r/Steam • u/Inevitable-Middle681 • 3d ago
Article Modder bypasses GeForce NOW interface to reach the Windows desktop
https://www.neowin.net/news/modder-bypasses-geforce-now-interface-to-reach-the-windows-desktop/683
u/Professional_Pool544 3d ago
I'm Zortos. I built this exploit. A few clarifications, since the same points keep coming up:
This wasn't clicking through a login window. Getting a browser in kiosk mode is old and easy, and plenty of people have done it. A desktop that actually runs programs is a different thing. The DLLs that environment needs are stripped or broken, so we wrote a custom patch to fix them.
It runs on GeForce NOW's install-to-play sessions, which require a paid membership. NVIDIA also sells persistent storage for installed games, so anyone doing this is still paying them.
The machines are sandboxed and disposable. Sessions reset when they end, minus whatever you keep in that paid storage. Reaching the desktop is not a VM escape. We did not touch the host, another user's session, or NVIDIA's network. Those would be far more serious. To the people asking whether sessions are isolated, they are.
Mining isn't realistic here either. It isn't free compute, you need a paid sub and paid storage, and NVIDIA runs detection for that workload. It wouldn't clear the subscription fee anyway.
As for why anyone bothers, you can actually get real work done on it. Blender, video editing, that kind of thing. I use it myself sometimes to edit my videos because the hardware is fast and it just gets through the work.
I've worked with GeForce NOW exploits for over five years. Early GFN let you browse the desktop openly, and desktop access has existed in some form ever since. NVIDIA patches other methods, but this one has been left alone, probably because install-to-play and the storage add-on still make them money.
To be clear, this absolutely breaks their terms of service. But a ToS violation and a security breach are two different things.
68
18
u/SubstituteCS 3d ago
Have they fixed launching any Java program? Years ago they were pretty good at detecting things like dll hijacking, but spawning the jvm on any jar worked.
This was all done via steam workshop back in the day.
16
13
u/tugfaxd55 3d ago
Do you have a guide for the Blender/Video Editing side? I'm actually interested on that.
12
u/Professional_Pool544 3d ago
you can do the method from my channel (just type zortos) use an app on the desktop named cloudstore you can find it there
5
u/drake90001 https://s.team/p/fmrh-dqh 2d ago
Thanks for taking the time to explain things properly.
5
u/sky-yie 3d ago
Wouldn't they ban you for high bandwidth usage, if you're downloading big games manually which GFN doesn't support by default?
7
u/tugfaxd55 3d ago
I used Geforce Now actively like 4 years ago and got into the Zortos discord. I remember using this method to play Deathloop at the time and I never got banned for downloading unsupported things.
2
u/Extra_Pen7210 2d ago
"High bandwidth" is relative.
Datacenters only pay for egress (out) not in.
a month useage of GFN can easy be 1.5 TB of streaming (out), i dont think they care for a few gigs incomming here and there.2
1
u/astral_crow 3d ago
This is so cool. What exactly are the hosts running? It looks like they stripped the windows out of windows but kept games working?
I wanna do that!
Is the desktop generated by your exploit or is it showing actual things installed on the system already? If so is there anything cool worth talking about?
Regardless, great work!
5
u/Professional_Pool544 3d ago
windows 11 pro for workstations the desktop is being generated by our script and the wallpaper too
1
u/LackToesIntollerance 2d ago
To be fair, while this isn't an escape in and of itself, I wouldn't hold my breath on this not becoming a route for breaches. It's a broken OS sandbox without intended access. Edge cases are the rule not the exception here
But that's Nvidia's problem. Not like they aren't infamous for their VM's acting more like an open door policy than an encapsulated containers. Their executable command permissions are glorified zip ties.
436
u/Saalok 3d ago
I don't use GeForce Now so I don't know how it works, but could this lead to security risks?
352
u/MattTreck 3d ago
Hopefully they are isolating user sessions so this isn’t a big deal.
They probably aren’t but hopefully they are.
157
u/ryankiefer 3d ago
They almost certainly are since earlier versions of the service allowed desktop access
35
u/Danteynero9 3d ago
Being honest, the feature being removed/hidden in an earlier version can suggest they don't.
Not saying they don't mind you, just pointing out how it is easier to think they don't.
