10 ms·

Remote Code Execution in Marvel Rivals Game

185 points by eugenekolo 2y ago

bangaladore 2y ago
> the game runs with admin privileges for the sake of anti-cheat "sake of anti-cheat" should be taken lightly here. There is a reason why all the other sane anti-cheats have at least two applications, the anti cheat service which often runs as admin, and the game, which does not. Running the game as admin is quite frankly inexcusable. The service often does the network comms and communicates to a kernel-mode driver and/or to the application via IPC or similar. Having defined barriers of separation are good things. In any case, this POC doesn't have huge implications necessarily for most people, but maybe in SEA or China where LAN cafes are more prevalent, it could be a larger concern.
- shalzuth 2y ago
  The one implication that I (the author) should highlight for the extra paranoid - this exploit extends to ISP's and cloud vendors that traffic is routed through. Anywhere in the trace route can MITM. It depends on how much you trust those parties.
  - sim7c00 2y ago
    tried in some communities of gamedev to talk about security but i gave up. i think the main sentiment is not to care at all. so many games have or had trivial exploits. enabling mass cheating, harasment of other players (DOS) and more nefarious stuff. for people whwo think the mitm wont affect them... thats a silly stance. people hack home routers on massive scales. (another domain who doesnt seem to give shits about security) good writeup! thanks!
    - 999900000999 2y ago
      Their's a really good argument for having a "gaming" os, Windows, and a serious OS , Linux on the same computer. If League of Legends needs super admin mode, it's no longer my computer. I'm sharing it with Tencent. I can't trust them ( specifically a disgruntled employee) to not install key loggers and other really nasty things.
      - sim7c00 2y ago
        this is also a good argument. the anti cheat is impossible to implement in usermode, but you can hardly trust developerd with kernel mode drivers that trace all things. im not sure if a gaming os would help there. it would be helpful if OSes wouldnt allow things like malicious drivers but this is an extremely hard problem in light of people loading known vulnerable drivers and exploiting those... you could argue that a lot of drivers could live in ring 1 or 2 rather than ring0, but that no OS implements. working on an OS to try and think of solutions to this types of issues, but u know... if u can wait like 40 years maybe it will be done (and likely it will be vulnerable in different ways :(( )
      - DaSHacka 2y ago
        This is essentially my Windows box. I use it for gaming, and RDP in from one of my other computers (all of which run GNU/Linux), when I need to run a Windows program away from the house. I treat it as though there's a random russian dude watching my every move through RDP keylogging all my inputs (and for how many one-off cracked programs have been installed on there over the years, it's not impossible). I can't imagine keeping my password manager and primary accounts logged-in on the same computer I have rootkits like Riot Anticheat and technical disasters like Marvel Rivals installed on.
      - keyringlight 2y ago
        I think there's a few angles on this. Firstly that a game developers main concern is getting their product functional, keeping that way, and that they can make money on it to make the whole endeavour worthwhile. There's already a lot of game releases where it comes across getting their idea working out the door is a lot higher up the list than the 'details' and attention to working great on the PC platform. Then that gamers will come in a wide range of skill/knowledge levels for their PCs, from those that treat them as glorified consoles to others that know every detail of their workstation. Dual booting adds more admin and complexity, and in a way it's admitting that the trust level in software is so low your OS can't sandbox things out, that stuff you're running is taking liberties or just enough effort to fulfill its task, and you're going to the extent of running a console in a separate partition but running it is mutually exclusive with the serious OS. I'd guess a lot of people who felt strong enough would just have 'serious OS' be another device, most likely a phone but alternatively laptop, which would seem to marginalize what they use the windows install for.
jauntywundrkind 2y ago
