Live data from Hacker News

Remote Code Execution in Marvel Rivals Game

shalzuth.com

101–110 of 132 posts

Re: Remote Code Execution in Marvel Rivals Game

#101

Earlier quoted context omitted.

The problem in big part stems from the business culture upstream. They're trying to produce a game, but what they're really after is e-sports money . They design multiplayer to be about organized pro play, which brings in all the cheating problems of professional sports, so they end up subjecting every player to e-sports-grade security like those anti-cheat systems, despite 99.9% of the player base not caring about p…

Nobody wants to play multiplayer (only) games with cheaters. It is that simple. Esports money...? Micro transactions is the money. Publisher driven esports is advertising.

Microtransactions are a self-inflicted fuckup. They're like a zombie bite - once you add them in, your game will start to transform into a slot machine wearing the skin of a dead game, and there's fuck all anyone can do to stop it.

> Publisher driven esports is advertising.

Yes, of course. E-sports is advertising. All professional sports are advertising. That's what makes money. Sales of tickets, merch, guides, coverage, etc. A successful sport is a self-sustaining money printing machine. Now, traditional sports are "frozen in time" relative to business timescales; meanwhile, in e-sports, it's entirely possible for a company to introduce a new game and turn it into a worldwide phenomenon over a couple of years, and then keep getting a cut from aforementioned money printer for many more years still, all while trying to introduce a new game to keep the money running.

And it's okay, I honestly don't mind. As far as the advertising-driven economy goes, sports (traditional or otherwise) is one of the more benign fields. The problem I see is the relentless focus on building a game optimized for professional play ruins it for vast majority of players, and I fail to see why companies keep doing it instead of bifurcating the multiplayer aspect into "casual play" and "pro play", allowing for the latter while also letting the former have their fun.

> Nobody wants to play multiplayer (only) games with cheaters.

My point is that most of the cheating comes from structuring the game around pro-play. You get a global ladder, which establishes an ordinal ranking that invites cheaters who just want to score higher for less effort. All those cheaters end up ruining the game for regular people, who don't care that much about the ranking. Most of those cheaters would go away if the ladder was removed - but that ladder is critical to the company and wannabe progamers precisely because the top levels of that ladder are a gateway to pro-level play.

You can't eliminate all cheating - there's always some people who, for whatever reason, enjoy ruining the game for others. Fortunately, such people are a very small fraction of the playerbase, and most of them don't enjoy it enough to bother if you throw some small obstacles their way. It's manageable. Competitive rankings, on the other hand, are something cheaters love much more than regular players, so by adding it, you're basically creating the problem.

This is true for all competitive endeavors - the bigger the reward, the more it attracts competitive players, some of which are going to resort to cheating, and attempts at fighting cheating further ruin things for those who don't care about competing in the first place. And yes, it applies to the market economy too.

Re: Remote Code Execution in Marvel Rivals Game

#102
post #25

Earlier quoted context omitted.

I think for web or "backend for network" people, you are always deploying into a hostile environment (the Internet) and so you really should be at least aware of basic security measures. If you consider yourself a professional in that field, it's table stakes. If you're a game dev, you were taught to write optimized code that runs locally on a computer. Not everything you do will run on the network, and networking/mu…

There is nothing special about game development that justifies not knowing/caring about security. It's 2025. Everyone is deploying into a hostile environment (the world). Security is now a horizontal that cuts across all kinds of development: frontend, backend, web, mobile, PC, console. You can't just say "Oh, security is the job of a Security Developer. I am just a Xyz Developer."

Hey I'm with you... I literally have a talk I give at my company about security being every developer's job (it's called "Developers are bad at security" and it's very popular).

I'm not arguing that it's "not their job", I'm saying they are less likely to have been trained in security because of the nature of their job...

Re: Remote Code Execution in Marvel Rivals Game

#103
post #25

Earlier quoted context omitted.

I think for web or "backend for network" people, you are always deploying into a hostile environment (the Internet) and so you really should be at least aware of basic security measures. If you consider yourself a professional in that field, it's table stakes. If you're a game dev, you were taught to write optimized code that runs locally on a computer. Not everything you do will run on the network, and networking/mu…

There are no triple A games today that doesn't run in a networked/internet environment, and your code lives on the hostile user; this seems like an even bigger risk than a web app.

AAA game are a small fraction of the whole games market though (and there are still plenty that don't have multiplayer - Cyberpunk 2077 comes to mind, or the Horizon games, lots of mobile games, etc).

Like I said in the other reply, I am not arguing against the need for security, I am saying a lot of game developers don't get, or seek out, security training because single player local games don't have the same network-driven risks.

Re: Remote Code Execution in Marvel Rivals Game

#104

The engineering culture behind AAA video games is rotten to the core with regards to security. Everyone thinks they're making Doom 3 and they're really making Windows 2000 Service Pack 1.

