Live data from Hacker News

Valve accused of ignoring existing RCE vulnerability in Source games for 2 years

twitter.com

111–120 of 122 posts

Re: Valve accused of ignoring existing RCE vulnerability in Source games for 2 years

#111
post #106
post #104

Earlier quoted context omitted.

At my previous client, the scrum master didn't decide 100% of the work, we could pick a small percentage of technical items to work on.

The scrum master decides the work? Why has agile become such a mess?

It’s been a while, I actually forgot a bit about the process, and I got it mixed up. Point being: tasks without a clear business driver were regularly brought into the sprint by devs.

Re: Valve accused of ignoring existing RCE vulnerability in Source games for 2 years

#112

Earlier quoted context omitted.

Why is it fundamentally impossible to stop aimbots?

because it requires you to distinguish between a human's aim and a bot's aim, which is pretty much impossible with a good enough bot

I think Steam actually primarily catches cheaters by it seeing the other running software rather than looking at the input patterns. I'm not sure whether it would detect a cheat implemented via a camera and custom mouse hardware that sends usb events you didn't do.

But I also think a lot of the hackers in both GTA and CS are cheating in ways that no regular user input could trigger, they're compromising the software at a lower level than that.

Re: Valve accused of ignoring existing RCE vulnerability in Source games for 2 years

#113

Earlier quoted context omitted.

because it requires you to distinguish between a human's aim and a bot's aim, which is pretty much impossible with a good enough bot

I think Steam actually primarily catches cheaters by it seeing the other running software rather than looking at the input patterns. I'm not sure whether it would detect a cheat implemented via a camera and custom mouse hardware that sends usb events you didn't do. But I also think a lot of the hackers in both GTA and CS are cheating in ways that no regular user input could trigger, they're compromising the software…

From what I know, VAC (Valve Anti Cheat) just looks for processes running on the system and detects injections into CSs memory. Then, for CS:GO specifically there's Overwatch, in which players look at other reported players' gameplay to determine whether they were cheating, and VacNET which is a machine learning system trained on the data from Overwatch to detect aimbots that way. There's a really good talk that someone from valve gave about 3 years ago[0].

The bigger problem is that even with input recognition, one of the biggest problems are wallhacks, meaning you can see other players through walls which is an advantage that's almost as large as aimbotting in tactical shooters like CS.

[0]: https://www.youtube.com/watch?v=kTiP0zKF9bc

Re: Valve accused of ignoring existing RCE vulnerability in Source games for 2 years

#115

Earlier quoted context omitted.

because it requires you to distinguish between a human's aim and a bot's aim, which is pretty much impossible with a good enough bot

I think Steam actually primarily catches cheaters by it seeing the other running software rather than looking at the input patterns. I'm not sure whether it would detect a cheat implemented via a camera and custom mouse hardware that sends usb events you didn't do. But I also think a lot of the hackers in both GTA and CS are cheating in ways that no regular user input could trigger, they're compromising the software…

The comment above was specifically about aimbots, i.e. cheats that mimic a person. Such cheats can be hidden from the system well enough for it to not know there is a program controlling the input. I'm not saying all kinds of cheats can stay 100% undetected and functional with enough effort on the hackers' side, that's obviously false.

Re: Valve accused of ignoring existing RCE vulnerability in Source games for 2 years

#116

Earlier quoted context omitted.

The kind of hacking that happens in first person shooters has nothing to do with security failures. It is fundamentally impossible to stop aim bots. All you can do is continually play cat and mouse games to make it harder.

Why is it fundamentally impossible to stop aimbots?

Because the player's computer needs to know where the enemy is in order to render them on the screen, create footstep sounds, calculate shadows, etc. As long as the player has ultimate (root, admin, etc) access on that computer, it will always be possible for a program running with elevated privileges to read that enemy position data from the game's memory and make the required mouse movements to point at it and left-click.

The only way to prevent this is to remove elevated access from the player's computer. This has been done with varying levels of success on consoles, but even then it's only a matter of time.

Re: Valve accused of ignoring existing RCE vulnerability in Source games for 2 years

#117
post #104

Earlier quoted context omitted.

This seems common in the industry at large. At my job it's impossible to fix an issue unless someone specifically puts in a ticket for it. I look at all the bugs in the code taunting me. Little landmines either nobody has stepped on yet or was too lazy to write a ticket for. Some tickets languish for years in the tracking system we use until the almighty scrum master doles it out. I am in hell.

At my previous client, the scrum master didn't decide 100% of the work, we could pick a small percentage of technical items to work on.

Other people choose their own tasks off the backlog. I chose my own and got a talking to. :)

Our lead says that all work must come from the scrum master but in practice it is selectively enforced.

Re: Valve accused of ignoring existing RCE vulnerability in Source games for 2 years

#118

Dozens of Counter-strike exploits exist and the cheating scene has just grown too rampantly. Valve simply doesn't care about the source engine. Any new CSGO player will tell you the anti-cheat doesn't work, I know first-hand. The lack of care regarding source engine netcode extends to every part of the source engine, including Valve Anti-cheat. The anti-cheat is trivial to reverse (several PUBLIC bypasses have existe…

Normally, I can handle some cheating in games, you just kinda deal with it, but holy fuck csgo was just nope. Between foul mouthed children and essentially watching God hackers play against eachother while you just die over and over. Yeah....no not exactly fun.

Do you know for sure people are cheating? I have limited experience with GO, but in source expert players certainly seem like cheaters. I've definitely been called out for scouting 3 people from garage in office. I don't completely blame them, it seems like magic.

Re: Valve accused of ignoring existing RCE vulnerability in Source games for 2 years

#119
post #82
post #64

Earlier quoted context omitted.

> CSGO player will tell you the anti-cheat doesn't work, I know first-hand. > It is in my opinion the greatest loss to gaming that a classic, legendary game like Counter-strike got completely ruined by lack of care by a company that profits millions off of the case unboxings. have you played the game in recent years? this has not been the case for me or the people I play with at all. when playing on high trust-factor…

>when playing on high trust-factor accounts, cheating is basically eliminated. Yes, but this is not a technical fix. You just hope that accounts with more "value" cheat less. Which is true in most cases.

That's another HUGE issue: stolen accounts are a massive underground market and while your skins can't be stolen usually, the account can be hacked on and get banned. You can get stolen prime accounts for under $5 and high value accounts for very cheap.

Trust does actually work a lot of the time. But you'd think account security would be easy for them to crack down upon.

Re: Valve accused of ignoring existing RCE vulnerability in Source games for 2 years

#120

Earlier quoted context omitted.

This is the way. Many games package in outright spyware that siphon all kinds of data off your machine including browsing history. Kerbal Space Program was infamous for this (they removed the spyware at some point but I haven't checked recently if it was ever added back in).

> Many games package in outright spyware that siphon all kinds of data off your machine including browsing history. Please post details. Were they literally mining user data?

The spyware is called Red Shell and it got packaged with a bunch of popular games. Yes, it mines user data.
Post reply on HN