6 ms·

So... stop trusting the game industry, I guess? We probably should run our games in containers. Anyone got an idea about how to do this? Isolate Steam/Origin/G

So... stop trusting the game industry, I guess? We probably should run our games in containers. Anyone got an idea about how to do this? Isolate Steam/Origin/Games into their own little sandbox

carlmr 9y ago
I have a dual boot system, my windows is my container for games :D.
- John_KZ 9y ago
  I hope you at least encrypt the other system. To be actually secure you have to have 2 completely disconnected drives.
  - carlmr 9y ago
    It's a single drive, not so secure. I wasn't really serious on my previous post.
    - chrisper 9y ago
      I think it is safe enough for the common Windows malware such as this one.
    - chopin 9y ago
      I am not sure if it is that bad. If your Linux partition is some file system unknown to Windows (like ext3), it'd be very hard to come by from a running Windows image (at least for Win7, where I had problems doing this).
John_KZ 9y ago
The first thing that needs to be done is criminally charge the company. If their CEO goes to jail, corporate people will be more reserved about distributing malware. As far as isolating software, there are a few possibilities, but sandboxing doen't always work. VMs are the way to go for now, but they're not foolproof either, and they come with a myriad of downsides.
- dx034 9y ago
  I'd be really surprised if this isn't illegal. They installed malware on people's computer that had no purpose but stealing passwords.
bringtheaction 9y ago
Another reason not to game on computer but to own a console like PS4 or Nintendo Switch instead.
- matte_black 9y ago
  Just build a dedicated gaming machine.
  - danpalmer 9y ago
    A second full (probably expensive) computer that can't be used for anything except gaming is not something many people can afford, and security should not be for the rich. Plus I would imagine that most gaming will require entering passwords at some point, whether that's into Steam, Origin, signing into humblebundle.com/etc.
- akerro 9y ago
  May I know how did you come to this conclusion? Like... games on PS4 are never pirated and never send data to 3rd party? >“This .exe file is from http://securityxploded.com http://securityxploded.com and is touted as a ‘Chrome Password Dump’ tool, Maybe that's another reason to use Firefox?
  - deleted 9y ago
    [deleted]
  - bringtheaction 9y ago
    I keep my PS4 offline, and any way my point was that by gaming on my PS4 instead of on my computer I avoid running potential malware on the same hardware where I keep sensitive information. Even if my PS4 was online it still only has gaming related data on it.
tobyhinloopen 9y ago
Look at Android & iOS. They know how it is done. Running apps in a sandbox should be the default behaviour for any OS by now. No app should have the privileges to access any file by default, except for files that are either created or owned by that app & user. Sharing files between apps should be done as an opt-in basis, with explicit permission by the user, either file-by-file or per group of files.
- bloak 9y ago
  That doesn't work so well when the app is some snazzy file manager or back-up tool. Of course the OS ought to provide good enough tools that users don't need to install dodgy apps for such things but sadly the attitude nowadays seems to be "there's an app for that", even if you only want to do some trivial file conversion. Unless the OS is Debian, in which case the OS includes a gazillion different tools for transforming PDFs, a big helping of astronomical data, and several alternative kitchen sink implementations.
  - tobyhinloopen 9y ago
    that would work with "some snazzy file manager" or back-up tool, you just have to give the app partial/full file-system access with a big fat warning, or it has to use the OS's file manager to access the files. The OS then decides whether to query the user, or use previously configured settings (like the trivial file conversion example below) "Trivial file conversion" tool can be implemented the same. The app tells the OS "hey, I want some files to convert" and the OS either grants access to a set of files/folders, or queries the user which file(s) (s)he wants to provide. IE the "open file" modal is the only window to accessing files. You can think of it like the HTML5 File upload & Drag/drop APIs, but a bit extended & more user-friendly. Obviously smart engineers can think this through for longer than 3 minutes like I just did, and come up with better/user friendlier/safer solutions. But it breaks all backwards compatibility in almost any desktop OS
  - piracykills 9y ago
    So what? At least only my snazzy file manager and media player get access to /sdcard - they still can't access other application's data to dump my browser credentials or modify those applications binaries to behave differently, the most harm they can do is delete my downloaded TV and pictures. Only my backup tool gets root and can access other application's data - random trash games I download or even if I were to install them from pirated sources are unable to do that. It's a vast improvement at the very least, even if not a perfect one.
aerique 9y ago
