4 ms·

Run arbitrary code as opposed to what code on clients machines? Wouldn’t running any code on a clients machine be a potential security risk? I’m just curious wh

Run arbitrary code as opposed to what code on clients machines? Wouldn’t running any code on a clients machine be a potential security risk? I’m just curious why people always refer to it as “arbitrary code”

tryauuum 5y ago
As opposed to, say, running a code (already existing in client software) for rendering transparent surfaces (by sending client a level that features such surfaces) Also I think sometimes there are vulnerabilities where you can technically run some tiny bit of your code on a vulnerable machine, but it would lead to a crash. Hence, people use "arbitrary code execution" to distinguish this particular threat from the less severe ones.
MayeulC 5y ago
As opposed to code that's already there. It could be running part of the game code. Deleting saved games, for instance. Getting control of the client application is different from pushing arbitrary code (any code the attacker want) on the machine and executing it. An in-between is return-oriented programming, where an attacker gains complete control over the execution flow of a given program. Even if they aren't able to push different code on the machine, they can chain parts of existing code to perform arbitrary computations on the machine: https://en.wikipedia.org/wiki/Return-oriented_programming https://en.wikipedia.org/wiki/Return-oriented_programming
TchoBeer 5y ago
A server always runs some sort of code on a client's machine (such as sending it instructions about the game world for it to render into an image). This isn't a problem because it can only do this in an incredibly constrained way.
- FearlessNebula 5y ago
  Thanks for your response. I’m confused how a server runs code on a client’s machine. It sends instructions over HTTP (presumably?), but then the client uses those instructions to decide what to do. I feel like sending the client some JSON is not the same as sending it some PHP code to execute. Maybe I’m misunderstanding something?
Peritract 5y ago
'Arbitrary' code in this case is your 'any code on a clients machine'. A vulnerability that lets someone run arbitrary code means they can run whatever code they want; that's what makes it such a problem.
thomastjeffery 5y ago
Phrased differently: Quake 3 servers could publish server mods that would be executed by the clients. This is the same security risk that anything with plugin/extension/mod functionality experiences. Generally, the best way to secure that vulnerability is to verify downloads from a moderated source, i.e. run a mod forum/plugin repository that disenfranchises bad actors and verify checksums at download. A good example is Emacs and melpa.

tryauuum 5y ago

As opposed to, say, running a code (already existing in client software) for rendering transparent surfaces (by sending client a level that features such surfaces) Also I think sometimes there are vulnerabilities where you can technically run some tiny bit of your code on a vulnerable machine, but it would lead to a crash. Hence, people use "arbitrary code execution" to distinguish this particular threat from the less severe ones.

MayeulC 5y ago

As opposed to code that's already there. It could be running part of the game code. Deleting saved games, for instance. Getting control of the client application is different from pushing arbitrary code (any code the attacker want) on the machine and executing it. An in-between is return-oriented programming, where an attacker gains complete control over the execution flow of a given program. Even if they aren't able to push different code on the machine, they can chain parts of existing code to perform arbitrary computations on the machine: https://en.wikipedia.org/wiki/Return-oriented_programming https://en.wikipedia.org/wiki/Return-oriented_programming

TchoBeer 5y ago

A server always runs some sort of code on a client's machine (such as sending it instructions about the game world for it to render into an image). This isn't a problem because it can only do this in an incredibly constrained way.

FearlessNebula 5y ago
Thanks for your response. I’m confused how a server runs code on a client’s machine. It sends instructions over HTTP (presumably?), but then the client uses those instructions to decide what to do. I feel like sending the client some JSON is not the same as sending it some PHP code to execute. Maybe I’m misunderstanding something?

Peritract 5y ago

'Arbitrary' code in this case is your 'any code on a clients machine'. A vulnerability that lets someone run arbitrary code means they can run whatever code they want; that's what makes it such a problem.

thomastjeffery 5y ago

Phrased differently: Quake 3 servers could publish server mods that would be executed by the clients. This is the same security risk that anything with plugin/extension/mod functionality experiences. Generally, the best way to secure that vulnerability is to verify downloads from a moderated source, i.e. run a mod forum/plugin repository that disenfranchises bad actors and verify checksums at download. A good example is Emacs and melpa.