For a second I thought this was the Marvel game that got briefly banned along with TikTok, but that's marvel Snap. It would have been a tiny bit funny if it had been the same company that was just briefly banned that was allowing a remote exploit.
- xnx 2y ago
  Exactly my confusion. This would've made the TikTok ban feel a little more legitimate.
- empath75 2y ago
  To be honest, I would not be surprised if netease the same kind of attention as bytedance.
doctorpangloss 2y ago
The engineering culture behind AAA video games is rotten to the core with regards to security. Everyone thinks they're making Doom 3 and they're really making Windows 2000 Service Pack 1.
- Xunjin 2y ago
  Great commentary, today the industry is focused on delivering free game with tons of cosmetics (which gives a ton of money) but forgetting about performance and security.
  - TonyTrapp 2y ago
    Your average networked game these days is probably a bazillion times more secure than one from 20 years ago. It was super common that there were cheat tools to crash all game clients in a match. It was super annoying, we can just be glad that it was usually not used for anything more nefarious.
    - Xunjin 2y ago
      Excellent point, how do you see today the industry, security wise?
- agoodusername63 2y ago
  Is it particularly surprising though? These are game developers. Not backend developers. Not web guys. Not remotely trained in infosec. They make games. Not security software. And for the longest time this was acceptable. I think for a GaaS in 2025 it's unacceptable to not have security minded engineers on staff for the backend stuff. Too much money is involved not to. Especially for studios very familiar with shipping online games. But I'm also kind of disappointed in how much we're forgetting that these people are not infosec nerds. Last year there was a cute fishing game made by a single dude messing around making things. It got popular and a kid found an RCE bug with the multiplayer. The dude got a TON of shit for the flaw, which feels deeply unfair. I don't expect my mom to configure a router correctly. I don't expect video game developers to understand defensive network programming without training. Maybe I'm just a little frustrated at the Internet largely unable to understand that defensive programming is something that isn't in a game devs trained skills. I would expect better of Netease however
S0y 2y ago
So what part of the game code exactly is able to download a random python script and run it?
- sanktanglia 2y ago
  The patching process sends python byte code for hot fixes
agentultra 2y ago
I was literally thinking about this the other day. There are a ton of games using kernel modules for anti-cheat and... just load and interpret data payloads. Certainly some of those payloads could manipulate the funny machines inside of a game executable if they're not careful about their parsing and validation. Nice PoC! Update: yes, most game client processes don't run in the kernel. My b. I was just thinking that updates and content payloads might be an interesting vector for langsec.
- agentultra 2y ago
  Also, if you see content distribution networks the way we've been looking into package managers as a vector distributing poisoned payloads... seems fruitful.
- Liquix 2y ago
  Yes. For example world of warcraft's anticheat (warden), although it runs in userspace, has been exploited multiple times to gain RCE/server root after receiving malicious payloads from clients.
- mavhc 2y ago
  Imagine if security software did that, but also ran on boot and took down a million critical machines
sanktanglia 2y ago
Funny enough this engine is based off the same one they used in Diablo immortal which also has this issue
wyldfire 2y ago
I'm surprised - isn't this game just a skin on Overwatch? So does Overwatch have an RCE?
- Nannooskeeska 2y ago
  No, Marvel Rivals and Overwatch are not related in any way other than they're both the same genre of game.
  - wyldfire 2y ago
    Wow, I was so convinced that it was the case that I thought you were mistaken. They look remarkably similar. But yeah, just another game in that genre like you said.
kibwen 2y ago
I bought a Steam Deck with the sole purpose of having a cheap, airgapped PC to run games on. Game devs just don't have the incentives or discipline to be trusted with security. Reminder that all three Dark Souls games allowed full RCE to any users connected to the internet: https://flashpoint.io/blog/rce-vulnerability-dark-souls/ https://flashpoint.io/blog/rce-vulnerability-dark-souls/
- Etheryte 2y ago
