11 ms·
CS:GO: From Zero to 0-Day
- ActorNightly 3y agoI always wondered how many game clients out there have exploitable vulnerabilities. Seems like you see a lot of CVEs in popular software, but never games.
- rapsey 3y agoMost likely every game that allows private servers has a bunch of exploitable vulnerabilities. Game developers are under too much pressure to deliver to worry about security. A while ago a popular game was running direct connections to the developers mysql server.
- qingdao99 3y agoWow, which game?
- veeti 3y agoSuper Meat Boy comes to mind: https://news.ycombinator.com/item?id=3387628 https://news.ycombinator.com/item?id=3387628
- gyaru 3y agoFinal Fantasy 14 had raw SQL queries in it's UI, so handing in a quest basically made you send an UPDATE statement straight to the DB to update your character with the rewards.
- atraac 3y agoAmazons New World was a perfect example, you could literally send the server info that you're invulnerable and you would be... unkillable. People flying, telling the server they have x gold, zero validation whatsoever. Online games are a constant balance between what can be handled by client and what should be handled on the server but most of them display absolute lack of after-thought given from developers and/or management.
- pjmlp 3y agoIf more people would return their games on such cases, or do lawsuits, like in other goods, they would worry about security.
- jsheard 3y agoProbably a lot, this isn't the first time Source has been affected by an RCE. For better or worse there's much less of an attack surface in newer multiplayer games though, since they've trended towards more closed ecosystems where the community isn't allowed to host their own servers or create their own content that the client consumes directly. Nowadays I'd be more concerned about malicious mods for singleplayer titles.
- scandinavian 3y agoCS:GO and other source games have had loads of serious vulnerabilities. I've found a few myself just by looking at the leaked source code: https://github.com/perilouswithadollarsign/cstrike15_src https://github.com/perilouswithadollarsign/cstrike15_src The engine code is very old, and CS:GO itself was not developed by valve but by Hidden Path Entertainment initially as a port of CS: Source to consoles and they didn't really do a great job.
- formerly_proven 3y agoGame studios have no security processes and people who look at this stuff (i.e. game hacking) are more likely to just add exploits to their cheats (e.g. being able to crash other players is obviously a huge selling point for a hack) instead of reporting them.
- tormeh 3y agoI think it's good security practice to run/install your games under a different user than the one you use for banking. It's a hack, but it's all we can do with the dismal state of desktop OSes.
- userbinator 3y agoVMs are normally a better solution for isolation, although with games it's probably better to let them run on the hardware while the sensitive stuff gets its own VMs.
- iueotnmunto 3y agoIf the VM operates under the same privileges than a host, all this does is prevent automated attacks - a savvy attacker can still access the disk image of the guest, in some cases, it might actually be more vulnerable (as disk image access is implicitly a privesc in the context of the VM).
- Springtime 3y agoThe problem with VMs is games that require anti-cheat, which from what I've read from user experiences try to detect and prevent VM usage (not sure about Valve's anti-cheat though).
- _piif 3y agoThe common ones such as EAC, BattlEye and VAC don't prevent you from running the corresponding games in a VM.
- Springtime 3y agoHmm, as I've seen topics like this[1] for EAC, though a comment from a different result[2] mentions EAC can be configured to optionally block VMs so maybe it varies by game. > Today, I purchased and installed Dead by Daylight with the intention of playing with some friends, only to start the game and find a message from Easy Anti-Cheat stating that the game "cannot run under a virtual machine." [1] https://www.reddit.com/r/VFIO/comments/100yqok/bypass_eac_cannot_run_under_virtual_machine_esxi/ https://www.reddit.com/r/VFIO/comments/100yqok/bypass_eac_ca... [2] https://www.reddit.com/r/blackdesertonline/comments/px0flc/virtual_machine_and_eac/hellltc/ https://www.reddit.com/r/blackdesertonline/comments/px0flc/v...
- esquire_900 3y agoReading the timeline at the bottom makes this seem like a very frustrating process, it took multiple nudges and over a year for Valve to even start fixing. I can't imagine putting in this much work and getting such a lackluster response.
- veave 3y agoExploiting these bugs requires you to connect to external servers which is not something you are really supposed to do in csgo.
- pityJuke 3y agoCommunity servers are a built in feature to Counter-Strike: Global Offensive, accessible for regular users via the main menu. Many of the professional scene exclusively use them (via MM services like FACEIT, and training servers like BrutalCS). Connecting to these services safely is absolutely something players should have trust in.
- ho_schi 3y agoHosting own servers is a feature of CSGO. A feature provided by all well designed client/server software. Thus avoiding vendor lock-in and dependence. Good for LAN-Parties, bad or no networking, original developer doesn’t exist anymore or doesn’t care. And then there as these developers which are the only ones with the server code and shutdown their servers by intention - I recommend to avoid software which such a planned obsolescence.
