'Monday Night Combat' is a free-to-play multiplayer shooter. (Uber Entertainment)
It's bad enough that hackers could compromise multiplayer servers for a number of popular first-person shooters, but it's potentially even worse that they could use the same knowledge to infiltrate the U.S. government.
Luigi Auriemma and Donato Ferrante, two researchers from ReVuln, a security firm based in Malta, discovered security vulnerabilities in online game servers and presented the vulnerabilities at the NoSuchCon security conference in Paris last week. Although some of the games they cited have waned in popularity, exploits of the same vulnerabilities could target similar architectures in government training and recruitment programs.
First-person shooters are a self-explanatory genre of video game that should be familiar to anyone who's ever played a title like "Doom" or "Counter-Strike." Most FPS games have multiplayer modes that invite players to compete with each other, either on player-run or company-sponsored servers. These servers can act as a gateway for exploits.
[pullquote]
The exploit itself is a potentially devastating one: By programming an algorithm that interrupts the game's normal data flow, Auriemma and Ferrante were able to view a list of game servers and view each individual player's IP address and location.
From there, they could launch an attack to take control of the system remotely. The possibilities from there are predictable, but potentially devastating: a hacker could infect a computer with malware, steal sensitive files or draft the computer into a botnet to aid in future attacks.
Auriemma and Ferrante found vulnerabilities in the Unreal Engine 3, idTech 4, CryEngine 3 and Hydrogen Engine systems that power a variety of games. Some titles like "Breach," "Homefront" and "Brink" have seen better days in terms of player population, but these engines power other hits like "Crysis 3" and "Mass Effect 3."
The researchers discovered ways to hack the games "Breach," "Monday Night Combat," "Homefront," "The Haunted: Hell's Reach," "Sanctum," "Enemy Territory: Quake Wars," "Brink" and "Quake 4." Hackers developing methods of exploiting other titles is not out of the question. [See also: 10 Great Games You're Missing]
This is not the first time the two researchers have discovered security holes in video games. Auriemma and Ferrante demonstrated similar flaws in the "Battlefield 2" engine in March.
ReVuln theorizes that hacking random gamers might not pose much of a threat, but the first-person shooter player base is diverse. All it would take is one politician or high-ranking corporate official taking some work home or playing on a work machine before compromising information winds up in hackers' hands.
Carelessness doesn't even have to factor into the equation. Both the U.S. Air Force and the FBI have licensed the Unreal Engine to create training programs for its members. "America's Army," a free-to-play game that the Army uses as a recruiting tool, also runs on the Unreal Engine. Hacking into an Air Force, FBI or Army server could be an easy way to get a hold of government secrets.
Not every game that runs on these engines is vulnerable to attack, so there are ways to avoid it — although since ReVuln is a consulting firm, it's not giving them away for free. If you're a developer, be sure to test your multiplayer servers for security holes.
If you're a player, be careful with any sensitive data on your gaming rig and hope for the best.
Get a daily look at what’s developing in science and technology throughout the world.