Live data from Hacker News

Remote Code Execution in Marvel Rivals Game

shalzuth.com

71–80 of 132 posts

Re: Remote Code Execution in Marvel Rivals Game

#71
post #24

Earlier quoted context omitted.

> The engineering culture behind AAA video games is rotten to the core with regards to security. But it is way ahead with regards to efficient hardware utilization!

And usually with an eye towards good user interface design. Not some white space heavy “clean” look where everything is hidden behind hamburger menus.

Preach. I often point towards games for examples of good balance of density, as well as elements of modern-looking skeuomorphism in UI.

Of course I get all the usual garbage non-arguments in response from designers who don't want to take up a challenge and actually design, and instead fall back on a "tried and true" (except it is shit) fashion.

Re: Remote Code Execution in Marvel Rivals Game

#72

Earlier quoted context omitted.

And usually with an eye towards good user interface design. Not some white space heavy “clean” look where everything is hidden behind hamburger menus.

I dunno, lately they're more interested in pointing you to the store page for skins and loot boxes.

True, but even the most vile loot box filled triple A slop game has better UI than the atrocities the OP refers to. At least there you can see some decent density of information and a hint of three-dimensionality, which is more than you can say about the "clean UI" desert landscape.

Re: Remote Code Execution in Marvel Rivals Game

#73
post #51

Interestingly, the game doesn't run as admin for any good reason. The first thing I did was only let the launcher and game run as the user with RunAsInvoker. The anticheat alone is allowed RunAsAdmin. At the same time, I don't trust any anticheat. It's probably worse than useless, but it is what it is. I thought Microsoft would clean this up after the Crowdstrike incident for all kernel-level code, but I guess there'…

I tried to get Microsoft to stop signing kernel mode anti-cheat drivers with no result. Even when a vulnerable driver is found the vendor is given way too much time to deploy a fix while the vulnerable build is out in the wild with a valid signature. The signature should be revoked as soon as an exploit is found, it's an anti-cheat driver for video games not essential business/government infrastructure.

Re: Remote Code Execution in Marvel Rivals Game

#74
post #29

Earlier quoted context omitted.

> Their's a really good argument for having a "gaming" os, Windows, and a serious OS , Linux on the same computer. This is a terrible idea if you think this will keep you secure. Windows provides direct access to update motherboard firmware and CPU microcode/management engine.

Is most malware literally going to embed itself in the BIOS and install itself on Linux ? Seems like an insanely difficult thing to do to target like .5% of users.

Hot off the presses:

https://github.com/google/security-research/security/advisor...

Re: Remote Code Execution in Marvel Rivals Game

#75
post #36
post #29

Earlier quoted context omitted.

> Their's a really good argument for having a "gaming" os, Windows, and a serious OS , Linux on the same computer. This is a terrible idea if you think this will keep you secure. Windows provides direct access to update motherboard firmware and CPU microcode/management engine.

hah yeah ,dont run insecure os nexto secure one :D. good point!

Linux distros can also update firmware and microcode.

Re: Remote Code Execution in Marvel Rivals Game

#76
post #42

The engineering culture behind AAA video games is rotten to the core with regards to security. Everyone thinks they're making Doom 3 and they're really making Windows 2000 Service Pack 1.

I don’t work in gaming, I know a few people who do, everyone of them does it for the love of the game. Certainly not for the job security or even the money. This idea that they’re also to handle security is too much. It’s not their fault, they’re writing “art” not secure micro services for multi national companies. Publishers will pay to have 0level kernel ring on your system but not for software securing their game.…

I've done IT support for a number of devs across multiple companies and they all expect local admin and admin access to everything. So no, I don't believe they feel it is risky. I believe they don't get it/don't care. It's just not their wheelhouse.

Re: Remote Code Execution in Marvel Rivals Game

#77

I like the other rant at the bottom. But why would game developers care about security when their customers don't care? The customers are fine running anticheat with admin privileges like in this RCE he just found.

I personally encountered a game anti-cheat driver in the wild (Anti-Cheat Expert) that caused BSODs and data loss. I later discovered there were known exploits in it and the signature still hadn't been revoked. I managed to get the developers of the game I was playing to reconfigure it by kicking up a fuss on the subreddit, at least.

Re: Remote Code Execution in Marvel Rivals Game

#78
post #47

> Game developers continue to amaze me at their lack of security awareness. Because game developers are SUPPOSED to be aware of these things? > It's very hard for security researchers to report bugs to most game dev companies. On top of that, most do not have bug bounty programs Yet the OP blames the GAME developers… They already have harder jobs than the majority of us, picking on them for not knowing skills outside…

If you sell software to millions of people that runs with access to sensitive data you have an obligation to do a good job, sorry. If you don't like that, make it MIT licensed on an open source site instead of $70 on Steam.

Re: Remote Code Execution in Marvel Rivals Game

#79
post #42

Earlier quoted context omitted.

I don’t work in gaming, I know a few people who do, everyone of them does it for the love of the game. Certainly not for the job security or even the money. This idea that they’re also to handle security is too much. It’s not their fault, they’re writing “art” not secure micro services for multi national companies. Publishers will pay to have 0level kernel ring on your system but not for software securing their game.…

I've done IT support for a number of devs across multiple companies and they all expect local admin and admin access to everything. So no, I don't believe they feel it is risky. I believe they don't get it/don't care. It's just not their wheelhouse.

No, it's because the average IT infrastructure is abysmal and getting things done without admin is it's own full-time job filing and following up on tickets and trying to plead your case for the ten thousandth time to the exalted security dieties that you just want to do your job gets old.

Am i bitter? Nah

Re: Remote Code Execution in Marvel Rivals Game

#80

The engineering culture behind AAA video games is rotten to the core with regards to security. Everyone thinks they're making Doom 3 and they're really making Windows 2000 Service Pack 1.

The problem in big part stems from the business culture upstream. They're trying to produce a game, but what they're really after is e-sports money. They design multiplayer to be about organized pro play, which brings in all the cheating problems of professional sports, so they end up subjecting every player to e-sports-grade security like those anti-cheat systems, despite 99.9% of the player base not caring about pro play in the first place.

This is the worst possible combination: players are forced to accept first-party invasive rootkits that are disruptive and ineffective, while cheaters still cheat.

IMHO the only sensible solution is to separate out e-sports angle from the game itself. People who want to "go pro" would be free to subject themselves to anti-cheats and drinking verification cans and past some point might as well buy company-authorized computers to play on. Everyone else should just be allowed to play casually and enjoy the game without the anti-cheat nuisance (and a looming threat of false positive).

With main incentive for serious cheating separated out, non-pro players would only have to worry about griefers. Those are a problem too, but they can be dealt with by simpler and less invasive measures than a kernel-level rootkit.

As it is, AAA multiplayer games are basically like if FIFA was to micromanage Town Recreational Leagues and hold them to the World Cup standard, because cheating is a Big Deal so every kid needs to take regular blood tests before the match.

Post reply on HN