  I wish Steam offered a console format of the deck, essentially the same thing, but with better specs, HDMI out and bluetooth for controllers. Would be a massive hit I wager.
  - jamie_ca 2y ago
    They tried some years back https://en.wikipedia.org/wiki/Steam_Machine_(computer) https://en.wikipedia.org/wiki/Steam_Machine_(computer) but it didn't really hit big. That said recent updates to SteamOS and agreements around logo/branding use hint that we're likely to see a few other options in the coming year or two (alongside some 3rd-party handhelds running SteamOS).
  - kibwen 2y ago
    This is what I do, I rarely use it in handheld mode (but I do appreciate the ability to). Valve sells a dock with HDMI out (along with ethernet, USB, etc), and I can confirm that it works wirelessly with Xbox controllers.
  - 0cf8612b2e1e 2y ago
    I thought SteamOS was just some layers on top of Arch. To not go full Dropbox, but I think if someone wants a Linux PC to run games, it is within the realm for a home PC builder to accomplish. It would otherwise be a tough market to sell, “Buy this gamer PC, less great specs than you would likely pick for yourself and not compatible with the most popular games that have onerous anti-cheat root kits”.
  - qskousen 2y ago
    This is something they are (probably) working towards with SteamOS, being able to run it on your own hardware with deck-level hardware support. See https://www.pcguide.com/news/valve-could-be-thinking-about-reviving-the-steam-machine-as-it-discusses-future-plans-for-steamos/ https://www.pcguide.com/news/valve-could-be-thinking-about-r...
bilekas 2y ago
> Game developers continue to amaze me at their lack of security awareness. Because game developers are SUPPOSED to be aware of these things? > It's very hard for security researchers to report bugs to most game dev companies. On top of that, most do not have bug bounty programs Yet the OP blames the GAME developers… They already have harder jobs than the majority of us, picking on them for not knowing skills outside of their area is just being mean and OP is targeting frustration at the wrong group.
- shalzuth 2y ago
  You’re right - I should have specified more explicitly. I am not referring to the game dev that is developing game features or content - I am specifically talking about the “security engineering” organizations within game developer companies. NetEase hired security engineers to specifically do security related tasks (see NetEase AntiCheat @ https://dun.163.com/locale/en?force=true https://dun.163.com/locale/en?force=true). NetEase Games doesn’t have an excuse for not conducting a security review on a massive game like Marvel Rivals - and this isn’t some corner case, this is part of the core architecture. And this is not a story unique to NetEase. I have multiple other examples that I’ll probably talk about in the future.
- munchler 2y ago
  YES. Did you read the part where the game devs use RCE with admin privileges to run patches? Any developer who does that should be aware of the security risks they’re taking.
  - bilekas 2y ago
    Any developer yes, but I personally put game developers into a different category, they’re making games and trying to find shortcuts to meet strange management requirements. They don’t know the security side.. I’m admitting there should be some guard before code review is approved from a real security engineer > Any developer who does that should be aware of the security risks they’re taking. Developer yeah, someone who’s focused on recreating the game probably not
lockemx 2y ago
Interestingly, the game doesn't run as admin for any good reason. The first thing I did was only let the launcher and game run as the user with RunAsInvoker. The anticheat alone is allowed RunAsAdmin. At the same time, I don't trust any anticheat. It's probably worse than useless, but it is what it is. I thought Microsoft would clean this up after the Crowdstrike incident for all kernel-level code, but I guess there's no incentive for them to only let game companies request runtime analysis / reports rather than run code. As for the anti-cheat industry, they should focus on patterns of user behavior to help game companies moderate the players as much as neccesary.
- zwily 2y ago
  I have a related question for you... my kids like Marvel Rivals, but I also use Microsoft family tools to limit their screen time so they don't have Admin accounts. However, the Marvel Rivals anti-cheat makes me enter my password every time they launch. Is there any way for me to create a shortcut or something so Rivals will launch without my password? I'm not a Windows guy and trying to figure this out has been extremely frustrating...