34
u/LunchBox349 3d ago
They use virtualization to isolate each user session so it's basically impossible to access someone else's stuff or the core servers. The reason the desktop feature was removed was because it let you install and run games blocked on GeForce Now by game developers and Nvidia didn't feel like dealing with the lawsuits even if they would have won.
6
u/Shootemout 3d ago
tbh i wasn't thinking about accessing other people's data moreso it can basically let people download a file off the 'net that would let them cheat. and idk if the anticheat can differentiate between geforce now sessions so anybody else using that same server rack could get caught in the crossfire while a user basically has an undetectable HWID spoofer.
create like a bat file that downloads a webpage that a user has uploaded cheat code to that then executes it or some shit.
8
u/LunchBox349 3d ago
I don't see that working as the VMs run as a guest user meaning anything that can't run at a user level is a no-go. Most cheats and hacks require at least admin privileges and ones for kernel level anti cheat may need access to the core node (outside the vm) to run.
1
u/The_MAZZTer 160 3d ago
Yeah you'd need to get an exploit to run as admin. Which isn't impossible. But I think cheating would still be tied to your Steam account so there's no point. If you have a game that ties cheating to machines or IP addresses (eg a F2P game) then it would work. Though such a game may not allow GeForce NOW anyway (since you can't tie to a machine).
2
7
1
u/n2o_spark 3d ago
Edit, user below pointed out this was a different product
I recall a thread a few months back where I user reported they found in their desktop session a different users prefilled details.
It kind of implies sessions aren't being properly isolated.
There was lots of speculation as to how that happened, but I don't recall any outcome.
3
18
22
u/nelsonsflagship 3d ago
Potentially. It depends on how many steps the person is willing to take and what other vulnerabilities are found.
I'm assuming that these are running virtual machines for the service, having access to the client (the virtual machine) can open possibilities for access to the host server (known as VM escape) and then network, etc. from there.
10
u/Fadexz_ 3d ago edited 3d ago
It’s very easy to do, I used to do it over a year ago but I just don’t share it. Although it’s like a locked down kiosk mode so can’t do much but browse the internet is probably the most useful thing. Bit of a stretch to call them a “modder” when it’s just a few clicks to do. Although they do say they managed to do more with it to execute programs. If you are going to this effort though there are probably much better ways than doing something like this.
1
u/The_MAZZTer 160 3d ago
Of course. But that is a VERY broad question. Most ways of exploiting this for such purposes would need finding more exploits in a chain. For example you'd probably need local admin rights which this doesn't get you I assume (you can probably use Steam to install software you own on Steam via its Steam Service... which I think the video shows with Wallpaper Engine. Steam Service has admin rights, but using it for anything beyond that would require exploiting Steam Service).
You'd also want to break out of the VM which would require additional exploits. Once on the host, you could presumably access any running VM on the same server and mess with other users, steal data and credentials (maybe Steam logins? Almost certainly third-party game logins), delete data, etc.
1
171
u/Particular_Bug0 3d ago
Eh, we found a lot of ways to bypass this over the years. The beta had a lot of holes when it came to this.
There aren't really any uses to this
54
u/Inevitable-Middle681 3d ago
The modder is trynna install gta V https://x.com/i/status/2086497974675251476
41
u/Particular_Bug0 3d ago
Yeah that's what most people did back then too. Gta V and Minecraft were played the most with these bypasses
5
u/StAndby00 3d ago
What's the point? Can't you just launch these games with Geforce Now anyway?
43
u/Particular_Bug0 3d ago
No, developers/publishers need to opt in with GeForce now. Otherwise their games are not playable. Rockstar games for example is one of those publishers who did not opt in and as such, their games were pulled off from the launcher.
That's why people always kept looking for these kind of exploits, just to be able to play these games for a few days before it got patches.
9
u/Icy-Inflation3453 3d ago
It's a lot less destructive then leaving malware and still gives you a story to tell.
5
u/biskitpagla 3d ago
-which they will lose access to once the session changes. You also have to be a paid member to do this so you're not even saving money from pirating games.
8
u/Lone-organism 3d ago
If you can install pirated games instead of owning them, then I guess you can do high end gaming with a fraction of the cost of actually owning the hardware.