Is it particularly surprising though? These are game developers. Not backend developers. Not web guys. Not remotely trained in infosec. They make games. Not security software. And for the longest time this was acceptable. I think for a GaaS in 2025 it's unacceptable to not have security minded engineers on staff for the backend stuff. Too much money is involved not to. Especially for studios very familiar with shippi…

For some little indie setup, sure. But AAA studios are like any other software companies— the folks putting their network stack together aren’t the same people that are making the gameplay logic, many of whom probably went to art school and learned how to script and write some less-complex C++, and they’re different from the people working with the low-level graphics programming in the game engine, many of whom probably have PhDs in computer science or other related math disciplines. Having a connection low-latency enough and reliable enough to have fighting game tournaments on servers with many thousands of players isn’t a job for a general purpose game developer.

Re: Remote Code Execution in Marvel Rivals Game

#105

> This also opens the door up to an entrypoint on PS5. Does he mean that this is potentially how one could install custom firmware on their console? Curious because I remember reading somewhat recently that console vendors have locked their consoles down well enough so as to avoid any vulnerabilities which could be exploited to install custom firmware. It would be amusing if that was invalidated by game dev security…

PS5 games are sandboxed, so it only allows an entrypoint to run code. For full PS5 exploitation, another chain is needed to go break out of the sandbox.

Re: Remote Code Execution in Marvel Rivals Game

#106
post #61

Looks like a typical mitm attack, which confuses me a bit, don't the developers use something like tls or dtls to protect their communications? The most recent game I analysed was helldivers 2, which uses dtls. i would have thought that would be fairly common knowledge.

That's the issue - they don't! But even games like Helldivers 2 have had silly vulnerabilities (just not RCE) - see https://helldivers.io/freesupercredits for some examples.

Re: Remote Code Execution in Marvel Rivals Game

#107
post #94

> This also opens the door up to an entrypoint on PS5. Does he mean that this is potentially how one could install custom firmware on their console? Curious because I remember reading somewhat recently that console vendors have locked their consoles down well enough so as to avoid any vulnerabilities which could be exploited to install custom firmware. It would be amusing if that was invalidated by game dev security…

> Does he mean that this is potentially how one could install custom firmware on their console? Sort of. It's a userland code execution exploit, which is often the first step, but all games run in a locked down VM specifically to protect against things like this, so you still need a kernel/hypervisor exploit to escape the VM and actually mess with the system in any significant way.

Thanks for the explanation. That helps complete the picture another comment (https://news.ycombinator.com/item?id=42921799) started about “funny machines”. I do believe the measures they’ve taken to protect against malicious payloads are going to be tested rather relentlessly.

Re: Remote Code Execution in Marvel Rivals Game

#108
post #47

> Game developers continue to amaze me at their lack of security awareness. Because game developers are SUPPOSED to be aware of these things? > It's very hard for security researchers to report bugs to most game dev companies. On top of that, most do not have bug bounty programs Yet the OP blames the GAME developers… They already have harder jobs than the majority of us, picking on them for not knowing skills outside…

>> Game developers continue to amaze me at their lack of security awareness.

> Because game developers are SUPPOSED to be aware of these things?

If a civil engineer amazed people with their lack of structural integrity awareness, they wouldn't be trusted to build a house of cards let alone a bridge open to the general public. Software developers write defective, bug-ridden and unsafe public-facing devices and services that are open to the entire world and we shrug whenever there's a major cybersecurity or software crash catastrophe.

If software engineers were held to the same standards of accountability and liability as real engineers when they apply their signature at the bottom of a design calculations document, maybe we'd stop shoveling trivially wormable garbage onto the Internet without a second thought.

Re: Remote Code Execution in Marvel Rivals Game

#109

Earlier quoted context omitted.

I wish Steam offered a console format of the deck, essentially the same thing, but with better specs, HDMI out and bluetooth for controllers. Would be a massive hit I wager.

> Would be a massive hit I wager. I strongly doubt it. Steam already tried releasing a console alternative, Steam boxes, and they massively flopped. By and far the main reason for the Steam deck's success is its portable form factor, not the fact that it's a linux machine that runs games. It succeeded in spite of the software, not because of it. The overwhelming majority of users are going to want either a "real" (re…

This misses why the old Steam Machine was a failure: it was half baked hardware with few games that would run well on it. With the work they've put into the Steam Deck they've largely solved both of those issues, they now have a stable platform and also a sizable library of games that just work, no tinkering required.

Re: Remote Code Execution in Marvel Rivals Game

#110
post #91

Earlier quoted context omitted.

In modern gaming you just make every texture max size even though it only covers a tiny surface and will only fill 6 pixels on a large monitor. Also, half of their shaders are broken on some configurations. Also they used a function call wrong so their game tries to render something a bunch of times instead of once. A huge portion of NVidia and AMD GPU drivers is literally hacks to make games actually run well. Both…

Hi, I’m a game developer. > in modern gaming you just make every texture max size even though it only covers a tiny surface This completely false. Not even hyperbole, just plain false. We have budgets, we have tools. You need higher res textures for things that are smaller because you can get close to them. Is there waste? Sure, but no more so than in any other field. My local newspaper takes 15 seconds to load on gi…

You could decode a 320kbps mp3 on an 83mhz Pentium I.
Post reply on HN