Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Valve accused of ignoring existing RCE vulnerability in Source games for 2 years

twitter.com

Post reply on HN
Print view View original

31–40 of 122 posts

Re: Valve accused of ignoring existing RCE vulnerability in Source games for 2 years

#31

Post by zinclozenge »

mhh__ wrote: post #17
invokestatic wrote: post #11

Earlier quoted context omitted.

No, anti-cheats in ring0 haven't eliminated cheaters, but that was never the point. The point is to make it more difficult to cheat. And they have succeeded in that. Check any cheat forum like unknowncheats. You'll see that most hackers now have to chain multiple (complex) exploits together to get their cheats working, only to get it patched by the anti-cheats a few days/weeks later. This is way more difficult and pr…

Surely the end state is cheats that even ring0 can't see i.e. read the display directly, act through the mouse. Maybe we should we run the entire OS in the games hypervisor?

I was actually thinking that you should be able to build a bot for MMOs and other kind of games that require farming with a raspberry pi or arduino acting like a mouse with a camera for image recognition. Don't know how feasible that is, but that would be undetectable by anti-cheat software.

Re: Valve accused of ignoring existing RCE vulnerability in Source games for 2 years

#32

Post by pjmlp »

philistine wrote: post #27
rstat1 wrote: post #18

Earlier quoted context omitted.

In my mind there's a huge difference between the 2. The sony rootkit was installed in secret, full of security holes, hard to remove, and made by a vendor that appeared to give 0 shits about said security holes. All of the anti-cheat solutions I've seen that run in kernel mode are none of those things. They make it well known that they're installing, are made by vendors that actively care about the security of their…

Hopefully, Microsoft is going to follow in Apple's footsteps and close the access to the kernel for any and all programs. Yes, we will lose a lot, since Apple right now cannot cover all use cases of kernel access through new APIs, but we will gain so much in security and reliability. I'm of the opinion that easy kernel access for all apps and games is ultimately not putting me in control of my computer.

They already kind of did, I only install PC games via the Windows store.

Re: Valve accused of ignoring existing RCE vulnerability in Source games for 2 years

#33

Post by pjmlp »

walrus01 wrote: post #12
xyst wrote: post #2

This is why I have a separate machine for "gaming" and "work" Some game companies (riot games) even install their anti-cheat software so that is loads in the ring 0 space. Even with their best efforts, cheaters will still prosper. Might even go a step further and firewall my gaming machine off from the rest of my network.

It seems that a lot of people forgot about things like sony installing rootkits on peoples' PCs. Now it's accepted for gaming anti cheat software?

Depends, Windows Store and the respective sandbox is a thing.

Re: Valve accused of ignoring existing RCE vulnerability in Source games for 2 years

#34

Post by JUNGLEISMASSIVE »

xyst wrote: post #2

This is why I have a separate machine for "gaming" and "work" Some game companies (riot games) even install their anti-cheat software so that is loads in the ring 0 space. Even with their best efforts, cheaters will still prosper. Might even go a step further and firewall my gaming machine off from the rest of my network.

I hope those separate machines are also on separate network segments without a route in between.

Re: Valve accused of ignoring existing RCE vulnerability in Source games for 2 years

#35

Post by EamonnMR »

zinclozenge wrote: post #31
mhh__ wrote: post #17

Earlier quoted context omitted.

Surely the end state is cheats that even ring0 can't see i.e. read the display directly, act through the mouse. Maybe we should we run the entire OS in the games hypervisor?

I was actually thinking that you should be able to build a bot for MMOs and other kind of games that require farming with a raspberry pi or arduino acting like a mouse with a camera for image recognition. Don't know how feasible that is, but that would be undetectable by anti-cheat software.

Not really, some anti-cheat analysis is server-side and designed to catch people acting bot-like.

Re: Valve accused of ignoring existing RCE vulnerability in Source games for 2 years

#36

Post by rstat1 »

philistine wrote: post #27
rstat1 wrote: post #18

Earlier quoted context omitted.

