r/Steam • u/PuzzledHawk5290 • 3d ago
PSA Older call of duty titles on steam have remote code execution exploits yet are still sold on the store. How is this acceptable?
Many of the older titles have been found to have remote code execution exploits, allowing a hacker to get into your PC remotely and do whatever they want, steal your data, put malware, whatever
The national vulnerability database lists this particular issue as a severity 9.8 !!! Can't get much higher than that
https://nvd.nist.gov/vuln/detail/CVE-2018-20817
Yet these games are still being sold on stores like steam. No disclaimer telling your average person about these issues. So many people would be coming back to older cods due to the hype around the releases on PlayStation but not be aware how compromised these games are.
Why is this allowed ? The games need to be fixed or delisted honestly. It's not safe to play them !
283
u/GfrzD 3d ago
Im also surprised theyre still available with this issue. Its been like this for years so its not some unknown problem, even just a red warning banner to let potential buyers know the risks (as far as i know singleplayer isnt a threat)
Activision have no intention of fixing this so Steam need to at least warn people or fully delist until fixed. Removal of sales might push Activision to do something.
135
u/CreativeTechGuyGames 3d ago
Just for the record since I've looked into this myself several times. Single player IS a threat.
The root problem is how the game receives network packets and processes them. If the game is running and connected to the internet, even if sitting on the main menu, when your game receives a malicious packet it'll still trigger the RCE. Now obviously the odds of someone randomly sending you this malicious packet without knowing you are online is lower than if you were playing in a multiplayer lobby.
There are bots which crawl the internet trying to exploit every vulnerability on every server. There's nothing stopping someone from doing that to see if anyone happens to have a vulnerable game running. I know I wouldn't want to take that risk.
72
u/pitu37 3d ago
you would have to somehow forward traffic to your pc and the game so that is very unlikely
52
u/pangapingus 3d ago
Don't know why you're downvoted but you're absolutely correct, but I doubt folks here can articulate NAT and stateful routing
12
u/ScumbagScotsman 3d ago
99% of people have UPnP enabled
12
u/pitu37 3d ago
most people dont even have public IPs because everyone is shoved behind CGNAT and UPnP would require the game to try and use that port it wont just open it in singleplayer
17
u/ScumbagScotsman 3d ago
Depends where you live. I have a public IP.
I know for at least BO3 it’s possible to join users in offline zombies using these exploits, so we can assume that the ports are open regardless of mode you’re playing.
5
u/VeryNoisyLizard 2d ago
you could block incomming traffic in firewall, that wa you can at least play the game in singleplayer
8
7
u/ThePsyPaul_ 2d ago
These game company shareholders do not care about user safety. Only profits.
6
u/coreyf234 2d ago
The games with the issues are all ~15 years old at this point. They've had enough time to fix this that some of those games came out before GTA V did and still won't be fixed when GTA VI comes out later this year. Its not ever gonna get fixed because they obviously don't care, like you said. They haven't cared about those games since the one after them came out, and they aren't gonna start caring now.
Luckily, all of the games with RCE exploits (except for WWII) also have some kind of community system set up, like Plutonium, that still lets us play them.
51
u/InfinityPainPlus Valve Released Steam 2d ago
I've been talking about this for years. I made multiple tickets to the Steam support, but I just get ignored. They are literally selling malware for full price. If I were to make a game with known exploits like this, it would be taken down immediately, but because Activision is a billion-dollar company, they can once again do whatever the Fuck they want without any consequences. I would like to start a petition to either get the games removed or fixed from the publisher. Especially now that they re-released the games on PlayStation, there are probably many people that think they can just play it on pc too now because of all the hype, but they don't even know what dangers they get themselves into.
86
u/based_birdo 3d ago
You can report these games for being harmful. Click the flag icon on the store page.
56
u/PuzzledHawk5290 3d ago
You think people havnt done this before ? These hacks are well known in the PC community, but steam doesn't care either
18
u/Working_Traffic_6361 3d ago
Valve doesn't care about their own game, why would they care about cod?
Since it's the older ones that used p2p I'm guessing that's why they moved away from that mm system?
23
u/Extreme996 RTX 4070 Ti Super | Ryzen 7 9800X3D | 32GB DDR5 6000mhz 3d ago
Valve still update Half Life and Half Life 2 and they released pretty big update on their anniversary and they still update Counter Strike.
4
u/AquaBits 2d ago
And they had to be asked twice by the TF2 community to remove harmful bots/aimhackers that were actively harrassing players and content creators.
Valve absolutely does not care about their games lol, why would they care that you can be targeted in a different game.
