Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Valve accused of ignoring existing RCE vulnerability in Source games for 2 years

twitter.com

Post reply on HN
Print view View original

81–90 of 122 posts

Re: Valve accused of ignoring existing RCE vulnerability in Source games for 2 years

#81

Post by tgsovlerkhgsel »

guidovranken wrote: post #22

There's a place for being patient and lenient, but HackerOne consistently seems to not shut down malfunctioning programs that never pay rewards and flat out stop talking to you, yet continue to collect bugs. Such a relationship is commonly called fraud so I suggest reporting HackerOne to the Federal Trade Commission as I have. The premise of bug bounties is that the reward amount is at the discretion of the program h…

This matches my experience. Additionally, they prohibit disclosure in such cases, effectively making them complicit in delaying (best case) or in many cases completely suppressing disclosure.

Re: Valve accused of ignoring existing RCE vulnerability in Source games for 2 years

#82

Post by gsich »

valec wrote: post #64
sodality2 wrote: post #19

Dozens of Counter-strike exploits exist and the cheating scene has just grown too rampantly. Valve simply doesn't care about the source engine. Any new CSGO player will tell you the anti-cheat doesn't work, I know first-hand. The lack of care regarding source engine netcode extends to every part of the source engine, including Valve Anti-cheat. The anti-cheat is trivial to reverse (several PUBLIC bypasses have existe…

> CSGO player will tell you the anti-cheat doesn't work, I know first-hand. > It is in my opinion the greatest loss to gaming that a classic, legendary game like Counter-strike got completely ruined by lack of care by a company that profits millions off of the case unboxings. have you played the game in recent years? this has not been the case for me or the people I play with at all. when playing on high trust-factor…

>when playing on high trust-factor accounts, cheating is basically eliminated.

Yes, but this is not a technical fix. You just hope that accounts with more "value" cheat less. Which is true in most cases.

Re: Valve accused of ignoring existing RCE vulnerability in Source games for 2 years

#83

Post by sodality2 »

hoffs wrote: post #73
sodality2 wrote: post #19

Dozens of Counter-strike exploits exist and the cheating scene has just grown too rampantly. Valve simply doesn't care about the source engine. Any new CSGO player will tell you the anti-cheat doesn't work, I know first-hand. The lack of care regarding source engine netcode extends to every part of the source engine, including Valve Anti-cheat. The anti-cheat is trivial to reverse (several PUBLIC bypasses have existe…

You found a video that says that they detect most old cheats from hl2 days and ban them and then the video just goes to show random github repos. What is that even supposed to prove? Theres nothing stopping anyone from creating repos with cheats that get detected or don't even work. Like it's just a super cringe "gotcha" type video

They are all undetected. VAC bypasses are public and have existed for years with no patch.

Re: Valve accused of ignoring existing RCE vulnerability in Source games for 2 years

#84

Post by gsich »

zinclozenge wrote: post #31
mhh__ wrote: post #17

Earlier quoted context omitted.

Surely the end state is cheats that even ring0 can't see i.e. read the display directly, act through the mouse. Maybe we should we run the entire OS in the games hypervisor?

I was actually thinking that you should be able to build a bot for MMOs and other kind of games that require farming with a raspberry pi or arduino acting like a mouse with a camera for image recognition. Don't know how feasible that is, but that would be undetectable by anti-cheat software.

Example for Valorant and a Raspberry Pi: https://www.youtube.com/watch?v=d1jz8qbzfIk

No need for a camera when you can just stream the screen.

Re: Valve accused of ignoring existing RCE vulnerability in Source games for 2 years

#85

Post by sodality2 »

valec wrote: post #64
sodality2 wrote: post #19

Dozens of Counter-strike exploits exist and the cheating scene has just grown too rampantly. Valve simply doesn't care about the source engine. Any new CSGO player will tell you the anti-cheat doesn't work, I know first-hand. The lack of care regarding source engine netcode extends to every part of the source engine, including Valve Anti-cheat. The anti-cheat is trivial to reverse (several PUBLIC bypasses have existe…

> CSGO player will tell you the anti-cheat doesn't work, I know first-hand. > It is in my opinion the greatest loss to gaming that a classic, legendary game like Counter-strike got completely ruined by lack of care by a company that profits millions off of the case unboxings. have you played the game in recent years? this has not been the case for me or the people I play with at all. when playing on high trust-factor…

Trust DOES help an immense amount. New players will NOT have good trust, though, hence why I said ask a new CSGO player.

