13 ms·
‘Counter Strike’ Bug Allows Hackers to Take over a PC with a Steam Invite
- Forbo 6y ago> A security researcher alerted Valve about the bug in June of 2019. Holy shit, Valve. Really? Nearly two years later and this is still exploitable. Edit, further on: > This is not the first time Valve has been slow to respond and fix reported vulnerabilities. In 2018, Motherboard reported that a security researcher found a bug in Steam that allowed hackers to take over victims' computers—a bug that had been present for 10 years. In 2019, Valve banned a security researcher from its bug bounty program, prompting him to publish the exploit publicly. I'm pretty appalled by this.
- Chlorus 6y agothe dedicated server situation was (is?) pretty dire back when i hosted a few SRCDS instances. here's a small taste: https://wiki.alliedmods.net/SRCDS_Hardening#Current_Exploits https://wiki.alliedmods.net/SRCDS_Hardening#Current_Exploits not to mention that the commands themselves obey absolutely zero *NIX conventions at all. Left a bad taste in my mouth ever since
- enjoiful 6y agoIf you want to see something really appalling, looking into the "coaching bug" that was recently exposed. It was known for years by Valve and it wasn't patched. It wasn't until the exploit was made public that dozens of professional CS coaches were banned.
- weird-eye-issue 6y agoThat wasn't a security or privacy issue and nobody forced those coaches who abused it
- spicybright 6y agoI don't know any context on the situation, but if there was a mechanic that's known and been around for years, bug or not, wouldn't anyone using it have an edge over anyone not using it? Therefore people need to use it to stay competitive?
- weird-eye-issue 6y agoNo because in sports you have rules that you must follow or there are consequences. This bug is considered an exploit and therefore it is against the rules to use.
- asdff 6y agoYes but this is Esports. Bugs are famously used competitively. The entire super smash brothers melee tournament circuit uses bugs to wave run; if you don't use the bug you won't be competitive. People practice using this bug and others like skipping animations. Most competitive FPS games had something similar, like being able to reload cancel or bunny hop. Things that are legitimately bugs, that you won't learn until you hear about them.
- weird-eye-issue 6y agoLike I said - "This bug is considered an exploit and therefore it is against the rules to use." Exploits aren't allowed. If a bug isn't considered an exploit and isn't explicitly against the rules they are fine to use them.
- asdff 6y agoI wonder who sets these rules? Like when wave dashing came to the competitive super smash bros scene, who decided that this would be allowed or banned? It seems to me it would depend how widespread it is. Maybe the tournament runners already knew how to wave dash so it was in their interest to keep this technique they already mastered legal, versus if they didn't know how to do it yet they might have banned it, like how they've been so careful to empirically place each character into different tiers for the sake of balance. I can see how leaning into exploits for competitive can ruin the noncompetitive community, and later take out the competitive one that feeds off this community. I used to play chivalry: medieval warefare, which was a lot more fun of a game before the competitive community figured out the frame perfect meta and ruined the game for everyone else who doesn't have hours and hours of free time to throw at practicing the metagame alone, which is most gamers I imagine.
- takoid 6y ago> It was known for years by Valve and it wasn't patched. This is not true. Once the exploit became known, Valve released an update same day.
- mhh__ 6y agoIt seems genuinely unbelievable it was being used for as long as it was without someone finding out
- charcircuit 6y agoIf it was known it could have just been low priority since it's a weird bug that doesn't even apply to the built in competitive mode.
- noxvilleza 6y agoAccording to pro players, this isn't true - Pita claimed he contacted Valve's twitter a long period of time before the whole ESIC investigation blew up.
- uncoder0 6y agoNow think about this... Steam is running on nearly every gamer's PC. That's what I'm more worried about than exploits in individual games.
- cyberlurker 6y agoNo excuses for Valve or the seriousness of this, but I believe the user needs to “accept” the invite. I did not see that mentioned in the article. Edit: My mistake, I thought there were accept/deny buttons for invites. In the example video they only have a link: https://youtu.be/rNQn--9xR1Q https://youtu.be/rNQn--9xR1Q
- Godel_unicode 6y agoThe very first sentence in the article is """Hackers could take control of victims' computers just by tricking them into clicking on a Steam invite"""
- brundolf 6y agoWorth noting that it requires clicking the invite. Still bad, but something you can easily avoid if you know to be suspicious.
- ziml77 6y agoSuspicious of an invite? Back around my college years it was very common to get an unexpected invite to a game. Usually friends decided they wanted to play a game and then want to grab whatever other friends are available to fill out their team. In that case you just spam invites and take the first people who accept it.
