A critical remote code execution (RCE) vulnerability was discovered in the now-defunct mobile game Marvel: Contest of Champions (also known as Marvel Rivals). The game's chat functionality lacked proper input sanitization, allowing attackers to inject and execute arbitrary JavaScript code within clients of other players. This could have been exploited to steal sensitive information, manipulate game data, or even potentially take control of affected devices. The vulnerability, discovered by a security researcher while reverse-engineering the game, was responsibly disclosed to Kabam, the game's developer. Although a fix was implemented, the exploit served as a stark reminder of the potential security risks associated with unsanitized user inputs in online games.
A vulnerability (CVE-2024-54507) was discovered in the XNU kernel, affecting macOS and iOS, which allows malicious actors to leak kernel memory. The flaw resides in the sysctl interface, specifically the kern.hv_vmm_vcpu_state handler. This handler failed to properly validate the size of the buffer provided by the user, resulting in an out-of-bounds read. By crafting a request with a larger buffer than expected, an attacker could read data beyond the intended memory region, potentially exposing sensitive kernel information. This vulnerability was patched by Apple in October 2024 and is relatively simple to exploit.
Hacker News commenters discuss the CVE-2024-54507 vulnerability, focusing on the unusual nature of the vulnerable sysctl and the potential implications. Several express surprise at the existence of a sysctl that directly modifies kernel memory, questioning why such a mechanism exists and speculating about its intended purpose. Some highlight the severity of the vulnerability, emphasizing the ease of exploitation and the potential for privilege escalation. Others note the fortunate aspect of the bug manifesting as a kernel panic rather than silent memory corruption, making detection easier. The limited practical impact due to System Integrity Protection (SIP) is also mentioned, alongside the difficulty of exploiting the vulnerability remotely. A few commenters also delve into the technical details of the exploit, discussing the specific memory manipulation involved and the resulting kernel crash. The overall sentiment reflects concern about the unusual nature of the vulnerability and its potential implications, even with the mitigating factors.
iOS 18 introduces homomorphic encryption for some Siri features, allowing on-device processing of encrypted audio requests without decrypting them first. This enhances privacy by preventing Apple from accessing the raw audio data. Specifically, it uses a fully homomorphic encryption scheme to transform audio into a numerical representation amenable to encrypted computations. These computations generate an encrypted Siri response, which is then sent to Apple servers for decryption and delivery back to the user. While promising improved privacy, the post raises concerns about potential performance impacts and the specific details of the implementation, which Apple hasn't fully disclosed.
Hacker News users discussed the practical implications and limitations of homomorphic encryption in iOS 18. Several commenters expressed skepticism about Apple's actual implementation and its effectiveness, questioning whether it's fully homomorphic encryption or a more limited form. Performance overhead and restricted use cases were also highlighted as potential drawbacks. Some pointed out that the touted benefits, like encrypted search and image classification, might be achievable with existing techniques, raising doubts about the necessity of homomorphic encryption for these tasks. A few users noted the potential security benefits, particularly regarding protecting user data from cloud providers, but the overall sentiment leaned towards cautious optimism pending further details and independent analysis. Some commenters linked to additional resources explaining the complexities and current state of homomorphic encryption research.
Summary of Comments ( 54 )
https://news.ycombinator.com/item?id=42920962
Hacker News users discussed the exploit detailed in the blog post, focusing on the surprising simplicity of the vulnerability and the potential impact it could have had. Several commenters expressed amazement that such a basic oversight could exist in a production game, with one pointing out the irony of a game about superheroes being vulnerable to such a mundane attack. The discussion also touched on the responsible disclosure process, with users questioning why Kabam hadn't offered a bug bounty and acknowledging the author's ethical handling of the situation. Some users debated the severity of the vulnerability, with opinions ranging from "not a big deal" to a serious security risk given the game's access to user data. The lack of a detailed technical explanation in the blog post was also noted, with some users desiring more information about the specific code involved.
The Hacker News post titled "Remote Code Execution in Marvel Rivals Game" (https://news.ycombinator.com/item?id=42920962) has a moderate number of comments, discussing various aspects of the linked blog post detailing a game exploit. Several commenters focus on the technical details of the exploit, while others discuss the broader implications for game security and the responsible disclosure process.
One compelling comment thread revolves around the surprising simplicity of the vulnerability. Commenters express astonishment that such a basic oversight could exist in a production game, especially given the potential security implications. The discussion touches upon the possibility of this being a common issue in other games and the need for better security practices in game development.
Another interesting thread focuses on the author's decision to withhold certain technical details of the exploit to prevent malicious actors from replicating it. Commenters generally agree with this approach, acknowledging the potential harm that could be caused if the exploit were to become widely known. Some discuss the ethical responsibilities of security researchers in disclosing vulnerabilities and the balance between transparency and protecting users.
Some comments also delve into the specifics of the exploit, questioning the author's description of it as "Remote Code Execution (RCE)." They argue that while the exploit allows for manipulating game data and potentially impacting other players, it doesn't necessarily grant full control over the server or allow for arbitrary code execution in the traditional sense. This leads to a nuanced discussion about the definition of RCE and the different levels of severity associated with various types of exploits.
Several users also share anecdotal experiences about encountering similar vulnerabilities in other games, highlighting the prevalence of such issues. They discuss the challenges of getting game developers to take security concerns seriously and the often slow response times in patching vulnerabilities.
Finally, some comments express appreciation for the author's detailed write-up and the clear explanation of the exploit, even with the omission of sensitive details. They commend the author for responsible disclosure and for bringing attention to an important security issue in the gaming industry. Overall, the comments provide valuable insights into the technical aspects of the exploit, the ethical considerations of vulnerability disclosure, and the broader implications for game security.