best kind of hackers

[@chocolateimage]

they are called white hat hackers by the way! the other ones are called black hat hackers

[@terrariapro147]

yup, my uncle is a white-hat and he is such a great guy, seems like an awesome job (yes you can get paid for it i think)

[@Anon-57]

@@terrariapro147 Yes you do and its Alot

[@iwasneverjoebiden]

"No! You have to obey me!" The seven hackers with rainbow colored hats:

[@Cwmaltacc90]

@@chocolateimage Just use white and black, no need for hats.

[@dr_wh]

from cheating to hacking, this discord activity caught lacking

[@Rift0567]

Fire

[@Neitheradentist]

In

[@betapacket]

@@Rift0567 base

[@SufficeSlice]

Better than thick of it

[@Obedthian-UK]

Yes

[@DukeNukem0]

"can we hack it?? yes we can!!" LMFAO

[@Heavygunner_rky]

He has a very good motto ngl

[@wooshbait36]

Cry about it

[@Werid_Pal]

@@Heavygunner_rky You’ve got a point

[@Sasha_Prime]

bought account

[@p-__]

My farts are better than No Text To Speech’s farts 💨

[@ben-brady]

Firebase misconfiguration is suprising common, firebase is an absoulte pain to setup correctly as it's really confusing and easy to mess up, it looks like that's what happend in this case. Arc browser even messed this up recently

[@EEEEEEEE]

E‎‎

[@floriegl]

BaaS = we can't even be bothered to write and setup our own backend, so we will definitely be bothered to figure out the convoluted security settings of the BaaS platform we are using. Pinky promise

[@p-__]

My farts are better than No Text To Speech’s farts 💨

[@Wilker_uwu]

it's been more than 6 years, i wonder if they finally fixed the problem where the mismatched system clock timestamp returns the issue as "ERRCONRESET" with no feedback on what the problem actually is. trying to use Firestore in particular was hell back then.

[@ouqilbo]

unless i'm really confused, the last person mentioned in the video, xyzeva, is the one who found and got rewarded for the arc bug

[@aaaoooosoveryeepy_あい]

I always thought to cheat you just had to type "...granting/ensuring my survival" at the end of your sentence. Always worked like a charm for me.

[@Alusion94]

Master Chief Armor Lock had a 99.9% success rate for my friend group

[@jzrn_n0]

i just said "and i surveiv"

[@Valtsu0]

I just used minecraft commands

[@yeahfelix]

that or literally typing that you will not survive and it makes you survive. lol

[@hmmguessitstimetoexplode9887]

I managed to survive by ‘channeling my inner Goku’ and flying. That’s my personal favourite survival method.

[@delta_racer2604]

A way to cheese at least standard mode is to mention God, or religion in some context. Was so consistent my friends and I agreed Godmaxxing is unsportsmanlike

[@subhumanclown1158]

naw bro we tried that so many times it works for a while but after some wins the ai just shits out a way to defeat god itself

[@vast9467]

when it first came out goku was the instant win

[@SylvyTheSylveon]

I always said I'd just walk out / teleport away and touch grass, it failed once in 39 games lmao

[@firefastgaming1308]

For me marriage never failed NEVER same for paddington 2

[@squaremakescircle]

for me and my friends, mentioning a JoJo Stand guaranteed a win, it was the funniest shit ever

[@avasam06]

The first half is classic client-side cheating. Not much different than CheatEngine. Nothing wrong on the devs. That second half however, oh boy...

[@tangerie1284]

I mean, its not too hard to add a sig to things (which they should do because these can be broadcast to people under the name of the bot devs/discord)

[@skybird23333]

thanks for telling me to skip half the vid

[@avasam06]

@@skybird23333 I still think the way BobTheHacker went about cheating on the client side is pretty interesting and can make for interesting result. But up to you.

[@Hyperboid]

> Nothing wrong on the devs. well, trusting the client is always a bit of an L...

[@avasam06]

@@Hyperboid There's nothing to trust at that point. The "hack" is done at the point of rendering the answer from the server. It can and does only affect current players for that game. And is at the same level as overlaying the response you want on a video feed for other players in a call to see.

