b0tacc0unt9952-hub/heino-dma-mitm-bypass-disclosure-riot-fail

Redacted research on Thunderbolt PCIe DMA bypass via firmware spoofing and commodity adapters. Privately disclosed to Riot Games (HackerOne #35330606) on Jan 29, 2026. Closed ineligible as "physical facilities" after 6 days with no human response. Shared defensively to help anticheat teams strengthen hardware protections against cheating.

1 best points · 1 comments · 1 Hacker News post · 34 GitHub stars · View on GitHub

From the README

Heino DMA / PCIe MITM Bypass — Disclosure & Vindication April 11, 2026 — Commercial products are now selling that implement the exact architecture I disclosed to Riot Games and other anticheat vendors in January 2026. They declined to engage. Three months later the hardware is on the market. This repo documents what I reported, when I reported it, and what happened after. What I Disclosed in January 2026 I submitted a coordinated disclosure to major anticheat vendors describing a PCIe Man-in-the-Middle hardware attack. The core of it: A device sits in a PCIe slot and mirrors the identity of a real, legitimate piece of hardware — an NVMe drive, a network card, whatever.

Hacker News discussions

• Heino DMA / PCIe MitM Bypass – Disclosure and Vindication (1 points, 1 comments, by undersuit, 2026-05-22)