In my mind there's a huge difference between the 2. The sony rootkit was installed in secret, full of security holes, hard to remove, and made by a vendor that appeared to give 0 shits about said security holes. All of the anti-cheat solutions I've seen that run in kernel mode are none of those things. They make it well known that they're installing, are made by vendors that actively care about the security of their…

Hopefully, Microsoft is going to follow in Apple's footsteps and close the access to the kernel for any and all programs. Yes, we will lose a lot, since Apple right now cannot cover all use cases of kernel access through new APIs, but we will gain so much in security and reliability. I'm of the opinion that easy kernel access for all apps and games is ultimately not putting me in control of my computer.

Access to kernel mode on Windows is already pretty restricted as it is. As far as I understand, you either have to run your whole machine in a special "Test Mode" or have a specific kind of (expensive) code signing certificate.

But beyond that, I don't see how "more restriction" == "more control for the user"

Re: Valve accused of ignoring existing RCE vulnerability in Source games for 2 years

#37

Post by fuyu »

rstat1 wrote: post #18
walrus01 wrote: post #12

Earlier quoted context omitted.

It seems that a lot of people forgot about things like sony installing rootkits on peoples' PCs. Now it's accepted for gaming anti cheat software?

In my mind there's a huge difference between the 2. The sony rootkit was installed in secret, full of security holes, hard to remove, and made by a vendor that appeared to give 0 shits about said security holes. All of the anti-cheat solutions I've seen that run in kernel mode are none of those things. They make it well known that they're installing, are made by vendors that actively care about the security of their…

Genshin Impact is a recent game that has included a kernel mode anti-cheat. I would be very surprised if the majority of players know that it exists, or understand what it means to have it run in kernel mode.

The Genshin website previously allowed anyone to view the phone number you have linked to your account via the password reset mechanism. Due to common reports of accounts getting stolen (and unable to be recovered), two factor auth has been highly requested, but doesn't seem to be a priority. I'm skeptical that they strongly care about the security of their users.

Even if Genshins anti-cheat is completely secure, as kernel anti-cheat becomes more common it's inevitable that we will get an instance that is full of security holes. Unfortunately as long as the user can't play their favorite game without it, they will happily install it.

Re: Valve accused of ignoring existing RCE vulnerability in Source games for 2 years

#38

Post by sseneca »

pstrateman wrote: post #29
sseneca wrote: post #26

Earlier quoted context omitted.

> Some game companies (riot games) even install their anti-cheat software so that is loads in the ring 0 space. Why are separate machines required, rather than dual-booting? (i.e. Windows for games, Linux for everything else)

Your computer is really a bunch of computers pretending to be a single computer. Most of the components have firmware that can itself be loaded with malware.

Ah. So, if a Windows application runs in ring 0, it can put malware in a place such that it can then interact with the Linux install?

Is there _any_ way to bypass this, apart from separate machines? I didn't know this was possible.

Re: Valve accused of ignoring existing RCE vulnerability in Source games for 2 years

#39

Post by tedunangst »

mhh__ wrote: post #17
invokestatic wrote: post #11

Earlier quoted context omitted.

No, anti-cheats in ring0 haven't eliminated cheaters, but that was never the point. The point is to make it more difficult to cheat. And they have succeeded in that. Check any cheat forum like unknowncheats. You'll see that most hackers now have to chain multiple (complex) exploits together to get their cheats working, only to get it patched by the anti-cheats a few days/weeks later. This is way more difficult and pr…

Surely the end state is cheats that even ring0 can't see i.e. read the display directly, act through the mouse. Maybe we should we run the entire OS in the games hypervisor?

A lot of cheats involve reading in memory game state to see through walls, which your screen grabber won't be able to do.

Re: Valve accused of ignoring existing RCE vulnerability in Source games for 2 years

#40

Post by zionic »

sseneca wrote: post #26
xyst wrote: post #2

This is why I have a separate machine for "gaming" and "work" Some game companies (riot games) even install their anti-cheat software so that is loads in the ring 0 space. Even with their best efforts, cheaters will still prosper. Might even go a step further and firewall my gaming machine off from the rest of my network.

> Some game companies (riot games) even install their anti-cheat software so that is loads in the ring 0 space. Why are separate machines required, rather than dual-booting? (i.e. Windows for games, Linux for everything else)

Because Linux and windows bootloaders routinely screw with each other. I am NEVER losing another weekend to that crap again. Dedicated windows gaming PC is the correct way to deal with this.
Post reply on HN