  - voxic11 2y ago
    You can make a on-demand scheduled task that runs Marvel Rivals as admin then create a shortcut that invokes the task. Full instructions https://chatgpt.com/share/67a13960-c1b4-8002-a699-7b547c759c33 https://chatgpt.com/share/67a13960-c1b4-8002-a699-7b547c759c...
  - sandyarmstrong 2y ago
    I just had to fix this for my kid over the weekend. https://steamcommunity.com/app/2767030/discussions/0/596260472619131921/ https://steamcommunity.com/app/2767030/discussions/0/5962604... was very helpful: You can also skip the UAC prompt without editing the registry, by adding the following to the game's launch options in Steam: cmd /min /C "set __COMPAT_LAYER=RUNASINVOKER && start "" %command%"
    - zwily 2y ago
zxilly 2y ago
Looks like a typical mitm attack, which confuses me a bit, don't the developers use something like tls or dtls to protect their communications? The most recent game I analysed was helldivers 2, which uses dtls. i would have thought that would be fairly common knowledge.
- shalzuth 2y ago
  That's the issue - they don't! But even games like Helldivers 2 have had silly vulnerabilities (just not RCE) - see https://helldivers.io/freesupercredits https://helldivers.io/freesupercredits for some examples.
plagiarist 2y ago
I like the other rant at the bottom. But why would game developers care about security when their customers don't care? The customers are fine running anticheat with admin privileges like in this RCE he just found.
- kevingadd 2y ago
  I personally encountered a game anti-cheat driver in the wild (Anti-Cheat Expert) that caused BSODs and data loss. I later discovered there were known exploits in it and the signature still hadn't been revoked. I managed to get the developers of the game I was playing to reconfigure it by kicking up a fuss on the subreddit, at least.
foco_tubi 2y ago
Interesting that the PS5 has been implicated - does this mean that there is an opportunity to jailbreak firmware again?
tart-lemonade 2y ago
It downloads and executes a Python script to update the store page? Log4j/log4shell, anyone? Just build a JSON API! It's not that hard! You don't need to RCE your game every time it launches just for microtransactions.
- X-Cubed 2y ago
  > Just build a JSON API! It's not that hard! I agree that a JSON API is a better approach, but it's possible for AAA game developers to screw that up too: https://arstechnica.com/gaming/2021/03/developers-to-update-gta-online-to-address-poor-load-times-after-community-fix/ https://arstechnica.com/gaming/2021/03/developers-to-update-...
lcnPylGDnU4H9OF 2y ago
> This also opens the door up to an entrypoint on PS5. Does he mean that this is potentially how one could install custom firmware on their console? Curious because I remember reading somewhat recently that console vendors have locked their consoles down well enough so as to avoid any vulnerabilities which could be exploited to install custom firmware. It would be amusing if that was invalidated by game dev security and I start hearing about ways to install some modded firmware, which include a step of "install one of these games". IIRC, the web browser on 3DS systems was exploited to install custom firmware rather than a game so it was rather easily patched with a system update (and, indeed, it actually was patched). I wonder if we'll be seeing Sony/Nintendo/Microsoft start to insist on certain security standards as a result of games being exploited to install custom firmware on the devices they sell, presuming the answer to my first question is affirmative.
- bakugo 2y ago
  > Does he mean that this is potentially how one could install custom firmware on their console? Sort of. It's a userland code execution exploit, which is often the first step, but all games run in a locked down VM specifically to protect against things like this, so you still need a kernel/hypervisor exploit to escape the VM and actually mess with the system in any significant way.
  - lcnPylGDnU4H9OF 2y ago
    Thanks for the explanation. That helps complete the picture another comment (https://news.ycombinator.com/item?id=42921799 https://news.ycombinator.com/item?id=42921799) started about “funny machines”. I do believe the measures they’ve taken to protect against malicious payloads are going to be tested rather relentlessly.
- shalzuth 2y ago
  PS5 games are sandboxed, so it only allows an entrypoint to run code. For full PS5 exploitation, another chain is needed to go break out of the sandbox.

