Remote Code Execution in Marvel Rivals Game
shalzuth.com
Remote Code Execution in Marvel Rivals Game
1–10 of 132 posts
Re: Remote Code Execution in Marvel Rivals Game
#2> the game runs with admin privileges for the sake of anti-cheat
"sake of anti-cheat" should be taken lightly here. There is a reason why all the other sane anti-cheats have at least two applications, the anti cheat service which often runs as admin, and the game, which does not. Running the game as admin is quite frankly inexcusable.
The service often does the network comms and communicates to a kernel-mode driver and/or to the application via IPC or similar. Having defined barriers of separation are good things.
In any case, this POC doesn't have huge implications necessarily for most people, but maybe in SEA or China where LAN cafes are more prevalent, it could be a larger concern.
Re: Remote Code Execution in Marvel Rivals Game
#3> the game runs with admin privileges for the sake of anti-cheat "sake of anti-cheat" should be taken lightly here. There is a reason why all the other sane anti-cheats have at least two applications, the anti cheat service which often runs as admin, and the game, which does not. Running the game as admin is quite frankly inexcusable. The service often does the network comms and communicates to a kernel-mode driver a…
The one implication that I (the author) should highlight for the extra paranoid - this exploit extends to ISP's and cloud vendors that traffic is routed through. Anywhere in the trace route can MITM. It depends on how much you trust those parties.
Re: Remote Code Execution in Marvel Rivals Game
#4> the game runs with admin privileges for the sake of anti-cheat "sake of anti-cheat" should be taken lightly here. There is a reason why all the other sane anti-cheats have at least two applications, the anti cheat service which often runs as admin, and the game, which does not. Running the game as admin is quite frankly inexcusable. The service often does the network comms and communicates to a kernel-mode driver a…
The one implication that I (the author) should highlight for the extra paranoid - this exploit extends to ISP's and cloud vendors that traffic is routed through. Anywhere in the trace route can MITM. It depends on how much you trust those parties.
tried in some communities of gamedev to talk about security but i gave up. i think the main sentiment is not to care at all. so many games have or had trivial exploits. enabling mass cheating, harasment of other players (DOS) and more nefarious stuff. for people whwo think the mitm wont affect them... thats a silly stance. people hack home routers on massive scales. (another domain who doesnt seem to give shits about security)
good writeup! thanks!
Re: Remote Code Execution in Marvel Rivals Game
#5For a second I thought this was the Marvel game that got briefly banned along with TikTok, but that's marvel Snap.
It would have been a tiny bit funny if it had been the same company that was just briefly banned that was allowing a remote exploit.
Re: Remote Code Execution in Marvel Rivals Game
#6Earlier quoted context omitted.
The one implication that I (the author) should highlight for the extra paranoid - this exploit extends to ISP's and cloud vendors that traffic is routed through. Anywhere in the trace route can MITM. It depends on how much you trust those parties.
tried in some communities of gamedev to talk about security but i gave up. i think the main sentiment is not to care at all. so many games have or had trivial exploits. enabling mass cheating, harasment of other players (DOS) and more nefarious stuff. for people whwo think the mitm wont affect them... thats a silly stance. people hack home routers on massive scales. (another domain who doesnt seem to give shits about…
Their's a really good argument for having a "gaming" os, Windows, and a serious OS , Linux on the same computer.
If League of Legends needs super admin mode, it's no longer my computer. I'm sharing it with Tencent. I can't trust them ( specifically a disgruntled employee) to not install key loggers and other really nasty things.
Re: Remote Code Execution in Marvel Rivals Game
#7The engineering culture behind AAA video games is rotten to the core with regards to security. Everyone thinks they're making Doom 3 and they're really making Windows 2000 Service Pack 1.
Re: Remote Code Execution in Marvel Rivals Game
#8The engineering culture behind AAA video games is rotten to the core with regards to security. Everyone thinks they're making Doom 3 and they're really making Windows 2000 Service Pack 1.
Great commentary, today the industry is focused on delivering free game with tons of cosmetics (which gives a ton of money) but forgetting about performance and security.
Re: Remote Code Execution in Marvel Rivals Game
#9Earlier quoted context omitted.
tried in some communities of gamedev to talk about security but i gave up. i think the main sentiment is not to care at all. so many games have or had trivial exploits. enabling mass cheating, harasment of other players (DOS) and more nefarious stuff. for people whwo think the mitm wont affect them... thats a silly stance. people hack home routers on massive scales. (another domain who doesnt seem to give shits about…
Their's a really good argument for having a "gaming" os, Windows, and a serious OS , Linux on the same computer. If League of Legends needs super admin mode, it's no longer my computer. I'm sharing it with Tencent. I can't trust them ( specifically a disgruntled employee) to not install key loggers and other really nasty things.
this is also a good argument. the anti cheat is impossible to implement in usermode, but you can hardly trust developerd with kernel mode drivers that trace all things.
im not sure if a gaming os would help there.
it would be helpful if OSes wouldnt allow things like malicious drivers but this is an extremely hard problem in light of people loading known vulnerable drivers and exploiting those...
you could argue that a lot of drivers could live in ring 1 or 2 rather than ring0, but that no OS implements.
working on an OS to try and think of solutions to this types of issues, but u know... if u can wait like 40 years maybe it will be done (and likely it will be vulnerable in different ways :(( )
Re: Remote Code Execution in Marvel Rivals Game
#10Earlier quoted context omitted.
tried in some communities of gamedev to talk about security but i gave up. i think the main sentiment is not to care at all. so many games have or had trivial exploits. enabling mass cheating, harasment of other players (DOS) and more nefarious stuff. for people whwo think the mitm wont affect them... thats a silly stance. people hack home routers on massive scales. (another domain who doesnt seem to give shits about…
Their's a really good argument for having a "gaming" os, Windows, and a serious OS , Linux on the same computer. If League of Legends needs super admin mode, it's no longer my computer. I'm sharing it with Tencent. I can't trust them ( specifically a disgruntled employee) to not install key loggers and other really nasty things.
This is essentially my Windows box. I use it for gaming, and RDP in from one of my other computers (all of which run GNU/Linux), when I need to run a Windows program away from the house.
I treat it as though there's a random russian dude watching my every move through RDP keylogging all my inputs (and for how many one-off cracked programs have been installed on there over the years, it's not impossible).
I can't imagine keeping my password manager and primary accounts logged-in on the same computer I have rootkits like Riot Anticheat and technical disasters like Marvel Rivals installed on.