Investigation into comments relating to players attacking others who have logged out

[Chewett]

Summary

Today at 18:08 a member on Discord made comments which seemed to imply a number of players were abusing bugs to attack them when offline. After significant investigation it was found that the issue was not due to bugs but because the player was using two devices to play MD and had not logged out of both.

During this investigate I disabled the combat system to preserve evidence. This was re-enabled at 19:27 after the appropriate information had been gathered.

We take accusations of bug abuse seriously and if you believe  anyone is abusing bugs please report it to a game admin.

No bug abuses have been found and no further action will be taken.

Full Report

Today one member of the MagicDuel family made a comment on Discord stating that seemed to imply people were cheating and attacking them while offline. This was concerning given Aia's latest contest so I immediately stopped what I was doing to investigate this. This comment was as follows:

Quote

Note to self. Logging out anywhere but a sanctuary, somehow means you can still be attacked. Good to know.

This was accompanied by an image that was suggesting a number of players were abusing this with an accusatory tone:

The colours indicate each player who was accused, since these accusations have been proven false their names have been removed.

Sadly the player did not include information about the times the attack occurred to aid the investigation so it took significantly longer then it should.

Fetching attack logs

First I correlated the data in the screenshot with the database and reproduced the information I did not have:

blue - Sun Mar 14 2021 11:48:17 GMT+0000
orange - Sun Mar 14 2021 11:50:02 GMT+0000
green - 1615722923 - Sun Mar 14 2021 11:55:23 GMT+0000
red - 1615722938 - Sun Mar 14 2021 11:55:38 GMT+0000
orange - Sun Mar 14 2021 11:59:38 GMT+0000
green - 1615723593 - Sun Mar 14 2021 12:06:33 GMT+0000
orange -  Sun Mar 14 2021 12:15:10 GMT+0000

Here you can see that the last attack on the player happened at 12:15:10 GMT+0000

Checking logout time

I was not provided any details of when the player making the comment had logged out so I correlated their IP  address used to log in with the access logs. From investigating this I discovered that they logged out at 11:51:57 +0000 with the browser Chrome 88

Checking browser access logs

To finish the investigation I cross-referenced the data against any other account actions and found that there were two browsers accessing the account. The final account access was at 12:17:49 +0000 with the browser Chrome 76.

It seems that since the player was logged onto two devices they did not log out from both and was only removed from the online players list when they stopped accessing MD from the second device. This meant they were attacked after pressing logout, but before closing all browsers.

Note to everyone

Please note that using multiple browsers with MD may cause unpredictable behaviour and confusion to yourself such as this. If you are using multiple browsers you will want to make sure you log out from all of them when logging out.

Names have been removed from to preserve privacy because they are not important to the investigation or report.