Security Risk: The game leaks your IP to ALL your steam friends

[DBW]

The game has been suffering from this issue since day one

If you are online on steam your steam friends can get your IP by simply checking your Game Info while you are in game in one of the following game states:
- Player lobby
- unranked search/match
- ranked search/match
- Probably in Tekken Lounge but I haven't checked it yet

I suggest going Invisible on steam until they patch it and don't accept any friend requests after beating someone on ranked, just to be extra safe :D

This has been reported on various forums, on X using #t8_report mentioned Harada but no one seemed to care so far.

This is a huge issue, streamers have had to avoid playing this game because DDoS attacks already on Day 1.

[CyberDNIWE]

That would be a risk if I didn't play on neighboring McDonald's wifi all the time.
Seriously though, it's alarming and they shouldn't do it like that. Only problem is - they cant because they suck at software engineering and always have :(

[Castyles]

Got any proof? Perhaps a screenshot with the IP address of a buddy of yours (everything censored, obviously) while they're playing the game or something?

Not trying to be an ♥♥♥♥♥♥♥, mind you. It's just that everyone would be in a complete uproar if such a thing was actually legit and the entire internet, save for you, is silent about the subject.

[DBW]

Originally posted by comatosedragon:

Originally posted by DBW:

It was explained below, you can deny it all you want and try to dismiss every fact i've exposed, doesn't make it a fake issue, and again, I'm not the one that is trying to create drama. You can ignore my post and cybersecurity as a whole topic.

You may be correct, and perhaps I did not explain my thoughts on the issue very well, I instead jumped to juvenile responses. I read what you posted about distributed denial of service attacks, and I assure you that I do take cyber security seriously.

I just don't find that credible.

My thought is, if this was an actual issue, why would the Bandai / Namco not have addressed this issue? Especially if there was a patch just recently? And no, I am not blindly following my corporate masters, I am just saying if this was an actual security risk, why wouldn't they have fixed it by now in order to protect themselves as a corporate entity?

Like I said, I may be wrong, I may be truly ignorant, but these are my thoughts on the matter.

You can try it yourself if you want, join any of the modes I listed and ask your friend to right click on your name on Steam and click Game Info, it will display your ip address.
It is an actual security risk, the chances of anyone exploiting it however is probably very small.

But It doesn't even need to be anyone you know to have malicious intent, if their steam accounts are compromised etc.. but that is even less likely tbh

[Axel]

Originally posted by Castyles:

Got any proof? Perhaps a screenshot with the IP address of a buddy of yours (everything censored, obviously) while they're playing the game or something?

Not trying to be an ♥♥♥♥♥♥♥, mind you. It's just that everyone would be in a complete uproar if such a thing was actually legit and the entire internet, save for you, is silent about the subject.

I just did it on someone and let them know about the issue. works on any mode that connects you with other players or puts you in a room that has internet connectivity.

https://ibb.co/b5WNLCH

I used ImgBB as the source since i did not want to login on IMGUR. Of course everything is censored, besides the map. and such. It does not provide an EXACT location if you look up an ip address with google. Just the town.

The game uses Peer 2 Peer connection (P2P) And i checked to see if its some kind of server IP and it isn't everyones i checked changed. I even checked my own and it showed up my state. Though to do this you have to have them as a friend. So just dont accept random friend invites on steam really. Or just show offline while playing Tekken 8.

[DBW]

Originally posted by Castyles:

Got any proof? Perhaps a screenshot with the IP address of a buddy of yours (everything censored, obviously) while they're playing the game or something?

Not trying to be an ♥♥♥♥♥♥♥, mind you. It's just that everyone would be in a complete uproar if such a thing was actually legit and the entire internet, save for you, is silent about the subject.

I can post proof in a few, but I explained the steps previously, just join any of the modes I listed and ask anyone from your steam friends to right click your name and game info, ask what IP address they see, and check yours on https://www.whatismyip.com/

One of the reasons why there isn't much of an uproar is because the game is P2P anyway so anyone you match with could probably capture your ip easily (I haven't checked myself)

And the other is the people you already saw in the thread, people just don't care about all this apparently :D

[Axel]

Originally posted by DBW:

Originally posted by Castyles:

Got any proof? Perhaps a screenshot with the IP address of a buddy of yours (everything censored, obviously) while they're playing the game or something?

Not trying to be an ♥♥♥♥♥♥♥, mind you. It's just that everyone would be in a complete uproar if such a thing was actually legit and the entire internet, save for you, is silent about the subject.

