Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Remote Code Execution in Marvel Rivals Game

shalzuth.com

Post reply on HN
Print view View original

111–120 of 132 posts

Re: Remote Code Execution in Marvel Rivals Game

#111

Post by [deleted] »

bongodongobob wrote: post #76
bilekas wrote: post #42

Earlier quoted context omitted.

I don’t work in gaming, I know a few people who do, everyone of them does it for the love of the game. Certainly not for the job security or even the money. This idea that they’re also to handle security is too much. It’s not their fault, they’re writing “art” not secure micro services for multi national companies. Publishers will pay to have 0level kernel ring on your system but not for software securing their game.…

I've done IT support for a number of devs across multiple companies and they all expect local admin and admin access to everything. So no, I don't believe they feel it is risky. I believe they don't get it/don't care. It's just not their wheelhouse.

[deleted]

Re: Remote Code Execution in Marvel Rivals Game

#112

Post by aprilnya »

Etheryte wrote: post #48
kibwen wrote: post #46

I bought a Steam Deck with the sole purpose of having a cheap, airgapped PC to run games on. Game devs just don't have the incentives or discipline to be trusted with security. Reminder that all three Dark Souls games allowed full RCE to any users connected to the internet: https://flashpoint.io/blog/rce-vulnerability-dark-souls/

I wish Steam offered a console format of the deck, essentially the same thing, but with better specs, HDMI out and bluetooth for controllers. Would be a massive hit I wager.

According to leaks, “Steam Deck TV” has been in the works for a couple years now iirc

Re: Remote Code Execution in Marvel Rivals Game

#113

Post by amatecha »

999900000999 wrote: post #6
sim7c00 wrote: post #4

Earlier quoted context omitted.

tried in some communities of gamedev to talk about security but i gave up. i think the main sentiment is not to care at all. so many games have or had trivial exploits. enabling mass cheating, harasment of other players (DOS) and more nefarious stuff. for people whwo think the mitm wont affect them... thats a silly stance. people hack home routers on massive scales. (another domain who doesnt seem to give shits about…

Their's a really good argument for having a "gaming" os, Windows, and a serious OS , Linux on the same computer. If League of Legends needs super admin mode, it's no longer my computer. I'm sharing it with Tencent. I can't trust them ( specifically a disgruntled employee) to not install key loggers and other really nasty things.

Separate computers. Windows gaming PC on a VLAN that can only access the internet, and nothing else on your network. This should really be the standard for home networks today.

Re: Remote Code Execution in Marvel Rivals Game

#114

Post by bongodongobob »

maccard wrote: post #97
bongodongobob wrote: post #76

Earlier quoted context omitted.

I've done IT support for a number of devs across multiple companies and they all expect local admin and admin access to everything. So no, I don't believe they feel it is risky. I believe they don't get it/don't care. It's just not their wheelhouse.

I use a company managed machine. If my machine is compromised even in user space, my AWS credentials (which AWS stores in %UserProfile%/.aws) are hosed. Source code? Gone. Cookies from chrome? Gone. Files on the network share that everyone has mounted? Compromised. If someone can run a python script on your machine, it’s game over whether it’s running as admin or not.

Yeah, that's why you don't do it that way. You're making my point.

Re: Remote Code Execution in Marvel Rivals Game

#115

Post by X-Cubed »

tart-lemonade wrote: post #84

It downloads and executes a Python script to update the store page? Log4j/log4shell, anyone? Just build a JSON API! It's not that hard! You don't need to RCE your game every time it launches just for microtransactions.

> Just build a JSON API! It's not that hard!

I agree that a JSON API is a better approach, but it's possible for AAA game developers to screw that up too: https://arstechnica.com/gaming/2021/03/developers-to-update-...

Re: Remote Code Execution in Marvel Rivals Game

#116

Post by oxygen_crisis »

LordDragonfang wrote: post #99
Etheryte wrote: post #48

Earlier quoted context omitted.

I wish Steam offered a console format of the deck, essentially the same thing, but with better specs, HDMI out and bluetooth for controllers. Would be a massive hit I wager.

> Would be a massive hit I wager. I strongly doubt it. Steam already tried releasing a console alternative, Steam boxes, and they massively flopped. By and far the main reason for the Steam deck's success is its portable form factor, not the fact that it's a linux machine that runs games. It succeeded in spite of the software, not because of it. The overwhelming majority of users are going to want either a "real" (re…

Steam Deck succeeded where Steam Machines flopped because of nearly a decade of advancement on the Proton compatibility layer, so the catalog of eligible games is orders of magnitude larger than it was in 2015.

When Steam Machines re-launch with the current generation of Proton compatibility it will be an entirely different story.

Re: Remote Code Execution in Marvel Rivals Game

#117

Post by lelanthran »

bongodongobob wrote: post #114
maccard wrote: post #97

Earlier quoted context omitted.