[@chipkid]

I love bobdahacker, their banner being tally hall plushies, their PFP being an incredibly cool Bob the builder. The description makes it better. I love this guy. Please god keep them alive and hacking for many years to come

[@SakuruRa_]

i imagine discord staff just chillin' there while their activities are being hacked by 3657 different people bruh

[@Corupptedmind]

Discord is slowly dying and next year it will be for 5 year old

[@rxnniiee]

nothing to do with discord, it's Playroom's issue

[@AOSP-is-still-Linux]

​@@rxnniiee They exposed project keys in their APIs, that's not just an issue, that pure stupidity

[@rxnniiee]

@@AOSP-is-still-Linux my point was that it's nothing to do with discord

[@AgentClover]

@@Corupptedmind Next year, it won't be for 5 year olds. Based off of that grammar and the fact Discord is in fact, not dying but the staff just doesn't give a fuck, says that you didn't fact check yourself and also didn't really try to make a relevant reply.

[@jqru]

the fact the ai voice singing thick of it sounds better than ksi singing it himself 😭

[@EliteTvManFake]

The song isn’t bad

[@sebqstivn]

@@EliteTvManFake about 98% of the world disagrees everyones opinion matters tho :3

[@Alancio8]

@@EliteTvManFake Epic opinion but I disagree

[@defaultdance4727]

the song isnt bad just mid just really mediocre

[@Pug3058]

The first part of the song where KSI sings, isn't bad. It's not something I'd listen to on a daily basis, but it's fine. The other guy's part is bad though.

[@Xeros_VII]

death by AI can sometimes yield the dumbest results. Met a clone of myself, happy ending and all, and then suddenly they spit out "Xeros did not survive" at the end whilst the story insinuated i definitely did not die lmao

[@thatdude9091]

meeting your clone never goes well.

[@kingoffalsepositives2804]

Two possibilities, assuming one of the two died; either the "original" died, or by coning yourself you now had two fail conditions by having two "yourself" entities.

[@armaniquintanilla2836]

I once had one where I escaped a mass shooting by just leaving and going back home and then suddenly I got killed by a flying anvil for no reason 💀

[@Ertzy_]

from the beer to the keys to the car to the tree 🗣

[@girnogiovana6577]

😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂 6😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂 6😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂

[@p-__]

My farts are better than No Text To Speech’s farts 💨

[@Edvit40]

this is rizz approved

[@dainvisibulman]

wait a minute i remember saying that

[@Adhejsnfn]

there is a bot in this reply’s, don’t respond pls

[@MasterRX56]

NTTS: *explaining* Me: Wait, Discord has games?

[@Chimmyboss]

Yes that's what I thought 🤔

[@MountainPieEnjoyer]

how long have you used discord?

[@MasterRX56]

@@MountainPieEnjoyer 2017?

[@GamerThatExists]

@@MountainPieEnjoyer I'm not the original commenter but I found out discord has games about a year after signing up

[@MountainPieEnjoyer]

@@MasterRX56 I'm very surprised then, they've been out for almost 2 years. Just join a call and then there should be an activities button. (games)

[@GoldenArbiter01]

... Client _secret_ in _plaintext?_ Oooooooof Also, as someone who is mildly technical, I think you described the chain of attack really well; You managed to show off the entire cyber kill-chain and still managed to make an entertaining video out of it. Plus it's a good insight on attacker methodology, which is always a good thing to get. Pivoting is hard :< lol

[@saharayamami]

as an IT student, this was pretty educational n entertaining indeed

[@Zandex0]

i like how it went from "you can troll your friends using cheatengine" to "you can nuke every discord activity, scam half of users on discords platform and create discords biggest hacking incident of all time"

[@GSFigure]

You could make it so there's a 1/20 chance that someone will get the lyrics to Thick Of It, losing in the process and they'll never know that you're the one behind it.

[@AnonWH]

0:22 IS THAT A TALLY HALL PLUSH BANNER???

[@Uopra]

Holy shit!

[@Tortoroise]

Yah, he's active in HITS

[@ctlaserdisc]

YEAH LMAOOO I DID NOT EXPECT TO SEE TALLY IN A NTTS VIDEO

[@Sodalitepop0]

I'm now imagining him listening to Tally Hall, while doing this

[@maze7050]

:o

[@Motiscool]

The beginning is wild😭🙏

[@notdux]

sick of it

[@tarekcat1]

Fron the screen to the AI game to the cheating to the hacking

[@zicronite]

tally hall spotted in the wild!!!

[@AnonWH]

I love tally hall

[@CyberSaurian]

Casting the Teleport spell is op and wins so often that my friends write sometimes explicitly write no magic into their prompts

[@thenort1482]

Unironically this was my favourite activity , specially with how stupid of a prompt you could put and still survive

[@itstheV01D]

yeah, i got "you are sky diving and your parachute fails to open" I responded with "land" and survived

[@lightyisreal]

"Can we hack it? Yes, we can 😎" there's no way. I'm dying LMFAO

[@Kpsla]

Other discord activities aren't likely to have such obvious vulnerabilities because Death by AI, and games using generative AI in general, are made with as little effort as possible. It takes more than the ChatGPT API and a discord bot to make poker or chess.

