Send News. Want a reply? Read this. More in the FAQ.   News Forum - All Forums - Mobile - PDA - RSS Headlines  RSS Headlines   Twitter  Twitter
User Settings
LAN Parties
Upcoming one-time events:

Regularly scheduled events

Report this Comment
Use this form to report the selected comment to the moderators. Reporting should generally be used only if the comment breaks forum rules.

32. It's not hard. You simply guess. Oct 17, 2012, 19:47 hb3d
In order to make this exploit work, you need to be able to cause something to create the file, in order to be able to execute it.
As I wrote before, if a Source engine game is installed, it can be made to do that with this exploit.

If you don't know what's installed, you have no attack vector.
You simply guess. Sure it won't affect people who don't have a Source game installed, but so many Steam users do, and so many use the default location for Steam that it isn't hard to find a vulnerable target. It was the exact same thing with the Uplay exploit. The specified path to the executable to run in that exploit was simply a guess on the target's directory structure and installed programs. Windows also still has a %path% variable that will execute anything in that path without knowing the full path.

Even their unreal engine exploit requires a upk file to exist already, in order to cause it to crash(integer overflow).
It already exists in the Sanctum game. That is why they chose that game over the dozens of other Unreal engine games on Steam.

But in the latter case, you need to know "what" you're running into to make it do something.
As I wrote before, you simply guess and target the most likely spots. Hackers have been doing that forever, and guess what? It works.

This comment was edited on Oct 17, 2012, 20:06.
Login Email   Password Remember Me
If you don't already have a Blue's News user account, you can sign up here.
Forgotten your password? Click here.


Blue's News logo