3 ms·

I always wondered how many game clients out there have exploitable vulnerabilities. Seems like you see a lot of CVEs in popular software, but never games.

rapsey 3y ago
Most likely every game that allows private servers has a bunch of exploitable vulnerabilities. Game developers are under too much pressure to deliver to worry about security. A while ago a popular game was running direct connections to the developers mysql server.
- qingdao99 3y ago
  Wow, which game?
  - veeti 3y ago
    Super Meat Boy comes to mind: https://news.ycombinator.com/item?id=3387628 https://news.ycombinator.com/item?id=3387628
  - gyaru 3y ago
    Final Fantasy 14 had raw SQL queries in it's UI, so handing in a quest basically made you send an UPDATE statement straight to the DB to update your character with the rewards.
  - atraac 3y ago
    Amazons New World was a perfect example, you could literally send the server info that you're invulnerable and you would be... unkillable. People flying, telling the server they have x gold, zero validation whatsoever. Online games are a constant balance between what can be handled by client and what should be handled on the server but most of them display absolute lack of after-thought given from developers and/or management.
- pjmlp 3y ago
  If more people would return their games on such cases, or do lawsuits, like in other goods, they would worry about security.
jsheard 3y ago
Probably a lot, this isn't the first time Source has been affected by an RCE. For better or worse there's much less of an attack surface in newer multiplayer games though, since they've trended towards more closed ecosystems where the community isn't allowed to host their own servers or create their own content that the client consumes directly. Nowadays I'd be more concerned about malicious mods for singleplayer titles.
scandinavian 3y ago
CS:GO and other source games have had loads of serious vulnerabilities. I've found a few myself just by looking at the leaked source code: https://github.com/perilouswithadollarsign/cstrike15_src https://github.com/perilouswithadollarsign/cstrike15_src The engine code is very old, and CS:GO itself was not developed by valve but by Hidden Path Entertainment initially as a port of CS: Source to consoles and they didn't really do a great job.
formerly_proven 3y ago
Game studios have no security processes and people who look at this stuff (i.e. game hacking) are more likely to just add exploits to their cheats (e.g. being able to crash other players is obviously a huge selling point for a hack) instead of reporting them.

rapsey 3y ago

Most likely every game that allows private servers has a bunch of exploitable vulnerabilities. Game developers are under too much pressure to deliver to worry about security. A while ago a popular game was running direct connections to the developers mysql server.

qingdao99 3y ago
Wow, which game?
- veeti 3y ago
  Super Meat Boy comes to mind: https://news.ycombinator.com/item?id=3387628 https://news.ycombinator.com/item?id=3387628
- gyaru 3y ago
  Final Fantasy 14 had raw SQL queries in it's UI, so handing in a quest basically made you send an UPDATE statement straight to the DB to update your character with the rewards.
- atraac 3y ago
  Amazons New World was a perfect example, you could literally send the server info that you're invulnerable and you would be... unkillable. People flying, telling the server they have x gold, zero validation whatsoever. Online games are a constant balance between what can be handled by client and what should be handled on the server but most of them display absolute lack of after-thought given from developers and/or management.
pjmlp 3y ago
If more people would return their games on such cases, or do lawsuits, like in other goods, they would worry about security.

jsheard 3y ago

Probably a lot, this isn't the first time Source has been affected by an RCE. For better or worse there's much less of an attack surface in newer multiplayer games though, since they've trended towards more closed ecosystems where the community isn't allowed to host their own servers or create their own content that the client consumes directly. Nowadays I'd be more concerned about malicious mods for singleplayer titles.

scandinavian 3y ago

CS:GO and other source games have had loads of serious vulnerabilities. I've found a few myself just by looking at the leaked source code: https://github.com/perilouswithadollarsign/cstrike15_src https://github.com/perilouswithadollarsign/cstrike15_src The engine code is very old, and CS:GO itself was not developed by valve but by Hidden Path Entertainment initially as a port of CS: Source to consoles and they didn't really do a great job.

formerly_proven 3y ago

Game studios have no security processes and people who look at this stuff (i.e. game hacking) are more likely to just add exploits to their cheats (e.g. being able to crash other players is obviously a huge selling point for a hack) instead of reporting them.