185 points by eugenekolo 2y ago

> the game runs with admin privileges for the sake of anti-cheat "sake of anti-cheat" should be taken lightly here. There is a reason why all the other sane anti-cheats have at least two applications, the anti cheat service which often runs as admin, and the game, which does not. Running the game as admin is quite frankly inexcusable. The service often does the network comms and communicates to a kernel-mode driver and/or to the application via IPC or similar. Having defined barriers of separation are good things. In any case, this POC doesn't have huge implications necessarily for most people, but maybe in SEA or China where LAN cafes are more prevalent, it could be a larger concern.

shalzuth 2y ago
The one implication that I (the author) should highlight for the extra paranoid - this exploit extends to ISP's and cloud vendors that traffic is routed through. Anywhere in the trace route can MITM. It depends on how much you trust those parties.
- sim7c00 2y ago
  tried in some communities of gamedev to talk about security but i gave up. i think the main sentiment is not to care at all. so many games have or had trivial exploits. enabling mass cheating, harasment of other players (DOS) and more nefarious stuff. for people whwo think the mitm wont affect them... thats a silly stance. people hack home routers on massive scales. (another domain who doesnt seem to give shits about security) good writeup! thanks!
  - 999900000999 2y ago
    Their's a really good argument for having a "gaming" os, Windows, and a serious OS , Linux on the same computer. If League of Legends needs super admin mode, it's no longer my computer. I'm sharing it with Tencent. I can't trust them ( specifically a disgruntled employee) to not install key loggers and other really nasty things.
    - sim7c00 2y ago
      this is also a good argument. the anti cheat is impossible to implement in usermode, but you can hardly trust developerd with kernel mode drivers that trace all things. im not sure if a gaming os would help there. it would be helpful if OSes wouldnt allow things like malicious drivers but this is an extremely hard problem in light of people loading known vulnerable drivers and exploiting those... you could argue that a lot of drivers could live in ring 1 or 2 rather than ring0, but that no OS implements. working on an OS to try and think of solutions to this types of issues, but u know... if u can wait like 40 years maybe it will be done (and likely it will be vulnerable in different ways :(( )
    - DaSHacka 2y ago
      This is essentially my Windows box. I use it for gaming, and RDP in from one of my other computers (all of which run GNU/Linux), when I need to run a Windows program away from the house. I treat it as though there's a random russian dude watching my every move through RDP keylogging all my inputs (and for how many one-off cracked programs have been installed on there over the years, it's not impossible). I can't imagine keeping my password manager and primary accounts logged-in on the same computer I have rootkits like Riot Anticheat and technical disasters like Marvel Rivals installed on.
    - keyringlight 2y ago
      I think there's a few angles on this. Firstly that a game developers main concern is getting their product functional, keeping that way, and that they can make money on it to make the whole endeavour worthwhile. There's already a lot of game releases where it comes across getting their idea working out the door is a lot higher up the list than the 'details' and attention to working great on the PC platform. Then that gamers will come in a wide range of skill/knowledge levels for their PCs, from those that treat them as glorified consoles to others that know every detail of their workstation. Dual booting adds more admin and complexity, and in a way it's admitting that the trust level in software is so low your OS can't sandbox things out, that stuff you're running is taking liberties or just enough effort to fulfill its task, and you're going to the extent of running a console in a separate partition but running it is mutually exclusive with the serious OS. I'd guess a lot of people who felt strong enough would just have 'serious OS' be another device, most likely a phone but alternatively laptop, which would seem to marginalize what they use the windows install for.

jauntywundrkind 2y ago

For a second I thought this was the Marvel game that got briefly banned along with TikTok, but that's marvel Snap. It would have been a tiny bit funny if it had been the same company that was just briefly banned that was allowing a remote exploit.

xnx 2y ago
Exactly my confusion. This would've made the TikTok ban feel a little more legitimate.
empath75 2y ago
To be honest, I would not be surprised if netease the same kind of attention as bytedance.

doctorpangloss 2y ago

The engineering culture behind AAA video games is rotten to the core with regards to security. Everyone thinks they're making Doom 3 and they're really making Windows 2000 Service Pack 1.

