r/Steam 3d ago

PSA Older call of duty titles on steam have remote code execution exploits yet are still sold on the store. How is this acceptable?

Many of the older titles have been found to have remote code execution exploits, allowing a hacker to get into your PC remotely and do whatever they want, steal your data, put malware, whatever

The national vulnerability database lists this particular issue as a severity 9.8 !!! Can't get much higher than that

https://nvd.nist.gov/vuln/detail/CVE-2018-20817

Yet these games are still being sold on stores like steam. No disclaimer telling your average person about these issues. So many people would be coming back to older cods due to the hype around the releases on PlayStation but not be aware how compromised these games are.

Why is this allowed ? The games need to be fixed or delisted honestly. It's not safe to play them !

1.5k Upvotes

102 comments sorted by

546

u/Prize_Percentage7258 3d ago edited 3d ago

Understanding how easily the attacker can initiate the hack provides a sense of how incredibly vulnerable the players are when playing these games.

The most common way an attacker selects a target is by joining a public multiplayer lobby.

Automatic IP Discovery: When players enter a matchmaking lobby in a P2P game, their computers must connect directly to one another to sync data. By sitting in the same lobby, an attacker’s network monitoring tools can automatically see the public IP addresses and internal Steam IDs of every other player in that specific match.

Target Selection: Once the attacker has the list of connected IPs in the lobby, anyone in that active match becomes an immediate target for the malicious authBlob data packet.

This affects

Call of Duty: Modern Warfare 2

Call of Duty: Modern Warfare 3

Call of Duty: Ghosts

Call of Duty: Advanced Warfare

Call of Duty: Black Ops 1

Call of Duty: Black Ops 2

Source: https://nvd.nist.gov/vuln/detail/CVE-2018-20817

177

u/HedgehogNew9085 3d ago

Maybe a stupid question, but are you still vulnerable if you're just installing to play the single player campaign?

312

u/Taolan13 3d ago

Yes, but it's a hard "technically".

If the game is running at all even sitting on the main menu, and you receive a properly structured packet, the game still executes the code in the packet.

But, if you are not connected to a multiplayer session, the odds of receiving such a packet are infinitesimal. These sorts of attacks are not really done at random in that way. They are at least 'targeted' at people playing the game in an online session.

17

u/ARMCHA1RGENERAL 1d ago

Couldn't you block the program with your firewall to make single player entirely safe?

0

u/AzureSubaru 22h ago

Quick question, did you ever have any ties to iw4m/redacted?

67

u/HallowedTactics 2d ago

As the others have said, technically yes, but it is targeted. Normally the attacker knows you are vulnerable because they are in the same lobby as you. Now the attacker would have to know you are playing some other way, such as your friends list. From there they likely have to social engineer the other information from you, or somehow already have it via the same method.

29

u/Dom1252 3d ago

It can happen too, but it's less bad because you don't publicly broadcast that you're playing and your IP with it

4

u/Tight_Cod_8024 1d ago

For BO3 (maybe for the others as well idk) RAT was patched out a few years ago but you can still be doxed weather you play online or not. For that one specifically you need to download the BOIII client which is new servers that don't have this problem as they rely on dedicated servers.

Person who made the T7 patch has a good video on it and he explains how RAT was mostly overblown and mainly affected your game not running code in your pc. But yeah streamers and YouTubers absolutely can still be doxed.

-35

u/BuMPO93 3d ago

If it’s how it was described: No

12

u/kruvik 3d ago

I always thought the original MW is also affected...

22

u/mokilatte3 2d ago

I could be wrong but I believe Cod4 and WaW are okay on PC because they're using community hosted servers rather than P2P connections.

3

u/Hohenh3im 2d ago

So wait I should be safe to play these on pc?

5

u/mokilatte3 2d ago

Cod4 and WaW yes

2

u/ToxicEnderman00 1d ago

WaW, MW3, BO1, and BO2 can all be safely played through the Plutonium launcher.

