If you play online shooters, you know how frustrating it is to get shot and killed by your opponents, or "fragged." Well, imagine if getting fragged
If you play online shooters, you know how frustrating it is to get shot and killed by your opponents, or “fragged.” Well, imagine if getting fragged also meant your opponent could hack and take control of your computer.
That’s exactly what hackers were able to do by taking advantage of a vulnerability in the Valve Source video game engine, which powers several popular games such as Counter Strike: Global Offensive, Team Fortress 2, and Left 4 dead 2, as a researcher at One Up Security explained in a blog post Thursday.
The researcher found that the Source engine could be exploited by loading malicious code into a custom asset within a player-made map. Games sometimes allow players to make custom maps for online play. In these maps, players can load custom assets such as textures, character skins, or ragdoll models. If you’ve played a lot of online games before, these are the types of files the game quickly downloads when you join a server that allows custom assets.
In this case, the custom asset that could be exploited was a “ragdoll” model, which determine how game characters flop around when they die.
A hacker could create a malicious ragdoll model, load it into his or her game, invite people to join, and then frag them to trigger the exploit and hack into their computer, according to Justin Taft, the researcher who found and reported the vulnerability.
“As video games are common inside employee break rooms and homes of employees, exploitation of a vulnerability could be used in a targeted attack to jump the air gap to a private network,” Taft wrote in the post. “Additionally, discovering a remote code execution vulnerability in a popular video game can be used to quickly create a botnet or spread ransomware.”
Taft said that Valve has already patched the bug (Valve did not immediately respond to a request for comment). So it shouldn’t be possible to take advantage of this bug anymore. But this is certainly one of the most unusual, and somewhat hilarious, ways to get owned.
Got a tip? You can contact this reporter securely on Signal at +1 917 257 1382, OTR chat at firstname.lastname@example.org, or email email@example.com
Get six of our favorite Motherboard stories every day by signing up for our newsletter.