Brad Dixon - Cheating in eSports: How to Cheat at Virtual Cycling
Reverse engineers the Zwift virtual cycling platform to demonstrate trivial speed cheating via client-side protocol manipulation.
Summary
Cheating in Virtual Cycling: Zwift
Brad Dixon presents a technical analysis of cheating in Zwift, the popular indoor cycling eSports platform used by professional athletes and millions of recreational cyclists.
Zwift Architecture and Trust Model
Zwift relies on a Windows/macOS client application that reads power meter and speed sensor data via Bluetooth/ANT+ and transmits it to cloud servers. The server trusts client-reported power values with minimal server-side validation.
Protocol Reverse Engineering
Dixon reverse engineers the Zwift client's network protocol using Wireshark and custom parsers, identifying the UDP and WebSocket messages that transmit rider power, cadence, and position.
Cheat Implementation
By injecting modified packets reporting artificially high power output, a rider can ride at simulated speeds of hundreds of kilometers per hour. Dixon demonstrates this in a live race, winning by minutes with near-zero physical effort — exposing the fundamental trust problem in all competitive online fitness applications.
Related talks
Main Stage·38 min
Jack Baker
Demonstrates memory editing and cheat development for WebAssembly-based browser games using dynamic binary instrumentation.
Main Stage·47 min
Dan Petro
Dan Petro reverse engineers Super Smash Bros. Melee memory structures to design an automated AI agent with sub-millisecond reaction speeds.
Main Stage·40 min
Julian Horoszkiewicz
Demonstrates rapid vulnerability discovery methodologies that uncovered seven zero-day local privilege escalation flaws in pre-installed OEM bloatware.