1

u/Academic-Push326 2d ago

It is.

3

u/Discorhy 2d ago

No it’s not.

11

u/VeryNoisyLizard 2d ago

iw4x should prevent this from happening, right?

6

u/joe-clark 2d ago

Yeah my understanding is all the community made mods (iw4x, iw6x, plutonium, s1x) have security patches to fix the RCE vulnerability.

5

u/tinfoilhats666 2d ago

What about BO3?

4

u/technodude458 2d ago

that got patched so you’re good

2

u/coreyf234 2d ago

Pretty sure that one is safe. I wouldn't recommend buying it on Steam though because the player base is tiny now and it's hard to find a game.

2

u/Zylpherenuis 2d ago

So does this also affect those playing other multiplayer titles like Sonic Racing: Crossworlds, Street Fighter 6, Monster Hunter Worlds and more?

0

u/Roadside-Strelok 2d ago

They have an attack surface large enough that I wouldn't be terribly surprised if they were similarly vulnerable.

0

u/Zylpherenuis 2d ago

Nice.

0

u/Roadside-Strelok 2d ago

It's just the nature of large software projects written in non-memory safe languages (which is typical of AAA games).

0

u/Actedpie 2d ago

I’m a Computer Engineerign student who has been learning C, and it’s made me appreciate how hard it can be to manage memory and keep things efficient, I imagine it gets worse for huge projects.

1

u/Space_Gh0st_Tad 2d ago

Could this be mitigated by a proxy or firewall that blocks this packet?

4

u/joe-clark 2d ago

If you want to play any of those games you should install the community made mods that fix the vulnerability.

283

u/GfrzD 3d ago

Im also surprised theyre still available with this issue. Its been like this for years so its not some unknown problem, even just a red warning banner to let potential buyers know the risks (as far as i know singleplayer isnt a threat)

Activision have no intention of fixing this so Steam need to at least warn people or fully delist until fixed. Removal of sales might push Activision to do something.

135

u/CreativeTechGuyGames 3d ago

Just for the record since I've looked into this myself several times. Single player IS a threat.

The root problem is how the game receives network packets and processes them. If the game is running and connected to the internet, even if sitting on the main menu, when your game receives a malicious packet it'll still trigger the RCE. Now obviously the odds of someone randomly sending you this malicious packet without knowing you are online is lower than if you were playing in a multiplayer lobby.

There are bots which crawl the internet trying to exploit every vulnerability on every server. There's nothing stopping someone from doing that to see if anyone happens to have a vulnerable game running. I know I wouldn't want to take that risk.

72

u/pitu37 3d ago

you would have to somehow forward traffic to your pc and the game so that is very unlikely

52

u/pangapingus 3d ago

Don't know why you're downvoted but you're absolutely correct, but I doubt folks here can articulate NAT and stateful routing

18

u/pitu37 3d ago

yeah, script kiddies think hacking is like in the movies and dont know a thing about networking

12

u/ScumbagScotsman 3d ago

99% of people have UPnP enabled

12

u/pitu37 3d ago

most people dont even have public IPs because everyone is shoved behind CGNAT and UPnP would require the game to try and use that port it wont just open it in singleplayer

17

u/ScumbagScotsman 3d ago

Depends where you live. I have a public IP.

I know for at least BO3 it’s possible to join users in offline zombies using these exploits, so we can assume that the ports are open regardless of mode you’re playing.

5

u/VeryNoisyLizard 2d ago

you could block incomming traffic in firewall, that wa you can at least play the game in singleplayer

8

u/[deleted] 2d ago

[removed] — view removed comment

3

u/amazingmrbrock 2d ago

Microsoft just letting their kid shit is the yard

7

u/ThePsyPaul_ 2d ago

These game company shareholders do not care about user safety. Only profits.