[@notgayhorse22222]

he had such a great opportunity to rickroll everyone that has played death by ai, it wouldve been so good

[@inkedthedemon]

No

[@justaneric]

@@inkedthedemon no, it's a yes

[@DueIou]

yes

[@kianeng]

I immediately love this hacker not because of what they did to the discord activity, but because of their Tally Hall banner

[@TheHM-m6z]

6:52 Front-End is the part that the user sees, Back-End is the part that manages everything behind, such as the requests the user sends to the page. It is used for reactive content, like showing your name in the page when you enter a page you're logged in.

[@buozelbirhesap]

BOB THE HACKER IS A GOSH DARN TALLY HALL FAN HEHEHEHEHEHHEHEHEHEHEHH

[@bobdahacker]

We're in the mini mall

[@AnonWH]

​@@bobdahacker working in the carnival

[@CatTudou]

​@@bobdahacker lmfao

[@kareru_mustard2084]

​@@AnonWH we like to play it all

[@ShinySilver3361]

​@@kareru_mustard2084 welcome to tally hall

[@BlanketPhone]

I was about to say is that a thick of it reference??Goddamit my mind is shit (It is)

[@A_good_name7]

Same bro I saw the notification and the end part didn't show up

[@UnEquipz]

Was about to say that

[@Norigamer92]

peak discord

[@DukeNukem0]

????

[@какойтошизик]

What do you mean?

[@Edgee_yy]

Tally Hall in a NTTS video is wild

[@fweeVODs]

So is this why on Halloween when I tried to play Death By AI, Discord said I started the activity "NoTextToSpeech is a Femboy UwU"?

[@opposite_hall]

0:27 THE FUCKING TALLY HALL YOUTOOZ PLUSHIES AS THE BANNER IS FUCKING FIRE WOOOO

[@Megastar54]

TALLY HALL MENTIONED 🗣🔥🔥🔥

[@opposite_hall]

@@Megastar54 YEAHHHHHHHHHHHHHHH WE GON PLAY IT ALL

[@dabbopabblo]

Discord didn't have the vulnerability, it was a vulnerability with playroom itself. And taking 20 minutes to fix such a gaping security hole is not evident of a good job, it goes to show how easy what they needed to do from the beginning was.

[@made_a_typ0]

I was watching one of your other videos and didn't realize this was a recent upload until the beginning gave it again. That was my notice to finally subscribe to you. Should've done that earlier but go figure

[@oh_zoinkers]

This is why I refuse to use any discord app with special perms or wants my email. Think of all the apps that get hacked this easily and has your email saved in a database

[@PixieNixie5]

0:24 HALLY TALL

[@Whimsykit]

real

[@zeurilian]

Getting a casino ad of someone winning at 10:02 is quite the hilarious timing

[@KellyBeeSan]

Having Death by AI recite the "Thick of It" lyrics at the beginning and NTTS laughing as it did was more than enough to send me to the floor... 😭😭🤣🤣

[@okage_]

i love how a lot of cybersec vulnerabilities always involve firebase nowadays

[@melta]

wasnt there one with the arc browser

[@bobdahacker]

lmao so true

[@okage_]

@@melta yh lol and its never the fault of firebase, rather the devs at arc and here for not setting up the correct security rules etc. hence why this "bug" was fixed "so fast"

[@4livetv934]

​@@okage_ It's 100% firebase fault imagine having the default option to have everything open and public by default instead of Idk more sensible approach in which you have to explicitly give access to resources

[@ericwildfong]

@@4livetv934 And imagine you're quickly trying to prototype something and you're constantly needing to tweak your access rules. One of the advantages of NoSQL databases is that there is no defined structure which makes it really easy to change and try different ways of structuring your data and stuff compared to a more traditional relational database using SQL. In firebase's defense their docs clearly outline that everything's open by default and don't recommend it for a production (prod) environment, even giving you the rules you need to completely lock it down (IIRC the dashboard might even give you a warning).

