Valve accused of ignoring existing RCE vulnerability in Source games for 2 years • Hacker News Board

Re: Valve accused of ignoring existing RCE vulnerability in Source games for 2 years

#61

Post by charcircuit » Sat, Apr 10, 2021, 9:11 PM UTC

fuyu wrote: post #37

rstat1 wrote: post #18

Earlier quoted context omitted.

In my mind there's a huge difference between the 2. The sony rootkit was installed in secret, full of security holes, hard to remove, and made by a vendor that appeared to give 0 shits about said security holes. All of the anti-cheat solutions I've seen that run in kernel mode are none of those things. They make it well known that they're installing, are made by vendors that actively care about the security of their…

Genshin Impact is a recent game that has included a kernel mode anti-cheat. I would be very surprised if the majority of players know that it exists, or understand what it means to have it run in kernel mode. The Genshin website previously allowed anyone to view the phone number you have linked to your account via the password reset mechanism. Due to common reports of accounts getting stolen (and unable to be recover…

Even if the security is bad does it even matter? User mode is enough for malware. "Sure an attacker could mine crypto, DoS people, use me as a proxy, keylog me, use my webcam, steal my saved usernames and passwords, but at least they can't upgrade my graphics drivers", said no one ever.

Re: Valve accused of ignoring existing RCE vulnerability in Source games for 2 years

#62

Post by matheusmoreira » Sat, Apr 10, 2021, 9:12 PM UTC

zinclozenge wrote: post #31

mhh__ wrote: post #17

Earlier quoted context omitted.

Surely the end state is cheats that even ring0 can't see i.e. read the display directly, act through the mouse. Maybe we should we run the entire OS in the games hypervisor?

I was actually thinking that you should be able to build a bot for MMOs and other kind of games that require farming with a raspberry pi or arduino acting like a mouse with a camera for image recognition. Don't know how feasible that is, but that would be undetectable by anti-cheat software.

With MMOs you can actually reverse engineer the network protocol and build yourself a custom client. Completely avoids any anti-cheating solution since they're not even running.

With mobile games it's ridiculously easy. I actually made daily task farming bots for a couple mobile games I used to play. The hardest part was getting the bot to log into the game. Completely neutralized the habit-forming strategies of these game companies. Ironically the bot was statistically indistinguishable from any sufficiently-addicted player.

Re: Valve accused of ignoring existing RCE vulnerability in Source games for 2 years

#63

Post by ladyanita22 » Sat, Apr 10, 2021, 9:20 PM UTC

rstat1 wrote: post #36

philistine wrote: post #27

Earlier quoted context omitted.

Hopefully, Microsoft is going to follow in Apple's footsteps and close the access to the kernel for any and all programs. Yes, we will lose a lot, since Apple right now cannot cover all use cases of kernel access through new APIs, but we will gain so much in security and reliability. I'm of the opinion that easy kernel access for all apps and games is ultimately not putting me in control of my computer.

Access to kernel mode on Windows is already pretty restricted as it is. As far as I understand, you either have to run your whole machine in a special "Test Mode" or have a specific kind of (expensive) code signing certificate. But beyond that, I don't see how "more restriction" == "more control for the user"

Are you talking about driver signing?

Re: Valve accused of ignoring existing RCE vulnerability in Source games for 2 years

#64

Post by valec » Sat, Apr 10, 2021, 9:29 PM UTC

sodality2 wrote: post #19

Dozens of Counter-strike exploits exist and the cheating scene has just grown too rampantly. Valve simply doesn't care about the source engine. Any new CSGO player will tell you the anti-cheat doesn't work, I know first-hand. The lack of care regarding source engine netcode extends to every part of the source engine, including Valve Anti-cheat. The anti-cheat is trivial to reverse (several PUBLIC bypasses have existe…

> CSGO player will tell you the anti-cheat doesn't work, I know first-hand.

> It is in my opinion the greatest loss to gaming that a classic, legendary game like Counter-strike got completely ruined by lack of care by a company that profits millions off of the case unboxings.

have you played the game in recent years? this has not been the case for me or the people I play with at all.

when playing on high trust-factor accounts, cheating is basically eliminated.

the experience for newer players is pretty bad but once you convince the system you're trustworthy, the algorithm does an extremely good job of not matching you with cheaters.

what valve lacks in boring, sensible solutions they make up for with interesting often much more complex workarounds (see: the open-world csgo danger-zone map shoved into a game with a room-based engine)

Re: Valve accused of ignoring existing RCE vulnerability in Source games for 2 years

#65

Post by matheusmoreira » Sat, Apr 10, 2021, 9:34 PM UTC

xyst wrote: post #2

This is why I have a separate machine for "gaming" and "work" Some game companies (riot games) even install their anti-cheat software so that is loads in the ring 0 space. Even with their best efforts, cheaters will still prosper. Might even go a step further and firewall my gaming machine off from the rest of my network.

Game companies literally think they have the right to own your machine. This is the kind of garbage they force gamers to install on their machines:

https://www.theregister.com/2016/09/23/capcom_street_fighter...

https://mobile.twitter.com/TheWack0lian/status/7793978407622...

Their software also takes screen shots, walks the file system, scans people's processes... Any similarities to malware may or may not be mere coincidences. They're also known for false positives: banning people for receiving special strings via text message, unknowingly installing mods with hacks bundled in or due to the presence of development tools such as debuggers or even virtual machines. Good luck trying to reverse such a ban, the entire gaming community has already been conditioned to accept any decision as final and to even defend this practice. When coupled with DRM, this essentially means your license to play the game has been revoked with no refunds.

