Critical Vulnerabilities In Call of Duty: Modern Warfare 3, CryEngine 3 77
hypnosec writes with news that two security consultants have found vulnerabilities in Call of Duty: Modern Warfare 3 and the CryEngine 3 graphics engine that could harm game makers and players alike. Presenting at the Power of Community (POC2012) security conference, the researchers demonstrated how a denial-of-service attack could affect Modern Warfare 3, and how a server-level attack on CryEngine 3 allowed them to "create a remote shell on a game-player's computer."
"'Once you get access to the server, which is basically the interface with the company, you can get access to all of the information on the players through the server,' Ferrante said. In general, game companies don't seem to be very focused on security but rather on performance of the game itself, Ferrante said. Adding security checks can slow down games, and if the companies don't deem the problem a very critical issue, it will usually be ignored. 'These are games that have a very large market,' Auriemma said."
Well duh (Score:4, Insightful)
Well of course they care only about performance Its all their user base really cares about.
Blame the users/consumers/people (Score:4, Insightful)
Well of course they care only about performance Its all their user base really cares about.
To be fair...nobody is interested in security until things go wrong, they will and they do. Then its look for a scapegoat, and the solution is to remove rights and privacy of the individual for the illusion protection, throw in a few laws, that only affect the law abiding and decent. Then we live in fear.
Re:Well duh (Score:5, Insightful)
Because by default we don't expect a game to compromise the security of our machine.
And, bluntly, I cannot fault the player, while at the same time knowing that games ARE a ticking time bomb. What really ticks me off about it is that there is usually no reason that it has to.
First of all, a lot of games require admin privileges on Windows, which always keeps me wondering why. What the FUCK is a game supposedly doing in areas where it touches anything that should remotely require admin rights? DRM, anyone? That's actually what really pisses me off, the game doesn't really need the privileges, but the useless crap that serves the player no purpose not only slows the whole crap down but also opens him up for an attack if the game has a security hole.
Now add that A-titles have a large player base and more and more of them require a network connection (DRM raises its ugly head again there) and see why they are a really interesting target for malware authors. First, unlike OSs and business software, security updates for games are not really a prime concern since there is with some certainty no business involved that could have a legal department which makes your life really unpleasant if your crappy software causes security concerns. The user doesn't worry if the software starts an online connection even if he doesn't intent to have one, since DRM is known to phone home, so firewall rules don't hit and the game has the rights to initiate contact to the outside world. Depending on the game, it might even be necessary to allow incoming connections. And to make matters worse, the game has admin privileges.
What more could a malware author ask for?
Re: (Score:2)
Two wrongs don't make a right, though. Doing this only convinces the studios that their DRM was not badass enough and needs more tightening to work.
Abstaining is the solution, and buying if, and only if, they do remove the DRM lockdown somewhere in the future. I really wanted to play R.U.S.E. I was really looking forward to it, but once I read what shape its DRM would take, I didn't get it. I still don't have it. The same is true for Diablo 3 and Mass Effect 3. Both titles that I really wanted, still want b
Re: (Score:2)
There is exactly NO excuse for games that require at least Windows Vista to run to NOT be aware of the security model of Vista, because obviously it was developed for it. Ancient games developed for Win95 and its immediate successors may be excused, but there is really no sensible excuse for games past WinXP.
A (new) game may even be excused to require elevated privileges to install, despite me even questioning this (unless I insist to install it in a non-public place, or the game needing updated runtime lib
Re: (Score:3)
Re: (Score:2)
Re: (Score:2)
Oh no! (Score:1, Funny)
Re:Oh no! (Score:5, Insightful)
Yep, and that patch will clean up your computer after hackers take over the server and run a remote shell on your computer and pilfer any information their botnet can find. Thank god we don't have to write secure software any more since we can patch it any time we need to before the hackers actually run exploits.
Re:Oh no! (Score:5, Funny)
Are you kidding? Why patch it.. is a feature, after all the future of modern warfare is cyber warfare! Users are now getting extra content for free,they should be thankful they aren't charged for a DLC pack that they are already using!
The remote shell is NOT a surprise (Score:1)
The game makes can install arbitrary code on the user's computer anyways by way of updates. (Anybody remember Sony's root-kit?). A remote shell is therefore trivial to implement.
Re:The remote shell is NOT a surprise (Score:5, Insightful)
The importance of the remote shell is not that "if you can get arbitrary code execution, you can get a remote shell" (this is pretty much a tautology). The importance is that it demonstrates the possibility of arbitrary code execution at all. A lot of security vulnerabilities are difficult to actually exploit. In most cases, the best that an attacker will ever achieve is denial of service ( a crash, or forced disconnect, or using up all the RAM so the game runs too slowly, or soemthing like that).
Contrary to what the movies would have you believe, actual exploits are (especially in a modern environment full of vulnerability mitigations) very difficult to produce in most cases. Many security researchers don't even bother with that step; it's enough to find the vulnerability and flag it "probably exploitable".
