News for hackers. Stuff that matters.
Re:Valve accused of ignoring existing RCE vulnerability in S... by sodality2 on Saturday April 10, 2021 @01:55PM (#26763456)
Dozens of Counter-strike exploits exist and the cheating scene has just grown too rampantly. Valve simply doesn't care about the source engine. Any new CSGO player will tell you the anti-cheat doesn't work, I know first-hand.

The lack of care regarding source engine netcode extends to every part of the source engine, including Valve Anti-cheat.

The anti-cheat is trivial to reverse (several PUBLIC bypasses have existed for years on github, with zero patch), the engine source has been leaked, reverse engineered, and fiddled with by thousands of 14 year old kids. It is pathetically easy to bypass, for example, by changing a single byte in memory you can see through walls, see enemy money, etc. See this video I found about how miserably broken it is: https://files.catbox.moe/8e3bxz.mp4

It is in my opinion the greatest loss to gaming that a classic, legendary game like Counter-strike got completely ruined by lack of care by a company that profits millions off of the case unboxings.

Re:Valve accused of ignoring existing RCE vulnerability in S... by valec on Saturday April 10, 2021 @05:29PM (#26765301)
> CSGO player will tell you the anti-cheat doesn't work, I know first-hand.

> It is in my opinion the greatest loss to gaming that a classic, legendary game like Counter-strike got completely ruined by lack of care by a company that profits millions off of the case unboxings.

have you played the game in recent years? this has not been the case for me or the people I play with at all.

when playing on high trust-factor accounts, cheating is basically eliminated.

the experience for newer players is pretty bad but once you convince the system you're trustworthy, the algorithm does an extremely good job of not matching you with cheaters.

what valve lacks in boring, sensible solutions they make up for with interesting often much more complex workarounds (see: the open-world csgo danger-zone map shoved into a game with a room-based engine)

Re:Valve accused of ignoring existing RCE vulnerability in S... by issamehh on Saturday April 10, 2021 @05:39PM (#26765387)
Just 2 days ago on prime I ran into a string of cheaters. At one point we had 2 on the enemy team and it caused someone on my team to go toggle. 3 cheaters in one match. On old accounts with everything.

I know he couldn't be an expert but the person on my team says he can he blatant every game and never get banned because we're on prime. I don't want to believe that but then he had a lot of items and didn't mind spinbotting at all.

Re:Valve accused of ignoring existing RCE vulnerability in S... by cmeacham98 on Saturday April 10, 2021 @06:06PM (#26765597)
From my understanding the CS:GO matchmaking basically ranks how likely of a cheater it thinks you are, and matches you with people of a similar ranking. If you're queuing with people that are bragging about blatantly cheating you're probably in the "likely cheater" group.

This is all really just anecdotes, but here's my counter anecdote. I play csgo on and off with friends. None of us have ever cheated in csgo (or any other competitive online game for that matter). I'd say we get about 1 obvious cheater every 50 games, with 2-3 less obvious "maybe they're using wallhacks" as well. This is significantly improved from 3-4 years ago where we got a cheater once every 4-5 games.

Re:Valve accused of ignoring existing RCE vulnerability in S... by issamehh on Saturday April 10, 2021 @10:40PM (#26767103)
I didn't queue with the cheater. He was a random on my team who happened to turn the cheats on when we were losing to a cheater. He left the game and everything to launch them.

The rest of us aren't cheaters. We have old steam accounts with lots of games, items, and play time. We have prime. We still got put into that lobby. I'm not good enough to look like a cheater on my playing alone either.

Re:Valve accused of ignoring existing RCE vulnerability in S... by sfilipov on Saturday April 10, 2021 @07:53PM (#26766407)
Exactly! I get blamed for cheating and reported (trust me I don't) so I whenever I play matchmaking I'm also in the "likely cheater" group. That's why I play on third party server with their own anti cheat system.
Re:Valve accused of ignoring existing RCE vulnerability in S... by gsich on Saturday April 10, 2021 @06:38PM (#26765878)
>when playing on high trust-factor accounts, cheating is basically eliminated.

Yes, but this is not a technical fix. You just hope that accounts with more "value" cheat less. Which is true in most cases.

Re:Valve accused of ignoring existing RCE vulnerability in S... by sodality2 on Monday April 12, 2021 @01:55PM (#26782691)
That's another HUGE issue: stolen accounts are a massive underground market and while your skins can't be stolen usually, the account can be hacked on and get banned. You can get stolen prime accounts for under $5 and high value accounts for very cheap.

Trust does actually work a lot of the time. But you'd think account security would be easy for them to crack down upon.

Re:Valve accused of ignoring existing RCE vulnerability in S... by sodality2 on Saturday April 10, 2021 @06:45PM (#26765942)
Trust DOES help an immense amount. New players will NOT have good trust, though, hence why I said ask a new CSGO player.
Re:Valve accused of ignoring existing RCE vulnerability in S... by hippira on Saturday April 10, 2021 @10:02PM (#26766946)
If you play on Asia region there’s 8/10 chance you will be matched with a hacker from China. The hacking industry there is making serious money.
Re:Valve accused of ignoring existing RCE vulnerability in S... by skim_milk on Saturday April 10, 2021 @02:41PM (#26763870)
>and fiddled with by thousands of 14 year old kids

People think you're kidding, but it's really that easy on Source! For a while, the most popular TF2 (a Valve Source game) hack was created by a 15 year old. He made at least a million dollars in profit too! (can't remember if this factoid was verified or not, but he can definitely pay for college now) I wasn't as nearly as talented but I made some hacks for fun when I was 15 or 16 years old.