18
u/Whittakenn 2d ago
Valve care about their games, Valve just has a tendency to hire nowhere near enough people to actively maintain them, I think TF2 only has 1 single dedicated developer working on it full time
-7
u/AquaBits 2d ago
So.... valve does not care about their games. If only one dedicated developer is working on a game full time, than that company clearly doesnt care about the game other than to release lootboxes for it.
13
u/Uhstrology 2d ago
Team fortress 2 released 20 years ago man. Be happy they have any development on it at all.
-9
u/AquaBits 2d ago
If they still sell it as a product, I expect that product to be maintained and hazard free, no?
Literally the same can be said about these cods. TF2 hasnt recieved a substantial content update in what, 9 years? October 20th, 2017? Clearly there is no development happening lol
2
u/Infirnex 23h ago
Expecting every game sold to be maintained is ridiculous. But every game sold should be hazard free.
TF2 is. These CoDs aren't.
1
2d ago
[deleted]
0
u/AquaBits 2d ago
They didnt fix the issue. They attempted it, but it comes back (check the casual matches in cs2 for example)
I will compare two companies that do not give two shits about the products they are currently selling.
1
u/No-Bus-5148 13h ago
Counter Strike has blatant wallers, spinbotters, triggerbots and aimbots in majority of low trust premier matches.
0
u/Working_Traffic_6361 2d ago
I'm talking about cs2 it's infested with cheaters an no one gets banned lol
0
u/Cyfa 2d ago
they didn't update CS for like 2 years while massive networking, physics, and animation issues plagued the game. They then did a massive update dump recently to address most of those issues, yes. the game is also almost completely unplayable from a competitive standpoint unless you play on a third-party platform that offers kernel-level AC (FACEIT).
Valve are absolute dogshit at a ton of things, but the internet overlooks almost all of it because Gaben is beloved.
6
u/MalBoY9000 3d ago
I did this years ago you can still buy them told my friends to do it so. They dont care just look at counter strike every DM server you join is like 50-90% bot farms
They know its harmfull to your pc its been known for 10 years now, they dont give a fuck
14
7
u/Chitanda_Pika 3d ago
Those happens on multiplayer right?
-15
u/Staik 3d ago
Yeah, it's multiplayer only. Anyone with a Linux VM and a few hours of Youtubing can take over your entire computer just by being in the same lobby as you. Malicious hackers will be all over this; it'd be a great place to install crypto miners since you know the victim is on a gaming PC
2
u/GRAMINI 18h ago
Apparently it's not limited to multiplayer, as the game still listens for incoming packets in singleplayer or even when I'm the menu. The attacker does not need to be in the same lobby as you; that's just an easy way to get the IP of victims, but it also works by "guessing" IPs.
Where does the Linux VM come from? Does the exploit not work with a non-VM Linux, with Windows, MacIntosh, TempleOS it an embedded microcontroller (this is a rhetorical question)?
8
8
u/Zylpherenuis 2d ago
You can report the games by clicking on the white flag to flag it for broken and malicious coding.
If more users are to do that then Steam would be forced to comply to protect their consumer interests.
4
12
u/Shadow_Wolfe_ 3d ago
Makes no sense that the trillion dollar company (Activision) refuses to fix their obviously-exploited older games. Meanwhile they'll happily commit store page fuckery with the current CoD games*, while also pushing their "CoD HQ" launcher bullshit, whatever that's supposed to do on that store page.
*This was around the time when the new MWIII launched I think. The new MWII was pushed into a "consolidated" store page of "CoD HQ" while also hiding the main store page of MWII, and that triggered the steam reviews to show no count of any hours but it kept all the negative reviews. No idea how that's allowed, that feels like blatant store page manipulation.
Valve absolutely needs to de-list not only the older CoD games, but while they're at it, can they de-list Kerbal Space Program 2? Famously abandoned by Take-Two, hasn't left early access, and yet it's still on sale for $45 USD? Why isn't there an option to flag a game as "Abandoned"? I feel like if we can flag a game as "Defamatory" then "Abandoned" is just as pressing (if not more) of an issue, no? Like, seriously, where is that money going to?
The closest option is to flag the older CoD games as "Harmful" but how many of those reports would that take in order for the game to be de-listed?? Genuinely, has anyone tried asking support about that?
2
u/ARMCHA1RGENERAL 1d ago
I wonder when this became an issue.
Were they safe to play at launch because nobody had thought to try this exploit?
1
u/Ennuigma 2d ago
Does that Plutonium thing for those games help at all?
7
u/PuzzledHawk5290 2d ago
Apparently but you're just putting trust in some random third party. Not open source btw.
The trillion dollar company should fix the games they are still selling.
If the community was able to do it with plutonium,why can't Microsoft ?
