Interestingly, the game doesn't run as admin for any good reason. The first thing I did was only let the launcher and game run as the user with RunAsInvoker. The anticheat alone is allowed RunAsAdmin. At the same time, I don't trust any anticheat. It's probably worse than useless, but it is what it is. I thought Microsoft would clean this up after the Crowdstrike incident for all kernel-level code, but I guess there's no incentive for them to only let game companies request runtime analysis / reports rather than run code. As for the anti-cheat industry, they should focus on patterns of user behavior to help game companies moderate the players as much as neccesary.
Remote Code Execution in Marvel Rivals Game
51–60 of 132 posts
Re: Remote Code Execution in Marvel Rivals Game
#52> Game developers continue to amaze me at their lack of security awareness. Because game developers are SUPPOSED to be aware of these things? > It's very hard for security researchers to report bugs to most game dev companies. On top of that, most do not have bug bounty programs Yet the OP blames the GAME developers… They already have harder jobs than the majority of us, picking on them for not knowing skills outside…
YES. Did you read the part where the game devs use RCE with admin privileges to run patches? Any developer who does that should be aware of the security risks they’re taking.
Re: Remote Code Execution in Marvel Rivals Game
#53I bought a Steam Deck with the sole purpose of having a cheap, airgapped PC to run games on. Game devs just don't have the incentives or discipline to be trusted with security. Reminder that all three Dark Souls games allowed full RCE to any users connected to the internet: https://flashpoint.io/blog/rce-vulnerability-dark-souls/
I wish Steam offered a console format of the deck, essentially the same thing, but with better specs, HDMI out and bluetooth for controllers. Would be a massive hit I wager.
This is what I do, I rarely use it in handheld mode (but I do appreciate the ability to). Valve sells a dock with HDMI out (along with ethernet, USB, etc), and I can confirm that it works wirelessly with Xbox controllers.
Re: Remote Code Execution in Marvel Rivals Game
#54I bought a Steam Deck with the sole purpose of having a cheap, airgapped PC to run games on. Game devs just don't have the incentives or discipline to be trusted with security. Reminder that all three Dark Souls games allowed full RCE to any users connected to the internet: https://flashpoint.io/blog/rce-vulnerability-dark-souls/
I wish Steam offered a console format of the deck, essentially the same thing, but with better specs, HDMI out and bluetooth for controllers. Would be a massive hit I wager.
I thought SteamOS was just some layers on top of Arch.
To not go full Dropbox, but I think if someone wants a Linux PC to run games, it is within the realm for a home PC builder to accomplish. It would otherwise be a tough market to sell, “Buy this gamer PC, less great specs than you would likely pick for yourself and not compatible with the most popular games that have onerous anti-cheat root kits”.
Re: Remote Code Execution in Marvel Rivals Game
#55I was literally thinking about this the other day. There are a ton of games using kernel modules for anti-cheat and... just load and interpret data payloads. Certainly some of those payloads could manipulate the funny machines inside of a game executable if they're not careful about their parsing and validation. Nice PoC! Update : yes, most game client processes don't run in the kernel. My b. I was just thinking that…
Imagine if security software did that, but also ran on boot and took down a million critical machines
Re: Remote Code Execution in Marvel Rivals Game
#56The engineering culture behind AAA video games is rotten to the core with regards to security. Everyone thinks they're making Doom 3 and they're really making Windows 2000 Service Pack 1.
> The engineering culture behind AAA video games is rotten to the core with regards to security. But it is way ahead with regards to efficient hardware utilization!
And usually with an eye towards good user interface design. Not some white space heavy “clean” look where everything is hidden behind hamburger menus.
Re: Remote Code Execution in Marvel Rivals Game
#57The engineering culture behind AAA video games is rotten to the core with regards to security. Everyone thinks they're making Doom 3 and they're really making Windows 2000 Service Pack 1.
It's not more rotten that your regular backend shop. How many api issues / auth problems / s3 open bucket there are out there exactly?
s3 open bucket syndrome is basically cured at this point. (Aside from legacy buckets, which should all be exploited by now)
The "yes I really want to do this" confirmations you need to go through when opening up a bucket these days are about 4 deep...
Authn/z issues are real though, they'll never be fixed
Re: Remote Code Execution in Marvel Rivals Game
#58Earlier quoted context omitted.
>These are game developers. Not backend developers. Not web guys. Not remotely trained in infosec. They make games. Not security software. Why do game developers get a pass but not "backend developers" or "web guys"? Don't the latter only "make CRUD apps, not security software"?
I think for web or "backend for network" people, you are always deploying into a hostile environment (the Internet) and so you really should be at least aware of basic security measures. If you consider yourself a professional in that field, it's table stakes. If you're a game dev, you were taught to write optimized code that runs locally on a computer. Not everything you do will run on the network, and networking/mu…
There are no triple A games today that doesn't run in a networked/internet environment, and your code lives on the hostile user; this seems like an even bigger risk than a web app.
Re: Remote Code Execution in Marvel Rivals Game
#59Interestingly, the game doesn't run as admin for any good reason. The first thing I did was only let the launcher and game run as the user with RunAsInvoker. The anticheat alone is allowed RunAsAdmin. At the same time, I don't trust any anticheat. It's probably worse than useless, but it is what it is. I thought Microsoft would clean this up after the Crowdstrike incident for all kernel-level code, but I guess there'…
I have a related question for you... my kids like Marvel Rivals, but I also use Microsoft family tools to limit their screen time so they don't have Admin accounts. However, the Marvel Rivals anti-cheat makes me enter my password every time they launch. Is there any way for me to create a shortcut or something so Rivals will launch without my password?
I'm not a Windows guy and trying to figure this out has been extremely frustrating...
Re: Remote Code Execution in Marvel Rivals Game
#60Interestingly, the game doesn't run as admin for any good reason. The first thing I did was only let the launcher and game run as the user with RunAsInvoker. The anticheat alone is allowed RunAsAdmin. At the same time, I don't trust any anticheat. It's probably worse than useless, but it is what it is. I thought Microsoft would clean this up after the Crowdstrike incident for all kernel-level code, but I guess there'…
If anticheat worked then it would be an interesting, perhaps tolerable tradeoff for some. The reality however is that games are absolutely packed with cheaters, there's an international industry in creating cheats for popular games, so what you get is an arms race that as usual only punishes honest users. It's like DRM, pirates don't seem to have much of a problem, but it sure can hurt the rest of us.
Unfortunately both the executives who buy into these things, and the average consumer, are simply too... simple, to understand or appreciate that.