Hackers can potentially take control of a person’s PC by having them click on a Steam invite to play Counter-Strike: Global Offensive, according to a report by Lorenzo Franceschi-Bicchierai of Motherboard on April 13 . According to researcher and Secret Club member Florian, hackers can use the invite bug to take over a victim’s computer.
The bug does utilize the Source engine, which other Valve titles such as Team Fortress 2, Portal and Left 4 Dead also use, but it’s unclear whether the exploit works for other titles. The researchers have mainly focused their efforts on CS:GO.
How long has Valve known about the CS:GO PC hack bug
According to Secret Club, Valve has known about the exploit for years and has been slow to announce changes.
“Two years ago, secret club member @floesen_ reported a remote code execution flaw affecting all source engine games. It can be triggered through a Steam invite. This has yet to be patched, and Valve is preventing us from publicly disclosing it.” Secret Club said in a Twitter post.
Two years ago, secret club member @floesen_ reported a remote code execution flaw affecting all source engine games. It can be triggered through a Steam invite. This has yet to be patched, and Valve is preventing us from publicly disclosing it. pic.twitter.com/0FWRvEVuUX
— secret club (@the_secret_club) April 10, 2021
Secret Club is a not-for-profit reverse-engineering group that break games and expose flaws in game systems like this CS:GO bug. The group has been posting about the bug recently, claiming they have notified Valve about the issue.
How long has the bug been in place
According to Secret Club, the organization alerted Valve over two years ago. Other people have also come forward to say they have contacted the company about the same issue.
“As you may know, @the_secret_club recently posted videos about Source Engine games RCE. I was also ignored by Valve for a year. Here’s the demonstration of my report. RCE can be achieved by connecting to a malicious server, then the chain will be completed when game is restarted.” Bien Pham, a software engineer for Shopee Singapore wrote.
As you may know, @the_secret_club recently posted videos about Source Engine games RCE. I was also ignored by Valve for a year. Here's the demonstration of my report. RCE can be achieved by connecting to a malicious server, then the chain will be completed when game is restarted. pic.twitter.com/oVGSjpYWTz
— Bien Pham 🇻🇳 (@bienpnn) April 12, 2021
Valve is notoriously slow when it comes to responding to community feedback and bugs in its systems. The Secret Club further claims other CS:GO bugs have been found and demonstrated that Valve has yet to address.
CS:GO is currently Steam’s most popular title in terms of players. The game has over 900,000 current players and peaked at 1,305,714 players in April.
Published: Apr 13, 2021 05:00 pm