LBP Union is indefinitely suspending service for Beacon, our LittleBigPlanet custom server. We have identified a credible means by which an adversary can forcibly join another player without their consent from any server. As a result, we no longer recommend playing on any custom server. This advisory will explain everything we know and what it will take to reactivate Beacon’s operations.
Video on This Topic
Discovery
On May 7th, LBP Union’s team received source code for a script which would automatically find other online RPCN users playing LittleBigPlanet online and create modified LittleBigInvites. These modified invites trick the victim’s game into immediately accepting the adversary’s join request without consent. This would allow the adversary to place down modded items with scripts into the session, a vulnerability described in a previous advisory.
This can be executed from any custom server, making it impossible to moderate or protect against by the server or the end user. This issue affects all custom servers because it is an issue with the game itself, also known as the client.
Closing Beacon
We have decided to close Beacon because playing LittleBigPlanet online has become too dangerous. The ability to force join players, even from remote servers, is too serious to ignore. More importantly, there’s nothing that can be done from the server-side to protect users. Even placing a custom server into a read-only state would still render users vulnerable to this exploit. To protect our community, we have no choice but to indefinitely suspend service for Beacon until a client-side patch or other solution is available. We are exploring options to restore service. No custom server is safe from this exploit because this problem is caused by an issue with the game itself.
Potential Solutions
There are a few potential, long-term solutions that could be attempted to approach this problem. However, they are not without significant challenges. If any of these possible solutions are viable and are completed, we may be able to restore service to Beacon.
Game Patch
The best case scenario is a game patch that removes the threat of custom scripts and the ability to forcibly join others. However, the sheer difficulty of decompiling each game is daunting. If it’s possible, it could take years or even decades to realize. We are interested in organizing a collaborative effort to pursue this goal, no matter how long it takes to realize the results. We strongly encourage anyone with reverse engineering experience to please share and collaborate to discuss ways of developing such a patch. If you’d like to discuss it on our Discord server, the #community-dev channel is a great place to do that.
Custom RPCN
We are considering operating our own RPCN server that would be compatible with Beacon. This would enable us greater control over who can register an account. It also potentially could allow us to restrict usage of the server in ways that we currently can’t with the official RPCS3 service. However, further research and testing will be needed to determine the viability of this approach. Unfortunately, this would not support official hardware like PlayStation 3 and Vita.
Additional Client-side Software
Hypothetically, additional client-side software could be developed which would need to be run at the same time as a patched LittleBigPlanet game. This might take the form of a VSH plugin on PlayStation 3, or an executable program on desktop machines running RPCS3. Such software could disrupt the ability of the game to play with other people. This could allow the game to be played without risk of anyone joining your session. However, it might mean that you’d only be able to play custom servers in a single-player experience. Alternatively, such software could help prevent malicious scripts from running. Unfortunately, there is always the risk that running such software could be cumbersome and difficult to enforce across all players of a server.
Other Temporary Solutions
Users might consider using remote desktop solutions like Parsec for couch co-op gameplay over the Internet. It’s also possible to download and play levels from archival sites like zaprit.fish. We are interested in supporting the development of an accessible means to easily share and download new and original community levels on the web.
Where We Go From Here
We are immeasurably disappointed by this outcome, but it is the only choice that we have at this time. LBP Union will continue to maintain its community as a place for all LittleBigPlanet fans. We will explore opportunities to continue engaging with this incredible community while offline, and encourage the research and development of potential solutions to this monumental challenge.
When the LittleBigPlanet servers for PlayStation 3 and Vita shut down in 2021, this community overcame previously thought to be insurmountable odds. Through our creativity, imagination, and ingenuity, we worked together to create custom servers that reconnected that fallen Cerebrum-bilical Cord. Our resilience is a Beacon that shines even in our darkest moments. If this is a game that you love, don’t give up. Someday we’ll play together again.
