Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Rumors of GTA online exploits allowing remote code execution on gamer PCs

old.reddit.com

Post reply on HN
Print view View original

21–30 of 50 posts

Re: Rumors of GTA online exploits allowing remote code execution on gamer PCs

#21

Post by int_19h »

mopsi wrote: post #18
armchairhacker wrote: post #14

Earlier quoted context omitted.

This is why you rewrite it in Rust \s But seriously, one of the reasons games should maybe be less C++ and more memory-safe languages, if not Rust then languages like C# or JavaScript. And maybe incorporate formal methods into game-dev. The code which handles server responses should be sufficiently isolated from any of the unsafe code (e.g. rendering), so that you can ideally prove (or non-ideally, at least be very c…

Microsoft Flight Simulator[1] is a really interesting example, because running code from third parties has been the norm for decades. Custom code for things like airplane instruments was distributed in DLL modules that had full Windows API access (file system, networking, etc) while the game was running. It's obviously a huge security risk. So for the new version of Flight Simulator, they divided it into core game en…

This kind of thing was fairly common historically. For example, Quake 2 mods were DLL / .so files, depending on the platform, and modding was more common than not in multiplayer. Or the just-released Mount & Blade 2: Bannerlord, which is written in C# and runs on the full-featured .NET Framework on Windows - its mods are managed assemblies, naturally, and they run under full trust.

(And then you go meta and write a mod that compiles and loads source code at runtime: https://www.nexusmods.com/mountandblade2bannerlord/mods/1651)

Re: Rumors of GTA online exploits allowing remote code execution on gamer PCs

#22

Post by philistine »

fakecarhacker wrote: post #16

The rumors are correct. This is an out-of-bounds array read/write vulnerability in the multiplayer scripting engine. Even if they patch this one, there are about half a dozen others known already. The only reason why this hasn't yet been turned into an exploit that runs arbitrary code outside of GTA on your computer is that no-one has bothered to do the extra work required for that. Not as far as I know anyway.

I'd bet good money they will find crypto-mining injections in the wild.

Re: Rumors of GTA online exploits allowing remote code execution on gamer PCs

#23

Post by someperson »

giancarlostoro wrote: post #20
someperson wrote: post #2

A remote code execution exploit in GTA 5 Online should not a surprise to anybody who has played GTA 5 Online. Cheaters have been rampant for many years, with people using apparently purchased cheat tools that allow them to choose to do server-side things like drop unlimited money and spawn vehicles anywhere, rapidly cycling through weather changes, and locking people permanently in cages. But get on the bad side of a…

> Cheaters have been rampant for many years, with people using apparently purchased cheat tools that allow them to choose to do server-side things like drop unlimited money and spawn vehicles anywhere, rapidly cycling through weather changes, and locking people permanently in cages. First I ever played with friends, we were driving down a highway, stopped by spikes that killed our tires, and someone spawned bags of m…

You can create a private room with just friends by the way. The option is buried deep in the menus, but it is there.

Re: Rumors of GTA online exploits allowing remote code execution on gamer PCs

#24

Post by Lendal »

someperson wrote: post #2

A remote code execution exploit in GTA 5 Online should not a surprise to anybody who has played GTA 5 Online. Cheaters have been rampant for many years, with people using apparently purchased cheat tools that allow them to choose to do server-side things like drop unlimited money and spawn vehicles anywhere, rapidly cycling through weather changes, and locking people permanently in cages. But get on the bad side of a…

I knew this was coming. GTA V is the game that finally caused me to quit PC online gaming entirely some years ago, and purchase a game console instead. I had to relearn everything, because I grew up on mouse/keyboard control and had never used a console controller before. (It's not that difficult, really.) The move was worth it. The amount of headaches caused by cheaters and hackers in PC gaming just isn't worth the time, money, aggravation and risk. User-created game mods aren't worth it. Building a faster rig than everyone else is interesting, but in the end wasn't worth it. My life is much easier & simpler now.

Re: Rumors of GTA online exploits allowing remote code execution on gamer PCs

#25

Post by DefineOutside »

I've played with and studied netcode and I'm unsure what GTA netcode would even look like. I've seen cheats to the point where everyone is just teleported to the cheater, the cheater spawning millions of dollars, cheaters taking away millions of dollars from people, the cheater unlocking all the online collectables for everyone in the lobby at the same time, people screwing with singleplayer sessions, cheaters crashing games, and much more.

This doesn't surprise me at all. There seems to be zero validation that other people's actions. How was netcode even designed to players allowed to teleport and unlock collectable for one another? How does the client accept actions from other players in a singleplayer game?

