Hacker News Reader

Comment by brundolf | Hacker News Reader

Worth noting that it requires clicking the invite. Still bad, but something you can easily avoid if you know to be suspicious.

View on HN

The invite exploit is far from the only one, supposedly

- RCE through malicious game invite (reported 2 years ago)

https://twitter.com/the_secret_club/status/13808687591292969...

- RCE through loading a malicious map/level (reported 5 months ago)

https://twitter.com/the_secret_club/status/13809661705227509...

- RCE through connecting to a malicious game server (reported "months" ago)

https://twitter.com/the_secret_club/status/13809601207257333...

- RCE through connecting to a malicious game server, again (reported 2 years ago)

https://twitter.com/the_secret_club/status/13812019496479047...

- RCE through connecting to a malicious game server, again, again (reported a year ago)

https://twitter.com/bienpnn/status/1381616325391384577

The creator of SteamDB also says he was paid for an exploit that was never fixed...

https://twitter.com/thexpaw/status/1381621297982103553

...and one of the above RCE finders says Valve has fixed bugs in one game while not fixing it in others

https://twitter.com/bienpnn/status/1381627400467804161

Suspicious of an invite? Back around my college years it was very common to get an unexpected invite to a game. Usually friends decided they wanted to play a game and then want to grab whatever other friends are available to fill out their team. In that case you just spam invites and take the first people who accept it.

Personally I usually text or am texted by the relevant friends, we jump in discord, and then we hop into a game, pretty much in that order

If its not someone you just played with and isn't on your friends list, I feel like most people don't really interact with the message. CSGO has had so many skin scammers through chats that it's basically expected that you're being hit up by someone trying to get into your account for skins or trade scam you.

This is much worse than those situations, but luckily (and unluckily) I think the CSGO culture is fairly prepared to avoid random invites to parties.

If the attacker gets code execution on just one victim, it should be possible to send invites to all of their friends. So you can't rely on just interacting with people you know well.

It's not going to be suspicious if someones account is compromised, or gets a virus that sends an invite to all their friends. Official interfaces like 'invite' should never be need to be viewed with suspicion

"Just don't click on the link" is probably the greatest example of wishful thinking in all of computer security.

>something that you can easily avoid

Yes, you can easily avoid every exploit if you create a list of 1000 buttons to not click on in certain cases because they are "suspicious".

Reply on news.ycombinator.com