Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Remote Code Execution in Marvel Rivals Game

shalzuth.com

Post reply on HN
Print view View original

81–90 of 132 posts

Re: Remote Code Execution in Marvel Rivals Game

#81

Post by mrguyorama »

pyrolistical wrote: post #39
devmor wrote: post #23

Earlier quoted context omitted.

Why would there be a strong engineering culture behind AAA video games at all? Game developers are underpaid, overworked and constantly told they can be replaced at a moments notice. I wouldn't expect anything but code that "ships" out of them, and its understandable why.

There needs to be at least 1 person to figure out why the game isn’t hitting the performance target. That is real engineering

In modern gaming you just make every texture max size even though it only covers a tiny surface and will only fill 6 pixels on a large monitor.

Also, half of their shaders are broken on some configurations. Also they used a function call wrong so their game tries to render something a bunch of times instead of once.

A huge portion of NVidia and AMD GPU drivers is literally hacks to make games actually run well. Both Nvidia and AMD patch game shaders at runtime to keep things from being unusable, and hack around broken behavior or wrong usage of APIs. It's exactly reminiscent of the situation Windows 95 had when all sorts of popular programs couldn't even save interrupt flags properly because they straight up did not read the manual which had many sentences and code fragments demonstrating that what they wrote would not work.

Also, Titanfall 1 shipped with like 30gb of uncompressed audio. They did this to "reduce CPU load". In 2014.

Re: Remote Code Execution in Marvel Rivals Game

#83

Post by bilekas »

kevingadd wrote: post #78
bilekas wrote: post #47

> Game developers continue to amaze me at their lack of security awareness. Because game developers are SUPPOSED to be aware of these things? > It's very hard for security researchers to report bugs to most game dev companies. On top of that, most do not have bug bounty programs Yet the OP blames the GAME developers… They already have harder jobs than the majority of us, picking on them for not knowing skills outside…

If you sell software to millions of people that runs with access to sensitive data you have an obligation to do a good job, sorry. If you don't like that, make it MIT licensed on an open source site instead of $70 on Steam.

The developers don’t have that obligation, the publishers do though.. They are the last in the chain here.. Those gaming agencies have a lot of beuracracy filtered in gaming senses.

I’ll say this, every single game dev I’ve ever met, has no clue how to navigate bureaucracy. I’m not saying it’s a type, but it’s not random, they have other things to worry about.

Re: Remote Code Execution in Marvel Rivals Game

#85

Post by lcnPylGDnU4H9OF »

> This also opens the door up to an entrypoint on PS5.

Does he mean that this is potentially how one could install custom firmware on their console?

Curious because I remember reading somewhat recently that console vendors have locked their consoles down well enough so as to avoid any vulnerabilities which could be exploited to install custom firmware. It would be amusing if that was invalidated by game dev security and I start hearing about ways to install some modded firmware, which include a step of "install one of these games".

IIRC, the web browser on 3DS systems was exploited to install custom firmware rather than a game so it was rather easily patched with a system update (and, indeed, it actually was patched). I wonder if we'll be seeing Sony/Nintendo/Microsoft start to insist on certain security standards as a result of games being exploited to install custom firmware on the devices they sell, presuming the answer to my first question is affirmative.

Re: Remote Code Execution in Marvel Rivals Game

#86

Post by bilekas »

bongodongobob wrote: post #76
bilekas wrote: post #42

Earlier quoted context omitted.

I don’t work in gaming, I know a few people who do, everyone of them does it for the love of the game. Certainly not for the job security or even the money. This idea that they’re also to handle security is too much. It’s not their fault, they’re writing “art” not secure micro services for multi national companies. Publishers will pay to have 0level kernel ring on your system but not for software securing their game.…

I've done IT support for a number of devs across multiple companies and they all expect local admin and admin access to everything. So no, I don't believe they feel it is risky. I believe they don't get it/don't care. It's just not their wheelhouse.