- brundolf 6y agoPersonally I usually text or am texted by the relevant friends, we jump in discord, and then we hop into a game, pretty much in that order
- JakeTheAndroid 6y agoIf its not someone you just played with and isn't on your friends list, I feel like most people don't really interact with the message. CSGO has had so many skin scammers through chats that it's basically expected that you're being hit up by someone trying to get into your account for skins or trade scam you. This is much worse than those situations, but luckily (and unluckily) I think the CSGO culture is fairly prepared to avoid random invites to parties.
- dubbel 6y agoIf the attacker gets code execution on just one victim, it should be possible to send invites to all of their friends. So you can't rely on just interacting with people you know well.
- petee 6y agoIt's not going to be suspicious if someones account is compromised, or gets a virus that sends an invite to all their friends. Official interfaces like 'invite' should never be need to be viewed with suspicion
- gr33nq 6y agoI have several thousands of hours logged in CS:GO since it was released in 2012, and Valve's lack of concern with this particular exploit seems to mimic their inattentiveness to so many other aspects of the game. With the massive following that the Counter Strike franchise has and the boatloads of cash they continually bring in from digital cases/keys/skins, they most certainly have the resources to put out these types of fires immediately. Instead, they have taken a bare minimum approach to community outreach and maintaining a game that touts a 26 million player count each month [0]. The cheating situation is the most prominent example of how little focus the game earns from its developers. Compared to how other popular FPS titles (Valorant) handles anti-cheat, CS:GO is years behind. It's not uncommon to face at least one or two players a day who are using some form of cheat (some more obvious than others). Reporting the player does nothing, and when you visit their player profile on Steam and see accusatory comments about cheating going back months or years, you can be confident that your report will have little-to-no impact -- chalk it up as a loss and hope for more honest opponents next time. I've even seen exploits in the wild that can be used to prevent anyone else in the server from reporting a cheater in the game's UI; spinbots that can kill an entire team with perfect aim accuracy within a couple seconds; bunny hop scripts that allow for movements rates that far exceed what is normal when running -- basically things that some basic AI/ML should be able to detect with relative ease. Fortunately, other third-party services have built large player bases by offering their own in-house anti-cheat software and matchmaking service which is far more effective, but I digress. It's unfortunate to see something with such great potential get so little TLC from a company that is more than capable. [0] https://blog.counter-strike.net/ https://blog.counter-strike.net/
- mberning 6y agoYou are absolutely right. This lackadaisical attitude towards their games was present in CS:S as well. Security, gameplay, performance. All of it takes a back seat to milking the cow.
- ep103 6y agoI looked into what was going on with CS:Go after trying to get back into it a few years ago, and noticing just how horrifically bad the amount of cheating was. The most damning thing for me wasn't just the subreddits dedicated to just indexing valve's lack of attention, or the way they appear to genuinely make money off of the cheating ecosystem. The worst was when I learned that VAC (their anti-cheating platform, IIRC) was so bad (at the time) that it appeared to only ban exact binary matches for detected cheats. So if you wrote a cheat, that eventually, ages later did end up getting banned by VAC, all you would have to do would be to go back to your source, rename a few functions and files, recompile to a new binary, and you'd be good to go again. As a sidenote, I just attempted to find the article that documented what I said above, and I found github repositories like this instead: https://github.com/danielkrupinski/VAC-Bypass https://github.com/danielkrupinski/VAC-Bypass The fact that things like this are front page google responses to phrases like "VAC Ban" (what I typed in google), really demonstrates just how abysmal Valve's performance is here.
- wqsz7xn 6y agoThe fact that this is wormable is huge.
- jsheard 6y agoFunnily enough the same group found a wormable exploit in Valve's Alien Swarm, a mostly forgotten game with a tiny playerbase, and Valve fixed it in 3 months. https://secret.club/2020/10/30/alien-swarm-rce.html https://secret.club/2020/10/30/alien-swarm-rce.html Meanwhile CS:GO, their flagship game with over a million daily peak players, has numerous wormable RCEs reported and ignored for as long as 2 years. Valve works in mysterious ways.
- hn8788 6y agoI think the difference with this exploit is that according to the people who found the exploit, it affects all Valve games that use the Source engine, not just CS:GO like the article says. Trying to fix it could end up breaking multiple games if it's done incorrectly.