Re: (Score:3)
Contrary to what the movies would have you believe, actual exploits are (especially in a modern environment full of vulnerability mitigations) very difficult to produce in most cases. Many security researchers don't even bother with that step; it's enough to find the vulnerability and flag it "probably exploitable".
On another hand, unpatched, unresolved, unfixed security issues will attract hackers until they find a way to exploit them. So, no need to find an easy exploitable scenario to flag them as probably exploitable. Why someone should sit and wait it becomes exploitable to fix it? It's a kind of security through obscurity you are talking about. I'm sorry, but this must be secure by design.
Re: (Score:2)
What do you mean, I'm talking about security through obscurity? That makes nothing resembling sense. I certainly didn't suggest that the vuln shouldn't be reported if the researcher doesn't develop an exploit, nor that the developer shouldn't fix it. Some devs won't take a vuln seriously without a PoC, it's true, but that's a failure on their part, not on the researcher's. Some developers don't take security seriously regardless.
I also don't understand why you seem to think that flagging a vuln as probably
Re: (Score:2)
The attack stipulates the server-side is compromised. Updates come from the server-side. This is not a remote code execution, this is a compromised update server scenario, no need for any exploit at all.There is not much that can be done on client side to defend.
Re: (Score:2)
Good point on the distinction between server and client side, and the fact that a meaningful cliam is actually being made here (two, really: first that it's possible to get arbitrary code execution on the server, second that it's possible to leverage that into arbitrary code execution on the client).
However, I don't quite buy your argument about updates. The update server is not usually the game server. Compromising a game server doesn't (in theory) let you send an update to the client, much less force them
Re: (Score:2)
That's an oversimplification. If the patches are signed and the update system verifies the signatures using well tested libraries, it's probably much harder to attack it that way instead of using any of the other "data entry points", even if that data isn't supposed to contain code.
Re: (Score:2)
I agree, but only if the signature keys are off-line and well protected. This rarely seems to be the case though.
They focus on client level security to some extent (Score:3)
Since MW3 is on the same engine as the others... (Score:2)
Re:Since MW3 is on the same engine as the others.. (Score:4, Informative)
I am not sure how bad the vulnerabilities have become, but back then it was generally buffer overflow exploits that allowed player clients to be crashed, servers to be crashed or even the master server to be crashed. There weren't any exploits that I would consider critical, but they were highly annoying.
They could stop these things... (Score:2, Insightful)
... by you know having LAN and private servers again so hacks don't take down the community. Security wouldn't be an issue for Diablo 3 if you could play the fucking game offline. But corporate greed and the dumb masses that feed the move to "online only" games this will become more frequent.
Re: (Score:2, Insightful)
"If the masses want something that YOU don't, it doesn't make them dumb"
Single player lag is such an awesome feature, that didn't exist in Diablo 1 + 2 because of morons like you who don't understand technology. Only a tech illiterate would say something like what you said.
Re:They could stop these things... (Score:5, Insightful)
You believe all the propaganda they pushed to get you to accept DRM. Cheats have always been a natural part of playing games provided the player can control who you can play with. Cheaters could cheat to their hearts content in private games and not effect anyone else. Private servers/LAN allow people to choose who they play with, when and where. These centralized servers create huge security and points of failure.
Not only that but cheating in a single player game you paid for - there's nothing wrong with it because it hurts no one. You are victim of gaming PR and propaganda. You accept broken and inferior products that's not a sign of a healthy mind.
Re: (Score:1)
I currently have no problems choosing who I play with, when, or where. As for centralized servers creating huge security and points of failure... LOL! Keep reaching.
As for the product being broken and inferior... Seems to work better than diablo 2 ever did. I don't see people running around online with hacked gear in 24 out of 25 games like I did in diablo 2. Seems diablo 1 & 2 were broken and inferior to me. I don't have to install hamachi or another type of VPN software and wonder if the game is
Re: (Score:1)
I hardly had any of the problems you've had in past older games. There are tons of mods for Counter-strike, Team Fortress, etc with people running their own servers and quite successful. Hell, I was playing Tribes with 100+ players on private servers that hardly ever had any issues and were quite fast. Now they won't even let us play with more than 32 players if we're lucky, they're all focusing on 16 players max, and the lag right now is unbearable with these company DRM'd servers.
Re: (Score:1)
Man, you're really some special kind of idiot. They don't NEED to make the game exclusively online for you to have your "non-antisocial reject" features (man, you're really worried about your own image to be typing like this. Projection much?)
They can just have a toggle "offline" / "online" and if they're worried about cheating, make it so offline characters can't go online. Don't fucking kid yourself, the only reason they require an internet connection is because it's a form of DRM.
Re: (Score:2)
As for centralized servers creating huge security and points of failure... LOL! Keep reaching.
Ahem, you heard of Sony Playstation Network? If you haven't, you are grossly uninformed. If you have, you are an idiot for thinking as you do, and more of one for advertising your idiocy online.