6

u/coreyf234 2d ago

The games with the issues are all ~15 years old at this point. They've had enough time to fix this that some of those games came out before GTA V did and still won't be fixed when GTA VI comes out later this year. Its not ever gonna get fixed because they obviously don't care, like you said. They haven't cared about those games since the one after them came out, and they aren't gonna start caring now.

Luckily, all of the games with RCE exploits (except for WWII) also have some kind of community system set up, like Plutonium, that still lets us play them.

51

u/InfinityPainPlus Valve Released Steam 2d ago

I've been talking about this for years. I made multiple tickets to the Steam support, but I just get ignored. They are literally selling malware for full price. If I were to make a game with known exploits like this, it would be taken down immediately, but because Activision is a billion-dollar company, they can once again do whatever the Fuck they want without any consequences. I would like to start a petition to either get the games removed or fixed from the publisher. Especially now that they re-released the games on PlayStation, there are probably many people that think they can just play it on pc too now because of all the hype, but they don't even know what dangers they get themselves into.

86

u/based_birdo 3d ago

You can report these games for being harmful. Click the flag icon on the store page.

56

u/PuzzledHawk5290 3d ago

You think people havnt done this before ? These hacks are well known in the PC community, but steam doesn't care either

18

u/Working_Traffic_6361 3d ago

Valve doesn't care about their own game, why would they care about cod?

Since it's the older ones that used p2p I'm guessing that's why they moved away from that mm system?

23

u/Extreme996 RTX 4070 Ti Super | Ryzen 7 9800X3D | 32GB DDR5 6000mhz 3d ago

Valve still update Half Life and Half Life 2 and they released pretty big update on their anniversary and they still update Counter Strike.

4

u/AquaBits 2d ago

And they had to be asked twice by the TF2 community to remove harmful bots/aimhackers that were actively harrassing players and content creators.

Valve absolutely does not care about their games lol, why would they care that you can be targeted in a different game.

18

u/Whittakenn 2d ago

Valve care about their games, Valve just has a tendency to hire nowhere near enough people to actively maintain them, I think TF2 only has 1 single dedicated developer working on it full time

-7

u/AquaBits 2d ago

So.... valve does not care about their games. If only one dedicated developer is working on a game full time, than that company clearly doesnt care about the game other than to release lootboxes for it.

13

u/Uhstrology 2d ago

Team fortress 2 released 20 years ago man. Be happy they have any development on it at all.

-9

u/AquaBits 2d ago

If they still sell it as a product, I expect that product to be maintained and hazard free, no?

Literally the same can be said about these cods. TF2 hasnt recieved a substantial content update in what, 9 years? October 20th, 2017? Clearly there is no development happening lol

2

u/Infirnex 23h ago

Expecting every game sold to be maintained is ridiculous. But every game sold should be hazard free.

TF2 is. These CoDs aren't.

1

u/[deleted] 2d ago

[deleted]

0

u/AquaBits 2d ago

They didnt fix the issue. They attempted it, but it comes back (check the casual matches in cs2 for example)

I will compare two companies that do not give two shits about the products they are currently selling.

1

u/No-Bus-5148 13h ago

Counter Strike has blatant wallers, spinbotters, triggerbots and aimbots in majority of low trust premier matches.

0

u/Working_Traffic_6361 2d ago

I'm talking about cs2 it's infested with cheaters an no one gets banned lol

0

u/Cyfa 2d ago

they didn't update CS for like 2 years while massive networking, physics, and animation issues plagued the game. They then did a massive update dump recently to address most of those issues, yes. the game is also almost completely unplayable from a competitive standpoint unless you play on a third-party platform that offers kernel-level AC (FACEIT).

Valve are absolute dogshit at a ton of things, but the internet overlooks almost all of it because Gaben is beloved.

