I'm surprised - isn't this game just a skin on Overwatch? So does Overwatch have an RCE?
Remote Code Execution in Marvel Rivals Game
31–40 of 132 posts
Re: Remote Code Execution in Marvel Rivals Game
#32Earlier quoted context omitted.
tried in some communities of gamedev to talk about security but i gave up. i think the main sentiment is not to care at all. so many games have or had trivial exploits. enabling mass cheating, harasment of other players (DOS) and more nefarious stuff. for people whwo think the mitm wont affect them... thats a silly stance. people hack home routers on massive scales. (another domain who doesnt seem to give shits about…
Their's a really good argument for having a "gaming" os, Windows, and a serious OS , Linux on the same computer. If League of Legends needs super admin mode, it's no longer my computer. I'm sharing it with Tencent. I can't trust them ( specifically a disgruntled employee) to not install key loggers and other really nasty things.
It's the endgame of cheats. If it's not supreme over all programs, you can cheat by chaining things when it isn't looking or before the anitcheat starts. By running a service from startup with maximal privilege, they can prevent cheats at the expense of running a service from startup as low at maximal privilege.
Arguably they could have already gotten all sensitive user data without that privilege if their program was hacked
Re: Remote Code Execution in Marvel Rivals Game
#33The engineering culture behind AAA video games is rotten to the core with regards to security. Everyone thinks they're making Doom 3 and they're really making Windows 2000 Service Pack 1.
It's not more rotten that your regular backend shop. How many api issues / auth problems / s3 open bucket there are out there exactly?
Re: Remote Code Execution in Marvel Rivals Game
#34I'm surprised - isn't this game just a skin on Overwatch? So does Overwatch have an RCE?
No, Marvel Rivals and Overwatch are not related in any way other than they're both the same genre of game.
Re: Remote Code Execution in Marvel Rivals Game
#35Earlier quoted context omitted.
Their's a really good argument for having a "gaming" os, Windows, and a serious OS , Linux on the same computer. If League of Legends needs super admin mode, it's no longer my computer. I'm sharing it with Tencent. I can't trust them ( specifically a disgruntled employee) to not install key loggers and other really nasty things.
Why stop at a separate OS? Why not use separate hardware just for gaming as well?
custom hardware is nice, like a ps5 or something, but this is usually built up from somewhat known component. a lot of hardware is not too bad, but the software has the main issues. i dont see gaming companies develop custom security hardened hardware quickly due to extreme costs related in making very advanced and fast chips.
ultimately a combination would be best, hardware tailored to be secure and allow secure software to be developed for it, but the same can be said for phones and pc's etc .
most modern cpus have quite a lot of hardware security features which are often not ideally implemented or not used. they also offer features that can allow software to enhance security, bit that is also rare. for example you _could_ use certain extended cpu registers to allow for taint tracking etc, but this likely kills game performance, and is not even done for trivial applications despite being proven to mitigate entire classes of vulnerabilities. (its quite complicated to implement too as the hardware isnt taking into account such features for such purposes)
Re: Remote Code Execution in Marvel Rivals Game
#36Earlier quoted context omitted.
Their's a really good argument for having a "gaming" os, Windows, and a serious OS , Linux on the same computer. If League of Legends needs super admin mode, it's no longer my computer. I'm sharing it with Tencent. I can't trust them ( specifically a disgruntled employee) to not install key loggers and other really nasty things.
> Their's a really good argument for having a "gaming" os, Windows, and a serious OS , Linux on the same computer. This is a terrible idea if you think this will keep you secure. Windows provides direct access to update motherboard firmware and CPU microcode/management engine.
hah yeah ,dont run insecure os nexto secure one :D. good point!
Re: Remote Code Execution in Marvel Rivals Game
#37Earlier quoted context omitted.
Is it particularly surprising though? These are game developers. Not backend developers. Not web guys. Not remotely trained in infosec. They make games. Not security software. And for the longest time this was acceptable. I think for a GaaS in 2025 it's unacceptable to not have security minded engineers on staff for the backend stuff. Too much money is involved not to. Especially for studios very familiar with shippi…
Hey, I feel there's some predisposition in infosec-minded people that insecure software must not exist regardless of its purpose or threat model. And also that people who can't write secure code must not write code...
People who can't write secure code yet can learn how to write secure code.
Re: Remote Code Execution in Marvel Rivals Game
#38I'm surprised - isn't this game just a skin on Overwatch? So does Overwatch have an RCE?
No, Marvel Rivals and Overwatch are not related in any way other than they're both the same genre of game.
Wow, I was so convinced that it was the case that I thought you were mistaken. They look remarkably similar. But yeah, just another game in that genre like you said.
Re: Remote Code Execution in Marvel Rivals Game
#39The engineering culture behind AAA video games is rotten to the core with regards to security. Everyone thinks they're making Doom 3 and they're really making Windows 2000 Service Pack 1.
Why would there be a strong engineering culture behind AAA video games at all? Game developers are underpaid, overworked and constantly told they can be replaced at a moments notice. I wouldn't expect anything but code that "ships" out of them, and its understandable why.
There needs to be at least 1 person to figure out why the game isn’t hitting the performance target. That is real engineering
Re: Remote Code Execution in Marvel Rivals Game
#40Earlier quoted context omitted.
>These are game developers. Not backend developers. Not web guys. Not remotely trained in infosec. They make games. Not security software. Why do game developers get a pass but not "backend developers" or "web guys"? Don't the latter only "make CRUD apps, not security software"?
I think for web or "backend for network" people, you are always deploying into a hostile environment (the Internet) and so you really should be at least aware of basic security measures. If you consider yourself a professional in that field, it's table stakes. If you're a game dev, you were taught to write optimized code that runs locally on a computer. Not everything you do will run on the network, and networking/mu…
This isn't really true, game devs have had to deal with client-server authenticity issues since the beginning of multiplayer gaming. There's a lot of lessons learned around and why there's whole sets of middleware designed to alleviate/lessen these issues. For as long as multiplayer games have been around this has been an issue.
The impact ie: RCE vs just ruining the game experience may be different but the concepts are all the same- adversarial clients.
The excuses you listed aren't any different for business apps.