Hackers Create Malicious Dota 2 Game Modes to Secretly Access Players' Systems
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-38003 | Memory Corruption in Chromium V8 JSON.stringify Affects Chrome, Edge, Opera CVE-2021-38003 is a memory corruption flaw in the V8 JavaScript engine used by Chromium, in which the engine's internal 'TheHole' sentinel value can leak into script-visible data during JSON.stringify processing (a heap-corruption condition tracked as CWE-122 and CWE-755). It is triggered when crafted JavaScript causes JSON.stringify to expose this internal value to script code. An attacker who can induce a victim to load malicious web content can leverage the resulting corruption, typically chained with further techniques, to execute code within the browser renderer or crash it. All users of Chromium-based browsers — explicitly including Google Chrome, Microsoft Edge, and Opera, and by extension other Chromium derivatives — are affected. Exploitation is confirmed in the wild: the flaw was added to CISA KEV on 2021-11-03, carries a 38.6% EPSS probability of exploitation within 30 days (98th percentile), and no public proof-of-concept is known. Do: Update all Chromium-based browsers (Chrome, Edge, Opera, and any Chromium-embedded or Electron-style applications in your estate) to the latest vendor-patched releases, per the CISA KEV required action to apply updates per vendor instructions. Verify remediated browser versions via enterprise update management and browser version reporting, prioritizing user workstations and externally reachable systems. Because exploitation is confirmed in the wild, treat unpatched Chromium browsers as an active exposure rather than a theoretical risk. | 8.8 | 39% | KEV PoC |
| mass≈3 billion users (combined Chromium-based browser install base, Chrome alone accounting for the large majority) |
Full article448 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananFeb 13, 2023Game Hacking / Cyber Threat
An unknown threat actor created malicious game modes for the Dota 2 multiplayer online battle arena (MOBA) video game that could have been exploited to establish backdoor access to players' systems.
The modes exploited a high-severity flaw in the V8 JavaScript engine tracked as CVE-2021-38003 (CVSS score: 8.8), which was exploited as a zero-day and addressed by Google in October 2021.
"Since V8 was not sandboxed in Dota, the exploit on its own allowed for remote code execution against other Dota players," Avast researcher Jan Vojtěšek said in a report published last week.
Following responsible disclosure to Valve, the game publisher shipped fixes on January 12, 2023, by upgrading the version of V8.
Game modes are essentially custom capabilities that can either augment an existing title or offer completely new gameplay in a manner that deviates from the standard rules.
While publishing a custom game mode to the Steam store includes a vetting process from Valve, the malicious game modes discovered by the antivirus vendor managed to slip through the cracks.
These game modes, which have since been taken down, are "test addon plz ignore," "Overdog no annoying heroes," "Custom Hero Brawl," and "Overthrow RTZ Edition X10 XP." The threat actor is also said to have published a fifth game mode named "Brawl in Petah Tiqwa" that did not pack any rogue code.
Embedded inside "test addon plz ignore" is an exploit for the V8 flaw that could be weaponized to execute custom shellcode.
The three others, on the other hand, take a more covert approach in that the malicious code is designed to reach out to a remote server to fetch a JavaScript payload, which is also likely to be an exploit for CVE-2021-38003 since the server is no longer reachable.
In a hypothetical attack scenario, a player launching one of the above game modes could be targeted by the threat actor to achieve remote access to the infected host and deploy additional malware for further exploitation.
It's not immediately known what the developer's end goals were behind creating the game modes, but they are unlikely to be for benign research purposes, Avast noted.
"First, the attacker did not report the vulnerability to Valve (which would generally be considered a nice thing to do)," Vojtěšek said. "Second, the attacker tried to hide the exploit in a stealthy backdoor."
"Regardless, it's also possible that the attacker didn't have purely malicious intentions either, since such an attacker could arguably abuse this vulnerability with a much larger impact."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2023/02/hackers-create-malicious-dota-2-game.html