6 ms·

Remote Code Execution like loading DLLs from a server and executing them sounds like malware.

rvnx 1y ago
It's "just" an automatic update, like Chrome, etc. It's one entry-point among others for RCE. If tomorrow NSA wants to gather any files on your computer, all they need to do is to ask Google to push an update for you through Google Omaha. https://epic.org/wp-content/uploads/privacy/nsa/foia/NSA-Google_FOIA_Request.pdf https://epic.org/wp-content/uploads/privacy/nsa/foia/NSA-Goo... Google and NSA have a "partnership". Valve could also have such partnership in theory, through VAC, though unlikely in practice.
- snickerdoodle12 1y ago
  I get chromium & firefox from my distro's repos
  - bflesch 1y ago
    Linux distros are vulnerable to the same supply chain attacks. Did you ever do a background check on your distro maintainers? How many of them have email addresses from non-democratic TLDs?
    - snickerdoodle12 1y ago
      If they want to publicly publish their exploit chain for everyone who uses the distro that's their choice.
- gruez 1y ago
  >If tomorrow NSA wants to gather any files on your computer, all they need to do is to ask Google to push an update for you through Google Omaha. They could in theory, but has this actually happened in practice? Pushing a rogue update isn't exactly a novel idea, but despite decades of government document leaks and APTs being analyzed, there's scant evidence that any government pressured a company to push a rogue update. Same goes for other threat models like "government pressuring CAs into issuing a certificate".
  - the8472 1y ago
    For CAs that'd likely get them kicked out of browser trust stores if someone detects it. And if it becomes known that a corporation pushes government-malware updates then that corporation would lose trust too. So playing that card means moving the entire planet into a lower-trust equilibrium where everyone has to defend against that. In a better-coordinated world the conclusion from that would be "let's not do that", alas on this Earth TLAs have shown that they're willing to burn the commons, forcing a response like RFC 7258.
- andrecarini 1y ago
  I'm really curious about this but searching for "Google Omaha" doesn't return anything related and the linked FOIA request is... just a request, which I assume anyone can write whatever they want in the request.
  - gruez 1y ago
    The request itself isn't very damning either. It just make references to vaguely worded "partnerships", and apparently uses that to imply that Google is handing over data. Even if we take that at face value, it says nothing about OP's claim, which is that NSA can ask google to serve backdoored updates.
- tonyhart7 1y ago
  how is this any different than the Google sells your data to Ads centre????
- bflesch 1y ago
  Valve has the same feature - it is deployed on more .ru machines than chrome.
phoronixrly 1y ago
The other day I mentioned that it's not OK for games to be proprietary software and/or use unethical software like DRM (which tbh anti-cheats are as well). I got accused that I wanted game developers to starve to death.
- altruios 1y ago
  that's where you turn and say: well, the game developer executives however... In all seriousness, DRM/anti-cheats => rootkits/rats. Don't fall for it. Demand better.
  - AndriyKunitsyn 1y ago
    Can't say for DRM, but there's much bigger demand to play a multiplayer action game without experiencing cheating than demand for a similar game that's not a rootkit. Cheaters are nasty. Devs make rootkit anti-cheats simply because there's no better alternative, not because they're evil.
    - altruios 1y ago
      We need to define nebulous terms like 'better'... to a company that's synonymous with what is 'cheapest' to their bottom line. To a player, that's a more effective anti-cheat. To my understanding, the latter is much more effectively solved server-side, but is more costly for the company to run. I'd rather play a game with server-side anti-cheat than player-side-anti-cheat.
      - AndriyKunitsyn 1y ago
        All games are different, and for some game, this may be true, but what I, personally, have in my mind in a discussion about intrusive anti-cheats is a fast shooter with lag compensation like CS or CoD, and for them, this problem is not solvable only server-side. CS:GO actually have heuristics and ML to flag cheaters server-side, but that's only another line of defense - the majority of defense is on the client-side anti-cheat. It's called VACnet, and its bans are temporary - most likely because of false positives. It's unfortunate, but it is how it is.
dathinab 1y ago
now think about in kernal anti cheat doing that ....
keyringlight 1y ago
I'm surprised there haven't been more events of mods and tools being used as trojans. For all the concern about anti-cheat/DRM, PC gamers seem very selective over what sources of code they're running on their computers they scrutinize. There's an awful lot of users with "just enough" levels of knowledge where I think a tempting enough release with the right timing for a hot game could get a lot of installs.
- charcircuit 1y ago
  What do you mean? There have been ton of stealers and RAT mods for games (and even for normal mobile apps too). It's absolutely a problem and a ton people fall victim to them.

