top | item 26762170

Valve accused of ignoring existing RCE vulnerability in Source games for 2 years

225 points| mxscho | 4 years ago |twitter.com

119 comments

order

dafelst|4 years ago

I have a friend who used to work at Valve as a software engineer - he mentioned to me that the entire source networking stack is chock full of unchecked buffers and all sorts of potential for fairly trivial RCEs, but due to Valve's internal structure (or lack thereof) there really isn't any incentive for anyone to fix them.

This was 5-6 odd years ago and he no longer works there, so things might have changed, but based on this tweet it seems unlikely.

TazeTSchnitzel|4 years ago

> due to Valve's internal structure (or lack thereof) there really isn't any incentive for anyone to fix them

This seems to be a common theme with problems at Valve.

atat7024|4 years ago

Game devs don't optimize for security, because they're not incentivised to.

KyleSanderson|4 years ago

Indeed, there's still plenty of these.

sodality2|4 years ago

Dozens of Counter-strike exploits exist and the cheating scene has just grown too rampantly. Valve simply doesn't care about the source engine. Any new CSGO player will tell you the anti-cheat doesn't work, I know first-hand.

The lack of care regarding source engine netcode extends to every part of the source engine, including Valve Anti-cheat.

The anti-cheat is trivial to reverse (several PUBLIC bypasses have existed for years on github, with zero patch), the engine source has been leaked, reverse engineered, and fiddled with by thousands of 14 year old kids. It is pathetically easy to bypass, for example, by changing a single byte in memory you can see through walls, see enemy money, etc. See this video I found about how miserably broken it is: https://files.catbox.moe/8e3bxz.mp4

It is in my opinion the greatest loss to gaming that a classic, legendary game like Counter-strike got completely ruined by lack of care by a company that profits millions off of the case unboxings.

valec|4 years ago

> CSGO player will tell you the anti-cheat doesn't work, I know first-hand.

> It is in my opinion the greatest loss to gaming that a classic, legendary game like Counter-strike got completely ruined by lack of care by a company that profits millions off of the case unboxings.

have you played the game in recent years? this has not been the case for me or the people I play with at all.

when playing on high trust-factor accounts, cheating is basically eliminated.

the experience for newer players is pretty bad but once you convince the system you're trustworthy, the algorithm does an extremely good job of not matching you with cheaters.

what valve lacks in boring, sensible solutions they make up for with interesting often much more complex workarounds (see: the open-world csgo danger-zone map shoved into a game with a room-based engine)

skim_milk|4 years ago

>and fiddled with by thousands of 14 year old kids

People think you're kidding, but it's really that easy on Source! For a while, the most popular TF2 (a Valve Source game) hack was created by a 15 year old. He made at least a million dollars in profit too! (can't remember if this factoid was verified or not, but he can definitely pay for college now) I wasn't as nearly as talented but I made some hacks for fun when I was 15 or 16 years old.

chc4|4 years ago

Video game cheats and anti-cheats are almost completely disjoint from remote code exploits like what are reported in the OP.

grawprog|4 years ago

Normally, I can handle some cheating in games, you just kinda deal with it, but holy fuck csgo was just nope. Between foul mouthed children and essentially watching God hackers play against eachother while you just die over and over.

Yeah....no not exactly fun.

sseneca|4 years ago

The outrageous profit Valve make from skins and the like is only half the story imo, their internal structure is the rest. Some of the stories ex-devs share from that place are just... idk, they explain the company’s apparent ineptitude

gameswithgo|4 years ago

No anti cheat for FPS games has ever "worked", it can't. The best you can do is make it a little hard for the cheats to keep up with your detectors or protocol changes.

hoffs|4 years ago

You found a video that says that they detect most old cheats from hl2 days and ban them and then the video just goes to show random github repos. What is that even supposed to prove? Theres nothing stopping anyone from creating repos with cheats that get detected or don't even work. Like it's just a super cringe "gotcha" type video

guidovranken|4 years ago

There's a place for being patient and lenient, but HackerOne consistently seems to not shut down malfunctioning programs that never pay rewards and flat out stop talking to you, yet continue to collect bugs. Such a relationship is commonly called fraud so I suggest reporting HackerOne to the Federal Trade Commission as I have.

The premise of bug bounties is that the reward amount is at the discretion of the program host and that the time incurred by developing a fix will influence the moment of payout, but refusing to pay and even communicate (for years!) for clearly eligible submissions is well beyond a reasonable interpretation of the conditions, and to consistently keep facilitating this abuse is simply fraudulent.

tgsovlerkhgsel|4 years ago

This matches my experience. Additionally, they prohibit disclosure in such cases, effectively making them complicit in delaying (best case) or in many cases completely suppressing disclosure.

xyst|4 years ago

This is why I have a separate machine for "gaming" and "work"

Some game companies (riot games) even install their anti-cheat software so that is loads in the ring 0 space. Even with their best efforts, cheaters will still prosper.

Might even go a step further and firewall my gaming machine off from the rest of my network.

invokestatic|4 years ago

No, anti-cheats in ring0 haven't eliminated cheaters, but that was never the point. The point is to make it more difficult to cheat. And they have succeeded in that. Check any cheat forum like unknowncheats. You'll see that most hackers now have to chain multiple (complex) exploits together to get their cheats working, only to get it patched by the anti-cheats a few days/weeks later. This is way more difficult and prone to detection than ReadProcessMemory was before anti-cheats went ring0.

walrus01|4 years ago

It seems that a lot of people forgot about things like sony installing rootkits on peoples' PCs. Now it's accepted for gaming anti cheat software?

fpgaminer|4 years ago

This is the way.