Re: Valve accused of ignoring existing RCE vulnerability in Source games for 2 years

#66

Post by issamehh » Sat, Apr 10, 2021, 9:39 PM UTC

valec wrote: post #64

sodality2 wrote: post #19

Dozens of Counter-strike exploits exist and the cheating scene has just grown too rampantly. Valve simply doesn't care about the source engine. Any new CSGO player will tell you the anti-cheat doesn't work, I know first-hand. The lack of care regarding source engine netcode extends to every part of the source engine, including Valve Anti-cheat. The anti-cheat is trivial to reverse (several PUBLIC bypasses have existe…

> CSGO player will tell you the anti-cheat doesn't work, I know first-hand. > It is in my opinion the greatest loss to gaming that a classic, legendary game like Counter-strike got completely ruined by lack of care by a company that profits millions off of the case unboxings. have you played the game in recent years? this has not been the case for me or the people I play with at all. when playing on high trust-factor…

Just 2 days ago on prime I ran into a string of cheaters. At one point we had 2 on the enemy team and it caused someone on my team to go toggle. 3 cheaters in one match. On old accounts with everything.

I know he couldn't be an expert but the person on my team says he can he blatant every game and never get banned because we're on prime. I don't want to believe that but then he had a lot of items and didn't mind spinbotting at all.

Re: Valve accused of ignoring existing RCE vulnerability in Source games for 2 years

#67

Post by jsnell » Sat, Apr 10, 2021, 9:43 PM UTC

mxscho wrote: post #49

veeti wrote: post #13

Earlier quoted context omitted.

Just release it. Maybe Valve will have to do something once folks start losing their precious CS:GO skins?

Doubt that. There is this so-called "Steam web API key scam" which is ongoing for years at this point: Scammers create phishing Steam login pages to grab people's credentials. Just with these credentials, the damage an attacker can do is still limited because of 2FA. However, the biggest flaw is that it is possible to automatically create API keys for the phished accounts that allow 24/7 remote access of these Steam…

Valve has been pretty aggressive about rolling out these kinds of policies compared to the rest of the industry. (E.g. they were wery early with requiring 2FA to be enabled for a period of time before doing sensitive actions like trades, adding warning interstitials on links that leave Steam). I don't think the incentives have changed that much.

So, here's what makes me confused about your story:

1. I don't see any kind of activity hooks in IEconService, that would let the attackers know via a callback that. Are you saying that they're polling all the hijacked accounts at a high frequency to detect trades they could intercept? That seems like a highly divergent use case from normal uses of the API, and one that an abuse team would be motivated to prevent.

2. I thought the Steam trade confirmation dialog showed very specific information about just what was being traded for what. I.e. it's not just that you're approving "a trade with foo", it's "a trade with foo (whom you've had as a friend for 20 days), where you give a xyzzy and receive a quux". Are the users just blindly approving trades worth thousands without even verifying?

I don't like either of your solutions though. A captcha would be just be minor irritation for the attacker, and anyone who can be phished into logging in can be phished to approve the key generation. It seems that the bigger problem here is that the API keys are unscoped. Once you have that, it's easier to inform the user in the approval flow about just what they're approving, and viable to nag the users into revoking access for apps with dangerous permissions.

Re: Valve accused of ignoring existing RCE vulnerability in Source games for 2 years

#68

Post by matheusmoreira » Sat, Apr 10, 2021, 9:44 PM UTC

oxylibrium wrote: post #48

fuyu wrote: post #37

Earlier quoted context omitted.

Genshin Impact is a recent game that has included a kernel mode anti-cheat. I would be very surprised if the majority of players know that it exists, or understand what it means to have it run in kernel mode. The Genshin website previously allowed anyone to view the phone number you have linked to your account via the password reset mechanism. Due to common reports of accounts getting stolen (and unable to be recover…

Genshin Impact's anti-cheat is not completely secure: you can use it to read/write umode memory / read kmode memory with kernel privileges: https://github.com/ScHaTTeNLiLiE/libmhyprot Mirror repo after the original author took the repo down, but still exploitable AFAIK.

Explanation of the exploit here:

https://github.com/Luohuayu/evil-mhyprot-cli

Not as bad as capcom.sys:

https://mobile.twitter.com/TheWack0lian/status/7793978407622...

The effect is the same though: ring 0 code execution.

Re: Valve accused of ignoring existing RCE vulnerability in Source games for 2 years

#69

Post by matheusmoreira » Sat, Apr 10, 2021, 9:46 PM UTC

fpgaminer wrote: post #15

xyst wrote: post #2

This is why I have a separate machine for "gaming" and "work" Some game companies (riot games) even install their anti-cheat software so that is loads in the ring 0 space. Even with their best efforts, cheaters will still prosper. Might even go a step further and firewall my gaming machine off from the rest of my network.

This is the way. Many games package in outright spyware that siphon all kinds of data off your machine including browsing history. Kerbal Space Program was infamous for this (they removed the spyware at some point but I haven't checked recently if it was ever added back in).

> Many games package in outright spyware that siphon all kinds of data off your machine including browsing history.

Please post details. Were they literally mining user data?

Re: Valve accused of ignoring existing RCE vulnerability in Source games for 2 years

#70

Post by flowless » Sat, Apr 10, 2021, 9:53 PM UTC

sseneca wrote: post #26

xyst wrote: post #2

This is why I have a separate machine for "gaming" and "work" Some game companies (riot games) even install their anti-cheat software so that is loads in the ring 0 space. Even with their best efforts, cheaters will still prosper. Might even go a step further and firewall my gaming machine off from the rest of my network.

> Some game companies (riot games) even install their anti-cheat software so that is loads in the ring 0 space. Why are separate machines required, rather than dual-booting? (i.e. Windows for games, Linux for everything else)

You can also run virtual machine with real card attached to it via VFIO if your host has IOMMU support. Guess what this means for anti-cheat.