Critical Vulnerabilities In Call of Duty: Modern Warfare 3, CryEngine 3 77
hypnosec writes with news that two security consultants have found vulnerabilities in Call of Duty: Modern Warfare 3 and the CryEngine 3 graphics engine that could harm game makers and players alike. Presenting at the Power of Community (POC2012) security conference, the researchers demonstrated how a denial-of-service attack could affect Modern Warfare 3, and how a server-level attack on CryEngine 3 allowed them to "create a remote shell on a game-player's computer."
"'Once you get access to the server, which is basically the interface with the company, you can get access to all of the information on the players through the server,' Ferrante said. In general, game companies don't seem to be very focused on security but rather on performance of the game itself, Ferrante said. Adding security checks can slow down games, and if the companies don't deem the problem a very critical issue, it will usually be ignored. 'These are games that have a very large market,' Auriemma said."
Well duh (Score:4, Insightful)
Well of course they care only about performance Its all their user base really cares about.
Re:Oh no! (Score:5, Insightful)
Yep, and that patch will clean up your computer after hackers take over the server and run a remote shell on your computer and pilfer any information their botnet can find. Thank god we don't have to write secure software any more since we can patch it any time we need to before the hackers actually run exploits.
Blame the users/consumers/people (Score:4, Insightful)
Well of course they care only about performance Its all their user base really cares about.
To be fair...nobody is interested in security until things go wrong, they will and they do. Then its look for a scapegoat, and the solution is to remove rights and privacy of the individual for the illusion protection, throw in a few laws, that only affect the law abiding and decent. Then we live in fear.
They could stop these things... (Score:2, Insightful)
... by you know having LAN and private servers again so hacks don't take down the community. Security wouldn't be an issue for Diablo 3 if you could play the fucking game offline. But corporate greed and the dumb masses that feed the move to "online only" games this will become more frequent.
Re:They could stop these things... (Score:2, Insightful)
"If the masses want something that YOU don't, it doesn't make them dumb"
Single player lag is such an awesome feature, that didn't exist in Diablo 1 + 2 because of morons like you who don't understand technology. Only a tech illiterate would say something like what you said.
Re:The remote shell is NOT a surprise (Score:5, Insightful)
The importance of the remote shell is not that "if you can get arbitrary code execution, you can get a remote shell" (this is pretty much a tautology). The importance is that it demonstrates the possibility of arbitrary code execution at all. A lot of security vulnerabilities are difficult to actually exploit. In most cases, the best that an attacker will ever achieve is denial of service ( a crash, or forced disconnect, or using up all the RAM so the game runs too slowly, or soemthing like that).
Contrary to what the movies would have you believe, actual exploits are (especially in a modern environment full of vulnerability mitigations) very difficult to produce in most cases. Many security researchers don't even bother with that step; it's enough to find the vulnerability and flag it "probably exploitable".
Re:Patch will soon be here (Score:4, Insightful)
MW3. My mind will always translates as Mech Warrior.
Re:They could stop these things... (Score:5, Insightful)
You believe all the propaganda they pushed to get you to accept DRM. Cheats have always been a natural part of playing games provided the player can control who you can play with. Cheaters could cheat to their hearts content in private games and not effect anyone else. Private servers/LAN allow people to choose who they play with, when and where. These centralized servers create huge security and points of failure.
Not only that but cheating in a single player game you paid for - there's nothing wrong with it because it hurts no one. You are victim of gaming PR and propaganda. You accept broken and inferior products that's not a sign of a healthy mind.
Re:They could stop these things... (Score:5, Insightful)
Well yes but THINK about having millions of people playing a SINGLE PLAYER GAME ONLINE, that means huge swaths of computers wouldn't have open ports/be communicating with servers at all if not for 'online drm'. Diablo 3 being a case in point, all these security issues are caused by gaming corporations wanting absolute control over everyone and everything in gaming.
The point is the whole centralization and DRM make security issues much bigger since companies tend to want control and as much information as possible about users and are careless with data. All that could be avoided if the multiplayer aspects of videogames didn't require being chained to online and all sorts of needing accounts, user info and other nonsense.
In Quake 3 you didn't need to sign up anywhere to play the damn game and you never had to give out emails or information to anybody. Not only that requiring users to be online when they play single player just creates a huge attack surface.
Re:Well duh (Score:5, Insightful)
Because by default we don't expect a game to compromise the security of our machine.
And, bluntly, I cannot fault the player, while at the same time knowing that games ARE a ticking time bomb. What really ticks me off about it is that there is usually no reason that it has to.
First of all, a lot of games require admin privileges on Windows, which always keeps me wondering why. What the FUCK is a game supposedly doing in areas where it touches anything that should remotely require admin rights? DRM, anyone? That's actually what really pisses me off, the game doesn't really need the privileges, but the useless crap that serves the player no purpose not only slows the whole crap down but also opens him up for an attack if the game has a security hole.
Now add that A-titles have a large player base and more and more of them require a network connection (DRM raises its ugly head again there) and see why they are a really interesting target for malware authors. First, unlike OSs and business software, security updates for games are not really a prime concern since there is with some certainty no business involved that could have a legal department which makes your life really unpleasant if your crappy software causes security concerns. The user doesn't worry if the software starts an online connection even if he doesn't intent to have one, since DRM is known to phone home, so firewall rules don't hit and the game has the rights to initiate contact to the outside world. Depending on the game, it might even be necessary to allow incoming connections. And to make matters worse, the game has admin privileges.
What more could a malware author ask for?