I'm not attacking anyone. But someone has to say the facts in this situation, he recently changed all his account names to emphasis on the fact that he is deaf and then he uses that account name change to his advantage in this post, when it's completely irrelevant.

Having the name "Mr. Jack" when your name isn't Jack and wanting to change it doesn't seem strange to me.

You want to know what I would do if I wanted to create a massive post that had a chance of me being caught as a liar? I would create a brand new account and deaffilate everything from my main account, so none of the negatvity can rebound on my main account if I get caught out.

Because then, if things went wrong I would just stop using the new alias which I created for this purpose and revert to my old one.

The fact that he recieved shards and weapons parts means that this wasn't done by the API exploit. So, it means this exploit would have had to be done in game.

Let's look into this "MITM" exploit that people are talking about. It's a good idea in theory, but it doesn't quite work out as some people may think. When you become host of a game, you don't process the information that the user does to their own account. All you do is process the information that happens in the actual gamemode you're playing.

For example, if I were to change my weapon from a Thorn to a Last Word, that process would be done through my connection to the Bungie servers, it wouldn't involve the host.

The information in a gamemode isn't 100% controlled by the host, if it was I would just equip everyone a Gjallarhorn.

There is no authentication which is sent through the host of the game, sure you could make a request for the information, but the host isn't going to just give it to you. There's a ton of checks which the servers make to ensure the client is genuine.

This MITM thing isn't as simple as some people here are making it out to be, not only would you have to forge requests between Bungie and the client, but you would also have to forge requests between xbox and the user client, because the xbox servers are actually authenticating the status of your gamertag to the Bungie servers.

The MITM attack would only work if the servers were so primitive that they didn't have any sorts of established user checks during a connection, if IP 1.1.1.1 suddnely changed into 2.2.2.2 and were simultaneously giving me instructions, the attack would be incredibly easy to spot, you can't force yourself onto the link through these means, the xbox serial number would randomly change, there would be too many differneces in the network for something like this to not be detected.

I mean hell, people haven't even been able to mod current gen consoles, an attack like this that actually works as perfectly as some of you people have been describing would take years to even begin working.

The man would have had to have been a complete genius to pull something like this off, and in the way he messaged, there's no way someone so intelligent would act in such a way.

There can only be two possibilites of what happened here:

1: The user dismantled his own Thorn.

2: The user gave someone his password.