How hackers broke Pokémon Go’s anti-cheat technology in four days

I stumbled on to the Java API a day or two after the launch and that was actually the first time I'd downloaded and run the Pokemon Go app. It was funny that writing code against the Niantic API was actually WAY more interesting than the game for me.

A week or two of playing around with it was all I needed to satiate my interest but it was a pretty neat thought excercise to avoid bans and come up with different strategies for maximizing XP gains and making the bot make better decisions and take efficient paths to high value areas.

The annoying thing was wading through slack and discord channels of people who had no clue what was going on but were pissed that their bots weren't working or that we weren't providing compiled binaries.

The reverse engineering thread on Discord was one of the most exciting spontaneous collaborative coding sessions I've read. There were several talented coders using the IDA disassembler to reverse engineer the encryption scheme tacked on to Niantic's API and bypassing the new security scheme.

Niantic's (mis)handling of the PoGo launch might go down in history as a seminal case study in how to botch a black swan event: disabling the spontaneous tracking aka the 3-step bug, constant server issues, premature shutting down of pokemon map sites (that mainly arose from the aforementioned 3-step tracking being disabled), bugs in the game play, lack of perceived engagement with the community, the disparity in game experience between rural and urban players, unbalanced gym mechanics, divergence from the core Pokemon experience, etc.

The gyms of the countries that are now getting PoGo are already flooded by geo-spoofers/bots and most will never get to experience the scavenger hunt like excitement with neither the in app radar or third party maps. I truly hope that Niantic manages to recapture the initial excitement an deliver on the original promise and manage to engage third party developers and the player community.

I was pretty heavily involved in the reverse engineering process (although more the management side as opposed to the RE side).

AMA?