'I had my fun' says hacker who used Call of Duty anti-cheat exploit to ban 'thousands upon thousands' of innocent players

pcgamer.com:

Last month, Activision posted that they'd «identified and disabled a workaround» within their automated anti-cheat tool, Ricochet. The language of the post is purposefully vague about what actually happened, but the studio asserts that only a «small number» of legitimate Call of Duty: Warzone and Modern Warfare III players were affected, and that those accounts have since been reinstated.

However, it wasn't long before hackers shared their side of the story—to say nothing of all the angry responses under Activision's post from players still locked out of their accounts. A hacker known as Zeebler was the first to publicly share details of the exploit, explaining how it allowed them to remotely permaban players by typing as few as two words into the lobby chat. TechCrunch has since caught up with the hacker who originally found the exploit. 

Going by the handle Vizor, the hacker in conversation alleges the extent of the issue was much farther reaching than Activision is willing to admit, saying they were able to remotely ban “thousands upon thousands” of players. Perhaps most damningly, the hacker also tells TechCrunch, «I could have done this for years and as long as I target random players and no one famous it would have gone without notice.»

Aimbots have been the bane of many a shooter fan's existence—and indeed even threw Apex Legends' anti-cheat software for a loop—so you can understand why Ricochet would have cheats like this in its sights. What is a lot less straightforward to understand is how simply typing the words 'aim bot' and sending them to another player could get them banned.

Vizor explained that Ricochet uses a list of hardcoded strings of text to detect cheaters and that they then exploited this to ban innocent players by simply sending one of these strings via an in-game whisper. To test the exploit the day they found it, they sent an in-game message containing one of these strings to themselves and promptly got banned.

Vizor elaborates, «I realized