4 ms·
So those games put infrastructure in place for the server to execute arbitrary code on my machine? No, thanks.
by mike_hock 7y ago
So those games put infrastructure in place for the server to execute arbitrary code on my machine?
No, thanks.
- cortesoft 7y agoYou bought a game from them... you are already letting them run arbitrary code on your machine.
- mike_hock 7y agoThe original game code, as well as automatically installed updates can be vetted and compared to other installations. Any malware injected into either of them risks being exposed over time. This allows the server to execute arbitrary, ephemeral code fragments on any client at any time, with no trace. If the server is ever compromised, so are all clients, instantly. This is absolutely insane from a security POV. Just because I gave you a program once that you're using doesn't mean that you want to give me an SSH login to your machine.
- cortesoft 7y agoWhat is to stop them from sending an update only to you? Followed by an update that deletes that code? Or an update that allows them to run arbitrary code sent from a server? I think you overestimate the ability for this to be detected. These aren't open source.
- smileybarry 7y agoSome games -- recently Overwatch -- send hotfixes as live hotpatches. Those couldn't be scrutinized by anyone except the developer until they're included in the next formal patch.
- jcranmer 7y agoYou say that like people aren't capable of converting the current memory space back into an executable.
- cortesoft 7y agoWhich also applies to the code the anti-cheat stuff is having you run. The point is they have a mechanism to download and run code without you explicitly validating the code. That is happening with or without this anti-cheat stuff, so what is the difference?
- smileybarry 7y agoOf course you can dump the current executable from memory (with varying effort depending on anti-tamper tech), but the point is that you can't examine them ahead of time. They're pulled & applied right before a match starts and the relevant code is used immediately.
- animal531 7y agoWell sure, but the whole game itself is already executing whatever arbitrary code it wants.
- mike_hock 7y agoThe game is on disk, doesn't execute until I choose to, and only executes the code that is there, on disk, for me to see. Unless it has a front door like this built in, of course.
- throwaway675309 7y agoI get what you're driving at, but unfortunately with auto-updating game platform delivery systems like Steam, this is sort of the way the world works. I'm sure there are dozens of MMOs with the same arbitrary code execution. Hell, if you're using any browser extensions in firefox/chrome, you're effectively open to the same vulnerabilities. (which did in fact happen, somebody's Chrome dev account was hacked and malicious code was injected into the extension which affected all end users).
- tsukurimashou 7y agoThe vast majority of gamers are running Windows, if you're running Windows you don't even own your OS. I think a game running some code on your machine is pretty low on the list of things you should worry about.
- astrobe_ 7y agoExcept that an MMO with millions of players could become a good weapon in the case of a cyber-warfare. This has been done before with AVs.