Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Valve accused of ignoring existing RCE vulnerability in Source games for 2 years

twitter.com

Post reply on HN
Print view View original

11–20 of 122 posts

Re: Valve accused of ignoring existing RCE vulnerability in Source games for 2 years

#11

Post by invokestatic »

xyst wrote: post #2

This is why I have a separate machine for "gaming" and "work" Some game companies (riot games) even install their anti-cheat software so that is loads in the ring 0 space. Even with their best efforts, cheaters will still prosper. Might even go a step further and firewall my gaming machine off from the rest of my network.

No, anti-cheats in ring0 haven't eliminated cheaters, but that was never the point. The point is to make it more difficult to cheat. And they have succeeded in that. Check any cheat forum like unknowncheats. You'll see that most hackers now have to chain multiple (complex) exploits together to get their cheats working, only to get it patched by the anti-cheats a few days/weeks later. This is way more difficult and prone to detection than ReadProcessMemory was before anti-cheats went ring0.

Re: Valve accused of ignoring existing RCE vulnerability in Source games for 2 years

#12

Post by walrus01 »

xyst wrote: post #2

This is why I have a separate machine for "gaming" and "work" Some game companies (riot games) even install their anti-cheat software so that is loads in the ring 0 space. Even with their best efforts, cheaters will still prosper. Might even go a step further and firewall my gaming machine off from the rest of my network.

It seems that a lot of people forgot about things like sony installing rootkits on peoples' PCs. Now it's accepted for gaming anti cheat software?

Re: Valve accused of ignoring existing RCE vulnerability in Source games for 2 years

#13

Post by veeti »

pricechild wrote: post #6
mxscho wrote: post #3

According to a tweet that was also retweeted by the user @floesen_ who was mentioned in the original thread, the initial report 2 years ago was done using HackerOne but has probably not seen any helpful response from Valve [1]. There are also other reports of Valve not reacting to HackerOne reports appropriately [2]. It is currently unclear whether there is a publicly available PoC or any exploitation going on in the…

> There are also other reports of Valve not reacting to HackerOne reports appropriately I'll second that. I discovered and reported a vulnerability with the Steam client's Bluetooth pairing process via hackerone. The issue was confirmed but decided "out of scope" as apparently "within bluetooth range" runs afoul of the bug bounty's "require physical access" exclusion. 8 months later (I haven't exactly kept on top of…

Just release it. Maybe Valve will have to do something once folks start losing their precious CS:GO skins?

Re: Valve accused of ignoring existing RCE vulnerability in Source games for 2 years

#14

Post by atat7024 »

dafelst wrote: post #7

I have a friend who used to work at Valve as a software engineer - he mentioned to me that the entire source networking stack is chock full of unchecked buffers and all sorts of potential for fairly trivial RCEs, but due to Valve's internal structure (or lack thereof) there really isn't any incentive for anyone to fix them. This was 5-6 odd years ago and he no longer works there, so things might have changed, but bas…

Game devs don't optimize for security, because they're not incentivised to.

Re: Valve accused of ignoring existing RCE vulnerability in Source games for 2 years

#15

Post by fpgaminer »

xyst wrote: post #2

This is why I have a separate machine for "gaming" and "work" Some game companies (riot games) even install their anti-cheat software so that is loads in the ring 0 space. Even with their best efforts, cheaters will still prosper. Might even go a step further and firewall my gaming machine off from the rest of my network.

This is the way.

Many games package in outright spyware that siphon all kinds of data off your machine including browsing history. Kerbal Space Program was infamous for this (they removed the spyware at some point but I haven't checked recently if it was ever added back in).

Re: Valve accused of ignoring existing RCE vulnerability in Source games for 2 years

#16

Post by KyleSanderson »

dafelst wrote: post #7

I have a friend who used to work at Valve as a software engineer - he mentioned to me that the entire source networking stack is chock full of unchecked buffers and all sorts of potential for fairly trivial RCEs, but due to Valve's internal structure (or lack thereof) there really isn't any incentive for anyone to fix them. This was 5-6 odd years ago and he no longer works there, so things might have changed, but bas…

Indeed, there's still plenty of these.

Re: Valve accused of ignoring existing RCE vulnerability in Source games for 2 years

#17

Post by mhh__ »

invokestatic wrote: post #11
xyst wrote: post #2

This is why I have a separate machine for "gaming" and "work" Some game companies (riot games) even install their anti-cheat software so that is loads in the ring 0 space. Even with their best efforts, cheaters will still prosper. Might even go a step further and firewall my gaming machine off from the rest of my network.

No, anti-cheats in ring0 haven't eliminated cheaters, but that was never the point. The point is to make it more difficult to cheat. And they have succeeded in that. Check any cheat forum like unknowncheats. You'll see that most hackers now have to chain multiple (complex) exploits together to get their cheats working, only to get it patched by the anti-cheats a few days/weeks later. This is way more difficult and pr…

Surely the end state is cheats that even ring0 can't see i.e. read the display directly, act through the mouse.

Maybe we should we run the entire OS in the games hypervisor?

Re: Valve accused of ignoring existing RCE vulnerability in Source games for 2 years

#18

Post by rstat1 »

walrus01 wrote: post #12
xyst wrote: post #2

This is why I have a separate machine for "gaming" and "work" Some game companies (riot games) even install their anti-cheat software so that is loads in the ring 0 space. Even with their best efforts, cheaters will still prosper. Might even go a step further and firewall my gaming machine off from the rest of my network.

It seems that a lot of people forgot about things like sony installing rootkits on peoples' PCs. Now it's accepted for gaming anti cheat software?

In my mind there's a huge difference between the 2. The sony rootkit was installed in secret, full of security holes, hard to remove, and made by a vendor that appeared to give 0 shits about said security holes.

All of the anti-cheat solutions I've seen that run in kernel mode are none of those things. They make it well known that they're installing, are made by vendors that actively care about the security of their products, and are trivially easy to remove once they're no longer needed.

Re: Valve accused of ignoring existing RCE vulnerability in Source games for 2 years

#19

Post by sodality2 »

Dozens of Counter-strike exploits exist and the cheating scene has just grown too rampantly. Valve simply doesn't care about the source engine. Any new CSGO player will tell you the anti-cheat doesn't work, I know first-hand.

The lack of care regarding source engine netcode extends to every part of the source engine, including Valve Anti-cheat.

The anti-cheat is trivial to reverse (several PUBLIC bypasses have existed for years on github, with zero patch), the engine source has been leaked, reverse engineered, and fiddled with by thousands of 14 year old kids. It is pathetically easy to bypass, for example, by changing a single byte in memory you can see through walls, see enemy money, etc. See this video I found about how miserably broken it is: https://files.catbox.moe/8e3bxz.mp4

It is in my opinion the greatest loss to gaming that a classic, legendary game like Counter-strike got completely ruined by lack of care by a company that profits millions off of the case unboxings.

Post reply on HN