Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Rumors of GTA online exploits allowing remote code execution on gamer PCs

old.reddit.com

Post reply on HN
Print view View original

31–40 of 50 posts

Re: Rumors of GTA online exploits allowing remote code execution on gamer PCs

#31

Post by 5e92cb50239222b »

someperson wrote: post #2

A remote code execution exploit in GTA 5 Online should not a surprise to anybody who has played GTA 5 Online. Cheaters have been rampant for many years, with people using apparently purchased cheat tools that allow them to choose to do server-side things like drop unlimited money and spawn vehicles anywhere, rapidly cycling through weather changes, and locking people permanently in cages. But get on the bad side of a…

Technically, the online game is a complete joke. I don't know if this still works, but a couple of years ago you could kick everyone from the server by simply pausing the main game process in Process Explorer for a few seconds (8-10 IIRC), and then unpausing it. Very handy when transporting stuff like cars that may be interesting to other players.

Re: Rumors of GTA online exploits allowing remote code execution on gamer PCs

#32

Post by doodlesdev »

mopsi wrote: post #15
autoexec wrote: post #8

Earlier quoted context omitted.

I wouldn't have assumed that a cheater's ability to effect things on a game server would mean they could execute whatever code they wanted on my personal computer unless that server was running on my system. Spawning money and vehicles sound like pretty harmless cheats you'd expect in a game like grand theft auto.

I would assume it. If attacker can send my game arbitrary commands for execution without client side filtering out things like moving my character around (unless context allows it, eg waiting for a mission to start), there are good odds they can cause a buffer overrun and execute code directly too. Games usually aren't in memory-safe languages.

Also remember this game is P2P, there is no saving that on PC, on consoles it works because it's a "safe" environment but on PC even with rootkit levels of anticheat you don't have control over the machine running the game and can't prevent it from messing things up

Re: Rumors of GTA online exploits allowing remote code execution on gamer PCs

#33

Post by BoorishBears »

Spastche wrote: post #29
Lendal wrote: post #24

Earlier quoted context omitted.

I knew this was coming. GTA V is the game that finally caused me to quit PC online gaming entirely some years ago, and purchase a game console instead. I had to relearn everything, because I grew up on mouse/keyboard control and had never used a console controller before. (It's not that difficult, really.) The move was worth it. The amount of headaches caused by cheaters and hackers in PC gaming just isn't worth the…

this is like burning down your house and deciding to live in a tent because your roof is leaky. multiplayer console gaming is even buggier than it's PC gaming counterpart, or at least has been traditionally.

I like how you left yourself an out with "or at least has been traditionally"... the 8th generation consoles came out a decade ago now and mostly put an end to widespread arbitrary code execution on consoles.

If there's anything that consoles absolutely blow PCs out of the water with, it's multiplayer gaming for that exact reason, and I say that as someone with a pretty serious gaming PC

Re: Rumors of GTA online exploits allowing remote code execution on gamer PCs

#34

Post by hahalolha »

philistine wrote: post #22
fakecarhacker wrote: post #16

The rumors are correct. This is an out-of-bounds array read/write vulnerability in the multiplayer scripting engine. Even if they patch this one, there are about half a dozen others known already. The only reason why this hasn't yet been turned into an exploit that runs arbitrary code outside of GTA on your computer is that no-one has bothered to do the extra work required for that. Not as far as I know anyway.

I'd bet good money they will find crypto-mining injections in the wild.

So now GTA:O hackers have found an irl money glitch /j

Re: Rumors of GTA online exploits allowing remote code execution on gamer PCs

#35

Post by CommitSyn »

lopkeny12ko wrote: post #19

Is it just me or is it impossible to find from this source link any _real details_ about the actual RCE? * This post claims an RCE being exploited and warns people not to play. * It links to Rockstar forums where people are warning about the game being exploited but provide no details on the attack vector or indicators of compromise. * It links to a screenshot of a tweet of some random person again warning not to pla…

It's likely one or a small group of people that have the exploit. Chances are they aren't spraying it en mass so it only happens unexpectedly to a few people here and there, none of which are security experts. The only source that can give these details are Rockstar, maybe once they figure it out, or now that it's out someone else may figure it out as well.

I believe it's likely real, and we'll see more details soon enough.

Re: Rumors of GTA online exploits allowing remote code execution on gamer PCs

#36

Post by dns_snek »

marcsj wrote: post #5
someperson wrote: post #2

A remote code execution exploit in GTA 5 Online should not a surprise to anybody who has played GTA 5 Online. Cheaters have been rampant for many years, with people using apparently purchased cheat tools that allow them to choose to do server-side things like drop unlimited money and spawn vehicles anywhere, rapidly cycling through weather changes, and locking people permanently in cages. But get on the bad side of a…

Really hoping that GTA 6 Online uses dedicated servers. It's not that expensive, and lets you have the option of being more authoritative with clients.

This is very likely, not to aid player experience but so that they can make even more money through grindy in-game currency and microtransactions.

Re: Rumors of GTA online exploits allowing remote code execution on gamer PCs

#37

Post by dns_snek »

Rockstar Games only seem to "guarantee" a $2,500 payment for RCE vulnerabilities, despite making billions off their properties. They claim to provide a bounty of up to $25k, but I couldn't find evidence of them ever paying a bounty close to that amount. It shows how much they value their customers' privacy and security.

https://hackerone.com/rockstargames

Re: Rumors of GTA online exploits allowing remote code execution on gamer PCs

#38

Post by tinus_hn »

DefineOutside wrote: post #25

I've played with and studied netcode and I'm unsure what GTA netcode would even look like. I've seen cheats to the point where everyone is just teleported to the cheater, the cheater spawning millions of dollars, cheaters taking away millions of dollars from people, the cheater unlocking all the online collectables for everyone in the lobby at the same time, people screwing with singleplayer sessions, cheaters crashi…

How can the game handle another player pushing you if you don’t ‘accept actions from other players’?

Re: Rumors of GTA online exploits allowing remote code execution on gamer PCs

#40

Post by bunnybender »

5e92cb50239222b wrote: post #31
someperson wrote: post #2

A remote code execution exploit in GTA 5 Online should not a surprise to anybody who has played GTA 5 Online. Cheaters have been rampant for many years, with people using apparently purchased cheat tools that allow them to choose to do server-side things like drop unlimited money and spawn vehicles anywhere, rapidly cycling through weather changes, and locking people permanently in cages. But get on the bad side of a…

Technically, the online game is a complete joke. I don't know if this still works, but a couple of years ago you could kick everyone from the server by simply pausing the main game process in Process Explorer for a few seconds (8-10 IIRC), and then unpausing it. Very handy when transporting stuff like cars that may be interesting to other players.

Yes it still works, but that is quite normal and fine, actually. The game's lobbies/sessions are based on peer-to-peer, so obviously when you cut connections to other players you will get to play by yourself (in other words, you are just "kicking" yourself out of the current session). Someone could join your "solo" session at any time, it just isn't very likely, as the game's services usually find more populated sessions for everyone.

Then again, nowadays you can play the game without restrictions in invite-only and friends sessions, too.

Post reply on HN