Arbitrary code execution in Unity Runtime
1–10 of 33 posts
Re: Arbitrary code execution in Unity Runtime
#2This is somewhat unsurprising - gaming software will doubtless cut corners on security-adjacent tooling (valgrind, etc) in order to ship faster.
It's also somewhat irrelevant unless there's a remote chain.
The Android Browser idea is interesting but is this actually a likely scenario?
Re: Arbitrary code execution in Unity Runtime
#3This is somewhat unsurprising - gaming software will doubtless cut corners on security-adjacent tooling (valgrind, etc) in order to ship faster. It's also somewhat irrelevant unless there's a remote chain. The Android Browser idea is interesting but is this actually a likely scenario?
how does one cut corners on Valgrind? It's a free tool from what I understand.
Re: Arbitrary code execution in Unity Runtime
#4This is somewhat unsurprising - gaming software will doubtless cut corners on security-adjacent tooling (valgrind, etc) in order to ship faster. It's also somewhat irrelevant unless there's a remote chain. The Android Browser idea is interesting but is this actually a likely scenario?
The relevance is bypassing the android application sandboxing of the game by other apps and running arbitrary code as the game. I suppose the relevance depends a lot on how much you are invested in your video game.
Re: Arbitrary code execution in Unity Runtime
#5This is somewhat unsurprising - gaming software will doubtless cut corners on security-adjacent tooling (valgrind, etc) in order to ship faster. It's also somewhat irrelevant unless there's a remote chain. The Android Browser idea is interesting but is this actually a likely scenario?
how does one cut corners on Valgrind? It's a free tool from what I understand.
I interpreted the comment as meaning cutting corners by not using Valgrind.
Re: Arbitrary code execution in Unity Runtime
#6This is somewhat unsurprising - gaming software will doubtless cut corners on security-adjacent tooling (valgrind, etc) in order to ship faster. It's also somewhat irrelevant unless there's a remote chain. The Android Browser idea is interesting but is this actually a likely scenario?
how does one cut corners on Valgrind? It's a free tool from what I understand.
by not using it.
Re: Arbitrary code execution in Unity Runtime
#7This is somewhat unsurprising - gaming software will doubtless cut corners on security-adjacent tooling (valgrind, etc) in order to ship faster. It's also somewhat irrelevant unless there's a remote chain. The Android Browser idea is interesting but is this actually a likely scenario?
Yeah, at first, I was like...Okay, so the victim needs to install a malicious app which means they already have code execution. This is just a permissions escalation? I suppose that can be bad if the target Unity app has some wide permissions.
But if it can be exploited via Browser, then it means any website with an XSS vulnerability becomes an attack vector. But the attack needs to specify which app to start. So even if you found a great app that uses Unity and has juicy permissions, you'd have to hope your victims have that specific app installed. I'm not sure you could try to launch multiple apps without tipping off the user that the website is trying to do something funky.
Re: Arbitrary code execution in Unity Runtime
#8Re: Arbitrary code execution in Unity Runtime
#9> This vulnerability allows malicious intents to control command line arguments passed to Unity applications, enabling attackers to load arbitrary shared libraries (.so files) and execute malicious code, depending on the platform.
Aren't intents an Android-only thing? I'm not sure adding "depending on the platform" makes sense when the exploit only works on a single platform.
Re: Arbitrary code execution in Unity Runtime
#10Interesting that Windows is impacted, but on Windows you can simply drop a dx9 dll or sameNameAsExecutable.dll to "inject" code. Commonly used by modders for Unity and other games. From that perspective, I don't see how this is novel or so highly rated, again on Windows specifically.
The URI handler is a separate vector that is more concerning.