Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Counter-Strike Global Offsets: reliable remote code execution

secret.club

Post reply on HN
Print view View original

21–30 of 94 posts

Re: Counter-Strike Global Offsets: reliable remote code execution

#21

Post by hn8788 »

any626 wrote: post #18

Backend dev here. How can one learn these types of skills? Recommendations?

Corelan Cybersecurity Research[1] is a good starting point. There haven't been any new articles in ~5 years, but some of the techniques in the linked article are covered. The /r/netsec subreddit is also a suprisingly good source of security info. A big part as well is just experimenting on your own. Vulnerability research is a very "creative" field, so being able to think outside the box is just as important as having technical knowledge.

[1] https://www.corelan.be/

Re: Counter-Strike Global Offsets: reliable remote code execution

#22

Post by breakfastduck »

asperous wrote: post #20

Another example is why app level security is so important. Why shouldn’t games allow arbitrary code execution? It only matters because the access space for programs is still so broad. People complain when applications on Mac request permission to access files, but that makes such a huge difference. It’s time for kernel level permissions to be standard on desktops.

Yeah the way macOS handles permissions can be annoying to some but generally the way it places an additional barrier between code execution and ability to read/write files beyond the application files itself is welcome imo.

If you accept the admin prompt in windows that code can just run anything. In macOS the first time it'll run the code but prompt again if it starts trying to access the core file system.

You may, as a developer, have an expectation some simple app you've downloaded should be able to run in a sandbox quite simply. A random app seemingly unnecessarily trying to access your user/systems files is worth a second thought.

Re: Counter-Strike Global Offsets: reliable remote code execution

#23

Post by tryonenow »

munk-a wrote: post #9
alkonaut wrote: post #3

How can people contact big corporations and get no response? Are the messages not being read? Or is there a weird culture of fear where you’d rather silently try to fix it without acknowledging that it exists, because acknowledging a problem means taking some legal responsibility? It wouldn’t be the first instance of US law having weird effects on human behavior but it does seem a bit far fetched.

I think game development companies are forced to take a very different approach from normal companies. Game developers face frequent abuse from customers due to passionate feelings involved with such an interactive media, programmers will get hate mail (generally vaguely directed at least) and female artists will get stalked pretty often - it's honestly a pretty toxic community. Look, for example, at what happened to…

To be fair, Hello Games promised way more than what people ended up paying for. Also I really don't think internet death threats are anything to be worried about. How often do people actually act on them?

Re: Counter-Strike Global Offsets: reliable remote code execution

#24

Post by arkadiyt »

google234123 wrote: post #4

Valve should be kicked off HackerOne. They seem to abusing the service to trick researchers into submitting vulnerabilities without providing any sort of compensation. Does anyone here work at HackerOne?

If you check their hacktivity you'll see that the previous negative press spurred them into action:

https://hackerone.com/valve/hacktivity?type=team

Re: Counter-Strike Global Offsets: reliable remote code execution

#26

Post by reasons »

google234123 wrote: post #4

Valve should be kicked off HackerOne. They seem to abusing the service to trick researchers into submitting vulnerabilities without providing any sort of compensation. Does anyone here work at HackerOne?

I like Valve's approach. Who is the real bad guy here?

Why should they prioritize people who break their hard work and coerce them into paying for protection?

I might be biased; always wanted to work @ Valve Software since HL1.

Re: Counter-Strike Global Offsets: reliable remote code execution

#27

Post by jmgao »

reasons wrote: post #26
google234123 wrote: post #4

Valve should be kicked off HackerOne. They seem to abusing the service to trick researchers into submitting vulnerabilities without providing any sort of compensation. Does anyone here work at HackerOne?

I like Valve's approach. Who is the real bad guy here? Why should they prioritize people who break their hard work and coerce them into paying for protection? I might be biased; always wanted to work @ Valve Software since HL1.

Because that's what they signed up for?

Re: Counter-Strike Global Offsets: reliable remote code execution

#28

Post by tantalor »

Burying the lead here!

> in over 4 months, we did not even receive an acknowledgment by a Valve representative. After public pressure, when it became apparent that Valve had also ignored other Security Researchers with similar impact, Valve finally fixed numerous security issues

Also, can we all agree "DD/MM/YYYY" is the worst possible date format?

Re: Counter-Strike Global Offsets: reliable remote code execution

#29

Post by iancarroll »

njbooher wrote: post #10
google234123 wrote: post #4

Valve should be kicked off HackerOne. They seem to abusing the service to trick researchers into submitting vulnerabilities without providing any sort of compensation. Does anyone here work at HackerOne?

They pay, eventually. They're particularly slow for game client exploits. Much quicker for server-side issues.

Yeah, it is certainly a wide spectrum. Server-side fixed in days to months, but these game client bugs have been sitting for years.

I had one server bug in HackerOne’s “mediation” for over a month, after 4-6mo of no reply, which did nothing until mentioning it to a Valve employee on another report they had actually responded to.

Disappointing for a program that has paid $1m+ in its lifetime.

Re: Counter-Strike Global Offsets: reliable remote code execution

#30

Post by iancarroll »

munk-a wrote: post #9
alkonaut wrote: post #3

How can people contact big corporations and get no response? Are the messages not being read? Or is there a weird culture of fear where you’d rather silently try to fix it without acknowledging that it exists, because acknowledging a problem means taking some legal responsibility? It wouldn’t be the first instance of US law having weird effects on human behavior but it does seem a bit far fetched.

I think game development companies are forced to take a very different approach from normal companies. Game developers face frequent abuse from customers due to passionate feelings involved with such an interactive media, programmers will get hate mail (generally vaguely directed at least) and female artists will get stalked pretty often - it's honestly a pretty toxic community. Look, for example, at what happened to…

This is definitely true in general, but it’s worth noting that Valve pays HackerOne to validate submitted issues before they have to look at them. If it can’t be reproduced as a security issue, it will likely not get through.
Post reply on HN