10 ms·

Grand Theft Auto V exploit assigned CVE number due to partial RCE

62 points by blackhole 4y ago

wnevets 4y ago
I'm surprised more exploits aren't being found in games, they're usually thrown together as quickly as possible.
- tialaramex 4y ago
  Ordinarily there's no reason why you would "attack" the game, so things only get found if a significant community arises for the game which would benefit, e.g. speed running Mario 64 is a thing, so figuring out weird details of the engine is crucial to the best possible times in categories which allow you to break the game to win. For a Remote Code Execution bug like this it only makes sense if it's a popular multiplayer game, so that there are enough targets to be worth attacking, for long enough after release that you can identify a bug and figure out how to abuse it. GTA V is like a decade old at this point, there a very few games with that sort of longevity, we're talking Minecraft, WoW, big hits rather than the average video game.
  - wnevets 4y ago
    Video games being connected to the internet 24/7 are quickly becoming the norm. I am convinced there is a treasure trove of exploits created by the gaming industry just waiting to be found.
    - smileybarry 4y ago
      IIRC it's unsafe to play multiplayer in past releases of Call of Duty, even if fully-patched, because the games have a plethora of unpatched exploits (used on Xbox 360 to create modded lobbies), and I'm guessing the game's P2P nature makes it easier to find a client in your lobby to exploit. The general recommendation is to install a community patch but I'd rather not run it at all, to be honest. I'd say "play in a VM" but I'm sure anti-cheat wouldn't like that.
  - jeoqn 4y ago
    Little reason to attack the game? How about knocking your enemies offline? Or getting their game or real money? Or recruit them for your DoS botnet? Because that’s what an RCE allows you to do…
    - tialaramex 4y ago
      Suppose it takes you six months to figure out an RCE for PowerWash Simulator. Yay, if you can find another player you can really pwn them now. Wait, how will you find a player to victimise? Nobody was looking for multiplayer PowerWash Simulator a month after it came out, let alone six months. GTA V has been around for ten years but still has a huge player base and that's what makes this practical.
- jamesfinlayson 4y ago
  I assume most of the reverse engineering being done on games is with an eye to developing cheats rather than attacking players.
- thatguy0900 4y ago
  If you are exploiting the games it's easy to make money by selling cheats in the game, probably keeps people from looking for crypto ransom payoffs as much
rektide 4y ago
FWIW, > CVE-2023-24059 What other video games have had CVE's?
- tschwimmer 4y ago
  Fairly recently Dark Souls 3 had a pretty bad one: https://nvd.nist.gov/vuln/detail/CVE-2021-34170 https://nvd.nist.gov/vuln/detail/CVE-2021-34170 They took the online servers offline in January and to their credit they patched a 6 year old game and brought the servers back in September.
- rubychill 4y ago
  Factorio had a CVE that allowed RCE in multiplayer servers: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11615 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1161...
- beardog 4y ago
  Not game specific, but I'll put this here: https://portswigger.net/daily-swig/valve-belatedly-fixes-steam-gaming-platform-rce-vulnerability https://portswigger.net/daily-swig/valve-belatedly-fixes-ste...
- BxGyw2 4y ago
  Source Engine CVE-2021-30481 There's actually been a lot more of these that don't get CVEs It's one of the reasons I prefer to game in a VM with heavy network filtering and egress only through VPN There is little to no care from game developers about security, games with actively exploitable RCEs (see pretty much the whole CoD franchise) are just allowed to stay up on Steam Gamers are also kinda dumb and oblivious to RATs etc which doesn't help
  - poly_morphis 4y ago
    How do you game in a VM? A lot of my game time includes flight simulators with many external peripherals.
    - 4y ago
Scaevolus 4y ago
GTA V has averaged >100k concurrent players on steam for the last 3 years, so a RCE has a lot of potential targets ripe for exploitation.
- ehnto 4y ago
  It only needs to make it into a mod-menu to get wide, unsuspecting distribution. For those curious, mod menus are what "hackers" use to exploit the gameplay for fun. Script-kiddies are a good analog in history. They're often just kids who googled GTA hacks and installed from the first page they thought looked cool. They'll be prime targets for distribution.
  - dns_snek 4y ago
    Interestingly enough, it seems like some of these "mod menus" have already patched the exploit. Having one of these is almost a requirement for playing GTA Online these days, purely for the defensive features they offer against other cheaters. It's still a mess and requires trust (or a VM).
  - joshspankit 4y ago
    Just like script-kiddies back in the day, the easiest vector of attack is to distribute infected “hacking” tools
mjg59 4y ago
I feel like I'm missing something here, but: the references are two support forum threads and a reddit thread, both of which link back to the referenced twitter thread? Is there any actual confirmation that this RCE exists? What does "partial RCE" even mean?
- deleted 4y ago
  [deleted]
- lfodofod 4y ago
  It really appears that this CVE was issued based on that super vague twitter thread.
deleted 4y ago
[deleted]
aborsy 4y ago
These games have tens of millions of lines of code (often building on top of the older components). They are also written in memory unsafe C++, by developers focused on features and rapid sales, to users that look forward to new features not better security. I won’t be surprised at all if they are filled with vulnerabilities.
- mirages 4y ago
  https://www.gamedeveloper.com/programming/dirty-game-development-tricks https://www.gamedeveloper.com/programming/dirty-game-develop... Look at "(s)elf-exploitation"
- minneelyyyy 4y ago
  Uhhh, GTA V has been known for bad security for a long time. Streamers can't even play the game without a VPN or they get their IP leaked. Single-player games can (could, maybe still can? I am unsure of the current state of the game) get hacked and be messed with by hackers. This goes far beyond just "they used C++." This shows a great lack of caring for security in general from Rockstar, not just another thing that you can use to prove to yourself that "C++ is dangerous!"
culi 4y ago
RCE: remote code execution CVE #: Common Vulnerabilities and Exposures number, assigned by the MITRE Corporation

