Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Remote Code Execution in Marvel Rivals Game

shalzuth.com

Post reply on HN
Print view View original

121–130 of 132 posts

Re: Remote Code Execution in Marvel Rivals Game

#121

Post by tpxl »

0cf8612b2e1e wrote: post #56
cubefox wrote: post #24

Earlier quoted context omitted.

> The engineering culture behind AAA video games is rotten to the core with regards to security. But it is way ahead with regards to efficient hardware utilization!

And usually with an eye towards good user interface design. Not some white space heavy “clean” look where everything is hidden behind hamburger menus.

Some games, sure, most games, no. There are tons of games out there with dialog options that don't support choosing with numbers, a ton of games where you can't quickloot/drop with shift-click, comparing equipment is a chore, confirmation screens don't have y/enter to confirm or n/esc to cancel, missing/useless tooltips, custom fonts that are unreadable...

These things are _trivial_ to implement, it's just nobody thinks about the UI as long as it 'works'.

Re: Remote Code Execution in Marvel Rivals Game

#122

Post by shalzuth »

bilekas wrote: post #47

> Game developers continue to amaze me at their lack of security awareness. Because game developers are SUPPOSED to be aware of these things? > It's very hard for security researchers to report bugs to most game dev companies. On top of that, most do not have bug bounty programs Yet the OP blames the GAME developers… They already have harder jobs than the majority of us, picking on them for not knowing skills outside…

You’re right - I should have specified more explicitly. I am not referring to the game dev that is developing game features or content - I am specifically talking about the “security engineering” organizations within game developer companies. NetEase hired security engineers to specifically do security related tasks (see NetEase AntiCheat @ https://dun.163.com/locale/en?force=true). NetEase Games doesn’t have an excuse for not conducting a security review on a massive game like Marvel Rivals - and this isn’t some corner case, this is part of the core architecture.

And this is not a story unique to NetEase. I have multiple other examples that I’ll probably talk about in the future.

Re: Remote Code Execution in Marvel Rivals Game

#123

Post by maccard »

bongodongobob wrote: post #114
maccard wrote: post #97

Earlier quoted context omitted.

I use a company managed machine. If my machine is compromised even in user space, my AWS credentials (which AWS stores in %UserProfile%/.aws) are hosed. Source code? Gone. Cookies from chrome? Gone. Files on the network share that everyone has mounted? Compromised. If someone can run a python script on your machine, it’s game over whether it’s running as admin or not.

Yeah, that's why you don't do it that way. You're making my point.

In your original comment you said:

> they all expect local admin and admin access to everything

It practically doesn't matter on a single user system. You're screwed whether you're running as an admin or not. My machine has credentials in AppData stored to basically every internal service of my company. On a linux machine, they're all in my home dir - even my ssh keys are compromised.

Re: Remote Code Execution in Marvel Rivals Game

#124

Post by mrguyorama »

maccard wrote: post #91
mrguyorama wrote: post #81

Earlier quoted context omitted.

In modern gaming you just make every texture max size even though it only covers a tiny surface and will only fill 6 pixels on a large monitor. Also, half of their shaders are broken on some configurations. Also they used a function call wrong so their game tries to render something a bunch of times instead of once. A huge portion of NVidia and AMD GPU drivers is literally hacks to make games actually run well. Both…

Hi, I’m a game developer. > in modern gaming you just make every texture max size even though it only covers a tiny surface This completely false. Not even hyperbole, just plain false. We have budgets, we have tools. You need higher res textures for things that are smaller because you can get close to them. Is there waste? Sure, but no more so than in any other field. My local newspaper takes 15 seconds to load on gi…

>As I’ve said many times, you might disagree but it was intentional. The Xbox one was an 8x1. 75GHz CPU, and some of that was reserved for system use

I'm sorry, the Xbox One was a what CPU?

Doesn't matter, it's possible that loading in uncompressed audio takes more CPU and RAM resources than just decompressing good MP3 audio. Nobody else ships uncompressed audio, and Titanfall 2 did not release with uncompressed audio.

Mind you, this was like 30gb of uncompressed audio, including several different audio languages. No matter how you played the game, most of that 30gb was unused.

Re: Remote Code Execution in Marvel Rivals Game

#125

Post by netcoyote »

TeMPOraL wrote: post #101
ThatMedicIsASpy wrote: post #93

Earlier quoted context omitted.

Nobody wants to play multiplayer (only) games with cheaters. It is that simple. Esports money...? Micro transactions is the money. Publisher driven esports is advertising.

Microtransactions are a self-inflicted fuckup. They're like a zombie bite - once you add them in, your game will start to transform into a slot machine wearing the skin of a dead game, and there's fuck all anyone can do to stop it. > Publisher driven esports is advertising. Yes, of course. E-sports is advertising. All professional sports are advertising . That's what makes money. Sales of tickets, merch, guides, cove…

> My point is that most of the cheating comes from structuring the game around pro-play

I wanted to address the same point txpl did. As someone who's made multiplayer games, I'm stunned that so many players cheat, even when the stakes are low. It's not just the pro-players; it's at every level.