Xunjin 2y ago
Great commentary, today the industry is focused on delivering free game with tons of cosmetics (which gives a ton of money) but forgetting about performance and security.
- TonyTrapp 2y ago
  Your average networked game these days is probably a bazillion times more secure than one from 20 years ago. It was super common that there were cheat tools to crash all game clients in a match. It was super annoying, we can just be glad that it was usually not used for anything more nefarious.
  - Xunjin 2y ago
    Excellent point, how do you see today the industry, security wise?
agoodusername63 2y ago
Is it particularly surprising though? These are game developers. Not backend developers. Not web guys. Not remotely trained in infosec. They make games. Not security software. And for the longest time this was acceptable. I think for a GaaS in 2025 it's unacceptable to not have security minded engineers on staff for the backend stuff. Too much money is involved not to. Especially for studios very familiar with shipping online games. But I'm also kind of disappointed in how much we're forgetting that these people are not infosec nerds. Last year there was a cute fishing game made by a single dude messing around making things. It got popular and a kid found an RCE bug with the multiplayer. The dude got a TON of shit for the flaw, which feels deeply unfair. I don't expect my mom to configure a router correctly. I don't expect video game developers to understand defensive network programming without training. Maybe I'm just a little frustrated at the Internet largely unable to understand that defensive programming is something that isn't in a game devs trained skills. I would expect better of Netease however

S0y 2y ago

So what part of the game code exactly is able to download a random python script and run it?

sanktanglia 2y ago
The patching process sends python byte code for hot fixes

agentultra 2y ago

I was literally thinking about this the other day. There are a ton of games using kernel modules for anti-cheat and... just load and interpret data payloads. Certainly some of those payloads could manipulate the funny machines inside of a game executable if they're not careful about their parsing and validation. Nice PoC! Update: yes, most game client processes don't run in the kernel. My b. I was just thinking that updates and content payloads might be an interesting vector for langsec.

agentultra 2y ago
Also, if you see content distribution networks the way we've been looking into package managers as a vector distributing poisoned payloads... seems fruitful.
Liquix 2y ago
Yes. For example world of warcraft's anticheat (warden), although it runs in userspace, has been exploited multiple times to gain RCE/server root after receiving malicious payloads from clients.
mavhc 2y ago
Imagine if security software did that, but also ran on boot and took down a million critical machines

sanktanglia 2y ago

Funny enough this engine is based off the same one they used in Diablo immortal which also has this issue

wyldfire 2y ago

I'm surprised - isn't this game just a skin on Overwatch? So does Overwatch have an RCE?

Nannooskeeska 2y ago
No, Marvel Rivals and Overwatch are not related in any way other than they're both the same genre of game.
- wyldfire 2y ago
  Wow, I was so convinced that it was the case that I thought you were mistaken. They look remarkably similar. But yeah, just another game in that genre like you said.

kibwen 2y ago

I bought a Steam Deck with the sole purpose of having a cheap, airgapped PC to run games on. Game devs just don't have the incentives or discipline to be trusted with security. Reminder that all three Dark Souls games allowed full RCE to any users connected to the internet: https://flashpoint.io/blog/rce-vulnerability-dark-souls/ https://flashpoint.io/blog/rce-vulnerability-dark-souls/