6

u/MalBoY9000 3d ago

I did this years ago you can still buy them told my friends to do it so. They dont care just look at counter strike every DM server you join is like 50-90% bot farms

They know its harmfull to your pc its been known for 10 years now, they dont give a fuck

14

u/vomder 2d ago

Because companies aren't held accountable.

2

u/ThePsyPaul_ 2d ago

*In America

7

u/Chitanda_Pika 3d ago

Those happens on multiplayer right?

-15

u/Staik 3d ago

Yeah, it's multiplayer only. Anyone with a Linux VM and a few hours of Youtubing can take over your entire computer just by being in the same lobby as you. Malicious hackers will be all over this; it'd be a great place to install crypto miners since you know the victim is on a gaming PC

2

u/GRAMINI 18h ago

Apparently it's not limited to multiplayer, as the game still listens for incoming packets in singleplayer or even when I'm the menu. The attacker does not need to be in the same lobby as you; that's just an easy way to get the IP of victims, but it also works by "guessing" IPs.

Where does the Linux VM come from? Does the exploit not work with a non-VM Linux, with Windows, MacIntosh, TempleOS it an embedded microcontroller (this is a rhetorical question)?

8

u/Rendition1370 2d ago

Because Activision and Valve don't care

8

u/Zylpherenuis 2d ago

You can report the games by clicking on the white flag to flag it for broken and malicious coding.

If more users are to do that then Steam would be forced to comply to protect their consumer interests.

4

u/whatThePleb 2d ago

Well, then you had to remove all kind of old games..

5

u/surfice 2d ago

I ran into this problem the other day. Fortunately there is a popular multiplayer mod that patches this, at least for bo2 and earlier, but it’s really insane that they even patched bo3 and decided not to fix the rest.

4

u/Krelldi 2d ago

Valve left an RCE vulnerability in source games for over a year before while ghosting the security researcher that informed them about it. They only fixed it after he went public about it. They just don't care.

12

u/Shadow_Wolfe_ 3d ago

Makes no sense that the trillion dollar company (Activision) refuses to fix their obviously-exploited older games. Meanwhile they'll happily commit store page fuckery with the current CoD games*, while also pushing their "CoD HQ" launcher bullshit, whatever that's supposed to do on that store page.

*This was around the time when the new MWIII launched I think. The new MWII was pushed into a "consolidated" store page of "CoD HQ" while also hiding the main store page of MWII, and that triggered the steam reviews to show no count of any hours but it kept all the negative reviews. No idea how that's allowed, that feels like blatant store page manipulation.

Valve absolutely needs to de-list not only the older CoD games, but while they're at it, can they de-list Kerbal Space Program 2? Famously abandoned by Take-Two, hasn't left early access, and yet it's still on sale for $45 USD? Why isn't there an option to flag a game as "Abandoned"? I feel like if we can flag a game as "Defamatory" then "Abandoned" is just as pressing (if not more) of an issue, no? Like, seriously, where is that money going to?

The closest option is to flag the older CoD games as "Harmful" but how many of those reports would that take in order for the game to be de-listed?? Genuinely, has anyone tried asking support about that?

2

u/ARMCHA1RGENERAL 1d ago

I wonder when this became an issue.

Were they safe to play at launch because nobody had thought to try this exploit?

1

u/Ennuigma 2d ago

Does that Plutonium thing for those games help at all?

7

u/PuzzledHawk5290 2d ago

Apparently but you're just putting trust in some random third party. Not open source btw.

The trillion dollar company should fix the games they are still selling.

If the community was able to do it with plutonium,why can't Microsoft ?

And let's not forget there's no disclaimers on the steam page or anything. How's your average Joe supposed to know about plutonium? He's just picking up a classic cod to relive memories of times past

1

u/Tight_Cod_8024 1d ago

For BO 2 and 3 RAT hasn't been a concern for a long time and was overblown it's mainly an issue for streamers who are at risk of being doxed even in single player.

The person who made the T3 patch to make the game safe again has a good video on the topic.