This doesn't seem to be just standard peer2peer issues, it seems like Rockstar went out of their way to design the least secure netcode possible.

Re: Rumors of GTA online exploits allowing remote code execution on gamer PCs

#26

Post by [deleted] »

lopkeny12ko wrote: post #19

Is it just me or is it impossible to find from this source link any _real details_ about the actual RCE? * This post claims an RCE being exploited and warns people not to play. * It links to Rockstar forums where people are warning about the game being exploited but provide no details on the attack vector or indicators of compromise. * It links to a screenshot of a tweet of some random person again warning not to pla…

[deleted]

Re: Rumors of GTA online exploits allowing remote code execution on gamer PCs

#27

Post by giancarlostoro »

someperson wrote: post #23
giancarlostoro wrote: post #20

Earlier quoted context omitted.

> Cheaters have been rampant for many years, with people using apparently purchased cheat tools that allow them to choose to do server-side things like drop unlimited money and spawn vehicles anywhere, rapidly cycling through weather changes, and locking people permanently in cages. First I ever played with friends, we were driving down a highway, stopped by spikes that killed our tires, and someone spawned bags of m…

You can create a private room with just friends by the way. The option is buried deep in the menus, but it is there.

Of course it is... Well, my friends have moved on, not worth the hassle. Thanks for the tip!

Re: Rumors of GTA online exploits allowing remote code execution on gamer PCs

#28

Post by ehnto »

revolvingocelot wrote: post #12

Keep in mind that this is the same game whose client-update-handshake-dance largely consisted of an enormous JSON of all the updates that had ever been done to the gamestate, which then got parsed naively. This situation was recognized and patched [0] by an interested third party [1]. Not a slight against the code monkey that implemented it that way, because they surely didn't bother to think about complexity consequ…

I appreciate that you note the capabilities of hackers in GTAO. Someone who doesn't play might just hear that there are a lot of them, but hackers in GTAO are essentially omnipotent and games are unplayable very regularly. The online world is essentially in sandbox mode for them.

Aimbots, a buzzkill, but I can play around it. Remotely spawning a cage on my player and lighting me on fire every time I spawn is unplayable. Teleporting everyone on the server to one location and blowing them up, over and over again, unplayable. Etc. You just have to quit. There are so many hackers that every server eventually succumbs to one.

Re: Rumors of GTA online exploits allowing remote code execution on gamer PCs

#29

Post by Spastche »

Lendal wrote: post #24
someperson wrote: post #2

A remote code execution exploit in GTA 5 Online should not a surprise to anybody who has played GTA 5 Online. Cheaters have been rampant for many years, with people using apparently purchased cheat tools that allow them to choose to do server-side things like drop unlimited money and spawn vehicles anywhere, rapidly cycling through weather changes, and locking people permanently in cages. But get on the bad side of a…

I knew this was coming. GTA V is the game that finally caused me to quit PC online gaming entirely some years ago, and purchase a game console instead. I had to relearn everything, because I grew up on mouse/keyboard control and had never used a console controller before. (It's not that difficult, really.) The move was worth it. The amount of headaches caused by cheaters and hackers in PC gaming just isn't worth the…

this is like burning down your house and deciding to live in a tent because your roof is leaky. multiplayer console gaming is even buggier than it's PC gaming counterpart, or at least has been traditionally.

Re: Rumors of GTA online exploits allowing remote code execution on gamer PCs

#30

Post by 5e92cb50239222b »

ehnto wrote: post #28
revolvingocelot wrote: post #12

Keep in mind that this is the same game whose client-update-handshake-dance largely consisted of an enormous JSON of all the updates that had ever been done to the gamestate, which then got parsed naively. This situation was recognized and patched [0] by an interested third party [1]. Not a slight against the code monkey that implemented it that way, because they surely didn't bother to think about complexity consequ…

I appreciate that you note the capabilities of hackers in GTAO. Someone who doesn't play might just hear that there are a lot of them, but hackers in GTAO are essentially omnipotent and games are unplayable very regularly. The online world is essentially in sandbox mode for them. Aimbots, a buzzkill, but I can play around it. Remotely spawning a cage on my player and lighting me on fire every time I spawn is unplayab…

Don't forget donating loads of generated cash to everyone around. I was banned for receiving a "gift" like this. Several weeks of gameplay and some difficult achievements down the drain. The email that notified me of the ban said that they are final and appeals will not be considered, which was confirmed by them ignoring any of my attempts to resolve the issue. Turned my opinion of Rockstar very sour indeed, definitely won't be playing anything "online" from them anymore.
Post reply on HN