Etheryte 2y ago
I wish Steam offered a console format of the deck, essentially the same thing, but with better specs, HDMI out and bluetooth for controllers. Would be a massive hit I wager.
- jamie_ca 2y ago
  They tried some years back https://en.wikipedia.org/wiki/Steam_Machine_(computer) https://en.wikipedia.org/wiki/Steam_Machine_(computer) but it didn't really hit big. That said recent updates to SteamOS and agreements around logo/branding use hint that we're likely to see a few other options in the coming year or two (alongside some 3rd-party handhelds running SteamOS).
- kibwen 2y ago
  This is what I do, I rarely use it in handheld mode (but I do appreciate the ability to). Valve sells a dock with HDMI out (along with ethernet, USB, etc), and I can confirm that it works wirelessly with Xbox controllers.
- 0cf8612b2e1e 2y ago
  I thought SteamOS was just some layers on top of Arch. To not go full Dropbox, but I think if someone wants a Linux PC to run games, it is within the realm for a home PC builder to accomplish. It would otherwise be a tough market to sell, “Buy this gamer PC, less great specs than you would likely pick for yourself and not compatible with the most popular games that have onerous anti-cheat root kits”.
- qskousen 2y ago
  This is something they are (probably) working towards with SteamOS, being able to run it on your own hardware with deck-level hardware support. See https://www.pcguide.com/news/valve-could-be-thinking-about-reviving-the-steam-machine-as-it-discusses-future-plans-for-steamos/ https://www.pcguide.com/news/valve-could-be-thinking-about-r...

bilekas 2y ago

> Game developers continue to amaze me at their lack of security awareness. Because game developers are SUPPOSED to be aware of these things? > It's very hard for security researchers to report bugs to most game dev companies. On top of that, most do not have bug bounty programs Yet the OP blames the GAME developers… They already have harder jobs than the majority of us, picking on them for not knowing skills outside of their area is just being mean and OP is targeting frustration at the wrong group.

shalzuth 2y ago
You’re right - I should have specified more explicitly. I am not referring to the game dev that is developing game features or content - I am specifically talking about the “security engineering” organizations within game developer companies. NetEase hired security engineers to specifically do security related tasks (see NetEase AntiCheat @ https://dun.163.com/locale/en?force=true https://dun.163.com/locale/en?force=true). NetEase Games doesn’t have an excuse for not conducting a security review on a massive game like Marvel Rivals - and this isn’t some corner case, this is part of the core architecture. And this is not a story unique to NetEase. I have multiple other examples that I’ll probably talk about in the future.
munchler 2y ago
YES. Did you read the part where the game devs use RCE with admin privileges to run patches? Any developer who does that should be aware of the security risks they’re taking.
- bilekas 2y ago
  Any developer yes, but I personally put game developers into a different category, they’re making games and trying to find shortcuts to meet strange management requirements. They don’t know the security side.. I’m admitting there should be some guard before code review is approved from a real security engineer > Any developer who does that should be aware of the security risks they’re taking. Developer yeah, someone who’s focused on recreating the game probably not

lockemx 2y ago

Interestingly, the game doesn't run as admin for any good reason. The first thing I did was only let the launcher and game run as the user with RunAsInvoker. The anticheat alone is allowed RunAsAdmin. At the same time, I don't trust any anticheat. It's probably worse than useless, but it is what it is. I thought Microsoft would clean this up after the Crowdstrike incident for all kernel-level code, but I guess there's no incentive for them to only let game companies request runtime analysis / reports rather than run code. As for the anti-cheat industry, they should focus on patterns of user behavior to help game companies moderate the players as much as neccesary.