- mohamoha1848 3y agohamdiish1
- pityJuke 3y agoI love CS:GO, but the Source engine has been a leaky faucet of critical bugs, and the developers haven't taken them seriously enough over the years. The disclosure timeline in this blog post seems to be the norm for them. For this tranche of bugs, it took significant public pressure for them to do anything. I mean, it's not quite MW2 (2009), which I believe has multiple known RCEs that'll never be patched. But still not good enough for an actively developed live service game. One hopes that Source 2 has better standards for it, but I'll believe it when I see it.
- Pozzuh 3y agoThe whole Call of Duty series is riddled with bugs similar to the one in this article. This makes sense of course since their engines are based on the same principles, they all originate from the Quake engine. One example of an exploit found in the Quake engine in 2006 [1], also related to the “fast download” functionality, has been present in Call of Duty games such as MW2, and Black Ops - so at least 4 years after the exploit was found. It seems like Activision does not allocate any development time to their older games, even if critical vulnerabilities are found. Black Ops 3 (2015) has a number of remote code execution vulnerabilities in its peer-to-peer networking code, making it completely unsafe to play - even though it is readily available on Steam. Of course, these exploits are fixed by the community in custom, modded, clients. Sadly Activision likes to send cease & desist letters to developers of these clients. Personally I’ve found an exploit in CoD4 (2007) that will leak the CD-key of a person joining your server. This was reported to Activision in 2009 (ish), but also never (officially) fixed. It uses similar CVar leaking concepts as the one discussed in this article. Probably that would also make for an interesting write-up. [1] https://web.archive.org/web/20080517095348/http://www.securityfocus.com/archive/1/archive/1/433349/100/0/threaded https://web.archive.org/web/20080517095348/http://www.securi...
- deleted 3y ago[deleted]
- cinntaile 3y agoThe original Half Life engine (goldSrc) was based on the Quake engine, on Wikipedia it is mentioned that it was heavily modified. Half Life 2 used the Source engine and it doesn't necessarily mean that a lot of Quake engine artifacts are left, no?
- charcircuit 3y agoBug 1 ShouldPreventServerCommand calls Host_IsSinglePlayerGame instead of Host_IsLocalServer. The former function checks to see if the server that you are connected to is a single player server where actually we are interested in if we are running a server locally. https://github.com/sr2echa/CSGO-Source-Code/blob/dafb3cafa88f37cd405df3a9ffbbcdcb1dba8f63/cstrike15_src/engine/cmd.cpp#L876 https://github.com/sr2echa/CSGO-Source-Code/blob/dafb3cafa88... https://github.com/sr2echa/CSGO-Source-Code/blob/dafb3cafa88f37cd405df3a9ffbbcdcb1dba8f63/cstrike15_src/engine/host.cpp#L911 https://github.com/sr2echa/CSGO-Source-Code/blob/dafb3cafa88...
- pjmlp 3y agoA good example of why security practices matter in game development.
- lrem 3y agoHow exactly does it show that?
- pjmlp 3y agoBy showing a 0-day for a game server.
- bogwog 3y agoOn the other hand, this is the most successful multiplayer FPS of all time, you rarely see articles like this, and I can't remember ever seeing an article talking about an exploit like this actually being used. How many high value targets are installing games on their machines with sensitive data, and connecting to random private servers? Hopefully not enough to justify developing an exploit like this.
- pjmlp 3y agoOnly because sadly, liability still isn't a thing in many places. Too many people are happy buying shoes that explode, taking their feet away, if the shoe laces are tied on the wrong order.
- jsheard 3y agoCS:GO skins can sell for thousands of dollars, using an exploit like this for spear-phishing attacks against whales flaunting their expensive inventories could easily net more than the $7500 bounty which the OP received for responsible disclosure. It's probably already happening, highly targeted attacks aren't likely to make the news, and even if they are publicised it's hard to determine exactly how they were achieved. https://www.kaspersky.co.uk/blog/cs-go-two-million-usd-inventory-hack/24600/ https://www.kaspersky.co.uk/blog/cs-go-two-million-usd-inven...
- ho_schi 3y agoHowever, sometimes programmers forget to remove the debug symbols from the final binaries of the game. Programmers are humans, and humans make mistakes. Delivering software with debug symbols - wether commercial or non-profit - isn’t a mistake. It is a decision for better bug reports, traces and convenience. Executables/libraries on disk file size will increase with debug symbols. The kernel and loader will look at binary headers and load only what is needed for execution into main-memory. Kernel and loader will not load the debug symbols at runtime, they are useless for them. The debugger will look also at the headers and use them to load the debug symbols, which are need for backtraces. Therefore initial file read from disk will take a little more time but the execution is not affected. Startup speed is usually influenced by loading of further resources, initialization and checks. So you will get a lot for some bytes on the disk. https://stackoverflow.com/questions/24117063/is-a-program-compiled-with-g-gcc-flag-slower-than-the-same-program-compiled-wit https://stackoverflow.com/questions/24117063/is-a-program-co... https://stackoverflow.com/questions/39222698/does-compiling-with-g-in-itself-degrade-performance https://stackoverflow.com/questions/39222698/does-compiling-.... Some people still argue that security by obscurity works and hide everything. I doubt that.