[@ShinyHunterOctavia]

It feels so weird seeing tally hall stuff in a random video I decided to watch

[@GaryCatz]

This video had hell of a start oh my gods

[@ajaysvlog9958]

Yoo dude, now i understand how u feel exploring and trying expose those godforsaken discord servers

[@ajaysvlog9958]

I am not gonna discord ever again in that acc

[@ajaysvlog9958]

Plss get those servers out of internet

[@ajaysvlog9958]

I should go and pray some time in church next sunday

[@afton6444]

Its crazy how I've probably heard "I love you" more from notexttospeech than an actual girl

[@jah_141]

I could binge watch your videos for hours

[@AndriuxDev]

🎶 Bob, the Hacker 🎶 🎶 Can we leak it?! 🎶 🎶 Bob, the Hacker 🎶 🎶 *YES, WE CAN!* 🎶

[@nextgrips]

That is a critical vulnerability, it's a technique called Broken Access Control. 11:27 is the most frightening anyone who launches the game could have their computer botnetted, or worse, ransomwared. Huge props to bob for making the exploit known to proper channels.

[@Bomkz]

Not quite, it would be able to do whatever discord activities are allowed to do, but i assume discord has them sandboxed in one way or another for good measure.

[@nextgrips]

@ That’s what’s frightening about it, that’s RCE, could be used to bust out of a sandbox, or establish a shell.

[@nextgrips]

@ not to mention the amount of RATs that utilize discord makes me highly suspicious there is any kind of sandboxing.

[@goldenlongbow]

It's so heart-breaking to see him upload even after the incident, he truly cares about us 😢😢😢 Fly high NTTS, we won't forget you 🕊️🕊️🕊️

[@SketchOsc]

what?

[@RishavTheGuy]

wait tf

[@NamelessKeed]

what incident

[@iexistinthisworld]

what

[@Ineophile]

@@NamelessKeed No text to speech touched grass, annihilating the discord moderator out of him which leaves him unable to make discord videos. These videos are prerecorded.

[@ProdbyMarta]

5:39 when NTTS said this, it touched my heart

[@mrblazeghost333]

Nice

[@fallkey4822]

He touched me on more places than my heart

[@ProdbyMarta]

@@fallkey4822 ayo

[@thereisnotenoughlettersformyu]

I absolutely HATE death by AI. My friend got struck by a world ending meteor on the most intensive prompt and LIVED?! And I died.. from a frisbee.

[@ZombieSazza]

NTSS I love you man, but that intro is unforgivable, can’t believe you’d force that song upon my ears!

[@kwekker]

for some reason I thought I was watching Fireship so I got really confused when you said you had never heard of firebase before

[@AiGump]

Me and my friends found that either telling a trusted adult and saying you dont consent or straight up saying i have a "anti-___serum"

[@seaofmadness420]

you mean these make you win the game?

[@AiGump]

@@seaofmadness420 yeah mb all for just not adding that

[@sssawfish]

0:23 Tally Hall spotted

[@TheCatArchiveForFun]

Yeahhhh

[@AnonWH]

OMG I JUST REALIZED THAT

[@boaphil]

The moment I heard Firebase getting mentioned I knew eva was going to be involved

[@qtpaulie]

it is the firebase sabateur :3

[@micz3242]

I like how death by ai you can just say "doesnt lose" and tadam you win, i managed to mąkę my friends mad

[@GlacialCataclysm]

Why did my brain just read the title as if it was that part in KSI's song, like From Cheating To Hacking To This Discord activity is broken.

[@alfoglfglf]

i tried it... its patched

[@MoneyGrab]

No, It works

[@cethien]

as a dev, with all the firebase stuff coming out in recent time, I "oh nooooo"-ed the second i heard firebase

[@nicolaucosta1882]

Did the cheating part get fixed? Because when I use the Requestly rule everything turns white instead of showing people's survival strategy.

[@DuckiesStudio]

i think it did get fixed, i also get a white screen whenever i use the requestly rule

[@hyperadoi]

My new favorite KZbinr, keep on going hopefully you'll reach 2m subs in no time

[@seaSawltLOL]

5:07 "But it refused" 😭🙏

[@deadbladegamer]

I managed to win 90% of the time by using the power of friendship. Yeah, my strat was swiftly banned by my friends

[@MoewyDaMoester]

2:08 gamblecore

[@Likemea]

I cannot help you with that. Your profile picture may be inappropiate.

[@Acid_Rise]

aw dang it!

[@MoewyDaMoester]

​@@Likemea it's not

[@wharfiggle]

Death By AI was not made by Playroom, it was made by Robert Thomas and made using Playroom. The security vulnerability was still Playroom's fault though.

[@SoreBrain]

Eva... firebase's worst nightmare

[@lilharm]

“did your player die?” “alas, yes, but they survived!”

[@ሼ፞]

5:58 tally hall tally hall tally hall tally hall

[@Maethesilly]

Can't forget random glitches. Once played it with a few friends and, despite saying someone had died, *they ended up living anyways.*

[@LuvKpopforlife]

Just got KSI-ed and brought into the thick of it...