rvnx 1y ago

It's "just" an automatic update, like Chrome, etc. It's one entry-point among others for RCE. If tomorrow NSA wants to gather any files on your computer, all they need to do is to ask Google to push an update for you through Google Omaha. https://epic.org/wp-content/uploads/privacy/nsa/foia/NSA-Google_FOIA_Request.pdf https://epic.org/wp-content/uploads/privacy/nsa/foia/NSA-Goo... Google and NSA have a "partnership". Valve could also have such partnership in theory, through VAC, though unlikely in practice.

snickerdoodle12 1y ago
I get chromium & firefox from my distro's repos
- bflesch 1y ago
  Linux distros are vulnerable to the same supply chain attacks. Did you ever do a background check on your distro maintainers? How many of them have email addresses from non-democratic TLDs?
  - snickerdoodle12 1y ago
    If they want to publicly publish their exploit chain for everyone who uses the distro that's their choice.
gruez 1y ago
>If tomorrow NSA wants to gather any files on your computer, all they need to do is to ask Google to push an update for you through Google Omaha. They could in theory, but has this actually happened in practice? Pushing a rogue update isn't exactly a novel idea, but despite decades of government document leaks and APTs being analyzed, there's scant evidence that any government pressured a company to push a rogue update. Same goes for other threat models like "government pressuring CAs into issuing a certificate".
- the8472 1y ago
  For CAs that'd likely get them kicked out of browser trust stores if someone detects it. And if it becomes known that a corporation pushes government-malware updates then that corporation would lose trust too. So playing that card means moving the entire planet into a lower-trust equilibrium where everyone has to defend against that. In a better-coordinated world the conclusion from that would be "let's not do that", alas on this Earth TLAs have shown that they're willing to burn the commons, forcing a response like RFC 7258.
andrecarini 1y ago
I'm really curious about this but searching for "Google Omaha" doesn't return anything related and the linked FOIA request is... just a request, which I assume anyone can write whatever they want in the request.
- gruez 1y ago
  The request itself isn't very damning either. It just make references to vaguely worded "partnerships", and apparently uses that to imply that Google is handing over data. Even if we take that at face value, it says nothing about OP's claim, which is that NSA can ask google to serve backdoored updates.
tonyhart7 1y ago
how is this any different than the Google sells your data to Ads centre????
bflesch 1y ago
Valve has the same feature - it is deployed on more .ru machines than chrome.

phoronixrly 1y ago

The other day I mentioned that it's not OK for games to be proprietary software and/or use unethical software like DRM (which tbh anti-cheats are as well). I got accused that I wanted game developers to starve to death.

altruios 1y ago
that's where you turn and say: well, the game developer executives however... In all seriousness, DRM/anti-cheats => rootkits/rats. Don't fall for it. Demand better.
- AndriyKunitsyn 1y ago
  Can't say for DRM, but there's much bigger demand to play a multiplayer action game without experiencing cheating than demand for a similar game that's not a rootkit. Cheaters are nasty. Devs make rootkit anti-cheats simply because there's no better alternative, not because they're evil.
  - altruios 1y ago
    We need to define nebulous terms like 'better'... to a company that's synonymous with what is 'cheapest' to their bottom line. To a player, that's a more effective anti-cheat. To my understanding, the latter is much more effectively solved server-side, but is more costly for the company to run. I'd rather play a game with server-side anti-cheat than player-side-anti-cheat.
    - AndriyKunitsyn 1y ago
      All games are different, and for some game, this may be true, but what I, personally, have in my mind in a discussion about intrusive anti-cheats is a fast shooter with lag compensation like CS or CoD, and for them, this problem is not solvable only server-side. CS:GO actually have heuristics and ML to flag cheaters server-side, but that's only another line of defense - the majority of defense is on the client-side anti-cheat. It's called VACnet, and its bans are temporary - most likely because of false positives. It's unfortunate, but it is how it is.

dathinab 1y ago

now think about in kernal anti cheat doing that ....

keyringlight 1y ago

I'm surprised there haven't been more events of mods and tools being used as trojans. For all the concern about anti-cheat/DRM, PC gamers seem very selective over what sources of code they're running on their computers they scrutinize. There's an awful lot of users with "just enough" levels of knowledge where I think a tempting enough release with the right timing for a hot game could get a lot of installs.

charcircuit 1y ago
What do you mean? There have been ton of stealers and RAT mods for games (and even for normal mobile apps too). It's absolutely a problem and a ton people fall victim to them.