- psychphysic 3y agoThis is WILD! The sentence before the one you quote is > Sometimes versions of the game are also intentionally shipped with debug symbols to generate better error reports. You remove that context, quote him saying sometimes it's a mistake and criticise him with the preface he already provided!?
- jpmoral 3y agoWith context then the quote is > Sometimes versions of the game are also intentionally shipped with debug symbols to generate better error reports. However, sometimes programmers forget to remove the debug symbols from the final binaries of the game. Programmers are humans, and humans make mistakes. It looks like the author is saying shipping final binaries with debug symbols is a mistake, and that's what @ho_schi is criticising.
- nickpeterson 3y agoAs much as I loved the olden says of shareware doom and extensive mods to games like counter strike, I think when it comes to competitive online games streaming is going to become the norm. Every one will be able to play, it will be much harder to cheat, and updates and enhancements are basically instant from an end user perspective.
- Sebb767 3y agoA lot of hacks already rely on visual/audio cues. An aimbot or audio-based wallhack doesn't need any input you don't want to give players. Also, competitive games, especially shooters, are extremely sensitive to latency, so they are by their nature quite unfit for streaming. People who build PCs which render at 300 FPS to a 120Hz+ monitor for competitive play won't be happy to deal with even a quite optimistic 10ms additional roundtrip latency.
- nickpeterson 3y agoI understand, but in a sense, those unlevel the playing field. I get it isn’t a perfect argument since many people have slower internet latencies, but it everyone has to do it, you get rid of a ton of variables.
- bnt 3y agoAs a late-30’s dev who plays competitive daily, this is the most frustrating thing in my day, but also the best way for me to vent out daily frustrations.
- fulafel 3y ago> for their bug bounty program, Valve requires a full-chain exploit demonstrating RCE impact That sounds quite bad.
- jagrsw 3y agoIt's somewhat concerning that Valve seems to disregard the importance of RCEs in server/client code, making them relatively easy to find. There appears to be a lack of proactivity in addressing these bugs. Given Valve's substantial daily earnings from CS:GO through weapon skin sales, it seems their operational focus is more on maintaining the revenue stream rather than committing to quality engineering practices.
- aranelsurion 3y agoWhat an amazing Sunday read, a step-by-step explanation, tables, timelines, even a short video demonstrating the exploit. Looking at how big the impact could be if this was discovered elsewhere, and how meager the payout was and how little Valve seemed to be interested, I guess it's fair to say that security of millions of PC clients is not taken seriously at all. If this is how it's handled for a game that makes big $$, I wouldn't dare imagine how it is for thousands of online AA games and other low budget software that runs everyday in our computers.
- Phelinofist 3y agoI did not fully read the article yet as I'm away from home - does this also affect Linux clients?
- xyst 3y agoAll of that work for $30K after 1 yr of Valve slow rolling it
- schmorptron 3y agoThe timeline mentioned in the post displays a scary lack of professionalism from Valve. For a full RCE (with full chain required to even be acknowledged!), taking over a YEAR to fix it and then having an almost insultingly low payout for it does not fill me with confidence as a user. What makes this worse is that if it had been exploited, even just getting account takeovers would have been catastrophic, not even speaking of other fun stuff people can do with an RCE. Many csgo players have items of insane monetary value in their steam inventories, so getting account takeovers would've been a direct link to profitability with this exploit. I'm very disappointed hearing this about such a reputable software maker.
- tpxl 3y agoLike 10 people work on this game, no surprise nothing is happening.
- itvision 3y agoIf only both of you guys knew that Valve has been working on CS2 for the past three years and no, it's not "10 people" it a lot lot more. I agree it took them too long to fix these vulnerabilities but Valve is notorious for its schedules/timeline/insane delays. It's been a meme for years now.
- deleted 3y ago[deleted]
- Conscat 3y agoValve doesn't make games, they make money. CSGO and TF2 are barely maintained.
- sjustinas 3y agoCS2, essentially a rewrite of CS:GO using the Source 2 engine is coming "this summer", so there's that.
- tgsovlerkhgsel 3y ago
- rldjbpin 3y agoas a player with thousands of hours in csgo, here's my take: right from the get go, the authors made it clear that each of the rce requires a user to connect to a malicious server. the only scenario this is possible is if the user connects to one of the community servers. while community servers have been the backbone of previous cs titles, it is far from the main place the majority of players connect to to play the game. the only major exception being third-party matchmaking systems such as faceit and esea, where the connection is handled directly by each service. so the scope of exploit in the vast majority of the cases would be for a very minor set of playerbase or unless exploiters hack faceit/esea servers. at the same time, the community servers have had a shady relationship with valve, where some of them allow you to try any skin in the game from server-side. i believe things like that played a part in why valve did not bother much with supporting them with the current game, especially with the ui for connecting to them barely updated since cs 1.6 two decades ago. moreover, the exploits listed are not by themselves enough to inject a payload to victims's computer. the game itself runs in user mode and the client-sided commands are usually game specific. overall, while i support the efforts made, the potential impact have been overblown in interpretation. i can see why valve took so long to fix these.