62 points by blackhole 4y ago

wnevets 4y ago

I'm surprised more exploits aren't being found in games, they're usually thrown together as quickly as possible.

tialaramex 4y ago
Ordinarily there's no reason why you would "attack" the game, so things only get found if a significant community arises for the game which would benefit, e.g. speed running Mario 64 is a thing, so figuring out weird details of the engine is crucial to the best possible times in categories which allow you to break the game to win. For a Remote Code Execution bug like this it only makes sense if it's a popular multiplayer game, so that there are enough targets to be worth attacking, for long enough after release that you can identify a bug and figure out how to abuse it. GTA V is like a decade old at this point, there a very few games with that sort of longevity, we're talking Minecraft, WoW, big hits rather than the average video game.
- wnevets 4y ago
  Video games being connected to the internet 24/7 are quickly becoming the norm. I am convinced there is a treasure trove of exploits created by the gaming industry just waiting to be found.
  - smileybarry 4y ago
    IIRC it's unsafe to play multiplayer in past releases of Call of Duty, even if fully-patched, because the games have a plethora of unpatched exploits (used on Xbox 360 to create modded lobbies), and I'm guessing the game's P2P nature makes it easier to find a client in your lobby to exploit. The general recommendation is to install a community patch but I'd rather not run it at all, to be honest. I'd say "play in a VM" but I'm sure anti-cheat wouldn't like that.
- jeoqn 4y ago
  Little reason to attack the game? How about knocking your enemies offline? Or getting their game or real money? Or recruit them for your DoS botnet? Because that’s what an RCE allows you to do…
  - tialaramex 4y ago
    Suppose it takes you six months to figure out an RCE for PowerWash Simulator. Yay, if you can find another player you can really pwn them now. Wait, how will you find a player to victimise? Nobody was looking for multiplayer PowerWash Simulator a month after it came out, let alone six months. GTA V has been around for ten years but still has a huge player base and that's what makes this practical.
jamesfinlayson 4y ago
I assume most of the reverse engineering being done on games is with an eye to developing cheats rather than attacking players.
thatguy0900 4y ago
If you are exploiting the games it's easy to make money by selling cheats in the game, probably keeps people from looking for crypto ransom payoffs as much

rektide 4y ago

FWIW, > CVE-2023-24059 What other video games have had CVE's?

