FFXIV Patch 7.2 Security Flaw Bypassed by Modders

by

Summary

  • The Final Fantasy 14 Patch 7.2 security fix has already been bypassed by a programmer.
  • NotNite and friends cracked Square Enix’s security measures in a few hours.
  • Concerns have previously been raised about the PlayerScope mod accessing sensitive information.

The anticipated update for Final Fantasy 14, Patch 7.2, aimed to rectify a vulnerability that permitted mods such as PlayerScope to monitor characters without authorization. However, a developer has declared that Square Enix’s attempts have been outmaneuvered. The developer further explained how they, along with other Final Fantasy 14 players, discovered the modifications made in Patch 7.2 by Square Enix and expressed their apprehensions about this situation.

On March 25, after a 24-hour maintenance, Update 7.2: Seekers of Eternity went live. This update brought in the upper tier of the Arcadion raid series, Cruiserweight, and continued the main storyline of Dawntrail. Alongside these additions, Seekers of Eternity made significant changes to several jobs. For instance, the Black Mage now casts spells faster and deals more damage, while the Pictomancer’s burst damage was reduced following player feedback. Additionally, this update aimed to secure player account data in Final Fantasy 14 by adding a layer of encryption.

Despite Square Enix’s recent attempt to strengthen security with Patch 7.2, it appears these efforts have been bypassed. In an interview with PC Gamer, a player named NotNite revealed that she and her friends managed to crack the new security measures implemented by Square Enix. The network obfuscation added in Patch 7.2 aimed to protect account ID information, but it was eventually decoded using an algorithm. After gaining consent from some friends for testing purposes, NotNite’s method proved effective following several hours of trial and error, which she shared on Bluesky.

Final Fantasy 14 Patch 7.2 Security Changes Already Rendered Vulnerable

IMPORTANT UPDATE: after a *lot* of testing and a group chat full of my smartest FFXIV friends, we have figured out the obfuscation is vulnerable, and that the account IDs are actually reversible. SE needs to stop sending the account ID entirely to clients and just set a hidden flag or something — NotNite (@notnite.com) 2025-03-25T22:34:23.484Z

NotNite didn’t reveal the method they employed to crack Square Enix’s encryptions, but they mentioned that mods for Final Fantasy 14 capable of retrieving account ID data, such as PlayerScope, will probably be revised once the technique is deciphered. This isn’t a new concern among players of Final Fantasy 14, as PlayerScope is a mod that collects information on all characters linked to a player’s account by tapping into client-side data. This data could potentially be exploited by malicious users for stalking or harassment purposes.

It seems that NotNite concluded the modifications in Final Fantasy 14 were likely prompted by challenges related to development time and resources. Back in January, Square Enix confirmed PlayerScope’s presence and emphasized once more that modifying or using third-party tools goes against the game’s terms of service. Furthermore, as mentioned in Patch 7.2 notes, alterations in Account IDs might result in some player names becoming unavailable. However, any affected profiles can be recreated.

After her tests, NotNite expressed dissatisfaction with Square Enix’s endeavors and recommended that the company should take measures to prevent sending confidential data to game users. In addition to a series of DDoS attacks on the servers of Final Fantasy 14, it remains to be seen how Square Enix will react in response.

Read More

2025-03-29 01:44