Like bad actors in the internet ad industry (not sure if any good ones are left) giving people a good reason to run adblockers, they just did the same for the game industry. Although I'm not sure what people are going to do. Run pirated copies with the malware removed? (Which reminds me: when I ran a jailbroken iPhone years ago I had a fix for a PDF exploit much sooner than people having to wait for Apple to fix it, making running a jailbroken phone more secure (at that time).)
- tpxl 9y ago
  I've done that before. Bought Bioshock 2 and got frustrated with its Games For Windows Live, so I pirated it and played that instead.
krapp 9y ago
You can't trust any software you haven't verified then compiled from source... and you can't even trust that entirely.
- chrisper 9y ago
  First you would have to audit the compiler itself... but then how do you compile it?
  - tobyhinloopen 9y ago
    Easy! You compile it by hand.
    - mcbits 9y ago
      That's actually not too hard as long as all your software is written in Forth.
tokenizerrr 9y ago
You should have done that ages ago. Essentially any anti-cheat software is malware that spies on you.
tarruda 9y ago
I run all my games in a virtual machine (Linux KVM with GPU passthrough). In my case, the gaming VM is shared by all windows games, but with some extra effort it is possible to isolate each game in a separate VM. (What comes to mind is using qemu qcow2 format for the base windows image, plus a snapshot file for each game installation)
akerro 9y ago
>We probably should run our games in containers Yes, we do it already. We pack Windows games into WINE, WINE into Flatpak, distribute it on torrents: There you go, games in a container supported by piracy, with privacy out-of-box included: [DTH crawler website with magnets, might be blocked in your country] -> https://skytorrents.unblockall.org/search/all/ed/1/?l=en-us&q=flatpak https://skytorrents.unblockall.org/search/all/ed/1/?l=en-us&... Why people do have to do it? Some companies install spyware, other companies install a lot of 3rd party crap, DRMs that slow down games for paying users, don't support Linux platform despite promises... Pirates will always be one step ahead, you can make a game with good user/buyer experience like CD-Project or great customer support - Darkwood [1] and make it win-win for literally everyone, or lose at some point. https://www.gamingonlinux.com/articles/the-developers-of-darkwood-have-put-up-a-free-torrent-if-you-cant-afford-to-buy-it.10231/page=6 https://www.gamingonlinux.com/articles/the-developers-of-dar...
- moviuro 9y ago
  Okay, so I might actually try that flatpak thingy. ATM, I was focusing on e.g. fez from HumbleBundle through the AUR [0] and factorio [1] [0] https://aur.archlinux.org/packages/fez/ https://aur.archlinux.org/packages/fez/ [1] https://aur.archlinux.org/packages/factorio/ https://aur.archlinux.org/packages/factorio/
_nedR 9y ago
https://www.sandboxie.com/ https://www.sandboxie.com/ You can either run Steam sandboxed which in turn will sandbox all the games it runs, or you have to do a bit of finagling if you want to individually sandbox your games.
- chrisper 9y ago
  Does that work well for you? I have had certain issues with sandboxed applications.
  - _nedR 9y ago
    It works well enough for most applications and games although I have had issues at times; for example with firefox installs. Using portable version of apps will make it easier in such situations. It is mostly trial and error fiddling with the level on f restrictions you want while not breaking apps. In my case, i have a template profile of permissions, most of which are for restricting access to personal/confidential files/folders like Documents, Browser profiles, etc. Instead of blocking access outright though , i usually make the files/folders write-only.. So, for example the other day i wanted to download a 60fps video from youtube, and the only practical option was to use an adware ridden java downloader.. So i just downloaded it created a new sandbox (based on the template sandbox) for the app, installed it (i recall i had some minor kinks in the install process but managed to get it to work in the end). After i was done with it , i deleted the sandbox and i was off on my way without having to worry if the application had left some unsavoury bits on my system.. edit: I might add that a key advantage of Sandboxie as opposed to other solutions like VMs is that afaik, Sandboxie mostly works by intercepting API calls to the underlying OS.. This maybe more leaky than a VM, but it is also much more lightweight, and as a consequence it has given me good performance for stuff like games, etc.
- moviuro 9y ago
  Here, sandbox your binaries in yet another untrusted binary :( What's to prove that sandboxie is not worse?.. [/tinfoil] Seriously though, has it been audited?
kevingadd 9y ago
itch.io's updater/launcher app has sandboxing support on windows, mac and linux. Another reason to support that service (it's great)

So... stop trusting the game industry, I guess? We probably should run our games in containers. Anyone got an idea about how to do this? Isolate Steam/Origin/Games into their own little sandbox

carlmr 9y ago

I have a dual boot system, my windows is my container for games :D.

