Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Remote Code Execution in Marvel Rivals Game

shalzuth.com

Post reply on HN
Print view View original

41–50 of 132 posts

Re: Remote Code Execution in Marvel Rivals Game

#41

Post by TonyTrapp »

Xunjin wrote: post #8
doctorpangloss wrote: post #7

The engineering culture behind AAA video games is rotten to the core with regards to security. Everyone thinks they're making Doom 3 and they're really making Windows 2000 Service Pack 1.

Great commentary, today the industry is focused on delivering free game with tons of cosmetics (which gives a ton of money) but forgetting about performance and security.

Your average networked game these days is probably a bazillion times more secure than one from 20 years ago. It was super common that there were cheat tools to crash all game clients in a match. It was super annoying, we can just be glad that it was usually not used for anything more nefarious.

Re: Remote Code Execution in Marvel Rivals Game

#42

Post by bilekas »

doctorpangloss wrote: post #7

The engineering culture behind AAA video games is rotten to the core with regards to security. Everyone thinks they're making Doom 3 and they're really making Windows 2000 Service Pack 1.

I don’t work in gaming, I know a few people who do, everyone of them does it for the love of the game. Certainly not for the job security or even the money. This idea that they’re also to handle security is too much. It’s not their fault, they’re writing “art” not secure micro services for multi national companies.

Publishers will pay to have 0level kernel ring on your system but not for software securing their game.

> the game runs with admin privileges for the sake of anti-cheat

Nobody higher than the devs thought “this might be risky?”

Because can assure you, the devs felt it stupid and risky.

Your “Everyone thinks their making doom 3”. As I see this is not the developer fault.

Re: Remote Code Execution in Marvel Rivals Game

#43

Post by 999900000999 »

p_ing wrote: post #29
999900000999 wrote: post #6

Earlier quoted context omitted.

Their's a really good argument for having a "gaming" os, Windows, and a serious OS , Linux on the same computer. If League of Legends needs super admin mode, it's no longer my computer. I'm sharing it with Tencent. I can't trust them ( specifically a disgruntled employee) to not install key loggers and other really nasty things.

> Their's a really good argument for having a "gaming" os, Windows, and a serious OS , Linux on the same computer. This is a terrible idea if you think this will keep you secure. Windows provides direct access to update motherboard firmware and CPU microcode/management engine.

Is most malware literally going to embed itself in the BIOS and install itself on Linux ?

Seems like an insanely difficult thing to do to target like .5% of users.

Re: Remote Code Execution in Marvel Rivals Game

#44

Post by DrillShopper »

pyrolistical wrote: post #39
devmor wrote: post #23

Earlier quoted context omitted.

Why would there be a strong engineering culture behind AAA video games at all? Game developers are underpaid, overworked and constantly told they can be replaced at a moments notice. I wouldn't expect anything but code that "ships" out of them, and its understandable why.

There needs to be at least 1 person to figure out why the game isn’t hitting the performance target. That is real engineering

With DLSS nobody bothers anymore. Just force the punters to buy an overpriced video card and then poor-shame them if they don't

Re: Remote Code Execution in Marvel Rivals Game

#45

Post by DrillShopper »

prophesi wrote: post #18
999900000999 wrote: post #6

Earlier quoted context omitted.

Their's a really good argument for having a "gaming" os, Windows, and a serious OS , Linux on the same computer. If League of Legends needs super admin mode, it's no longer my computer. I'm sharing it with Tencent. I can't trust them ( specifically a disgruntled employee) to not install key loggers and other really nasty things.

I have a Windows partition that I haven't booted into for ages. Originally I would first try to run a game on Linux, and fallback to Windows if it has problems. Some live service AAA games are still impossible to run on Linux due to anticheat, but it's otherwise a pretty good time for Linux gaming in the era of the Steam Deck.

I've removed the rebooting step and instead use a GPU pass-through VM

Re: Remote Code Execution in Marvel Rivals Game

#46

Post by kibwen »

I bought a Steam Deck with the sole purpose of having a cheap, airgapped PC to run games on. Game devs just don't have the incentives or discipline to be trusted with security.

Reminder that all three Dark Souls games allowed full RCE to any users connected to the internet: https://flashpoint.io/blog/rce-vulnerability-dark-souls/

Re: Remote Code Execution in Marvel Rivals Game

#47

Post by bilekas »

> Game developers continue to amaze me at their lack of security awareness.

Because game developers are SUPPOSED to be aware of these things?

> It's very hard for security researchers to report bugs to most game dev companies. On top of that, most do not have bug bounty programs

Yet the OP blames the GAME developers…

They already have harder jobs than the majority of us, picking on them for not knowing skills outside of their area is just being mean and OP is targeting frustration at the wrong group.

Re: Remote Code Execution in Marvel Rivals Game

#48

Post by Etheryte »

kibwen wrote: post #46

I bought a Steam Deck with the sole purpose of having a cheap, airgapped PC to run games on. Game devs just don't have the incentives or discipline to be trusted with security. Reminder that all three Dark Souls games allowed full RCE to any users connected to the internet: https://flashpoint.io/blog/rce-vulnerability-dark-souls/

I wish Steam offered a console format of the deck, essentially the same thing, but with better specs, HDMI out and bluetooth for controllers. Would be a massive hit I wager.

Re: Remote Code Execution in Marvel Rivals Game

#49

Post by hibikir »

999900000999 wrote: post #6
sim7c00 wrote: post #4

Earlier quoted context omitted.

tried in some communities of gamedev to talk about security but i gave up. i think the main sentiment is not to care at all. so many games have or had trivial exploits. enabling mass cheating, harasment of other players (DOS) and more nefarious stuff. for people whwo think the mitm wont affect them... thats a silly stance. people hack home routers on massive scales. (another domain who doesnt seem to give shits about…

Their's a really good argument for having a "gaming" os, Windows, and a serious OS , Linux on the same computer. If League of Legends needs super admin mode, it's no longer my computer. I'm sharing it with Tencent. I can't trust them ( specifically a disgruntled employee) to not install key loggers and other really nasty things.

The data breach Disney had last year is reported to be caused by downloading a malicious mod in a work computer, which then fetched the Slack credentials and downloaded everything available. Many a cryptocurrency wallet is emptied out with similar attack vectors.

We might have better computer security than with Windows 95, but the level of isolation we need to have a semblance of security is very rare and it's very easy for people to slip.

Re: Remote Code Execution in Marvel Rivals Game

#50

Post by jamie_ca »

Etheryte wrote: post #48
kibwen wrote: post #46

I bought a Steam Deck with the sole purpose of having a cheap, airgapped PC to run games on. Game devs just don't have the incentives or discipline to be trusted with security. Reminder that all three Dark Souls games allowed full RCE to any users connected to the internet: https://flashpoint.io/blog/rce-vulnerability-dark-souls/

I wish Steam offered a console format of the deck, essentially the same thing, but with better specs, HDMI out and bluetooth for controllers. Would be a massive hit I wager.

They tried some years back https://en.wikipedia.org/wiki/Steam_Machine_(computer) but it didn't really hit big. That said recent updates to SteamOS and agreements around logo/branding use hint that we're likely to see a few other options in the coming year or two (alongside some 3rd-party handhelds running SteamOS).
Post reply on HN