tschwimmer 4y ago
Fairly recently Dark Souls 3 had a pretty bad one: https://nvd.nist.gov/vuln/detail/CVE-2021-34170 https://nvd.nist.gov/vuln/detail/CVE-2021-34170 They took the online servers offline in January and to their credit they patched a 6 year old game and brought the servers back in September.
rubychill 4y ago
Factorio had a CVE that allowed RCE in multiplayer servers: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11615 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1161...
beardog 4y ago
Not game specific, but I'll put this here: https://portswigger.net/daily-swig/valve-belatedly-fixes-steam-gaming-platform-rce-vulnerability https://portswigger.net/daily-swig/valve-belatedly-fixes-ste...
BxGyw2 4y ago
Source Engine CVE-2021-30481 There's actually been a lot more of these that don't get CVEs It's one of the reasons I prefer to game in a VM with heavy network filtering and egress only through VPN There is little to no care from game developers about security, games with actively exploitable RCEs (see pretty much the whole CoD franchise) are just allowed to stay up on Steam Gamers are also kinda dumb and oblivious to RATs etc which doesn't help
- poly_morphis 4y ago
  How do you game in a VM? A lot of my game time includes flight simulators with many external peripherals.
  - 4y ago

Scaevolus 4y ago

GTA V has averaged >100k concurrent players on steam for the last 3 years, so a RCE has a lot of potential targets ripe for exploitation.

ehnto 4y ago
It only needs to make it into a mod-menu to get wide, unsuspecting distribution. For those curious, mod menus are what "hackers" use to exploit the gameplay for fun. Script-kiddies are a good analog in history. They're often just kids who googled GTA hacks and installed from the first page they thought looked cool. They'll be prime targets for distribution.
- dns_snek 4y ago
  Interestingly enough, it seems like some of these "mod menus" have already patched the exploit. Having one of these is almost a requirement for playing GTA Online these days, purely for the defensive features they offer against other cheaters. It's still a mess and requires trust (or a VM).
- joshspankit 4y ago
  Just like script-kiddies back in the day, the easiest vector of attack is to distribute infected “hacking” tools

mjg59 4y ago

I feel like I'm missing something here, but: the references are two support forum threads and a reddit thread, both of which link back to the referenced twitter thread? Is there any actual confirmation that this RCE exists? What does "partial RCE" even mean?

deleted 4y ago
[deleted]
lfodofod 4y ago
It really appears that this CVE was issued based on that super vague twitter thread.

deleted 4y ago

[deleted]

aborsy 4y ago

These games have tens of millions of lines of code (often building on top of the older components). They are also written in memory unsafe C++, by developers focused on features and rapid sales, to users that look forward to new features not better security. I won’t be surprised at all if they are filled with vulnerabilities.

mirages 4y ago
https://www.gamedeveloper.com/programming/dirty-game-development-tricks https://www.gamedeveloper.com/programming/dirty-game-develop... Look at "(s)elf-exploitation"
minneelyyyy 4y ago
Uhhh, GTA V has been known for bad security for a long time. Streamers can't even play the game without a VPN or they get their IP leaked. Single-player games can (could, maybe still can? I am unsure of the current state of the game) get hacked and be messed with by hackers. This goes far beyond just "they used C++." This shows a great lack of caring for security in general from Rockstar, not just another thing that you can use to prove to yourself that "C++ is dangerous!"

culi 4y ago

RCE: remote code execution CVE #: Common Vulnerabilities and Exposures number, assigned by the MITRE Corporation