Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Counter-Strike Global Offsets: reliable remote code execution

secret.club

Post reply on HN
Print view View original

11–20 of 94 posts

Re: Counter-Strike Global Offsets: reliable remote code execution

#11

Post by TechBro8615 »

Fun writeup, thanks. FYI to the author, on mobile there is a horizontal overflow due to one image being too wide (the dereference illustration). I really like the blog’s style otherwise.

There is one part I’m not clear about. Presumably the vector to exploit this is a malicious server, not a proxy. So if you control the server, why do you need to set two Content-Link headers to trick the parser into thinking it’s empty? Could you use a legit file and a fake content header with extra (empty) bytes? Or does that have too many side effects due to the client actually parsing the file rather than ignoring it?

Re: Counter-Strike Global Offsets: reliable remote code execution

#14

Post by stefan_ »

TechBro8615 wrote: post #11

Fun writeup, thanks. FYI to the author, on mobile there is a horizontal overflow due to one image being too wide (the dereference illustration). I really like the blog’s style otherwise. There is one part I’m not clear about. Presumably the vector to exploit this is a malicious server, not a proxy. So if you control the server, why do you need to set two Content-Link headers to trick the parser into thinking it’s emp…

The idea is that you don't want to fill the memory chunk with real data from the server but keep the contents that happen to be in there from previous allocations. Then when the proxy later retrieves the contents of the memory chunk they get essentially a random block of old heap contents. Thats valuable because those will contain (vtable) pointers that reveal where in memory the game was loaded - most executables nowadays use ASLR so a prerequisite to an exploit is having some sort of information leak like this that can tell you the base address.

Re: Counter-Strike Global Offsets: reliable remote code execution

#15

Post by inetknght »

alkonaut wrote: post #3

How can people contact big corporations and get no response? Are the messages not being read? Or is there a weird culture of fear where you’d rather silently try to fix it without acknowledging that it exists, because acknowledging a problem means taking some legal responsibility? It wouldn’t be the first instance of US law having weird effects on human behavior but it does seem a bit far fetched.

> How can people contact big corporations and get no response? Are the messages not being read?

Customer support is seen as an expense. So automate as much as their job as possible and then... stop paying for customer support.

Re: Counter-Strike Global Offsets: reliable remote code execution

#16

Post by userbinator »

alkonaut wrote: post #3

How can people contact big corporations and get no response? Are the messages not being read? Or is there a weird culture of fear where you’d rather silently try to fix it without acknowledging that it exists, because acknowledging a problem means taking some legal responsibility? It wouldn’t be the first instance of US law having weird effects on human behavior but it does seem a bit far fetched.

How can people contact big corporations and get no response?

In general, the bigger the company, the more bureaucracy and layers of indirection you have to get through to reach someone who even knows what you're talking about. This is regardless of whether the message is "bad security bug in your product" or "want to buy a million of your product".

Re: Counter-Strike Global Offsets: reliable remote code execution

#17

Post by freshair »

throwaway3699 wrote: post #5
google234123 wrote: post #4

Valve should be kicked off HackerOne. They seem to abusing the service to trick researchers into submitting vulnerabilities without providing any sort of compensation. Does anyone here work at HackerOne?

More likely is nobody at Valve cares enough to actually monitor or respond. There's plenty here about their bizarre corporate structure which really falls flat at critical times.

Does it really make a difference, with respect to whether they should be kicked off HackerOne? Incompetence and disorganization is no excuse for what is essentially (if not literally) wage theft.

Re: Counter-Strike Global Offsets: reliable remote code execution

#19

Post by Rebelgecko »

hn8788 wrote: post #13
Rebelgecko wrote: post #12

Is this the same exploit that was reported to Valve in like 2018?

No, the site has a timeline that says it was reported in January, but Valve didn't fix it until they got publicly shamed for not fixing the 2 year old RCE.

Weird, when I read the article earlier the page content stopped after the 'convars as a gadget' section. That did seem like an abrupt ending

Re: Counter-Strike Global Offsets: reliable remote code execution

#20

Post by asperous »

Another example is why app level security is so important. Why shouldn’t games allow arbitrary code execution? It only matters because the access space for programs is still so broad.

People complain when applications on Mac request permission to access files, but that makes such a huge difference. It’s time for kernel level permissions to be standard on desktops.

Post reply on HN