John_KZ 9y ago
I hope you at least encrypt the other system. To be actually secure you have to have 2 completely disconnected drives.
- carlmr 9y ago
  It's a single drive, not so secure. I wasn't really serious on my previous post.
  - chrisper 9y ago
    I think it is safe enough for the common Windows malware such as this one.
  - chopin 9y ago
    I am not sure if it is that bad. If your Linux partition is some file system unknown to Windows (like ext3), it'd be very hard to come by from a running Windows image (at least for Win7, where I had problems doing this).

John_KZ 9y ago

The first thing that needs to be done is criminally charge the company. If their CEO goes to jail, corporate people will be more reserved about distributing malware. As far as isolating software, there are a few possibilities, but sandboxing doen't always work. VMs are the way to go for now, but they're not foolproof either, and they come with a myriad of downsides.

dx034 9y ago
I'd be really surprised if this isn't illegal. They installed malware on people's computer that had no purpose but stealing passwords.

bringtheaction 9y ago

Another reason not to game on computer but to own a console like PS4 or Nintendo Switch instead.

matte_black 9y ago
Just build a dedicated gaming machine.
- danpalmer 9y ago
  A second full (probably expensive) computer that can't be used for anything except gaming is not something many people can afford, and security should not be for the rich. Plus I would imagine that most gaming will require entering passwords at some point, whether that's into Steam, Origin, signing into humblebundle.com/etc.
akerro 9y ago
May I know how did you come to this conclusion? Like... games on PS4 are never pirated and never send data to 3rd party? >“This .exe file is from http://securityxploded.com http://securityxploded.com and is touted as a ‘Chrome Password Dump’ tool, Maybe that's another reason to use Firefox?
- deleted 9y ago
  [deleted]
- bringtheaction 9y ago
  I keep my PS4 offline, and any way my point was that by gaming on my PS4 instead of on my computer I avoid running potential malware on the same hardware where I keep sensitive information. Even if my PS4 was online it still only has gaming related data on it.

tobyhinloopen 9y ago

Look at Android & iOS. They know how it is done. Running apps in a sandbox should be the default behaviour for any OS by now. No app should have the privileges to access any file by default, except for files that are either created or owned by that app & user. Sharing files between apps should be done as an opt-in basis, with explicit permission by the user, either file-by-file or per group of files.

bloak 9y ago
That doesn't work so well when the app is some snazzy file manager or back-up tool. Of course the OS ought to provide good enough tools that users don't need to install dodgy apps for such things but sadly the attitude nowadays seems to be "there's an app for that", even if you only want to do some trivial file conversion. Unless the OS is Debian, in which case the OS includes a gazillion different tools for transforming PDFs, a big helping of astronomical data, and several alternative kitchen sink implementations.
- tobyhinloopen 9y ago
  that would work with "some snazzy file manager" or back-up tool, you just have to give the app partial/full file-system access with a big fat warning, or it has to use the OS's file manager to access the files. The OS then decides whether to query the user, or use previously configured settings (like the trivial file conversion example below) "Trivial file conversion" tool can be implemented the same. The app tells the OS "hey, I want some files to convert" and the OS either grants access to a set of files/folders, or queries the user which file(s) (s)he wants to provide. IE the "open file" modal is the only window to accessing files. You can think of it like the HTML5 File upload & Drag/drop APIs, but a bit extended & more user-friendly. Obviously smart engineers can think this through for longer than 3 minutes like I just did, and come up with better/user friendlier/safer solutions. But it breaks all backwards compatibility in almost any desktop OS
- piracykills 9y ago
  So what? At least only my snazzy file manager and media player get access to /sdcard - they still can't access other application's data to dump my browser credentials or modify those applications binaries to behave differently, the most harm they can do is delete my downloaded TV and pictures. Only my backup tool gets root and can access other application's data - random trash games I download or even if I were to install them from pirated sources are unable to do that. It's a vast improvement at the very least, even if not a perfect one.