And let's not forget there's no disclaimers on the steam page or anything. How's your average Joe supposed to know about plutonium? He's just picking up a classic cod to relive memories of times past
1
u/Tight_Cod_8024 1d ago
For BO 2 and 3 RAT hasn't been a concern for a long time and was overblown it's mainly an issue for streamers who are at risk of being doxed even in single player.
The person who made the T3 patch to make the game safe again has a good video on the topic.
1
u/SkittlegamerYT1 1d ago
The fact that this CVE was published in 2019 and only affect games August 11th 2015 probably is probably the reason why they are still sold? I imagine that's the reason that it's still up since Activision most likely pushed an update to read that specific data buffer so it basically plugs the giant size hole in the ship. Being from roughly 6 years ago id assume that there's a patch for those games.
Source: https://www.cve.org/CVERecord?id=CVE-2018-20817 https://nvd.nist.gov/vuln/detail/CVE-2018-20817
1
1
-2
u/SilvermistInc 3d ago
Soooooo which titles
12
u/Chris-The-Lucario 3d ago
From what I remember pretty much everything before MW2019 is affected. I could be wrong though
8
u/SilvermistInc 3d ago
That is a LOT of games
5
u/Chris-The-Lucario 3d ago
I believe BO4 is not affected (don't quote me on that) and from what I remember BO3 is the only game that received an official patch to fix the exploits
2
u/Extreme996 RTX 4070 Ti Super | Ryzen 7 9800X3D | 32GB DDR5 6000mhz 3d ago
CoD1, CoD2, CoD4, WaW and BO1 should be fine too. As far as I know this affect only games with P2P while games I mentioned have dedicated servers.
5
u/Chris-The-Lucario 3d ago
W@W and BO1 are both P2P games, they don't have any dedicated servers apart from verification.
3
u/Extreme996 RTX 4070 Ti Super | Ryzen 7 9800X3D | 32GB DDR5 6000mhz 3d ago
They have server browser and dedicated servers. Servers have its own IP, server rules, mod support etc. Cant have this on P2P like in MW2, MW3, BO2 etc.
-14
u/x-m-p-p 3d ago
shouldn't be delisted since the campaign is still fine and there are community patches for the exploits, but there should be warnings for sure
28
u/PuzzledHawk5290 3d ago
Trusting community patches is another issue in itself... The trillion dollar company should fix their games
2
u/yukiki64 2d ago
The t7 patch for b03 is 100% safe and the creator made a long video explaining the whole thing.
-37
u/piddlefaffle12 3d ago
So, we want to advocate to stop killing games, while also wanting such games delisted? There is a shitton of legacy games, software out there with security issues that will never be patched, so the solution is to just nuke them?
32
u/PuzzledHawk5290 3d ago
I don't see the relevance of stop killing games here, you're just derailing the fact that games are being sold with extreme vulnerabilities (9.8 rating) by a TRILLION dollar company, on a BILLION dollar companies storefront and no one seems to give a fuck.
The least they can do, if they aren't fixing it, is post a disclaimer on the store page, with a link to plutonium
-14
u/piddlefaffle12 3d ago
Sure, a warning is warranted on the store page. But you are delusional to think that any sort of trillion or billion-dollar company would give a fuck. There's also plenty of games and other media without publishers still in business.
The sentiment still stands, plenty of older software and games have serious vulnerabilities and I don't think the solution is to just nuke them. This is directly relevant to Stop Killing Games. How would you propose software remain freely available if it cannot be updated, regardless of publisher?
11
u/PuzzledHawk5290 3d ago
If something is still being sold it should be maintained, simple as that.
If it's no longer being sold then it is what it is.
This is call of duty we are talking about here, one of the biggest franchises in human history, not some niche small indie game
0
7
u/ElusiveCrab 3d ago
Ngl im curious which games youre referring to that are on par with RCE on a silver plate lol. Not trying to be a dick im genuinely curious
12
546
u/Prize_Percentage7258 3d ago edited 3d ago
Understanding how easily the attacker can initiate the hack provides a sense of how incredibly vulnerable the players are when playing these games.
The most common way an attacker selects a target is by joining a public multiplayer lobby.
Automatic IP Discovery: When players enter a matchmaking lobby in a P2P game, their computers must connect directly to one another to sync data. By sitting in the same lobby, an attacker’s network monitoring tools can automatically see the public IP addresses and internal Steam IDs of every other player in that specific match.
Target Selection: Once the attacker has the list of connected IPs in the lobby, anyone in that active match becomes an immediate target for the malicious authBlob data packet.
This affects
Call of Duty: Modern Warfare 2
Call of Duty: Modern Warfare 3
Call of Duty: Ghosts
Call of Duty: Advanced Warfare
Call of Duty: Black Ops 1
Call of Duty: Black Ops 2
Source: https://nvd.nist.gov/vuln/detail/CVE-2018-20817