Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Remote Code Execution in Marvel Rivals Game

shalzuth.com

Post reply on HN
Print view View original

21–30 of 132 posts

Re: Remote Code Execution in Marvel Rivals Game

#21

Post by phoronixrly »

agoodusername63 wrote: post #14
doctorpangloss wrote: post #7

The engineering culture behind AAA video games is rotten to the core with regards to security. Everyone thinks they're making Doom 3 and they're really making Windows 2000 Service Pack 1.

Is it particularly surprising though? These are game developers. Not backend developers. Not web guys. Not remotely trained in infosec. They make games. Not security software. And for the longest time this was acceptable. I think for a GaaS in 2025 it's unacceptable to not have security minded engineers on staff for the backend stuff. Too much money is involved not to. Especially for studios very familiar with shippi…

Hey, I feel there's some predisposition in infosec-minded people that insecure software must not exist regardless of its purpose or threat model. And also that people who can't write secure code must not write code...

Re: Remote Code Execution in Marvel Rivals Game

#22

Post by gruez »

999900000999 wrote: post #6
sim7c00 wrote: post #4

Earlier quoted context omitted.

tried in some communities of gamedev to talk about security but i gave up. i think the main sentiment is not to care at all. so many games have or had trivial exploits. enabling mass cheating, harasment of other players (DOS) and more nefarious stuff. for people whwo think the mitm wont affect them... thats a silly stance. people hack home routers on massive scales. (another domain who doesnt seem to give shits about…

Their's a really good argument for having a "gaming" os, Windows, and a serious OS , Linux on the same computer. If League of Legends needs super admin mode, it's no longer my computer. I'm sharing it with Tencent. I can't trust them ( specifically a disgruntled employee) to not install key loggers and other really nasty things.

>If League of Legends needs super admin mode, it's no longer my computer. I'm sharing it with Tencent. I can't trust them ( specifically a disgruntled employee) to not install key loggers and other really nasty things.

relevant: https://xkcd.com/1200/

kernel/root/ring0 might sound super scary, but if there's any sort of code execution on linux/windows, practically speaking it's already game over.

Re: Remote Code Execution in Marvel Rivals Game

#23

Post by devmor »

doctorpangloss wrote: post #7

The engineering culture behind AAA video games is rotten to the core with regards to security. Everyone thinks they're making Doom 3 and they're really making Windows 2000 Service Pack 1.

Why would there be a strong engineering culture behind AAA video games at all? Game developers are underpaid, overworked and constantly told they can be replaced at a moments notice.

I wouldn't expect anything but code that "ships" out of them, and its understandable why.

Re: Remote Code Execution in Marvel Rivals Game

#24

Post by cubefox »

doctorpangloss wrote: post #7

The engineering culture behind AAA video games is rotten to the core with regards to security. Everyone thinks they're making Doom 3 and they're really making Windows 2000 Service Pack 1.

> The engineering culture behind AAA video games is rotten to the core with regards to security.

But it is way ahead with regards to efficient hardware utilization!

Re: Remote Code Execution in Marvel Rivals Game

#25

Post by sbarre »

gruez wrote: post #19
agoodusername63 wrote: post #14

Earlier quoted context omitted.

Is it particularly surprising though? These are game developers. Not backend developers. Not web guys. Not remotely trained in infosec. They make games. Not security software. And for the longest time this was acceptable. I think for a GaaS in 2025 it's unacceptable to not have security minded engineers on staff for the backend stuff. Too much money is involved not to. Especially for studios very familiar with shippi…

>These are game developers. Not backend developers. Not web guys. Not remotely trained in infosec. They make games. Not security software. Why do game developers get a pass but not "backend developers" or "web guys"? Don't the latter only "make CRUD apps, not security software"?

I think for web or "backend for network" people, you are always deploying into a hostile environment (the Internet) and so you really should be at least aware of basic security measures. If you consider yourself a professional in that field, it's table stakes.

If you're a game dev, you were taught to write optimized code that runs locally on a computer.

Not everything you do will run on the network, and networking/multiplayer might not be relevant every single time you ship a game. So it's less relevant (if still important)

Re: Remote Code Execution in Marvel Rivals Game

#27

Post by agentultra »

agentultra wrote: post #17

I was literally thinking about this the other day. There are a ton of games using kernel modules for anti-cheat and... just load and interpret data payloads. Certainly some of those payloads could manipulate the funny machines inside of a game executable if they're not careful about their parsing and validation. Nice PoC! Update : yes, most game client processes don't run in the kernel. My b. I was just thinking that…

Also, if you see content distribution networks the way we've been looking into package managers as a vector distributing poisoned payloads... seems fruitful.

Re: Remote Code Execution in Marvel Rivals Game

#28

Post by Liquix »

agentultra wrote: post #17

I was literally thinking about this the other day. There are a ton of games using kernel modules for anti-cheat and... just load and interpret data payloads. Certainly some of those payloads could manipulate the funny machines inside of a game executable if they're not careful about their parsing and validation. Nice PoC! Update : yes, most game client processes don't run in the kernel. My b. I was just thinking that…

Yes. For example world of warcraft's anticheat (warden), although it runs in userspace, has been exploited multiple times to gain RCE/server root after receiving malicious payloads from clients.

Re: Remote Code Execution in Marvel Rivals Game

#29

Post by p_ing »

999900000999 wrote: post #6
sim7c00 wrote: post #4

Earlier quoted context omitted.

tried in some communities of gamedev to talk about security but i gave up. i think the main sentiment is not to care at all. so many games have or had trivial exploits. enabling mass cheating, harasment of other players (DOS) and more nefarious stuff. for people whwo think the mitm wont affect them... thats a silly stance. people hack home routers on massive scales. (another domain who doesnt seem to give shits about…

Their's a really good argument for having a "gaming" os, Windows, and a serious OS , Linux on the same computer. If League of Legends needs super admin mode, it's no longer my computer. I'm sharing it with Tencent. I can't trust them ( specifically a disgruntled employee) to not install key loggers and other really nasty things.

> Their's a really good argument for having a "gaming" os, Windows, and a serious OS , Linux on the same computer.

This is a terrible idea if you think this will keep you secure. Windows provides direct access to update motherboard firmware and CPU microcode/management engine.

Re: Remote Code Execution in Marvel Rivals Game

#30

Post by dfxm12 »

999900000999 wrote: post #6
sim7c00 wrote: post #4

Earlier quoted context omitted.

tried in some communities of gamedev to talk about security but i gave up. i think the main sentiment is not to care at all. so many games have or had trivial exploits. enabling mass cheating, harasment of other players (DOS) and more nefarious stuff. for people whwo think the mitm wont affect them... thats a silly stance. people hack home routers on massive scales. (another domain who doesnt seem to give shits about…

Their's a really good argument for having a "gaming" os, Windows, and a serious OS , Linux on the same computer. If League of Legends needs super admin mode, it's no longer my computer. I'm sharing it with Tencent. I can't trust them ( specifically a disgruntled employee) to not install key loggers and other really nasty things.

Why stop at a separate OS? Why not use separate hardware just for gaming as well?
Post reply on HN