Secret Club has published multiple videos showcasing exploits of RCE bugs in CS:GO from multiple researchers claiming that Valve ignored them for long periods, from five months to a year. Researchers claim Valve ignores reportsĬarl Schou, a leading member of the Secret Club, told BleepingComputer that an attacker could leverage this RCE vulnerability to steal sensitive information like credentials or banking information. While Valve does not actively prevent Florian from sharing the details, the researcher has strong ethical principles and knows that full disclosure would put millions of users at risk. Some bug bounty programs on HackerOne have a policy that allows researchers to disclose exploits or vulnerabilities if a fix is not available after a reasonable period like 90 or 180 days. “We intentionally did not mention that because we do not want people to search for the patch in the game binaries as this would greatly reduce the effort to rebuild the exploit for all the other unpatched games” – Florianįlorian is a member of the Secret Club, a non-profit group of reverse engineers who complained on Twitter over Valve taking so long to address the issue in all games. The researcher did not disclose which game received the fix but told us that he was able to confirm Valve’s actions. The last Florian heard from Valve was about six months ago, when Valve paid him a bounty and said that it was in the process of fixing the problem, and that it had addressed it in one specific game using the Source engine. He made a demo video showing how an attacker could exploit the vulnerability and execute code on a target computer by simply sending a Steam game invitation to the victim. In a conversation with BleepingComputer, Florian said that CS:GO still had the vulnerable Source code on April 10th and the bug could be exploited to run arbitrary code on a machine running the game.Īlso Read: Compliance Course Singapore: Spotlight On The 3 Offerings Last month, the game counted close to 27 million unique players, according to stats on the game’s page. However, among the games affected is CS:GO, whose latest update was on March 31. Exceptions are games built with Source 2 or those that run a modified version of the Source engine, like Titanfall. He told BleepingComputer that the vulnerability is a memory corruption in the Source engine code, so it’s present in multiple game titles. Bounty paid, bug still activeįlorian, a student passionate about reverse engineering, reported the remote code execution (RCE) flaw two years ago through Valve’s bug bounty program on HackerOne. What irks the group is that after all this time they cannot publish the technical details about the bug because the bug is still affecting some games. Some of the games that utilize Valve’s Source engine include Counter-Strike, Half-Life, Half-Life 2, Garry’s Mod, Team Fortress, Left 4 Dead, and Portal. One of the researchers in the group says that they disclosed the vulnerability to Valve about two years ago, yet it continues to affect the latest release of Counter Strike: Global Offensive (CS:GO). In this case, multiple game titles built with Source are affected and require a patch to eliminate the risk to users. A group of security researchers known as the Secret Club took to Twitter to report a remote code execution bug in the Source 3D game engine developed by Valve and used for building games with tens of millions of unique players.Ī vulnerability in the game engine propagates to products built with it.
0 Comments
Leave a Reply. |