5 ms·

Of course, but it seems fairly unlikely that the average gamer is running public-facing internet services.

by ripdog 5y ago

jfim 5y ago
There are some games that run peer to peer connections, and for those to work, they require inbound connections to work. As far as the security of the average game codebase is concerned, I'd say it's pretty terrible as nobody really audits these codebases for buffer overflows/RCEs.
- paulmd 5y ago
  Source Engine (CS:GO, Team Fortress 2, etc) has a bunch of RCE that were disclosed to Valve years ago and which they did nothing about, and which have been released to public at this point. Join a server and they can RCE on your machine. Another one can be triggered just from a Steam invite. Too bad Valve makes money now and not games, they can't even get a fix out after it's been disclosed for years. https://twitter.com/the_secret_club/status/1381201949647904768 https://twitter.com/the_secret_club/status/13812019496479047... https://twitter.com/the_secret_club/status/1380960120725733376 https://twitter.com/the_secret_club/status/13809601207257333... https://twitter.com/the_secret_club/status/1380868759129296900 https://twitter.com/the_secret_club/status/13808687591292969... Titanfall (the original) is another one (also Source Engine underneath but rewritten by Respawn/EA), a salty hacker who was mad he was getting rekt has been taking down the multiplayer service off and on for years now. https://www.reddit.com/r/titanfall/comments/d10ori/tales_from_the_aged_frontier/ https://www.reddit.com/r/titanfall/comments/d10ori/tales_fro... Last I heard he was starting to hit Titanfall 2 xbox servers too (since nothing has been done after years attacking the first one, why wouldn't he escalate it further?) and Respawn just don't care, they're done with it, they make piles of money from Apex now and don't care about supporting their older stuff. https://mp1st.com/news/titanfall-2-servers-down-due-to-ddos-attack-respawn-working-on-it https://mp1st.com/news/titanfall-2-servers-down-due-to-ddos-... Given the clientele of this website, hoping a little name-and-shame might bring some attention to the issues...
  - jfim 5y ago
    As frustrating as it is, not a whole lot of people in the video game industry really care about that, and for those that do, they can't really do that much about it. Once a game is sold, there's not much of an incentive to keep it alive other than making sure it's moderately playable so that they manage to sell expansion packs or downloadable content. A hypothetical "someone might overflow a buffer and run arbitrary code" bug is going to be pretty low on the list compared to "all the graphics are broken on the latest nvidia driver because our code base is held together by duct tape and wishful thinking." Even for the developers that do care about writing decent code (and a lot of them do care about making great games), after 60 hours or more a week of fixing random bugs on Barbie's Plastic Adventures, Call of Battlefield, or Mobile Lootbox Idle Clicker, there's not that much motivation left at the end of the day to work on these kinds of issues.
    - paulmd 5y ago
      It’s pretty frustrating with games like TF2 that still generate significant amounts of revenue but can’t even get major security problems patched let alone basic bugs fixed. And I’m not talking about selling new copies, I’m talking about hundreds of millions of dollars a year in lootbox revenue.
      - jfim 5y ago
        Games like DotA 2 that still get attention from Valve have all kinds of broken things. Bots were endemic in certain MMR brackets for a while (might still be, no idea), and they were pretty straightforward to detect. Multiple kinds of griefing were pretty much ignored, reporting players didn't do anything for a while, and so on. Even Rockstar had the issue about load times for GTA online, which had they even bothered to look into it, would've netted them dozens of millions of dollars. Until there's something absolutely catastrophic like a worm that spreads through a popular online game and formats hard drives/mines bitcoin/transfers all the hats to third parties, the industry will keep on doing the same thing as usual with no care. I wish it was different, but it's not, unfortunately. I definitely understand your frustration though.

Of course, but it seems fairly unlikely that the average gamer is running public-facing internet services.

by ripdog 5y ago

Of course, but it seems fairly unlikely that the average gamer is running public-facing internet services.

jfim 5y ago

There are some games that run peer to peer connections, and for those to work, they require inbound connections to work. As far as the security of the average game codebase is concerned, I'd say it's pretty terrible as nobody really audits these codebases for buffer overflows/RCEs.

paulmd 5y ago
Source Engine (CS:GO, Team Fortress 2, etc) has a bunch of RCE that were disclosed to Valve years ago and which they did nothing about, and which have been released to public at this point. Join a server and they can RCE on your machine. Another one can be triggered just from a Steam invite. Too bad Valve makes money now and not games, they can't even get a fix out after it's been disclosed for years. https://twitter.com/the_secret_club/status/1381201949647904768 https://twitter.com/the_secret_club/status/13812019496479047... https://twitter.com/the_secret_club/status/1380960120725733376 https://twitter.com/the_secret_club/status/13809601207257333... https://twitter.com/the_secret_club/status/1380868759129296900 https://twitter.com/the_secret_club/status/13808687591292969... Titanfall (the original) is another one (also Source Engine underneath but rewritten by Respawn/EA), a salty hacker who was mad he was getting rekt has been taking down the multiplayer service off and on for years now. https://www.reddit.com/r/titanfall/comments/d10ori/tales_from_the_aged_frontier/ https://www.reddit.com/r/titanfall/comments/d10ori/tales_fro... Last I heard he was starting to hit Titanfall 2 xbox servers too (since nothing has been done after years attacking the first one, why wouldn't he escalate it further?) and Respawn just don't care, they're done with it, they make piles of money from Apex now and don't care about supporting their older stuff. https://mp1st.com/news/titanfall-2-servers-down-due-to-ddos-attack-respawn-working-on-it https://mp1st.com/news/titanfall-2-servers-down-due-to-ddos-... Given the clientele of this website, hoping a little name-and-shame might bring some attention to the issues...
- jfim 5y ago
  As frustrating as it is, not a whole lot of people in the video game industry really care about that, and for those that do, they can't really do that much about it. Once a game is sold, there's not much of an incentive to keep it alive other than making sure it's moderately playable so that they manage to sell expansion packs or downloadable content. A hypothetical "someone might overflow a buffer and run arbitrary code" bug is going to be pretty low on the list compared to "all the graphics are broken on the latest nvidia driver because our code base is held together by duct tape and wishful thinking." Even for the developers that do care about writing decent code (and a lot of them do care about making great games), after 60 hours or more a week of fixing random bugs on Barbie's Plastic Adventures, Call of Battlefield, or Mobile Lootbox Idle Clicker, there's not that much motivation left at the end of the day to work on these kinds of issues.
  - paulmd 5y ago
    It’s pretty frustrating with games like TF2 that still generate significant amounts of revenue but can’t even get major security problems patched let alone basic bugs fixed. And I’m not talking about selling new copies, I’m talking about hundreds of millions of dollars a year in lootbox revenue.
    - jfim 5y ago
      Games like DotA 2 that still get attention from Valve have all kinds of broken things. Bots were endemic in certain MMR brackets for a while (might still be, no idea), and they were pretty straightforward to detect. Multiple kinds of griefing were pretty much ignored, reporting players didn't do anything for a while, and so on. Even Rockstar had the issue about load times for GTA online, which had they even bothered to look into it, would've netted them dozens of millions of dollars. Until there's something absolutely catastrophic like a worm that spreads through a popular online game and formats hard drives/mines bitcoin/transfers all the hats to third parties, the industry will keep on doing the same thing as usual with no care. I wish it was different, but it's not, unfortunately. I definitely understand your frustration though.