zwily 2y ago
I have a related question for you... my kids like Marvel Rivals, but I also use Microsoft family tools to limit their screen time so they don't have Admin accounts. However, the Marvel Rivals anti-cheat makes me enter my password every time they launch. Is there any way for me to create a shortcut or something so Rivals will launch without my password? I'm not a Windows guy and trying to figure this out has been extremely frustrating...
- voxic11 2y ago
  You can make a on-demand scheduled task that runs Marvel Rivals as admin then create a shortcut that invokes the task. Full instructions https://chatgpt.com/share/67a13960-c1b4-8002-a699-7b547c759c33 https://chatgpt.com/share/67a13960-c1b4-8002-a699-7b547c759c...
- sandyarmstrong 2y ago
  I just had to fix this for my kid over the weekend. https://steamcommunity.com/app/2767030/discussions/0/596260472619131921/ https://steamcommunity.com/app/2767030/discussions/0/5962604... was very helpful: You can also skip the UAC prompt without editing the registry, by adding the following to the game's launch options in Steam: cmd /min /C "set __COMPAT_LAYER=RUNASINVOKER && start "" %command%"
  - zwily 2y ago

zxilly 2y ago

Looks like a typical mitm attack, which confuses me a bit, don't the developers use something like tls or dtls to protect their communications? The most recent game I analysed was helldivers 2, which uses dtls. i would have thought that would be fairly common knowledge.

shalzuth 2y ago
That's the issue - they don't! But even games like Helldivers 2 have had silly vulnerabilities (just not RCE) - see https://helldivers.io/freesupercredits https://helldivers.io/freesupercredits for some examples.

plagiarist 2y ago

I like the other rant at the bottom. But why would game developers care about security when their customers don't care? The customers are fine running anticheat with admin privileges like in this RCE he just found.

kevingadd 2y ago
I personally encountered a game anti-cheat driver in the wild (Anti-Cheat Expert) that caused BSODs and data loss. I later discovered there were known exploits in it and the signature still hadn't been revoked. I managed to get the developers of the game I was playing to reconfigure it by kicking up a fuss on the subreddit, at least.

foco_tubi 2y ago

Interesting that the PS5 has been implicated - does this mean that there is an opportunity to jailbreak firmware again?

tart-lemonade 2y ago

It downloads and executes a Python script to update the store page? Log4j/log4shell, anyone? Just build a JSON API! It's not that hard! You don't need to RCE your game every time it launches just for microtransactions.

X-Cubed 2y ago
> Just build a JSON API! It's not that hard! I agree that a JSON API is a better approach, but it's possible for AAA game developers to screw that up too: https://arstechnica.com/gaming/2021/03/developers-to-update-gta-online-to-address-poor-load-times-after-community-fix/ https://arstechnica.com/gaming/2021/03/developers-to-update-...

lcnPylGDnU4H9OF 2y ago

> This also opens the door up to an entrypoint on PS5. Does he mean that this is potentially how one could install custom firmware on their console? Curious because I remember reading somewhat recently that console vendors have locked their consoles down well enough so as to avoid any vulnerabilities which could be exploited to install custom firmware. It would be amusing if that was invalidated by game dev security and I start hearing about ways to install some modded firmware, which include a step of "install one of these games". IIRC, the web browser on 3DS systems was exploited to install custom firmware rather than a game so it was rather easily patched with a system update (and, indeed, it actually was patched). I wonder if we'll be seeing Sony/Nintendo/Microsoft start to insist on certain security standards as a result of games being exploited to install custom firmware on the devices they sell, presuming the answer to my first question is affirmative.

bakugo 2y ago
> Does he mean that this is potentially how one could install custom firmware on their console? Sort of. It's a userland code execution exploit, which is often the first step, but all games run in a locked down VM specifically to protect against things like this, so you still need a kernel/hypervisor exploit to escape the VM and actually mess with the system in any significant way.
- lcnPylGDnU4H9OF 2y ago
  Thanks for the explanation. That helps complete the picture another comment (https://news.ycombinator.com/item?id=42921799 https://news.ycombinator.com/item?id=42921799) started about “funny machines”. I do believe the measures they’ve taken to protect against malicious payloads are going to be tested rather relentlessly.
shalzuth 2y ago
PS5 games are sandboxed, so it only allows an entrypoint to run code. For full PS5 exploitation, another chain is needed to go break out of the sandbox.