Re:Valve accused of ignoring existing RCE vulnerability in S... by chc4 on Saturday April 10, 2021 @04:13PM (#26764710)
Video game cheats and anti-cheats are almost completely disjoint from remote code exploits like what are reported in the OP.
Re:Valve accused of ignoring existing RCE vulnerability in S... by sodality2 on Saturday April 10, 2021 @06:45PM (#26765948)
>The lack of care regarding source engine netcode extends to every part of the source engine, including Valve Anti-cheat.
Re:Valve accused of ignoring existing RCE vulnerability in S... by grawprog on Saturday April 10, 2021 @04:43PM (#26764973)
Normally, I can handle some cheating in games, you just kinda deal with it, but holy fuck csgo was just nope. Between foul mouthed children and essentially watching God hackers play against eachother while you just die over and over.

Yeah....no not exactly fun.

Re:Valve accused of ignoring existing RCE vulnerability in S... by P_I_Staker on Monday April 12, 2021 @10:30AM (#26779830)
Do you know for sure people are cheating? I have limited experience with GO, but in source expert players certainly seem like cheaters. I've definitely been called out for scouting 3 people from garage in office. I don't completely blame them, it seems like magic.
Re:Valve accused of ignoring existing RCE vulnerability in S... by ChickeNES on Saturday April 10, 2021 @07:42PM (#26766339)
> foul mouthed children

Luckily you can now report accounts for this, and with enough reports they will be auto-muted now.

Re:Valve accused of ignoring existing RCE vulnerability in S... by grawprog on Sunday April 11, 2021 @01:50AM (#26767768)
That's good to know. Hearing the squeaky voice of a prepubescent child repeating racial slurs incessantly for 10 minutes straight while giggling to themselves like it's the funniest fucking thing in the world gets a bit grating and kind of tries ones patience. It's not exactly what one typically enjoys listening to while trying to relax and kill some time gaming.
Re:Valve accused of ignoring existing RCE vulnerability in S... by happyconcepts on Sunday April 11, 2021 @03:08AM (#26768148)
Pity you need the computer to press mute for you. I do it myself but I don't have a butler either.
Re:Valve accused of ignoring existing RCE vulnerability in S... by sseneca on Saturday April 10, 2021 @02:31PM (#26763772)
The outrageous profit Valve make from skins and the like is only half the story imo, their internal structure is the rest. Some of the stories ex-devs share from that place are just... idk, they explain the company’s apparent ineptitude
Re:Valve accused of ignoring existing RCE vulnerability in S... by gameswithgo on Saturday April 10, 2021 @06:31PM (#26765817)
No anti cheat for FPS games has ever "worked", it can't. The best you can do is make it a little hard for the cheats to keep up with your detectors or protocol changes.
Re:Valve accused of ignoring existing RCE vulnerability in S... by sodality2 on Saturday April 10, 2021 @06:46PM (#26765959)
That's absolutely true! Valve anti-cheat has entirely failed at that. Free open source cheats exist that VAC just cannot detect. Period. Wanna know the secret? The fact that it's a Java cheat.
Re:Valve accused of ignoring existing RCE vulnerability in S... by na85 on Saturday April 10, 2021 @10:54PM (#26767157)
What's the magic of Java? Is it just that VAC doesn't/can't inspect the jvm?
Re:Valve accused of ignoring existing RCE vulnerability in S... by sodality2 on Saturday April 10, 2021 @11:18PM (#26767233)
Some speculation it is Java, some that it is Java's license, some that it is the license the cheat is under (open source), etc. No one really knows why.

Strangely the only difference between one java cheat that was detected and one that has been undetected for four years, is that the original, old java one that got detected was licensed upder GPL, and the newer one is licensed under AGPL. Then there's a newer fork with a GUI that is undetected for ~2 years.

VAC seems to be... unable or unwilling to detect Java cheats. The original, old one got detected, though, and it was Java. so there is a tad of confusion.

I have sent countless messages to valve offering patches for several current exploits, like the current server lagger/crasher that allows teleportation. They literally just do NOT care. At all.

Re:Valve accused of ignoring existing RCE vulnerability in S... by hoffs on Saturday April 10, 2021 @06:14PM (#26765652)
You found a video that says that they detect most old cheats from hl2 days and ban them and then the video just goes to show random github repos. What is that even supposed to prove? Theres nothing stopping anyone from creating repos with cheats that get detected or don't even work. Like it's just a super cringe "gotcha" type video
Re:Valve accused of ignoring existing RCE vulnerability in S... by sodality2 on Saturday April 10, 2021 @06:44PM (#26765935)
They are all undetected. VAC bypasses are public and have existed for years with no patch.