Re: Valve accused of ignoring existing RCE vulnerability in Source games for 2 years

#86

Post by sodality2 »

chc4 wrote: post #51
sodality2 wrote: post #19

Dozens of Counter-strike exploits exist and the cheating scene has just grown too rampantly. Valve simply doesn't care about the source engine. Any new CSGO player will tell you the anti-cheat doesn't work, I know first-hand. The lack of care regarding source engine netcode extends to every part of the source engine, including Valve Anti-cheat. The anti-cheat is trivial to reverse (several PUBLIC bypasses have existe…

Video game cheats and anti-cheats are almost completely disjoint from remote code exploits like what are reported in the OP.

>The lack of care regarding source engine netcode extends to every part of the source engine, including Valve Anti-cheat.

Re: Valve accused of ignoring existing RCE vulnerability in Source games for 2 years

#87

Post by sodality2 »

gameswithgo wrote: post #79
sodality2 wrote: post #19

Dozens of Counter-strike exploits exist and the cheating scene has just grown too rampantly. Valve simply doesn't care about the source engine. Any new CSGO player will tell you the anti-cheat doesn't work, I know first-hand. The lack of care regarding source engine netcode extends to every part of the source engine, including Valve Anti-cheat. The anti-cheat is trivial to reverse (several PUBLIC bypasses have existe…

No anti cheat for FPS games has ever "worked", it can't. The best you can do is make it a little hard for the cheats to keep up with your detectors or protocol changes.

That's absolutely true! Valve anti-cheat has entirely failed at that. Free open source cheats exist that VAC just cannot detect. Period. Wanna know the secret? The fact that it's a Java cheat.

Re: Valve accused of ignoring existing RCE vulnerability in Source games for 2 years

#89

Post by Natsu »

squeaky-clean wrote: post #47
Natsu wrote: post #41

Earlier quoted context omitted.

Yeah, even if someone made a physical robot that did everything, they'd notice when it did stuff like playing for 1,000 hours without ever taking a break or talking to anyone.

Just have your bot log off and "sleep" randomly for 4-10 hours every night, and log off for 15 minutes every few hours during the day. If you ever get a private message, have your system play a beep (or ping you on IRC then/Discord nowadays). As for not talking to anyone, a surprising amount of people play MMOs just like that, so it's not really atypical for a player to never communicate. Runescape even has an accoun…

I've seen people try that, but the admins just sit there quietly watching them loop for an hour or something, then note how long it takes them to respond to a simple hello.

Or in some games, they can send messages in a way that a human would see, but not a bot who expects the messages to come over chat. For example, waving a sign in front of the character's face with a message or whatever. It helps that the admins can also hide from normal presence detection, even though they're visible on the bot's screen, visually.

I've literally watched admins ban a bot using these precise countermeasures. The trick is to always keep giving them new things they haven't thought of to adapt to.

Re: Valve accused of ignoring existing RCE vulnerability in Source games for 2 years

#90

Post by Natsu »

sp0rk wrote: post #44
Natsu wrote: post #41

Earlier quoted context omitted.

Yeah, even if someone made a physical robot that did everything, they'd notice when it did stuff like playing for 1,000 hours without ever taking a break or talking to anyone.

Bots have long been designed to account for these types of checks by having scheduled hours and jittered breaks. Private messages and name mentions can alert the bot owner so they can respond manually. I've even seen bots that will pipe private messages to an IRC channel so that any number of restricted people can respond to the messages. It's been a long time since I've worked with game bots so I'm sure they're even…

Yeah, I know it's always an arms race, but the trick is to always give them something they weren't anticipating that's hard to deal with in code. There are always methods that would alert a human to something odd going on that don't alert the bot's methods for perceiving its surroundings.

One of the best tricks is to show them messages via a method outside of normal chat which a normal player would see on their screen, but which a bot would not receive as 'chat'.

Post reply on HN