- charcircuit 6y agoDoes requiring action from the next victim still classify it as wormable? Almost any malware good send messages to friends trying to social engineer them into running malware.
- jsheard 6y agoIt doesn't meet the strict definition of wormable, but the user action required for it to spread is so benign that it's pretty close A CS:GO player getting an invite to play CS:GO from someone on their friends list isn't likely to raise any red flags
- beatrobot 6y agoGoogle's Project Zero should look into this. It is not the first time that Valve slept on known and reported vulnerabilities.
- oeiiooeieo 6y agoValve's development practices are apparently good for a chuckle. https://www.youtube.com/watch?v=k238XpMMn38 https://www.youtube.com/watch?v=k238XpMMn38 The devs don't seem like they have enough time to deal with the code they have to write, let alone respond to security issues. (not their fault, of course)
- kjjjjjjjjjjjjjj 6y agoValve seems to have like 6 developers that work there and since nobody seems to fucking manage the company (literally, this is how they operate) I am not surprised at all. How they managed to put together half life alyx at all is astonishing.
- ls612 6y agoNot only put it together, but make it really good too! Idk how they work but it doesn’t make sense to me.
- bogwog 6y agoThat mountain of money they're sitting on probably helps.
- kjjjjjjjjjjjjjj 6y agoForcing users to install steam for half life 2 was the best decision they have ever made
- ls612 6y agoA mountain of money does not necessarily (or even likely) make a good game. Yet Alyx was one of the best titles of 2020 and probably the best VR game ever made. Color me impressed by Valve’s game development team, regardless of the incompetence of their security practices
- throwaway3699 6y agoTheir development philosophy makes sense on the face of it. People, properly empowered, left to work on what they think is best, might produce really great results. Unfortunately most of the time they don't produce any results at all. Last time I heard there was less than a dozen developers "in charge" of Steam. Everything else was an ancillary project that sprung up and shut down around it.
- matheusmoreira 6y agoGames also require root access to the machine for the sake of DRM and ineffective anti-cheating software so it's impossible to contain the damage they do.
- charcircuit 6y agoCSGO does not require root access for anticheat nor DRM.
- Red_Leaves_Flyy 6y agoA lot of games do though... https://levvvel.com/games-with-kernel-level-anti-cheat-software/ https://levvvel.com/games-with-kernel-level-anti-cheat-softw...
- MayeulC 6y agoI've said it before, I'm saying it again: this is the reason I sandbox steam (I run it in a flatpak). Remote code execution vulnerabilities galore in games that haven't been patched in decades. UT99 servers can send dlls, so some even do it on purpose back then. It doesn't require much: imagine a RSS feed on a game menu. The parser has a RCE. The domain name expires. It doesn't take much. For now, some anti cheat systems do not work on Linux. If that's the price to pay for avoiding these invasive tools, then so be it. I don't want a 0day in some random anti cheat system to ruin my day/year/life.
- antpls 6y agoFlatpak is backed by Linux containers, which are not designed to be secure against hacks. Flatpak (like Snap) is a convenience to distribute and install apps, not a security protection.
- swalladge 6y agoThey actually do have sandboxing which would help. I'm not sure of the full extent though. See: - https://snapcraft.io/docs/security-sandboxing https://snapcraft.io/docs/security-sandboxing - https://docs.flatpak.org/en/latest/sandbox-permissions.html https://docs.flatpak.org/en/latest/sandbox-permissions.html However, in my (limited) experience, apps that actually do a lot of things have most of the sandbox features disabled anyway (network, disk access, etc.). Note that AppImage is similar, but contains no sandboxing. I've taken to running steam and other untrusted software under a separate user account. It's probably not ideal, and it's annoying to switch accounts to use certain software. But at least it may help limit the damage if the software is hacked as everything is contained within the throwaway account. I'm sure one can do a lot better with selinux/apparmor/firejail, but it would probably take a lot of work to get it set up properly.
- SubzeroCarnage 6y agoWhile most Flatpaks by default aren't all tuned up, you can easily set overrides for them, see `man flatpak-override`. There also exist `Flatseal` which is a GUI for doing so. AppImage can be used with Firejail. Firejail use is trivial to setup, we try to keep out of box breakage minimal but still strict, just `sudo apt install firejail && sudo firecfg` + a logout and back in. Disclosure: I am one of the core Firejail contributors.
- marcinzm 6y agoHasn't Valve been in the news a number of times now for ignoring bugs and strong arming people on HackerOne into not disclosing them? At this point you should probably assume all of Valve's products are riddled with security bugs that are being sold to the highest bidder and act accordingly.