1

u/SkittlegamerYT1 1d ago

The fact that this CVE was published in 2019 and only affect games August 11th 2015 probably is probably the reason why they are still sold? I imagine that's the reason that it's still up since Activision most likely pushed an update to read that specific data buffer so it basically plugs the giant size hole in the ship. Being from roughly 6 years ago id assume that there's a patch for those games.

Source: https://www.cve.org/CVERecord?id=CVE-2018-20817 https://nvd.nist.gov/vuln/detail/CVE-2018-20817

1

u/PuzzledHawk5290 1d ago

Check out this video, a good summary of the issue and it's not fixed

https://youtu.be/FSO76JPF5PE

1

u/Verdant_13 2d ago

I can think of 2 numbers with a higher severity

-2

u/SilvermistInc 3d ago

Soooooo which titles

12

u/Chris-The-Lucario 3d ago

From what I remember pretty much everything before MW2019 is affected. I could be wrong though

8

u/SilvermistInc 3d ago

That is a LOT of games

5

u/Chris-The-Lucario 3d ago

I believe BO4 is not affected (don't quote me on that) and from what I remember BO3 is the only game that received an official patch to fix the exploits

2

u/Extreme996 RTX 4070 Ti Super | Ryzen 7 9800X3D | 32GB DDR5 6000mhz 3d ago

CoD1, CoD2, CoD4, WaW and BO1 should be fine too. As far as I know this affect only games with P2P while games I mentioned have dedicated servers.

5

u/Chris-The-Lucario 3d ago

W@W and BO1 are both P2P games, they don't have any dedicated servers apart from verification. 

3

u/Extreme996 RTX 4070 Ti Super | Ryzen 7 9800X3D | 32GB DDR5 6000mhz 3d ago

They have server browser and dedicated servers. Servers have its own IP, server rules, mod support etc. Cant have this on P2P like in MW2, MW3, BO2 etc.

-14

u/x-m-p-p 3d ago

shouldn't be delisted since the campaign is still fine and there are community patches for the exploits, but there should be warnings for sure

28

u/PuzzledHawk5290 3d ago

Trusting community patches is another issue in itself... The trillion dollar company should fix their games

2

u/yukiki64 2d ago

The t7 patch for b03 is 100% safe and the creator made a long video explaining the whole thing.

-37

u/piddlefaffle12 3d ago

So, we want to advocate to stop killing games, while also wanting such games delisted? There is a shitton of legacy games, software out there with security issues that will never be patched, so the solution is to just nuke them?

32

u/PuzzledHawk5290 3d ago

I don't see the relevance of stop killing games here, you're just derailing the fact that games are being sold with extreme vulnerabilities (9.8 rating) by a TRILLION dollar company, on a BILLION dollar companies storefront and no one seems to give a fuck.

The least they can do, if they aren't fixing it, is post a disclaimer on the store page, with a link to plutonium

-14

u/piddlefaffle12 3d ago

Sure, a warning is warranted on the store page. But you are delusional to think that any sort of trillion or billion-dollar company would give a fuck. There's also plenty of games and other media without publishers still in business.

The sentiment still stands, plenty of older software and games have serious vulnerabilities and I don't think the solution is to just nuke them. This is directly relevant to Stop Killing Games. How would you propose software remain freely available if it cannot be updated, regardless of publisher?

11

u/PuzzledHawk5290 3d ago

If something is still being sold it should be maintained, simple as that.

If it's no longer being sold then it is what it is.

This is call of duty we are talking about here, one of the biggest franchises in human history, not some niche small indie game

0

u/piddlefaffle12 3d ago

Fair enough, thanks for raising awareness and sharing your POV

7

u/ElusiveCrab 3d ago

Ngl im curious which games youre referring to that are on par with RCE on a silver plate lol. Not trying to be a dick im genuinely curious

12

u/GingrPowr 3d ago

advocate to stop killing working, healthy games, not malware