aerique 9y ago

Like bad actors in the internet ad industry (not sure if any good ones are left) giving people a good reason to run adblockers, they just did the same for the game industry. Although I'm not sure what people are going to do. Run pirated copies with the malware removed? (Which reminds me: when I ran a jailbroken iPhone years ago I had a fix for a PDF exploit much sooner than people having to wait for Apple to fix it, making running a jailbroken phone more secure (at that time).)

tpxl 9y ago
I've done that before. Bought Bioshock 2 and got frustrated with its Games For Windows Live, so I pirated it and played that instead.

krapp 9y ago

You can't trust any software you haven't verified then compiled from source... and you can't even trust that entirely.

chrisper 9y ago
First you would have to audit the compiler itself... but then how do you compile it?
- tobyhinloopen 9y ago
  Easy! You compile it by hand.
  - mcbits 9y ago
    That's actually not too hard as long as all your software is written in Forth.

tokenizerrr 9y ago

You should have done that ages ago. Essentially any anti-cheat software is malware that spies on you.

tarruda 9y ago

I run all my games in a virtual machine (Linux KVM with GPU passthrough). In my case, the gaming VM is shared by all windows games, but with some extra effort it is possible to isolate each game in a separate VM. (What comes to mind is using qemu qcow2 format for the base windows image, plus a snapshot file for each game installation)

akerro 9y ago

>We probably should run our games in containers Yes, we do it already. We pack Windows games into WINE, WINE into Flatpak, distribute it on torrents: There you go, games in a container supported by piracy, with privacy out-of-box included: [DTH crawler website with magnets, might be blocked in your country] -> https://skytorrents.unblockall.org/search/all/ed/1/?l=en-us&q=flatpak https://skytorrents.unblockall.org/search/all/ed/1/?l=en-us&... Why people do have to do it? Some companies install spyware, other companies install a lot of 3rd party crap, DRMs that slow down games for paying users, don't support Linux platform despite promises... Pirates will always be one step ahead, you can make a game with good user/buyer experience like CD-Project or great customer support - Darkwood [1] and make it win-win for literally everyone, or lose at some point. https://www.gamingonlinux.com/articles/the-developers-of-darkwood-have-put-up-a-free-torrent-if-you-cant-afford-to-buy-it.10231/page=6 https://www.gamingonlinux.com/articles/the-developers-of-dar...

moviuro 9y ago
Okay, so I might actually try that flatpak thingy. ATM, I was focusing on e.g. fez from HumbleBundle through the AUR [0] and factorio [1] [0] https://aur.archlinux.org/packages/fez/ https://aur.archlinux.org/packages/fez/ [1] https://aur.archlinux.org/packages/factorio/ https://aur.archlinux.org/packages/factorio/

_nedR 9y ago

https://www.sandboxie.com/ https://www.sandboxie.com/ You can either run Steam sandboxed which in turn will sandbox all the games it runs, or you have to do a bit of finagling if you want to individually sandbox your games.

chrisper 9y ago
Does that work well for you? I have had certain issues with sandboxed applications.
- _nedR 9y ago
  It works well enough for most applications and games although I have had issues at times; for example with firefox installs. Using portable version of apps will make it easier in such situations. It is mostly trial and error fiddling with the level on f restrictions you want while not breaking apps. In my case, i have a template profile of permissions, most of which are for restricting access to personal/confidential files/folders like Documents, Browser profiles, etc. Instead of blocking access outright though , i usually make the files/folders write-only.. So, for example the other day i wanted to download a 60fps video from youtube, and the only practical option was to use an adware ridden java downloader.. So i just downloaded it created a new sandbox (based on the template sandbox) for the app, installed it (i recall i had some minor kinks in the install process but managed to get it to work in the end). After i was done with it , i deleted the sandbox and i was off on my way without having to worry if the application had left some unsavoury bits on my system.. edit: I might add that a key advantage of Sandboxie as opposed to other solutions like VMs is that afaik, Sandboxie mostly works by intercepting API calls to the underlying OS.. This maybe more leaky than a VM, but it is also much more lightweight, and as a consequence it has given me good performance for stuff like games, etc.
moviuro 9y ago
Here, sandbox your binaries in yet another untrusted binary :( What's to prove that sandboxie is not worse?.. [/tinfoil] Seriously though, has it been audited?

kevingadd 9y ago

itch.io's updater/launcher app has sandboxing support on windows, mac and linux. Another reason to support that service (it's great)