Hacker News Reader

Comment by ActorNightly | Hacker News Reader

I always wondered how many game clients out there have exploitable vulnerabilities. Seems like you see a lot of CVEs in popular software, but never games.

View on HN

Probably a lot, this isn't the first time Source has been affected by an RCE. For better or worse there's much less of an attack surface in newer multiplayer games though, since they've trended towards more closed ecosystems where the community isn't allowed to host their own servers or create their own content that the client consumes directly.

Nowadays I'd be more concerned about malicious mods for singleplayer titles.

Most likely every game that allows private servers has a bunch of exploitable vulnerabilities. Game developers are under too much pressure to deliver to worry about security. A while ago a popular game was running direct connections to the developers mysql server.

If more people would return their games on such cases, or do lawsuits, like in other goods, they would worry about security.

Wow, which game?

Final Fantasy 14 had raw SQL queries in it's UI, so handing in a quest basically made you send an UPDATE statement straight to the DB to update your character with the rewards.

Amazons New World was a perfect example, you could literally send the server info that you're invulnerable and you would be... unkillable. People flying, telling the server they have x gold, zero validation whatsoever. Online games are a constant balance between what can be handled by client and what should be handled on the server but most of them display absolute lack of after-thought given from developers and/or management.

Super Meat Boy comes to mind: https://news.ycombinator.com/item?id=3387628

CS:GO and other source games have had loads of serious vulnerabilities. I've found a few myself just by looking at the leaked source code:

https://github.com/perilouswithadollarsign/cstrike15_src

The engine code is very old, and CS:GO itself was not developed by valve but by Hidden Path Entertainment initially as a port of CS: Source to consoles and they didn't really do a great job.

Game studios have no security processes and people who look at this stuff (i.e. game hacking) are more likely to just add exploits to their cheats (e.g. being able to crash other players is obviously a huge selling point for a hack) instead of reporting them.

Reply on news.ycombinator.com