Looks like a typical mitm attack, which confuses me a bit, don't the developers use something like tls or dtls to protect their communications?
The most recent game I analysed was helldivers 2, which uses dtls. i would have thought that would be fairly common knowledge.
Remote Code Execution in Marvel Rivals Game
61–70 of 132 posts
Re: Remote Code Execution in Marvel Rivals Game
#62I bought a Steam Deck with the sole purpose of having a cheap, airgapped PC to run games on. Game devs just don't have the incentives or discipline to be trusted with security. Reminder that all three Dark Souls games allowed full RCE to any users connected to the internet: https://flashpoint.io/blog/rce-vulnerability-dark-souls/
I wish Steam offered a console format of the deck, essentially the same thing, but with better specs, HDMI out and bluetooth for controllers. Would be a massive hit I wager.
This is something they are (probably) working towards with SteamOS, being able to run it on your own hardware with deck-level hardware support. See https://www.pcguide.com/news/valve-could-be-thinking-about-r...
Re: Remote Code Execution in Marvel Rivals Game
#63> Game developers continue to amaze me at their lack of security awareness. Because game developers are SUPPOSED to be aware of these things? > It's very hard for security researchers to report bugs to most game dev companies. On top of that, most do not have bug bounty programs Yet the OP blames the GAME developers… They already have harder jobs than the majority of us, picking on them for not knowing skills outside…
YES. Did you read the part where the game devs use RCE with admin privileges to run patches? Any developer who does that should be aware of the security risks they’re taking.
Any developer yes, but I personally put game developers into a different category, they’re making games and trying to find shortcuts to meet strange management requirements. They don’t know the security side.. I’m admitting there should be some guard before code review is approved from a real security engineer
> Any developer who does that should be aware of the security risks they’re taking.
Developer yeah, someone who’s focused on recreating the game probably not
Re: Remote Code Execution in Marvel Rivals Game
#64I bought a Steam Deck with the sole purpose of having a cheap, airgapped PC to run games on. Game devs just don't have the incentives or discipline to be trusted with security. Reminder that all three Dark Souls games allowed full RCE to any users connected to the internet: https://flashpoint.io/blog/rce-vulnerability-dark-souls/
I wish Steam offered a console format of the deck, essentially the same thing, but with better specs, HDMI out and bluetooth for controllers. Would be a massive hit I wager.
The deck already has bluetooth for controllers and HDMI out if you get a standard USB3/HDMI dongle (or their expensive dock).
Essentially all you're asking for them to add is better specs.
In December their revised branding guidelines added a "Powered by SteamOS" badge so presumably 3rd-party boxes with various specs in set-top form factors will be coming before too long:
> The Powered by SteamOS logo indicates that a hardware device will run the SteamOS and boot into SteamOS upon powering on the device. Partners / manufacturers will ship hardware with a Steam image in the form provided by and/or developed in close collaboration with Valve.
Re: Remote Code Execution in Marvel Rivals Game
#65I like the other rant at the bottom. But why would game developers care about security when their customers don't care? The customers are fine running anticheat with admin privileges like in this RCE he just found.
Re: Remote Code Execution in Marvel Rivals Game
#66Earlier quoted context omitted.
Great commentary, today the industry is focused on delivering free game with tons of cosmetics (which gives a ton of money) but forgetting about performance and security.
Your average networked game these days is probably a bazillion times more secure than one from 20 years ago. It was super common that there were cheat tools to crash all game clients in a match. It was super annoying, we can just be glad that it was usually not used for anything more nefarious.
Excellent point, how do you see today the industry, security wise?
Re: Remote Code Execution in Marvel Rivals Game
#67Earlier quoted context omitted.
YES. Did you read the part where the game devs use RCE with admin privileges to run patches? Any developer who does that should be aware of the security risks they’re taking.
Any developer yes, but I personally put game developers into a different category, they’re making games and trying to find shortcuts to meet strange management requirements. They don’t know the security side.. I’m admitting there should be some guard before code review is approved from a real security engineer > Any developer who does that should be aware of the security risks they’re taking. Developer yeah, someone…
Trying to meet strange management requirements is normal for just about any professional developer. I don’t understand why you think game developers deserve a special exemption.
Re: Remote Code Execution in Marvel Rivals Game
#68The engineering culture behind AAA video games is rotten to the core with regards to security. Everyone thinks they're making Doom 3 and they're really making Windows 2000 Service Pack 1.
Is it particularly surprising though? These are game developers. Not backend developers. Not web guys. Not remotely trained in infosec. They make games. Not security software. And for the longest time this was acceptable. I think for a GaaS in 2025 it's unacceptable to not have security minded engineers on staff for the backend stuff. Too much money is involved not to. Especially for studios very familiar with shippi…
They generally make software that runs with (at least) unrestricted user level access on client devices, as opposed to backend guys who have no client access, and web guys whose code runs in a sandbox.
If anything these devs should be more cautious than the others as the risk to the end user is extreme.
Re: Remote Code Execution in Marvel Rivals Game
#69Earlier quoted context omitted.
> The engineering culture behind AAA video games is rotten to the core with regards to security. But it is way ahead with regards to efficient hardware utilization!
And usually with an eye towards good user interface design. Not some white space heavy “clean” look where everything is hidden behind hamburger menus.
I dunno, lately they're more interested in pointing you to the store page for skins and loot boxes.
Re: Remote Code Execution in Marvel Rivals Game
#70Interestingly, the game doesn't run as admin for any good reason. The first thing I did was only let the launcher and game run as the user with RunAsInvoker. The anticheat alone is allowed RunAsAdmin. At the same time, I don't trust any anticheat. It's probably worse than useless, but it is what it is. I thought Microsoft would clean this up after the Crowdstrike incident for all kernel-level code, but I guess there'…
I have a related question for you... my kids like Marvel Rivals, but I also use Microsoft family tools to limit their screen time so they don't have Admin accounts. However, the Marvel Rivals anti-cheat makes me enter my password every time they launch. Is there any way for me to create a shortcut or something so Rivals will launch without my password? I'm not a Windows guy and trying to figure this out has been extr…
You can make a on-demand scheduled task that runs Marvel Rivals as admin then create a shortcut that invokes the task.
Full instructions https://chatgpt.com/share/67a13960-c1b4-8002-a699-7b547c759c...