I'm surprised more exploits aren't being found in games, they're usually thrown together as quickly as possible.
I assume most of the reverse engineering being done on games is with an eye to developing cheats rather than attacking players.
Grand Theft Auto V exploit assigned CVE number due to partial RCE
31–40 of 42 posts
Re: Grand Theft Auto V exploit assigned CVE number due to partial RCE
#32GTA V has averaged >100k concurrent players on steam for the last 3 years, so a RCE has a lot of potential targets ripe for exploitation.
It only needs to make it into a mod-menu to get wide, unsuspecting distribution. For those curious, mod menus are what "hackers" use to exploit the gameplay for fun. Script-kiddies are a good analog in history. They're often just kids who googled GTA hacks and installed from the first page they thought looked cool. They'll be prime targets for distribution.
Interestingly enough, it seems like some of these "mod menus" have already patched the exploit. Having one of these is almost a requirement for playing GTA Online these days, purely for the defensive features they offer against other cheaters. It's still a mess and requires trust (or a VM).
Re: Grand Theft Auto V exploit assigned CVE number due to partial RCE
#33I'm surprised more exploits aren't being found in games, they're usually thrown together as quickly as possible.
If you are exploiting the games it's easy to make money by selling cheats in the game, probably keeps people from looking for crypto ransom payoffs as much
Re: Grand Theft Auto V exploit assigned CVE number due to partial RCE
#34Earlier quoted context omitted.
How do you play any game with anti-cheat in a VM?
Which anti-cheat would be triggered by running in a VM? I thought VAC worked by detecting runtime patching of .dll files.
VAC has a number of other triggers too but doesn't care about VMs in particular. I think everyone and their dog is an expert in not tripping VAC at this point
It's mostly those annoying ACs with kernel modules like EAC, BattlEye, ESEA etc. that do anti VM in an attempt to prevent cheat devs from 1. debugging the AC without at least a little effort and 2. having a clean OS but reading guest RAM from the host to avoid the anticheat entirely
Re: Grand Theft Auto V exploit assigned CVE number due to partial RCE
#35I'm surprised more exploits aren't being found in games, they're usually thrown together as quickly as possible.
Ordinarily there's no reason why you would "attack" the game, so things only get found if a significant community arises for the game which would benefit, e.g. speed running Mario 64 is a thing, so figuring out weird details of the engine is crucial to the best possible times in categories which allow you to break the game to win. For a Remote Code Execution bug like this it only makes sense if it's a popular multipl…
Little reason to attack the game? How about knocking your enemies offline? Or getting their game or real money? Or recruit them for your DoS botnet? Because that’s what an RCE allows you to do…
Re: Grand Theft Auto V exploit assigned CVE number due to partial RCE
#36These games have tens of millions of lines of code (often building on top of the older components). They are also written in memory unsafe C++, by developers focused on features and rapid sales, to users that look forward to new features not better security. I won’t be surprised at all if they are filled with vulnerabilities.
https://www.gamedeveloper.com/programming/dirty-game-develop...
Look at "(s)elf-exploitation"
Re: Grand Theft Auto V exploit assigned CVE number due to partial RCE
#37Earlier quoted context omitted.
Source Engine CVE-2021-30481 There's actually been a lot more of these that don't get CVEs It's one of the reasons I prefer to game in a VM with heavy network filtering and egress only through VPN There is little to no care from game developers about security, games with actively exploitable RCEs (see pretty much the whole CoD franchise) are just allowed to stay up on Steam Gamers are also kinda dumb and oblivious to…
How do you game in a VM? A lot of my game time includes flight simulators with many external peripherals.
This is the biggest obstacle you're going to face:
https://wiki.archlinux.org/title/PCI_passthrough_via_OVMF
With AMD cards it's relatively easy if you're willing to install two cards and have one of them just sit there doing nothing when you're not using the VM. It's also possible to use just one card and detach it from the host system, pass it to the VM, and then reattach back to the host system when you're done playing, although I spent multiple days on this and never got it working. YMMV, it was 2-3 years ago, the driver support may have improved.
With nvidia it ranges from difficult to impossible.
Re: Grand Theft Auto V exploit assigned CVE number due to partial RCE
#38Earlier quoted context omitted.
Ordinarily there's no reason why you would "attack" the game, so things only get found if a significant community arises for the game which would benefit, e.g. speed running Mario 64 is a thing, so figuring out weird details of the engine is crucial to the best possible times in categories which allow you to break the game to win. For a Remote Code Execution bug like this it only makes sense if it's a popular multipl…
Video games being connected to the internet 24/7 are quickly becoming the norm. I am convinced there is a treasure trove of exploits created by the gaming industry just waiting to be found.
IIRC it's unsafe to play multiplayer in past releases of Call of Duty, even if fully-patched, because the games have a plethora of unpatched exploits (used on Xbox 360 to create modded lobbies), and I'm guessing the game's P2P nature makes it easier to find a client in your lobby to exploit.
The general recommendation is to install a community patch but I'd rather not run it at all, to be honest. I'd say "play in a VM" but I'm sure anti-cheat wouldn't like that.
Re: Grand Theft Auto V exploit assigned CVE number due to partial RCE
#39Earlier quoted context omitted.
Source Engine CVE-2021-30481 There's actually been a lot more of these that don't get CVEs It's one of the reasons I prefer to game in a VM with heavy network filtering and egress only through VPN There is little to no care from game developers about security, games with actively exploitable RCEs (see pretty much the whole CoD franchise) are just allowed to stay up on Steam Gamers are also kinda dumb and oblivious to…
How do you game in a VM? A lot of my game time includes flight simulators with many external peripherals.
The only good working solution I found (other than PCIe passthrough or specialized GPU virtualization) is VMware stuff (with better success on Windows [as a host]), because their DirectX virtualization is top-notch. Years ago I did some random testing of my Steam library and got close to native performance.
Obviously, it means you can't use DLSS, RT, or any other GPU-specific features, but their DirectX virtualization supports up to DX12.
Re: Grand Theft Auto V exploit assigned CVE number due to partial RCE
#40Earlier quoted context omitted.
Ordinarily there's no reason why you would "attack" the game, so things only get found if a significant community arises for the game which would benefit, e.g. speed running Mario 64 is a thing, so figuring out weird details of the engine is crucial to the best possible times in categories which allow you to break the game to win. For a Remote Code Execution bug like this it only makes sense if it's a popular multipl…
Little reason to attack the game? How about knocking your enemies offline? Or getting their game or real money? Or recruit them for your DoS botnet? Because that’s what an RCE allows you to do…
Suppose it takes you six months to figure out an RCE for PowerWash Simulator. Yay, if you can find another player you can really pwn them now. Wait, how will you find a player to victimise? Nobody was looking for multiplayer PowerWash Simulator a month after it came out, let alone six months.
GTA V has been around for ten years but still has a huge player base and that's what makes this practical.