I use a company managed machine. If my machine is compromised even in user space, my AWS credentials (which AWS stores in %UserProfile%/.aws) are hosed. Source code? Gone. Cookies from chrome? Gone. Files on the network share that everyone has mounted? Compromised. If someone can run a python script on your machine, it’s game over whether it’s running as admin or not.

Yeah, that's why you don't do it that way. You're making my point.

>>> I've done IT support for a number of devs across multiple companies and they all expect local admin and admin access to everything.

>> If someone can run a python script on your machine, it’s game over whether it’s running as admin or not.

> Yeah, that's why you don't do it that way. You're making my point.

I have to admit, I don't get your point here. If I am correct (and, if I am not, I welcome a correction):

1. Your original point was "Devs want local admin or admin access to everything.

2. GP's response was that even without any admin access of any type, he's hosed if his machine is compromised.

How does #2 above support or prove #1 above?

Re: Remote Code Execution in Marvel Rivals Game

#118

Post by lelanthran »

maccard wrote: post #91
mrguyorama wrote: post #81

Earlier quoted context omitted.

In modern gaming you just make every texture max size even though it only covers a tiny surface and will only fill 6 pixels on a large monitor. Also, half of their shaders are broken on some configurations. Also they used a function call wrong so their game tries to render something a bunch of times instead of once. A huge portion of NVidia and AMD GPU drivers is literally hacks to make games actually run well. Both…

Hi, I’m a game developer. > in modern gaming you just make every texture max size even though it only covers a tiny surface This completely false. Not even hyperbole, just plain false. We have budgets, we have tools. You need higher res textures for things that are smaller because you can get close to them. Is there waste? Sure, but no more so than in any other field. My local newspaper takes 15 seconds to load on gi…

> Slack uses more ram than the game im developing sometimes.

I think this should be said more often: the ratio of content to non-content is absurd in some electron-based apps.

Look at it this way: the average video game probably has about 30GB (uncompressed) of content and uses about 10GB-12GB of RAM.

In a busy slack, with hundreds of messages, we're still only looking at maybe I think the video game devs are doing a much better job at writing desktop software than the Slack/Postman/etc guys.

Additionally, security in video games (it's poorest metric) has, over the last 10 years or so, improved considerably, while efficiency in desktop software (it's poorest metric) has gotten worse!

It's unfair to single out video game developers for poor software considering that they are making gains in their weakest measurement while those doing the criticising are happily using software that is losing points in it's weakest metric.

Re: Remote Code Execution in Marvel Rivals Game

#119

Post by lelanthran »

kcb wrote: post #110
maccard wrote: post #91

Earlier quoted context omitted.

Hi, I’m a game developer. > in modern gaming you just make every texture max size even though it only covers a tiny surface This completely false. Not even hyperbole, just plain false. We have budgets, we have tools. You need higher res textures for things that are smaller because you can get close to them. Is there waste? Sure, but no more so than in any other field. My local newspaper takes 15 seconds to load on gi…

You could decode a 320kbps mp3 on an 83mhz Pentium I.

> You could decode a 320kbps mp3 on an 83mhz Pentium I.

Only if doing nothing else at the same time!

I was there; I had a 486 that could decode 96kbps mp3.

But, like the P1, if you tried to do anything else while decoding mp3s, the entire computer, including the sound output, would stutter.

I'm not defending 30GB of uncompressed audio (obviously they could have compressed it a little, at least), but to claim that a P1@80MHz could indeed decode mp3s@320kbps is a bit of a stretch.

It could do so only if you weren't doing anything else at the time.

Re: Remote Code Execution in Marvel Rivals Game

#120

Post by tpxl »

TeMPOraL wrote: post #101
ThatMedicIsASpy wrote: post #93

Earlier quoted context omitted.

Nobody wants to play multiplayer (only) games with cheaters. It is that simple. Esports money...? Micro transactions is the money. Publisher driven esports is advertising.

Microtransactions are a self-inflicted fuckup. They're like a zombie bite - once you add them in, your game will start to transform into a slot machine wearing the skin of a dead game, and there's fuck all anyone can do to stop it. > Publisher driven esports is advertising. Yes, of course. E-sports is advertising. All professional sports are advertising . That's what makes money. Sales of tickets, merch, guides, cove…

> My point is that most of the cheating comes from structuring the game around pro-play

This is incorrect. Both selling cheats and cheating are big businesses.

In Escape from Tarkov, cheaters bought the game (50€), cheated to get in-game items, sold in-game items for money, got banned, and bought the game again. It's literally profitable to keep buying a 50€ game after getting banned.

Same happened with Diablo 3 when it had the real money auction house. A mate of mine earned around 10k in 3 months and went through a dozen accounts a week.

Team Fortress 2 basically has no competitive scene, but the casual games are full of cheaters anyway. And you can't even make money through it, unlike the previous two examples.

The bottom line about cheating is, it's relatively easy to prevent with manual moderation. But humans doing stuff dOeSn'T sCaLe, even though banning cheaters that will re-buy the game has a positive RoI.

Post reply on HN