Some are optimizing their experience because they don't have as much time to play as they'd like. Some feel they deserve the enjoyment of winning without the effort. Some justify it with the belief that everyone else is doing it. And the really difficult ones to deal with feel rewarded by behaving badly (anonymously, of course).

So every design decision comes with an evaluation of how players will abuse the system, and there are no easy answers. And that's why you see companies adding (invasive and ineffective) anti-cheat solutions to band-aid the problem that developers were unable to anticipate or solve.

Re: Remote Code Execution in Marvel Rivals Game

#126

Post by bongodongobob »

lelanthran wrote: post #117
bongodongobob wrote: post #114

Earlier quoted context omitted.

Yeah, that's why you don't do it that way. You're making my point.

>>> I've done IT support for a number of devs across multiple companies and they all expect local admin and admin access to everything. >> If someone can run a python script on your machine, it’s game over whether it’s running as admin or not. > Yeah, that's why you don't do it that way. You're making my point. I have to admit, I don't get your point here. If I am correct (and, if I am not, I welcome a correction): 1…

IT does things that piss off devs like not allow python to be installed on the laptop because, yes, having python installed can be exploited. So we lock down the laptops and have isolated dev envs that you use instead.

Re: Remote Code Execution in Marvel Rivals Game

#127

Post by prophesi »

DrillShopper wrote: post #45
prophesi wrote: post #18

Earlier quoted context omitted.

I have a Windows partition that I haven't booted into for ages. Originally I would first try to run a game on Linux, and fallback to Windows if it has problems. Some live service AAA games are still impossible to run on Linux due to anticheat, but it's otherwise a pretty good time for Linux gaming in the era of the Steam Deck.

I've removed the rebooting step and instead use a GPU pass-through VM

I'll definitely need to look into doing that.

Re: Remote Code Execution in Marvel Rivals Game

#128

Post by devmor »

kcb wrote: post #110
maccard wrote: post #91

Earlier quoted context omitted.

Hi, I’m a game developer. > in modern gaming you just make every texture max size even though it only covers a tiny surface This completely false. Not even hyperbole, just plain false. We have budgets, we have tools. You need higher res textures for things that are smaller because you can get close to them. Is there waste? Sure, but no more so than in any other field. My local newspaper takes 15 seconds to load on gi…

You could decode a 320kbps mp3 on an 83mhz Pentium I.

How about 30-40 of them at the same time, while sending off video to be rendered by the GPU, tracking as many entities positions 60x per second and more?

Re: Remote Code Execution in Marvel Rivals Game

#129

Post by yencabulator »

tpxl wrote: post #120
TeMPOraL wrote: post #101

Earlier quoted context omitted.

Microtransactions are a self-inflicted fuckup. They're like a zombie bite - once you add them in, your game will start to transform into a slot machine wearing the skin of a dead game, and there's fuck all anyone can do to stop it. > Publisher driven esports is advertising. Yes, of course. E-sports is advertising. All professional sports are advertising . That's what makes money. Sales of tickets, merch, guides, cove…

> My point is that most of the cheating comes from structuring the game around pro-play This is incorrect. Both selling cheats and cheating are big businesses. In Escape from Tarkov, cheaters bought the game (50€), cheated to get in-game items, sold in-game items for money, got banned, and bought the game again. It's literally profitable to keep buying a 50€ game after getting banned. Same happened with Diablo 3 when…

> In Escape from Tarkov, cheaters bought the game (50€), cheated to get in-game items, sold in-game items for money, got banned, and bought the game again. It's literally profitable to keep buying a 50€ game after getting banned.

You can blame in-game microtransactions and the idea that in-game inventory is worth money on that one.

Re: Remote Code Execution in Marvel Rivals Game

#130

Post by zwily »

sandyarmstrong wrote: post #92
zwily wrote: post #59

Earlier quoted context omitted.

I have a related question for you... my kids like Marvel Rivals, but I also use Microsoft family tools to limit their screen time so they don't have Admin accounts. However, the Marvel Rivals anti-cheat makes me enter my password every time they launch. Is there any way for me to create a shortcut or something so Rivals will launch without my password? I'm not a Windows guy and trying to figure this out has been extr…

I just had to fix this for my kid over the weekend. https://steamcommunity.com/app/2767030/discussions/0/5962604... was very helpful: You can also skip the UAC prompt without editing the registry, by adding the following to the game's launch options in Steam: cmd /min /C "set __COMPAT_LAYER=RUNASINVOKER && start "" %command%"

Wow... thank you so much. I actually couldn't get that way to work, but adding RunAsInvoker in the registry worked for us. I can't believe all it took was one registry entry.
Post reply on HN