Call of Duty anti-cheat bug let hackers ban people with a DM

Online shooters can get contentious, so it’s no surprise that they’re filled with cheaters and regular players whose behaviors get them banned.

But some hackers were able to exploit Call of Duty‘s automated anti-cheating system to get innocent players banned, simply by sending them one line of text in a direct message. That’s right, a single message from a stranger would get your account permanently disabled.

The Verge reports that hackers who sold cheats for Call of Duty: Modern Warfare III and Call of Duty: Warzone bragged of their exploit on Twitter. The Ricochet anti-cheat system apparently scanned player files for text including the phrase “trigger bot,” so sending someone a message with those words would trigger the system to ban the receiver’s account.

The hackers claimed that this technique was used to ban “several thousand” players, including some popular streamers who got sent the messages and were banned while playing live.

For you good little video gamers, a “triggerbot” is a cheating tool that automatically clicks your mouse (or fire button) when it detects that an enemy is in your crosshairs. It’s a more subtle variation of an “aimbot” that requires the player to move and look around the environment, but can still offer a massive competitive advantage. Using one is, of course, grounds for being banned from pretty much any online multiplayer game.

Activision’s own Call of Duty Updates Twitter account announced that the Ricochet exploit had been fixed yesterday and that the “small number of legitimate player accounts” that were banned have been restored.

In Activision’s defense, millions of people play the Call of Duty games, so thousands of bans would still be a relatively small number. Policing these online systems is essentially impossible without a large degree of automation, and it’s inevitable that cheaters will always find some way to exploit them on a pretty regular basis.