- Artur96 6y agoJust publish the exploit. That'll get Valve off their bottoms once public lobbies start to install ransomware with cryptominers.
- Red_Leaves_Flyy 6y agoI think the more likely scenario would be this: Player with a multi million dollar skin inventory gets everything stolen and sues valve on the grounds that they were negligent custodians of their service.
- wnevets 6y agoPeople love to complain on HN about how companies like Google only incentivize developers to create new revenue streams rather than maintaining them however some former employees claim Valve takes that concept and turns it up to 11.
- question000 6y agoI remember there was a DEFCON talk about anti-cheating measure for counter strike and speaker just noted casually that Valve just scans all processes running on your machine during a match and determines what's a cheating process and what is not via a blacklist. Which begs the question what can't Valve do vis Steam?
- ArchOversight 6y agoAny software running on your machine can do this unless it is sandboxed. In fact many games go even further and install kernel level rootkits to make sure you are not running unapproved software. See https://www.osnews.com/story/131665/riot-games-maker-of-league-of-legends-installs-rootkit-with-their-new-hit-game-valorant/ https://www.osnews.com/story/131665/riot-games-maker-of-leag...
- hulahoof 6y agoReminds me of Warden used (at least in the heyday) by Blizzard to prevent cheating in WoW. In the automation community they ended up having to use rootkits to hide the process, as previous methods of spoofing the return signal were denied in Blizzard vs. Glider over EULA infringement.
- sitzkrieg 6y agoive been following this for a while and am glad its getting a lot of coverage since apparently valve cant be bothered to take a break from their money printer to fix a remote code execution!
- TazeTSchnitzel 6y agoPrevious discussion: https://news.ycombinator.com/item?id=26762170 https://news.ycombinator.com/item?id=26762170
- joshmn 6y agoI received similar radio silence when I recently reported a bug to a major sports league. I had access to all their ticket inventory, including bar codes, PII, and the ability to transfer the tickets to my own account. As secret club shows alludes to on Twitter, it's a little jarring when you don't even receive a response from an entity that you're reporting to in good faith. It's more than disappointing. I feel for their frustration. I hope someone at Valve picks this up internally.
- ArkanExplorer 6y agoValve is resting on their laurels and their 30% commission and lack of any minimum standards for game submission is making gaming worse.
- bogwog 6y agoValve won. They won a long time ago. They're like in a similar situation to Google where nothing else they do is ever going to make more money than their primary source of income (Steam). Except instead of releasing a bunch of half-assed products which are eventually abandoned like Google does, Valve just does nothing. Also, unlike Google, Valve is a private company. So they don't have any pressure from anyone to do anything. They just gotta have enough people in the office to keep Steam's servers running.
- lostmsu 6y agoThey are being unwon right now by Epic and Xbox Game Pass for PC.
- Blaine0002 6y agoLol... just a few years ago (5ish?) steam had an exploit where you could click lost password, enter the targets username, and immediately set a new password for that account with no confirmation whatsoever.
- qyi 6y agoI remember that. In the early 2000s you could download any game from Steam's servers, even ones you don't own. Counter Strike Source originally had a format string vulnerability in player name. Setting your name to %s will crash the game. Where do we get a full list? The idea of running games on the same machine you bank on (via insecure websites with 90s security) is ludicrous.
- Blaine0002 6y agohaha. ive seen name formatting issues in tons of games as well. paired with the fact that this was before 2 factor was available and people had million dollar skin inventories probably made their support team (or lack there of's) week terrible. im pretty sure you can still download any game from steams servers but now they come encrypted unless you actually own them (i could be completely wrong on this)
- gfxgirl 6y agoThis is a much bigger problem than just Counter Strike. I'm pretty confident there are 1000+ games on the steam store that have vulnerabilities where a simple link or network packet while gaming can exploit a user's machine. Both MS and Steam really need to work on locking down Windows.
- lostmsu 6y agoMS already did that. UWP apps are sandboxed. They even recently made an OpenGL implementation over DirectX 12 (vendor implementations are incompatible with UWP sandbox). A few games in Microsoft Store are actually properly sandboxed as the result. For example, We Happy Few.
- xtnmclain 6y agoCounter-Strike is the most played game in Steam as of the moment. There are a lot of players who played countless hours throughout their life. Even though there is much feedback from their players, they should filter those that are very important, like hacks and exploits. It's just appalling to think that the most played game in the source engine is the one that hasn't fixed this issue yet.