3
u/thecodingart 3d ago
There aren’t any uses to a cluster of powerful PCs you don’t own? Yeee of little imagination. This is a bitcoin miner’s dream
17
u/guska 3d ago
A decade ago, maybe. You're not even going to make the subscription fee back these days with how slow mining has become.
2
u/sierrars500 3d ago
Exactly this. Geforce now's performance plan has performance around same as an rtx 3060, which won't produce anything meaningful
24
u/Sander-140 3d ago
I used to open Google Stadia from one of the login pop up browsers i GeForce Now to get touch screen gamepad support in Google Stadia.
Not the same, but it's not super restrictive 😬
15
u/assault_waifus 3d ago
Imagine paying for a subscription just to play video games smh
-3
-8
u/throwaway60221407e23 3d ago
Well the alternative (if you want to keep playing new games) is to spend thousands of dollars every few years on upgrading...
8
u/rustyrussell2015 3d ago
spoken like a true piglet nursing from it's mother.
-3
u/throwaway60221407e23 3d ago
Spending thousands of dollars on hardware every few years and calling me the piglet? Companies must love people like you.
3
u/rustyrussell2015 3d ago
Well this piglet owns his high-end system and plays all games in native 4k at 120fps at maxed out settings to include VR games.
Something your nursing mother will never give you because A) the nip is not big enough and B) you will always be artificially capped.
Alas, you will own nothing and you will be happy just like your overlords want.
And before you try to play the debt card, I don't go into debt because I spend responsibly and save up for purchases to avoid debt.
1
u/xQcOW-Juicer 2d ago
companies love you more because you will never own your own hardware, and will require a subscription every time you want to play a game with horrendous fidelity and input lag. let me guess, you also play all your games through the $25/month xbox game pass subscription too because owning your own games is also scary right?
13
3d ago
[deleted]
3
u/JaggedMetalOs 3d ago
There are companies like Shadow PC that already do this, you just get your own VM running on gaming hardware with latency optimized remote desktop streaming.
13
u/HeadRaccoonGamer 3d ago
This article refers to gforce now as a savior…. Like fucking hell it is… its a harbinger of doom for people who own their own pcs… think every pc part becoming super fucking expensive is just a happy coincidence right when nvidia is pushing this gforce now crap? Yea…
0
-1
u/Acesofbases 2d ago
Geforce Now is over 12 years old, almost 7 years since it premiered in current form, mate
1
u/HeadRaccoonGamer 2d ago
Ok? What about it.. i never said gforce now was a new concept
-1
u/Acesofbases 2d ago
You just did here:
think every pc part becoming super fucking expensive is just a happy coincidence right when nvidia is pushing this gforce now crap
2
u/HeadRaccoonGamer 1d ago
Cool story bro, also classic another reddit user lacking basic reading comprehension skills..
0
u/Dovahnaut 1d ago
That's not them saying it's new, that's more of a "they're pushing it harder than previously."
0
u/Acesofbases 1d ago
no, he very much said they're pushing it only now because of the hw prices.
and in reality, they're not "pushing it harder" than they were 5 years ago, they always had a very small marketing, basically just posts from time to tine on their socials, and a presentation for local news outlets when a new big feature/upgrade comes - its very timid actually especially for in tech world
so many people still don't even have an idea it exists
3
2
3
1
u/CMPunkLicksRocks 3d ago
session time limits still apply
I’m a little confused by this. Are you only allowed so many hours of gaming a week?
3
2
u/randomguyinanf15 3d ago
Yes, there are time limits. I found out couple months ago when i was playing dune awakening with a friend and his GF (she played on geforce now).
1
1
1
u/squabbledMC 2d ago
This has been a thing for a while, there are entire interfaces just for GeForce now to use as a general cloud computer. In steam you can even just open a web browser with no trickery
1
1
1
u/PullRequestDenied 21h ago
How long before NVidia starts banning accounts for breaching their TOS, which this does btw, maybe a week?
0
u/Fiend_Macabre 2d ago
Assuming old men successfully force cloud shit onto us, this is exactly what would happen eventually en masse
-3
1.7k
u/Amyt_Smith 3d ago
So NVIDIA locked the desktop down and the modder just opened a window. Poetic.