Re: (Score:2)
Haven't you heard about the 0-day hacks infesting COD (Which are non-centralized servers)? Or the people who got hacked by using hamachi or other VPNs to set up LAN based games over the internet? Oh, how about Company of Heroes and their hacks since the servers aren't centralized, or their massive issues that STILL haven't been solved with people behind NATs. Guess you are grossly uninformed.
Re: (Score:2)
Re: (Score:2)
We were pounded by the same propaganda and didn't succumb. I agree with some of what you are saying as problems become more detailed and technical it's hard to figure out the truth.
But when it comes to games that have parts of their code taken hostage on the other side of the net for their SINGLE PLAYER component like diablo 3, most people (gamers) simply want to play and don't want to learn anything about how the tech works or how bad they are being ripped off. Those of us who grew up on PC games through
Re: (Score:1)
The upside of cheating and hacking is that it allows modding in game features. These game companies don't care about the cheaters that cheat their system, they don't want YOU to modify the game to make it better that everyone starts playing your mod instead of their crappy game modes. They made you accept DRM with the excuse of cheaters and hackers ruining your public game like they made you accept TSA at airports because of terrorism. And let me add on that there are people that are cheating and hacking in
Re: (Score:2)
If someone plays only by himself, why should I care if he cheats?
I played D2 offline, as well as online, with online being only with friends or on the "official" closed Battle.net servers. One might see why I never had a problem with cheaters, either I was by myself or with friends that I knew and trusted, or if I had to play with strangers I went for the venue that is now the only one.
What's wrong with offering me this option?
Re: (Score:2)
Because the hacks, cheats, and dups were on the official battle.net servers. Then you'd have the griefers that would only come online to try and kill off hardcore characters until they got banned and they wouldn't care because they'd just go play offline or on non-battle.net servers. All that went away, and good riddance.
Re: (Score:3)
No actually, the masses are dumb. They don't want their single player games to actually be multiplayer games. However, many of them have been led to believe it is a good thing via techniques of propaganda, which have time and again been proven to be effective at making people make poor decisions. The masses want someone else to make decisions for them. That's why we can't have libertarianism. It only works if people can make their own decisions responsibly, and most people don't even want to make their own
Comment removed (Score:4, Interesting)
Re: (Score:2)
No, they said they were sick and tired of running into griefers, cheaters, and people who ruin the game for others.
Re: (Score:2)
Re: (Score:2)
Security would absolutely still be an issue. The scope of an attack might be lower, but the actual threat of compromise would still exit unless they removed the multiplayer funcationity (clients and servers) entirely.
Re:They could stop these things... (Score:5, Insightful)
Well yes but THINK about having millions of people playing a SINGLE PLAYER GAME ONLINE, that means huge swaths of computers wouldn't have open ports/be communicating with servers at all if not for 'online drm'. Diablo 3 being a case in point, all these security issues are caused by gaming corporations wanting absolute control over everyone and everything in gaming.
The point is the whole centralization and DRM make security issues much bigger since companies tend to want control and as much information as possible about users and are careless with data. All that could be avoided if the multiplayer aspects of videogames didn't require being chained to online and all sorts of needing accounts, user info and other nonsense.
In Quake 3 you didn't need to sign up anywhere to play the damn game and you never had to give out emails or information to anybody. Not only that requiring users to be online when they play single player just creates a huge attack surface.
Re: (Score:2)
False. If you could play Diablo 3 offline and on LAN, there would still be a significant portion of the population that would want to play it on the battle.net servers. Just like Diablo 2. And those people would still need to have these security concerns addressed.
Patch will soon be here (Score:5, Funny)
Re:Patch will soon be here (Score:4, Insightful)
MW3. My mind will always translates as Mech Warrior.
Re: (Score:1)
Cancelled. They didn't have the funding to make it, and apparently hadn't even started on it judging by how the MWO guys had to start with zero assets after the sublicensing deal.
Re: (Score:2)
In any case, it is the same as it always has been. Noobs will grab the biggest slowest mech they can, group all their weapons and try to alpha people, thinking they have an autowin button. They don't. It's not. I can run circles around a
Re: (Score:1)
Funny, my mind will always translate it as Moraff's World.
Re: (Score:2)
Funny, my mind will always translate it as Moraff's World.
damn man.. I had forgotten about Moraffs games totally. was moraffs world any good?
Re: (Score:2)
MW3. My mind will always translates as Mech Warrior.
Same here!
Re: (Score:2)
Every time I see someone refer to Assassin's Creed 3 as "AC3" I read "Asheron's Call 3" in my head.
Hoi polloi (Score:1)
Dunia? (Score:2)
40 Comments and no console joke? (Score:2)
Hahahahahah! (Score:1)
It's so quaint they think anyone cares.
I told you little pirates (Score:1)
Well I'll Be... Do We Do Wop (Score:1)
Vulnerable to hacks indeed. WELL... if these Call of Duty Black Ops server thingies have become a problem, a way to hurt people I say maybe we should call it a day and just shut them down.
'Cause we don't want to hurt people now do we.
Do we??
Cheap Discount UGG Boots handbags sale (Score:1)