Many games package in outright spyware that siphon all kinds of data off your machine including browsing history. Kerbal Space Program was infamous for this (they removed the spyware at some point but I haven't checked recently if it was ever added back in).

Guest19023892|4 years ago

This is one of the reasons I like gaming on GeForce NOW. I can use my primary laptop, play any game without having to install anything, instantly alt-tab back to the desktop between rounds without any weird bugs or crashes, etc.

matheusmoreira|4 years ago

Game companies literally think they have the right to own your machine. This is the kind of garbage they force gamers to install on their machines:

https://www.theregister.com/2016/09/23/capcom_street_fighter...

https://mobile.twitter.com/TheWack0lian/status/7793978407622...

Their software also takes screen shots, walks the file system, scans people's processes... Any similarities to malware may or may not be mere coincidences. They're also known for false positives: banning people for receiving special strings via text message, unknowingly installing mods with hacks bundled in or due to the presence of development tools such as debuggers or even virtual machines. Good luck trying to reverse such a ban, the entire gaming community has already been conditioned to accept any decision as final and to even defend this practice. When coupled with DRM, this essentially means your license to play the game has been revoked with no refunds.

sseneca|4 years ago

> Some game companies (riot games) even install their anti-cheat software so that is loads in the ring 0 space.

Why are separate machines required, rather than dual-booting? (i.e. Windows for games, Linux for everything else)

JUNGLEISMASSIVE|4 years ago

I hope those separate machines are also on separate network segments without a route in between.

mxscho|4 years ago

According to a tweet that was also retweeted by the user @floesen_ who was mentioned in the original thread, the initial report 2 years ago was done using HackerOne but has probably not seen any helpful response from Valve [1]. There are also other reports of Valve not reacting to HackerOne reports appropriately [2].

It is currently unclear whether there is a publicly available PoC or any exploitation going on in the wild.

[1] https://twitter.com/AntiCheatPD/status/1380873722966503426

[2] https://twitter.com/killa/status/1380872852090540032

pricechild|4 years ago

> There are also other reports of Valve not reacting to HackerOne reports appropriately

I'll second that.

I discovered and reported a vulnerability with the Steam client's Bluetooth pairing process via hackerone.

The issue was confirmed but decided "out of scope" as apparently "within bluetooth range" runs afoul of the bug bounty's "require physical access" exclusion.

8 months later (I haven't exactly kept on top of this) they're still demanding I keep it confidential. I'll follow it up...

tgsovlerkhgsel|4 years ago

HackerOne also at least strongly discourages publishing your findings if the developers refuse to take action.

https://www.hackerone.com/disclosure-guidelines states that "After the Report has been closed, Public disclosure may be requested by either the Finder or the Security Team." - so if the report just doesn't get closed, you can't disclose through the platform, and https://www.hackerone.com/policies/code-of-conduct says "Disclosing report information without previous authorization is not permitted."

To me, that seems that you're not permitted to disclose the issue at all until the report has been closed and either 1) 30 days have passed and the security team hasn't requested an extension, or 2) "180 days have elapsed with the Security Team being unable or unwilling to provide a vulnerability disclosure timeline".

Due to this, I refuse to report through HackerOne.

gsich|4 years ago

2 years? Just leak it. At some point "responsible" disclose is not worth it.

anonymousab|4 years ago

Moreso, at some point it may be more responsible to exert real pressure and a time concern on them to fix it by revealing the flaw.

It depends on whether you think there's a reasonable chance that someone may be using that exploit by now. Carrot and stick approaches do not work without a reliable stick.

Edit: I suppose it also depends on how much you value going through the exact same process with valve for other bugs in the future. But in a situation like this it seems like little would be lost.

BlueGh0st|4 years ago

Absolutely! Going public is an important part of responsible disclosure

Aissen|4 years ago

Totally believable. Someone I trust in the RE community told me about similar shenanigans when trying to report issues to Valve.

dkarras|4 years ago

It would be a shame if an "anonymous hacker" "hacked" @floesen_, found their notes about the RCE and released it to public, accidentally of course.

sneak|4 years ago

It would probably also be a shame when floesen_ got sued for an NDA violation and had to spend tens of thousands of dollars in civil court explaining that they got hacked and it's not their fault.

breakingcups|4 years ago

At this point, just leak it to Project Zero anonymously and let them wring Valve's hand for you.

There's a small chance you might still get the bounty, because you reported it first. And if not, because it's already disclosed by another party, you can cry foul on social media.

zokier|4 years ago

Source engine itself is at least 16 years old, and has pretty direct lineage to the original 21 year old Quake engine (Quake (-> Quake II) -> GoldSrc -> Source). I would be more surprised if there weren't lots of RCEs in it.

rasz|4 years ago

Imagine you are Valve - why would you fix anything? Your money printer goes Brrr regardless, and legal assures you H1 deal prevent participants from leaking anything.

DanAtC|4 years ago

Unless you have the clout of Project Zero, "responsible" disclosure is anything but.

Full disclosure or no disclosure.