I can post proof in a few, but I explained the steps previously, just join any of the modes I listed and ask anyone from your steam friends to right click your name and game info, ask what IP address they see, and check yours on https://www.whatismyip.com/

One of the reasons why there isn't much of an uproar is because the game is P2P anyway so anyone you match with could probably capture your ip easily (I haven't checked myself)

And the other is the people you already saw in the thread, people just don't care about all this apparently :D

Dont have to show proof i did above. ^

[DBW]

Originally posted by Axel:

Dont have to show proof i did above. ^

Great! Thanks!

[Axel]

Originally posted by DBW:

Originally posted by Axel:

Dont have to show proof i did above. ^

Great! Thanks!

There is also an on going thread on reddit about this. Im not sure if this problem was present on Tekken 7.

[loitertude]

What you mean is don't play online games on pc, it's literally never a good experience unless it's turn based or you got completely ripped off on the latest specs. Even a console older than 2 years is beaming with misconduct, but it's more like an economic 3 years... Unless they suck at producing anything like they do now and just made Helldivers 2 or some pos. Just thinking about GTAVI online makes me shudder, there will need to be something new to play it on and that's where they got you.

[MechaDeka]

Originally posted by loitertude:

What you mean is don't play online games on pc, it's literally never a good experience unless it's turn based or you got completely ripped off on the latest specs. Even a console older than 2 years is beaming with misconduct, but it's more like an economic 3 years... Unless they suck at producing anything like they do now and just made Helldivers 2 or some pos. Just thinking about GTAVI online makes me shudder, there will need to be something new to play it on and that's where they got you. :Dosh:

Did you really type this, look at it, and think you were being remotely coherent?

[ShadowSplit]

Splendid.

So, your Tekken friends (ones you don't have on your Steam list) are unable to see it or they can see it, too?

[Hidebehind]

Originally posted by DBW:

Originally posted by DoDonPachi:

Who had to drop the game? And why? And if this is a big deal why isnt everybody talking about it?

fake drama fake issue

Watched a streamer called elajjaz try to play close to launch day only to constantly get DDoS'd, not saying that it couldn't have been completely unrelated but it doesn't change the fact that its a security risk and IS an issue, regardless of people giving a damn about it or not.

There is no drama, I made the post to raise awareness to people who DO give a damn, and potentionally Bandai Namco in case they weren't aware.

This is horrible! Some streamer decided to call himself a victim to be supported by donations! I've never seen anything like this before!
To start playing, you were asked to read the license agreement, and you naturally read it in full, right? You agreed with every word in it and started playing. If you didn't like something in the license agreement, you could have easily got your money back. But you read the whole text like a good boy, agreed to all the terms, and now you are complaining about what you agreed to? That doesn't make sense.

Only very popular streamers are subject to DDoS attacks. At best, it is done by one person in a thousand. That person has ways to get IP targets without buying the game. I'm going to upset you very much and probably hurt your ego, but no one wants your IP.

[DBW]

Originally posted by Hidebehind:

Originally posted by DBW:

Watched a streamer called elajjaz try to play close to launch day only to constantly get DDoS'd, not saying that it couldn't have been completely unrelated but it doesn't change the fact that its a security risk and IS an issue, regardless of people giving a damn about it or not.

There is no drama, I made the post to raise awareness to people who DO give a damn, and potentionally Bandai Namco in case they weren't aware.

This is horrible! Some streamer decided to call himself a victim to be supported by donations! I've never seen anything like this before!
To start playing, you were asked to read the license agreement, and you naturally read it in full, right? You agreed with every word in it and started playing. If you didn't like something in the license agreement, you could have easily got your money back. But you read the whole text like a good boy, agreed to all the terms, and now you are complaining about what you agreed to? That doesn't make sense.

Only very popular streamers are subject to DDoS attacks. At best, it is done by one person in a thousand. That person has ways to get IP targets without buying the game. I'm going to upset you very much and probably hurt your ego, but no one wants your IP.

No one complained, I shed light to a security risk the developers probably did not intended to ship their game with. Try reading and comprehending the original post and my comments. Even I said that chances of this issue being exploited is very small.
Doesn't make it a non issue. Thanks for bumping the discussion though!

[DBW]

Originally posted by ShadowSplit:

Splendind.

So, your Tekken friends (ones you don't have on your Steam list) are unable to see it or they can see it, too?

Only people who are on your steam friends list can see it

[ShadowSplit]

Originally posted by DBW:

Originally posted by ShadowSplit:

Splendind.

So, your Tekken friends (ones you don't have on your Steam list) are unable to see it or they can see it, too?

Only people who are on your steam friends list can see it

Wondefully stupid design...