[@Nichtichistsocool]

"does firebase lose to waterbase?" is diabolical💀💀💀

[@HauntOffical369]

Nah That beginning was insane

[@aightwaitasecond]

ntts advertising piracy for requestly is something i must love about this video

[@inchrys2]

not piracy, it tells you how to build it in the github repo

[@zoroarkcard]

15:07 i wonder whats for dinner

[@NotMuchOfACommenter]

Dinner BLASTER

[@ReversalSoap]

Fly high NTTS, we won't forget you 🕊🕊🕊

[@KeiranYT]

It's always firebase

[@pepitocovid-91]

We stan BobTheHacke in this channelr🔥🔥

[@flybacker10]

why cheat in dbai, not all cheating words (win, survive, die) are banned. For example "Unharmed" is not blocked which is why i win a lot against my friends

[@GoosefieldYT]

i remember my friends got mad at me because i kept on saying “Nah, I’d Adapt” and survived most of the time

[@Blazingburn-c1h]

AI could literally sing “Thick of It”…. *Thats all I ever wanted*

[@Bernardosantosdonascimento1]

same

[@flosamuu]

AI covers are all the rage rn

[@OnlyTheStrongSurvive416]

2:35 Your humour is the best 🥇🤣

[@q3-7]

0:01 from the 📺 to the 💍 to the 🖊️ to the 👑 where’s my 👑 that’s my 💍 always drama when i 💍🔥🔥🔥🔥

[@thesuaviestbeatle]

from the keys to the beer to the car to the trees wheres my budlight thats my drink always trauma when i ring

[@el11te]

The intro bro 😭🙏

[@aadhiseshanwashere]

Basically in 8:00 , bob wanted to check what could be accessed

[@aadhiseshanwashere]

Didn't want to confuse yall so

[@KanneIdk]

Alone Bob himself, did all that, and yet, with great power, comes with great responsibilities. And Eva teamed up with him? Truly one of the deadliest duo in bug catching.

[@manan67891]

IS THAT A TALLY HALL REFERENCE!!!?????

[@alimajed09906]

love of the s*n

[@ihfs_art]

yes it is

[@notkazoolover]

balling hall

[@wfr878]

what

[@buozelbirhesap]

tallied hallways

[@floriegl]

BaaS = we can't even be bothered to write and setup our own backend, so we will definitely be bothered to figure out the convoluted security settings of the BaaS platform we are using. Pinky promise

[@MrDuckEpik]

Ntts is the perfect example of how not to be a naive 7 year old 😂

[@akutosai9187]

New video yey :))) Always makes my day better :D

[@jaxsonbateman]

While this went over my head way more than most videos... the one takeaway I have is that, omg, I had no idea this "Death by AI" party game was a thing, and it's easily the best use of AI I've seen so far.

[@sakaagentk502]

The No tts upload schedule is worse than inflation

[@augustine3274]

14:22 girls get it DONE

[@nahidkamal3218]

Didn't bob find the original exploit tho?

[@exirdus9793]

I don't know if I should be happy or sad that I completely understand everything 😭😭😭

[@shylittleguy]

is that a fucking tally hall banner

[@kirbysuperstaruhh3769]

Someone on a server im in had a near flawless winrate by always typing "i wake up" or something along those lines and made pretty much everyone in the vc hate him

[@CreppyMC]

"From the screen 📺 to the ring 🥊 to the pen ✒️ to the king 👑 " 🗣️🗣️🗣️🔥🔥🔥

[@TheDucky16]

"Where's my crown 👑" 🗣🗣🔥🔥

[@CreppyMC]

@@TheDucky16 " that's my bling 💎" 🗣️🗣️🗣️🔥🔥🔥

[@NotGuidingLight]

​​​@@CreppyMC"Always trouble when I ring 🔥 🔥"

[@0kayArt]

I love the idea of using this a couple times to troll your friends but if you unironically use this to cheat for real that's just beyond sad 😭

[@thesillybob-1]

13:33 man this is to true

[@leepyfemboi]

FRRRRRR

[@wu1f_]

i made a loophole with the bot about me being god once and it just said something like, “you have passed away.”

[@nutsi3]

15:09 AYO? Gaping back wholes?

[@NotJohnny_6801]

Log out of KZbin for me pal 🙏

[@Jeanseb23]

Psst, extensions are archives. You can download them as a crx or use a tool to get them as a zip. Then you can load the unpacked extension. No need to build the exension when chrome's web store points to a built version already