News for hackers. Stuff that matters.
Re:Bytecode Breakdown: Unraveling Factorio's Lua Security Flaws by hypeatei on Saturday June 29, 2024 @12:45PM (#40831805)
> A multiplayer game where a server can be extended with custom code via plugins

A game called Mordhau (based on Unreal engine) had a built-in "message of the day" feature where server owners can put in a URL that loads an in-game browser when the player connects. No client side option existed to disable the browser and I believe the devs eventually disabled it completely but I'm not sure the status of it now.

Just shows how complex games / game engines are getting where you have an embedded web browser for seemingly no good reason.

Re:Bytecode Breakdown: Unraveling Factorio's Lua Security Flaws by zachrip on Saturday June 29, 2024 @03:27PM (#40832839)
A lot of games have web browsers embedded nowadays for ui
Re:Bytecode Breakdown: Unraveling Factorio's Lua Security Flaws by dfox on Saturday June 29, 2024 @04:43PM (#40833231)
Unreal Engine has something that can be called embedded web browser since the day one. The original Unreal Engine is this thing that has its own implementation of “something not entirely unlike JVM” and refers to various things by means of URLs.
Re:Bytecode Breakdown: Unraveling Factorio's Lua Security Flaws by ooterness on Saturday June 29, 2024 @05:03PM (#40833343)
The game "Tabletop Simulator" allows you to spawn various objects into a VR playspace. One of the objects is a tablet PC, which displays a little web browser on its virtual screen. It's handy to look up rules or whatever without leaving VR.

The last time I tried this, the browser had a notification that it was out of date and needed updates.

Thinking about this broke my brain a little. I have no idea how to apply software updates to the virtual browser on the virtual tablet running in a virtual room simulated by my (hopefully real) PC.

Re:Bytecode Breakdown: Unraveling Factorio's Lua Security Flaws by CapsAdmin on Sunday June 30, 2024 @12:26AM (#40835135)
Garry's mod uses Lua on server and clients. It also has the ability to create an embedded web browser on the client.

There have been many exploits throughout the years, including this particular exploit with bytecode, though in LuaJIT. Some were source engine related, some LuaJIT related, some web browser related (Awesomium) and some even steam overlay related.

I believe one funny thing about Awesomium was being able to read arbitrary files outside of the sandboxed virtual file system by using the file:// uri scheme. I think some debug related commands in source engine would also allow you to get a list of files outside of the virtual file system.

At one point someone even managed to install actual malware on my computer and sent me screenshots of my desktop. I forgot what the exploit was though.

Re:Bytecode Breakdown: Unraveling Factorio's Lua Security Flaws by andersa on Sunday June 30, 2024 @09:46AM (#40837143)
> sent me screenshots of my desktop

Damn. That's the scariest thing I've read all week.

This thread is really making me consider buying another computer for all gaming related things...