4 ms·
Worth noting that it requires clicking the invite. Still bad, but something you can easily avoid if you know to be suspicious.
by brundolf 6y ago
Worth noting that it requires clicking the invite. Still bad, but something you can easily avoid if you know to be suspicious.
- ziml77 6y agoSuspicious of an invite? Back around my college years it was very common to get an unexpected invite to a game. Usually friends decided they wanted to play a game and then want to grab whatever other friends are available to fill out their team. In that case you just spam invites and take the first people who accept it.
- brundolf 6y agoPersonally I usually text or am texted by the relevant friends, we jump in discord, and then we hop into a game, pretty much in that order
- JakeTheAndroid 6y agoIf its not someone you just played with and isn't on your friends list, I feel like most people don't really interact with the message. CSGO has had so many skin scammers through chats that it's basically expected that you're being hit up by someone trying to get into your account for skins or trade scam you. This is much worse than those situations, but luckily (and unluckily) I think the CSGO culture is fairly prepared to avoid random invites to parties.
- dubbel 6y agoIf the attacker gets code execution on just one victim, it should be possible to send invites to all of their friends. So you can't rely on just interacting with people you know well.
- petee 6y agoIt's not going to be suspicious if someones account is compromised, or gets a virus that sends an invite to all their friends. Official interfaces like 'invite' should never be need to be viewed with suspicion
- jsheard 6y agoThe invite exploit is far from the only one, supposedly - RCE through malicious game invite (reported 2 years ago) https://twitter.com/the_secret_club/status/1380868759129296900 https://twitter.com/the_secret_club/status/13808687591292969... - RCE through loading a malicious map/level (reported 5 months ago) https://twitter.com/the_secret_club/status/1380966170522750979 https://twitter.com/the_secret_club/status/13809661705227509... - RCE through connecting to a malicious game server (reported "months" ago) https://twitter.com/the_secret_club/status/1380960120725733376 https://twitter.com/the_secret_club/status/13809601207257333... - RCE through connecting to a malicious game server, again (reported 2 years ago) https://twitter.com/the_secret_club/status/1381201949647904768 https://twitter.com/the_secret_club/status/13812019496479047... - RCE through connecting to a malicious game server, again, again (reported a year ago) https://twitter.com/bienpnn/status/1381616325391384577 https://twitter.com/bienpnn/status/1381616325391384577 The creator of SteamDB also says he was paid for an exploit that was never fixed... https://twitter.com/thexpaw/status/1381621297982103553 https://twitter.com/thexpaw/status/1381621297982103553 ...and one of the above RCE finders says Valve has fixed bugs in one game while not fixing it in others https://twitter.com/bienpnn/status/1381627400467804161 https://twitter.com/bienpnn/status/1381627400467804161
- deleted 6y ago[deleted]
- qyi 6y ago>something that you can easily avoid Yes, you can easily avoid every exploit if you create a list of 1000 buttons to not click on in certain cases because they are "suspicious".
- rodgerd 6y ago"Just don't click on the link" is probably the greatest example of wishful thinking in all of computer security.