This is a different case, if I don’t have permission to talk to the graphics card, sound card, even ram, I’m a restricted engineer.

> I believe they don’t get it/don’t care.

You’re right, anything that’s not obstructive is never worried about.

To me that says you’re doing a good job giving permissions, it’s also your job to manage those permissions, not the developers..

> It's just not their wheelhouse.

Your absolute bang on. And I can say from experience, it’s good you guys are there.

Re: Remote Code Execution in Marvel Rivals Game

#87

Post by bongodongobob »

idiotsecant wrote: post #79
bongodongobob wrote: post #76

Earlier quoted context omitted.

I've done IT support for a number of devs across multiple companies and they all expect local admin and admin access to everything. So no, I don't believe they feel it is risky. I believe they don't get it/don't care. It's just not their wheelhouse.

No, it's because the average IT infrastructure is abysmal and getting things done without admin is it's own full-time job filing and following up on tickets and trying to plead your case for the ten thousandth time to the exalted security dieties that you just want to do your job gets old. Am i bitter? Nah

Totally get it dude.

Re: Remote Code Execution in Marvel Rivals Game

#88

Post by bongodongobob »

bilekas wrote: post #86
bongodongobob wrote: post #76

Earlier quoted context omitted.

I've done IT support for a number of devs across multiple companies and they all expect local admin and admin access to everything. So no, I don't believe they feel it is risky. I believe they don't get it/don't care. It's just not their wheelhouse.

This is a different case, if I don’t have permission to talk to the graphics card, sound card, even ram, I’m a restricted engineer. > I believe they don’t get it/don’t care. You’re right, anything that’s not obstructive is never worried about. To me that says you’re doing a good job giving permissions, it’s also your job to manage those permissions, not the developers.. > It's just not their wheelhouse. Your absolute…

Right and that's the thing, you don't need local admin for that. It can be done granularly or set up a dev env vm etc. It's a pain for everyone to be sure and some routes are easier than others.

Re: Remote Code Execution in Marvel Rivals Game

#89

Post by ThatPlayer »

oxygen_crisis wrote: post #64
Etheryte wrote: post #48

Earlier quoted context omitted.

I wish Steam offered a console format of the deck, essentially the same thing, but with better specs, HDMI out and bluetooth for controllers. Would be a massive hit I wager.

The deck already has bluetooth for controllers and HDMI out if you get a standard USB3/HDMI dongle (or their expensive dock). Essentially all you're asking for them to add is better specs. In December their revised branding guidelines added a "Powered by SteamOS" badge so presumably 3rd-party boxes with various specs in set-top form factors will be coming before too long: > The Powered by SteamOS logo indicates that…

Better specs would also be interesting, because Steam's current "Steam Deck Verified" does check if games run well on the Steam Deck's hardware. There's another check for text size on the smaller 7" screen too.

Re: Remote Code Execution in Marvel Rivals Game

#90

Post by ryandrake »

sbarre wrote: post #25
gruez wrote: post #19

Earlier quoted context omitted.

>These are game developers. Not backend developers. Not web guys. Not remotely trained in infosec. They make games. Not security software. Why do game developers get a pass but not "backend developers" or "web guys"? Don't the latter only "make CRUD apps, not security software"?

I think for web or "backend for network" people, you are always deploying into a hostile environment (the Internet) and so you really should be at least aware of basic security measures. If you consider yourself a professional in that field, it's table stakes. If you're a game dev, you were taught to write optimized code that runs locally on a computer. Not everything you do will run on the network, and networking/mu…

There is nothing special about game development that justifies not knowing/caring about security. It's 2025. Everyone is deploying into a hostile environment (the world). Security is now a horizontal that cuts across all kinds of development: frontend, backend, web, mobile, PC, console. You can't just say "Oh, security is the job of a Security Developer. I am just a Xyz Developer."
Post reply on HN