Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Valve accused of ignoring existing RCE vulnerability in Source games for 2 years

twitter.com

Post reply on HN
Print view View original

51–60 of 122 posts

Re: Valve accused of ignoring existing RCE vulnerability in Source games for 2 years

#51

Post by chc4 »

sodality2 wrote: post #19

Dozens of Counter-strike exploits exist and the cheating scene has just grown too rampantly. Valve simply doesn't care about the source engine. Any new CSGO player will tell you the anti-cheat doesn't work, I know first-hand. The lack of care regarding source engine netcode extends to every part of the source engine, including Valve Anti-cheat. The anti-cheat is trivial to reverse (several PUBLIC bypasses have existe…

Video game cheats and anti-cheats are almost completely disjoint from remote code exploits like what are reported in the OP.

Re: Valve accused of ignoring existing RCE vulnerability in Source games for 2 years

#52

Post by linkfee »

oxylibrium wrote: post #46
rstat1 wrote: post #18

Earlier quoted context omitted.

In my mind there's a huge difference between the 2. The sony rootkit was installed in secret, full of security holes, hard to remove, and made by a vendor that appeared to give 0 shits about said security holes. All of the anti-cheat solutions I've seen that run in kernel mode are none of those things. They make it well known that they're installing, are made by vendors that actively care about the security of their…

> ...make it well known that they're installing... Many vendors originally hid the fact until they started receiving community backlash about it. For example, Riot with Vanguard originally hid*[0] that it was running 24/7, and also hid the fact that it blocked drivers, until people noticed and complained about it. Many games, PUBG Lite and Genshin Impact in recent memory, also do not reveal this to the user. [0]: htt…

disgusting company, disgusting policies. But awesome research! ~nerrix

Re: Valve accused of ignoring existing RCE vulnerability in Source games for 2 years

#53

Post by 120391583 »

sseneca wrote: post #38
pstrateman wrote: post #29

Earlier quoted context omitted.

Your computer is really a bunch of computers pretending to be a single computer. Most of the components have firmware that can itself be loaded with malware.

Ah. So, if a Windows application runs in ring 0, it can put malware in a place such that it can then interact with the Linux install? Is there _any_ way to bypass this, apart from separate machines? I didn't know this was possible.

It's a very real and terrifying threat. A standard PC has numerous components with their own firmware that can potentially be flashed. Some of those components may have integrity checking schemes that are supposed to ensure only vendor-signed code can be flashed or executed, but don't rely on those measures actually working as intended (and not being exploitable themselves). Hardware vendors are notoriously bad at this.

This is one of the reasons I'm so enthusiastic about the T2 and M1: a hardware root of trust designed by a competent vendor. (Yes, there is a flaw in the T2, but it requires physical access to exploit.) In my opinion, those are the only trustworthy desktops or laptops on the market right now. You'll notice AWS (Nitro) and Google (Titan) also have their own proprietary hardware security chips for the same reason.

Re: Valve accused of ignoring existing RCE vulnerability in Source games for 2 years

#54

Post by chaoz_ »

EamonnMR wrote: post #35
zinclozenge wrote: post #31

Earlier quoted context omitted.

I was actually thinking that you should be able to build a bot for MMOs and other kind of games that require farming with a raspberry pi or arduino acting like a mouse with a camera for image recognition. Don't know how feasible that is, but that would be undetectable by anti-cheat software.

Not really, some anti-cheat analysis is server-side and designed to catch people acting bot-like.

Yep. Not to mention that MMO game bots aim at automated resource farming and owner still needs to somehow sell it.

Some of the MMO games I've played used this gold transfer "graph" analysis that worked pretty well with really low False Positive Rate.

Re: Valve accused of ignoring existing RCE vulnerability in Source games for 2 years

#56

Post by grawprog »

sodality2 wrote: post #19

Dozens of Counter-strike exploits exist and the cheating scene has just grown too rampantly. Valve simply doesn't care about the source engine. Any new CSGO player will tell you the anti-cheat doesn't work, I know first-hand. The lack of care regarding source engine netcode extends to every part of the source engine, including Valve Anti-cheat. The anti-cheat is trivial to reverse (several PUBLIC bypasses have existe…

Normally, I can handle some cheating in games, you just kinda deal with it, but holy fuck csgo was just nope. Between foul mouthed children and essentially watching God hackers play against eachother while you just die over and over.

Yeah....no not exactly fun.

Re: Valve accused of ignoring existing RCE vulnerability in Source games for 2 years

#57

Post by 0xbkt »

zionic wrote: post #40
sseneca wrote: post #26

Earlier quoted context omitted.

> Some game companies (riot games) even install their anti-cheat software so that is loads in the ring 0 space. Why are separate machines required, rather than dual-booting? (i.e. Windows for games, Linux for everything else)

Because Linux and windows bootloaders routinely screw with each other. I am NEVER losing another weekend to that crap again. Dedicated windows gaming PC is the correct way to deal with this.

With a UEFI-GPT setup two ESPs (one for each OS) and you're good. Now that I have no software bootloaders, which need to know about multiple OSs, I only need to use BIOS' own boot device selector on startup.

Re: Valve accused of ignoring existing RCE vulnerability in Source games for 2 years

#58

Post by TazeTSchnitzel »

dafelst wrote: post #7

I have a friend who used to work at Valve as a software engineer - he mentioned to me that the entire source networking stack is chock full of unchecked buffers and all sorts of potential for fairly trivial RCEs, but due to Valve's internal structure (or lack thereof) there really isn't any incentive for anyone to fix them. This was 5-6 odd years ago and he no longer works there, so things might have changed, but bas…

> due to Valve's internal structure (or lack thereof) there really isn't any incentive for anyone to fix them

This seems to be a common theme with problems at Valve.

Re: Valve accused of ignoring existing RCE vulnerability in Source games for 2 years

#59

Post by charcircuit »

tedunangst wrote: post #39
mhh__ wrote: post #17

Earlier quoted context omitted.

Surely the end state is cheats that even ring0 can't see i.e. read the display directly, act through the mouse. Maybe we should we run the entire OS in the games hypervisor?

A lot of cheats involve reading in memory game state to see through walls, which your screen grabber won't be able to do.

You can use DMA to read memory in an undetectable way.

Re: Valve accused of ignoring existing RCE vulnerability in Source games for 2 years

#60

Post by sneak »

dkarras wrote: post #55

It would be a shame if an "anonymous hacker" "hacked" @floesen_, found their notes about the RCE and released it to public, accidentally of course.

It would probably also be a shame when floesen_ got sued for an NDA violation and had to spend tens of thousands of dollars in civil court explaining that they got hacked and it's not their fault.
Post reply on HN